This article describes how to set restrictions on a site collection on a computer that is running the 2007 Microsoft Office servers Service Pack 1 (SP1). The article discusses how to allow access only for users in a particular organizational unit (OU).

Administrators can use the stsadm.exe command to set restrictions on a site collection to allow access only for users in a particular OU. To do this, follow these steps:

1. Click Start, click Run, type cmd, and then click OK.
2. At the command prompt, type the following command, and then press ENTER:
   cd /d %programfiles% \Common Files\Microsoft Shared\Web Server Extensions\12\BIN
3. At the command prompt, type the following command, and then press ENTER:
   stsadm.exe –o setsiteuseraccountdirectorypath –url site collection url -path OU path
   For example, type the following at the command prompt:
   setsiteuseraccountdirectorypath –url http://server/sites/s1 -path "OU=MSCRM,DC=redmond,DC=corp,DC=microsoft,DC=com"
   Note The path will be the full distinguished name of the OU. The command will set the restrictions to allow only users under "OU=MSCRM,DC=redmond,DC=corp,DC=microsoft,DC=com" to be added to the site collection http://server/sites/s1.

To obtain the OU path, type the following at the command prompt, and then press ENTER:When the administrator uses the Stsadm.exe tool or another management tool to manage the site collection, the administrator will be added as a user to the site collection. The command in step 3 will block the administrator from managing the site collection if the administrator does not belong to the OU.

To enable the administrator to manage the site collection, type the following at the command prompt, and then press ENTER:Note In this command, paths is a placeholder for a semicolon-separated list of distinguished names.

To see the list of allowed administrator directory paths, type the following at the command prompt, and then press ENTER: