2

I want to create a user that can query LDAP on my Windows 2008 R2 Active Directory. It only works with Domain Admins. I read the Account Operators group will also work. Both these have write rights, however. I also read that Domain Users should be able to work, but it does not. Only Domain Admin accounts work.

This is for a PHP program that has an LDAP plugin, so I'm trying to create a read-only user.

|improve this question
  • Create a user, put it in the Domain Guests group, remove all other groups. Of course the privileges you need depend on what you need to read. There are a few attributes that ACLs that restrict who can read them. – Zoredache Feb 25 '14 at 19:48
8

Any user in the Active Directory already has read only access to most (if not all) of the tree. If you could elaborate on exactly what type of error you see would be helpful. It's possible your code is not behaving in the manner that you expected.

|improve this answer
  • It was invalid user and credentials. I thought I had it right. I guess I was wrong. Sorry. Thanks. – johnny Feb 25 '14 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.