Windows NT was notorious for the amount of information available to hackers and penetration teams as configured out of the box. It was possible for a guest to get a list of shares, the list of users, groups, ad nausem. Microsoft released a method to restrict anonymous connections . It appears Microsoft is repeating old mistakes in the Active Directory realm. The Pre-Windows 2000 Compatible Access group grants Everyone the same ability to browse through the Active Directory, to read permissions on every attribute of every object. OUCH! This is a little too much free information flow.

The default membership of Pre-Windows 2000 Compatible Access group includes the Everyone group. To tighten up the system you need to remove the Everyone group from the Pre-Windows 2000 Compatible Access group .

You need to test. Just like the Windows NT anonymous connections issues, you may not be able to close the whole because of unique issues within your enterprise. Certain down level clients may not function, particularly Win9x clients.