0

I have a question about accounts that can be used to perform directory lookups. I need to have an account that can perform lookups for an application, however it needs to have the minimum permissions needed to do this. Does anyone know whether it is possible to have an account that can perform directory lookups that is not an administrator? I thought that it was, but need to know which group it needs to be assigned so that it has the least privileges whilst still being able to perform lookups.

TIA

Improve this question

1 Answer 1

Reset to default
2

A user does not need to be an administrator to look up data in the directory.

It all depends on what you want the account to access. Assuming you haven't changed any ACLs in your directory, then by default a user who is only in 'Domain Users', will be able to retrieve all the basic details about users/groups/objects in your domain. They won't be everything, some fields are protected and require admin access (e.g. passwords).

It would be a bad idea, but you could even enable anonymous access and then you would not need any accounts at all.

If you have different requirements you can set ACLs on your OUs and grant the privileges you want.

Improve this answer
3
  • Agreed, only needs to be domain user. Agree, DO NOT use anonymous access!
    – Matt
    Aug 19, 2011 at 9:48
  • Great, thanks I'll try this with a basic user then and it should work - I hvaen't changed any of the ACL's in the directory.
    – 5lovak
    Aug 19, 2011 at 10:15
  • 1
    It's actually sufficient if the user is part of Domain Guests.
    – pfo
    Aug 19, 2011 at 11:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .