Read only access to 2003 A.D

[saint_stevo]

How do i give someone read only access to A.D? I want them to see all the users, security groups etc but not be able to make changes.......it will also need to replicate any changes.

 

I thought there was a way within MMC, but as yet i have not found it.

 

Possibly whoosh for most, but hoping Mewsta may be floating about!

 

Cheers

 

s_s

[TUS]

Only give the user access to the "Domain users" group?

[saint_stevo]

huh?

 

They need to be able to see all the users and security groups

[TUS]

My understanding was that if their user account belongs to no other security groups then they won't have the ability to change anything except their own account ... and will still be able to view groups. It's been a while since I've touched AD though .. so sorry if that's not the case. :-/

[Mewsta]

Correct, the users only need to be a member of the Domain Users group and have access to a machine with the AD Users & Computers Snap In.... My users connect to a management server that has the AD Users & Computers Snap In installed and they can open users and groups with read only permission........

[saint_stevo]

the user in question is a domain admin......

[Joey-deacons-left-nut]

think that will overide any other gpo settings you make...

[badgerx16]

think that will overide any other gpo settings you make...

Correct. Dom-Admin overrides all GPO security settings.