XADM: How to Prevent Domain Users from Viewing Exchange Custom Attributes (812295)

MORE INFORMATION

In some cases, you may want to prevent other domain users from viewing the custom extension attributes for an Exchange recipient. To do this, deny the user or group Read access to the extension attribute of the user account. To do this, follow these steps:

1. Start the Active Directory Users and Computers utility.
2. On the View menu, click Advanced Features if it is not already selected.
3. Right-click the user account that you want to edit, and then click Properties.
4. Click the Security tab, click Advanced, click Add, click the user or group that you want to prevent from viewing the Exchange custom attributes, and then click OK.
5. Click the Properties tab, and then click to select the Read Custom Attribute number check box (where number is the number of the attribute) in the Deny column.
6. When you are finished selecting the Deny check boxes for the custom attributes that you want to block access to, click OK.
7. Click OK, and then click OK again.

Important The addition of Deny access control entries (ACEs) is the recommended method to prevent access to the Exchange custom attributes. Microsoft recommends that you do not remove the Authenticated Users group from the access control list (ACL) of an object. You can also use the DSACLS tool, included with the Windows 2000 Support Tools, to edit the ACL of an object. For additional information about how to use the DSACLS tool, see Windows 2000 Support Tools online Help.

For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base: