Removing "List Contents" and/or "Read" permissions from Authenticated Users on the root of a domain.

authenticated users has read , list contents permissions on root of every domain i've seen.

what ramifications of removing one, other, or both of these permissions.

i've read lync , other office products may have problems if remove read.

that in wouldnt effect much, have exchange 2010.  could, would, should effect exchange?

what removing list contents?

we hosting company.  give some customers rights manager own ous.  not these customers can see entirety of our domain.  figure removing these read and/or list contents rights authenticated users make happen.

i have seen folks decide "everyone" group shouldn't have read access, go in , set group's read access deny.  realize poor choice was.  have go , work denied permission removed, since... "administrator" every other user in domain part of "everyone" group.  user went , modified "everyone" permissions "authenticated users".  don't understand why folks think have remove read permission users. 

i suggest leave root of domain alone, users won't able read.  create new ou , within not pass on inheritance each object within described in link below.  might in not allowing users browse upon 1 another.
http://networkadminkb.com/kb/a23/how-to-hide-or-secure-objects-in-active-directory.aspx

--
paul bergson
mvp - directory services
mcitp: enterprise administrator
mcts, mct, mcse, mcsa, security+, bs csci
2008, vista, 2003, 2000 (early achiever), nt4
http://blogs.dirteam.com/blogs/paulbergson  twitter @pbbergs
please no e-mails, questions should posted in newsgroup. posting provided "as is" no warranties, , confers no rights.

Windows Server  >  Directory Services