I am not sure if this is the right place to post this question but I figured since some users here are familiar with Windows Servers and Active Directories, that I might to get some information about my issue.
I am developing an server cloud backup application. The software will be deployed to all users on an Active Directory and the files should be backed up to the cloud under the same account using a single email and password. This is all very trivial and straight forward.
My problem is when a specific (Non-Administrator) user tries to manage his backed up files. I need to differentiate this user on the web console, he needs to enter some credentials that are unique to this user. This is because only the administrator should know the main credentials of the account.
I am leaning on implementing a method that incorporates the account name [username@domain] as the sub-account name and the application will ask the user for a password while the administrator can still access all users' data using the main account's credentials.
I am creating this question mainly to ask what are the best practices for such system as I am not a server expert and haven't done much time with active directory and Windows servers. My main concern is the security of the main account and the sub-users accounts.