Microsoft KB Archive/943100

= How to set restrictions on a site collection to allow only users in a particular organizational unit on a computer that is running SharePoint Server 2007 Service Pack 1 =

Article ID: 943100

Article Last Modified on 11/14/2007

-

APPLIES TO


 * 2007 Microsoft Office Servers Service Pack 1
 * Microsoft Office SharePoint Server 2007

-



INTRODUCTION
This article describes how to set restrictions on a site collection on a computer that is running Microsoft Office SharePoint Server 2007 Service Pack 1 (SP1). The article discusses how to allow access only for users in a particular organizational unit (OU).



MORE INFORMATION
Administrators can use the stsadm.exe command to set restrictions on a site collection to allow access only for users in a particular OU. To do this, follow these steps:  Click Start, click Run, type cmd, and then click OK. At the command prompt, type the following command, and then press ENTER:

cd /d %programfiles% \Common Files\Microsoft Shared\Web Server Extensions\12\BIN

 At the command prompt, type the following command, and then press ENTER:

stsadm.exe –o setsiteuseraccountdirectorypath –url  -path

For example, type the following at the command prompt:

setsiteuseraccountdirectorypath –url http://server/sites/s1 -path &quot;OU=MSCRM,DC=redmond,DC=corp,DC=microsoft,DC=com&quot;

Note The path will be the full distinguished name of the OU. The command will set the restrictions to allow only users under &quot;OU=MSCRM,DC=redmond,DC=corp,DC=microsoft,DC=com&quot; to be added to the site collection http://server/sites/s1.

To obtain the OU path, type the following at the command prompt, and then press ENTER:

stsadm.exe –o getsiteuseraccountdirectorypath –url

When the administrator uses the Stsadm.exe tool or another management tool to manage the site collection, the administrator will be added as a user to the site collection. The command in step 3 will block the administrator from managing the site collection if the administrator does not belong to the OU. To enable the administrator to manage the site collection, type the following at the command prompt, and then press ENTER:

stsadm.exe -o setproperty -url  -pn &quot;peoplepicker-serviceaccountdirectorypaths&quot; -pv

Note In this command,  is a placeholder for a semicolon-separated list of distinguished names.

To see the list of allowed administrator directory paths, type the following at the command prompt, and then press ENTER:

stsadm.exe -o getproperty -url  -pn &quot;peoplepicker-serviceaccountdirectorypaths&quot;

Additional query words: MOSS MOSS2007

Keywords: kbhowto kbexpertiseadvanced KB943100

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.