Solved

How prevent AD account from logging on but allow ldap query of AD

Posted on 2014-02-03
2
474 Views
Last Modified: 2014-02-03
We're creating a role account to be used by a 3rd party system on our network that needs to be able to query AD but we'd like to prevent anyone from using that role account to actually log in to AD.  Is that possible?

If so, how?

Our AD domain functional level is 2003, but we have a mix of Server 2008 and Server 2003 DC's.  We're trying to get to a place where we can retire our Server 2003 DC but we're not there yet.

Thanks!
0
Comment
Question by:RhoSysAdmin
2 Comments
 
LVL 35

Accepted Solution

by:
Mahesh earned 250 total points
ID: 39830177
Just go to user ad properties, navigate to accounts tab \ log on to and select the following computer and click OK.
Do not add any computer there, or add any disabled computer account there
Now user will able to make LDAP query but could not be logon to any computers in domain

Mahesh
0
 

Author Closing Comment

by:RhoSysAdmin
ID: 39830993
Perfectly simple solution.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Allow users from Trusted Domain to Access Resources 1 42
Power shell script 6 58
Group policy update error 8 25
Disable NetBios Seeting via Group Policy 6 39
I know all systems administrator at some time or another has had to create a script to copy file from a server share to a desktop. Well now there is an easy way to do this in Group Policy. Using Group policy preferences is not hard. The first thing …
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now