Solved

AD Read only admin account in windows 2003 server

Posted on 2013-01-29
5
1,656 Views
Last Modified: 2013-02-20
I run a Windows 2003 server network with Windows 7 workstations for small organization within a larger organization. We run our own forest/domain and servers for a business reason.

In moving to an enterprise remote access and MDM solution, the project managers working on this project wants me to create and provide them an AD admin account that is read only so that they can use this account to read my AD.

How do you create a readonly AD admin account?
0
Comment
Question by:TechGoingSolo
5 Comments
 
LVL 8

Accepted Solution

by:
R_Edwards earned 500 total points
Comment Utility
Domains users by default have a read access to Active directory objects. So there is no need to creating a any group to accomplsih this.

Probably you need to install RSAT Tool on users system (I am assuming users are using windows vista or higher OS on their client system)

Download the RSAT Tool from below link and install it on the client sytems.

http://www.microsoft.com/download/en/details.aspx?id=7887

Refer below link to understand this better.

http://www.windowsecurity.com/articles/installing-using-remote-server-administration-tools-rsat-vista.html

Above link explains step by step procedure to install the RSAT Tool.( Window vista, windows 2008 Etc)

For Legacy operting systems (XP, windows server 2003) you need to use adminpak.msi.

http://support.microsoft.com/kb/314978
0
 

Author Comment

by:TechGoingSolo
Comment Utility
This is what the project engineer emailed me asking for information.

"Also provide the admin DN (a read only account and password so that RSA can read your AD) and search DNs for users and groups"

So I can just create and send him a standard user account information?
0
 
LVL 8

Expert Comment

by:R_Edwards
Comment Utility
yep, I would test it out to ensure that you can access it.
0
 
LVL 10

Expert Comment

by:ddiazp
Comment Utility
Sounds like they want to use their own ldap tools instead of active directory.. which is understandable


you need to find the 'path' of the account you created and provide it with LDAP syntax for the username DN:


search base (probably what he meant instead of search DNs):

This is usually:

CN=Users,DC=example,DC=com  If the users they need to search are located under the Users container

OU=Groups,DC=example,DC=com If the groups they need to search are located under the Groups OU


the username DN would be: CN=userexample,OU=examplechildou,OU=exampleparentou,DC=example,DC=com

Assuming that you created 'userexample' under a OU named 'examplechildou', which is a child of OU named 'exampleparentou', which is then directly under your domain: DC=example,DC=com
0
 
LVL 3

Expert Comment

by:jeorge
Comment Utility
A Read Only Domain Admin is a contradiction in terms. A normal
authenticated user has the ability to read most things in a domain if they
have the right tools.

There is no Read only domain administrator account in AD. Members of Domain administrator account will be having more powerful permissions in your Domain. So it is bad practice to add lot of user accounts to domain admin groups.
By default all domain users will be having read access to Active directory. They can check the user account/computers accounts/GPO etc in your AD.

Just look at this link and look if it suits your need feasible..

http://technet.microsoft.com/en-us/library/hh356036.aspx

http://technet.microsoft.com/en-us/library/hh356036.aspx

Else you can use a third party tool for the same to make your work and your vendor work easier.

I f you want i can suggest you.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Even if you have implemented a Mobile Device Management solution company wide, it is a good idea to make sure you are taking into account all of the major risks to your electronic protected health information (ePHI).
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now