"Everyone knows that it is important to lock down the resources on the network. The resources that need to be locked down include folders and the files that are contained in them, as well as some Registry keys that are located on servers and workstations throughout the enterprise. We can’t forget those Active Directory objects that reside on domain controllers. All of these resources need to be locked down so that users that should not have access to them, can’t access them. To control the permissions on these resources, you have multiple options. Some options are more attractive than others, but a look at all options should be investigated."

http://www.windowsecurity.com/articles/Controlling-Resource-Permissions.html

 Urs