How can I see who has the permission to retrieve Active Directory data?

I discovered sensitive data within my Active Directory groups in the "description" field. How can I see which users have read access to that data?

Solution 1:

The "List contents" permission is used to list the entries within Active Directory and the "Read all properties" permission is used to read the contents. By default, "Authenticated Users" are given both "List contents" and "Read all properties" permissions. You can examine the permissions for "Authenticated Users" directly by doing the following:

1. Launch "Active Directory Users and Computers"
2. Click the menu: View -> Advanced Features
3. Right click on "Domain Tree" and select "Properties"
4. Click the "Security" tab
5. Click on "Advanced"
6. Click on the "Effective Access" tab
7. Click on "Select a user" and enter "Authenticated Users"
8. Click on "View Effective Access"
9. You can see that "List contents" and "Read all properties" are both checked to be available.