saint_stevo Posted 2 August, 2010 Share Posted 2 August, 2010 How do i give someone read only access to A.D? I want them to see all the users, security groups etc but not be able to make changes.......it will also need to replicate any changes. I thought there was a way within MMC, but as yet i have not found it. Possibly whoosh for most, but hoping Mewsta may be floating about! Cheers s_s Link to comment Share on other sites More sharing options...
TUS Posted 2 August, 2010 Share Posted 2 August, 2010 Only give the user access to the "Domain users" group? Link to comment Share on other sites More sharing options...
saint_stevo Posted 2 August, 2010 Author Share Posted 2 August, 2010 huh? They need to be able to see all the users and security groups Link to comment Share on other sites More sharing options...
TUS Posted 2 August, 2010 Share Posted 2 August, 2010 My understanding was that if their user account belongs to no other security groups then they won't have the ability to change anything except their own account ... and will still be able to view groups. It's been a while since I've touched AD though .. so sorry if that's not the case. :-/ Link to comment Share on other sites More sharing options...
Mewsta Posted 2 August, 2010 Share Posted 2 August, 2010 Correct, the users only need to be a member of the Domain Users group and have access to a machine with the AD Users & Computers Snap In.... My users connect to a management server that has the AD Users & Computers Snap In installed and they can open users and groups with read only permission........ Link to comment Share on other sites More sharing options...
saint_stevo Posted 2 August, 2010 Author Share Posted 2 August, 2010 the user in question is a domain admin...... Link to comment Share on other sites More sharing options...
Joey-deacons-left-nut Posted 2 August, 2010 Share Posted 2 August, 2010 think that will overide any other gpo settings you make... Link to comment Share on other sites More sharing options...
badgerx16 Posted 2 August, 2010 Share Posted 2 August, 2010 think that will overide any other gpo settings you make... Correct. Dom-Admin overrides all GPO security settings. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now