Return
-
Title
Hide "Deleted Objects" in MMC and Web Interface for some Users -
Description
The Active Directory Deleted Objects Recycle Bin is a feature available in Active Directory Domains starting with Windows 2008 R2 Functional Level. While this feature can be useful for Administrators, once enabled it is visible to all Users by default. There may be a need or desire to hide this object from view for some Users. -
Resolution
The Deleted Objects object is itself a Container. Active Roles Server doesn't come with pre-configured Access Templates for manipulating Containers, but it is very simple to create a custom Access Template which can be linked to this Container in order to hide it from view.
- Log into the MMC as an Active Roles Administrator and browse to Quest One ActiveRoles | Configuration | Access Templates
- If you don't already have a custom Access Template Container, create one now. Inside your custom Container, create a new Access Template called Containers - List - Deny or something similar.
- Click Next through the wizard and then double-click on the new template to open it.
- On the Permissions tab, click Add
- On the first screen, select Only the following classes: and check Container, then click Next
- Select Object access and check List Object. Then be sure to check Deny permission at the top right before clicking Finish and OK.
This Access Template can be linked to the Deleted Objects container by right-clicking on it and choosing Delegate Control. You can then choose the Users and/or Groups whom you wish to restrict along with this new access template.
There is no need to restart any services or reset IIS. The Users will notice this change upon the next refresh or logon.