We are testing SPAM/Virus cloud solutions and they can read active directory users and groups to help with users set-up and configuration. All they need from me is a user name, a password and the port opening up on our firewall. By giving them a user name and password to access the active directory, what am I opening up on my network? Would the cloud solution be able to read passwords? What exactly can they see? Can I reduce what objects they can see?

Our server is Windows 2008 sbs.

  • 1
    What's that "SPAM/Virus cloud solution" you're using?
    – Adi
    Apr 3, 2013 at 12:14
  • The one in question is maildistiller.com Apr 3, 2013 at 13:40

1 Answer 1


First off, and most importantly, they can NOT see passwords; however, they basically have read-only access to all of the contents of your Active Directory, such as: users, groups, group membership, computer objects, and group policy objects. Additionally, the cloud solution could install a tool like Adsiedit on their workstation to view attributes in Active Directory that are not available via the standard Active Directory Users and Computers (ADUC) MMC snap-in, such as: last logon of user objects, last password change of user objects, etc.

One risk you are opening yourself up to is a low and slow brute force password attack against your users since the cloud solution will be able to obtain a complete list of usernames.

Since the function of the cloud solution is to have access to your users and groups, you are unfortunately not able to effectively restrict what they have access to.

  • Thanks for the detailed explanation. Its quite concerning that they will be able to access all active directory objects (there's a lot of them). Is there NTFS permissions on active directory objects? is so could i restrict access that way? Apr 3, 2013 at 13:55
  • Unfortunately, it is a separate set of permissions which protect the Active Directory objects themselves. I found this article (stackoverflow.com/questions/823184/…) which may give you a way forward.
    – Joe Gatt
    Apr 3, 2013 at 15:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .