Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a question about accounts that can be used to perform directory lookups. I need to have an account that can perform lookups for an application, however it needs to have the minimum permissions needed to do this. Does anyone know whether it is possible to have an account that can perform directory lookups that is not an administrator? I thought that it was, but need to know which group it needs to be assigned so that it has the least privileges whilst still being able to perform lookups.


share|improve this question
up vote 2 down vote accepted

A user does not need to be an administrator to look up data in the directory.

It all depends on what you want the account to access. Assuming you haven't changed any ACLs in your directory, then by default a user who is only in 'Domain Users', will be able to retrieve all the basic details about users/groups/objects in your domain. They won't be everything, some fields are protected and require admin access (e.g. passwords).

It would be a bad idea, but you could even enable anonymous access and then you would not need any accounts at all.

If you have different requirements you can set ACLs on your OUs and grant the privileges you want.

share|improve this answer
Agreed, only needs to be domain user. Agree, DO NOT use anonymous access! – Matt Aug 19 '11 at 9:48
Great, thanks I'll try this with a basic user then and it should work - I hvaen't changed any of the ACL's in the directory. – 5lovak Aug 19 '11 at 10:15
It's actually sufficient if the user is part of Domain Guests. – pfo Aug 19 '11 at 11:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.