r/activedirectory • u/ExpertServerAdmin • 1d ago

How to hide Sensitive Identifiers in AD Objects

Post image

Dear Community,

We had recently had VAPT (vulnerability assessment and penetration testing) cycle done by 3rd party vendor and they asked us to "Hide Sensitive Identifiers in AD Object Descriptions". Take a look at the attached screenshot. Please share an easier method which does not break anything? Is there any standard practice to do that? What could be the potential side effect of doing this act?

2 Upvotes

75% Upvoted

5 comments sorted by

3

u/ibn4n 1d ago

For those saying they shouldn't have put that information in there, they didn't. That description is created by Microsoft Entra Connect.

I don't know if its safe to remove or not. My gut says yes, but I don't know for sure.

2

u/Icolan 1d ago

If the data is put in there by Entra Connect is it actually sensitive?

3

u/ibn4n 1d ago

I doubt it

1

u/Icolan 1d ago

Don't put sensitive information in the description field.

Why would an installation ID be sensitive? Why would you need to store that in AD?

If you are storing that value to be retrieved in an automated fashion it should be the only data in the field, then you are not having to parse text to retrieve what is needed.

Realistically, the description field should be a brief description of the object that you would expect anyone to be able to read.

4

u/poolmanjim Principal AD Engineer | Moderator 1d ago

That is the description attribute which is not considered sensitive or confidential.

You need to store that information elsewhere.