Active Directory Visibility Modes

Active Directory stores content in the form of securable objects and in addition to providing the ability to control read, modify, create and delete access, it also provides the ability to control list access to these securable objects.

List access refers to the ability of a user to list or view an object i.e. learn of the existence of an object in the Active Directory.

For example, consider a scenario wherein a hosting provider uses a single Active Directory domain to deliver security services to multiple customers, which the provider facilitates by creating separate organizational units (OUs) for each client. Their service level agreement requires that clients not be able to learn of the existence of other clients, so the service provider is required to control the visibility of each customer's OU to users of that customer only. In such scenarios organizations need a way to tightly control visibility.

To enable such scenarios, Active Directory provides two object visibility modes –

1. List Child Mode
2. List Object Mode

These modes provide the means by which to control object visibility in Active Directory, and their functionality is facilitated by the List Child (LC) and List Object (LO) standard Active Directory permissions.

These object visibility control in Active Directory work as follows –

1. List Child Mode

   This is the default object Visibility mode in Active Directory. In this mode, in order to view child objects of a specific Active Directory object (referred to as a parent), the user need only be granted the List Child on the parent object. No additional permissions are necessary to view the parent's child objects.

2. List Object Mode

   This is the non-default object Visibility mode in Active Directory. In this mode, in order to view child objects of a specific Active Directory object (referred to as a parent), the user must have List Object permission granted both on the parent object and on each individual child object. In this mode, the presence of List Child permission on the parent has no effect.

Example

Consider an organizational unit OU O that has two child objects, Child A and Child B and consider a User U. In List Child Visibility mode, if User U is granted List Child permission on OU O, the user U will be able to view both the child objects, Child A and Child B.

However, in List Object visibility mode, User U will only be able to view Child A and Child B if the user is granted List Object permission on all three objects – OU O, Child A and Child B. In this mode, if User U only has List Object permissions on OU U and Child A but not on Child B, the user will only be able to list Child A, but not Child B.