Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are testing SPAM/Virus cloud solutions and they can read active directory users and groups to help with users set-up and configuration. All they need from me is a user name, a password and the port opening up on our firewall. By giving them a user name and password to access the active directory, what am I opening up on my network? Would the cloud solution be able to read passwords? What exactly can they see? Can I reduce what objects they can see?

Our server is Windows 2008 sbs.

share|improve this question
1  
What's that "SPAM/Virus cloud solution" you're using? –  Adnan Apr 3 '13 at 12:14
    
The one in question is maildistiller.com –  resolver101 Apr 3 '13 at 13:40

1 Answer 1

up vote 1 down vote accepted

First off, and most importantly, they can NOT see passwords; however, they basically have read-only access to all of the contents of your Active Directory, such as: users, groups, group membership, computer objects, and group policy objects. Additionally, the cloud solution could install a tool like Adsiedit on their workstation to view attributes in Active Directory that are not available via the standard Active Directory Users and Computers (ADUC) MMC snap-in, such as: last logon of user objects, last password change of user objects, etc.

One risk you are opening yourself up to is a low and slow brute force password attack against your users since the cloud solution will be able to obtain a complete list of usernames.

Since the function of the cloud solution is to have access to your users and groups, you are unfortunately not able to effectively restrict what they have access to.

share|improve this answer
    
Thanks for the detailed explanation. Its quite concerning that they will be able to access all active directory objects (there's a lot of them). Is there NTFS permissions on active directory objects? is so could i restrict access that way? –  resolver101 Apr 3 '13 at 13:55
    
Unfortunately, it is a separate set of permissions which protect the Active Directory objects themselves. I found this article (stackoverflow.com/questions/823184/…) which may give you a way forward. –  Joe Gatt Apr 3 '13 at 15:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.