Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

How prevent AD account from logging on but allow ldap query of AD

Posted on 2014-02-03
2
Medium Priority
?
522 Views
Last Modified: 2014-02-03
We're creating a role account to be used by a 3rd party system on our network that needs to be able to query AD but we'd like to prevent anyone from using that role account to actually log in to AD.  Is that possible?

If so, how?

Our AD domain functional level is 2003, but we have a mix of Server 2008 and Server 2003 DC's.  We're trying to get to a place where we can retire our Server 2003 DC but we're not there yet.

Thanks!
0
Comment
Question by:RhoSysAdmin
2 Comments
 
LVL 39

Accepted Solution

by:
Mahesh earned 1000 total points
ID: 39830177
Just go to user ad properties, navigate to accounts tab \ log on to and select the following computer and click OK.
Do not add any computer there, or add any disabled computer account there
Now user will able to make LDAP query but could not be logon to any computers in domain

Mahesh
0
 

Author Closing Comment

by:RhoSysAdmin
ID: 39830993
Perfectly simple solution.
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
The article explains the process to deploy a Self-Service password reset portal I developed a few years ago. Hopefully, it will prove useful to someone.  Any comments, bug reports etc. are welcome...
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Suggested Courses

572 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question