in an Active Directory managed from Samba 4 I have to bind some application to let it use and select users and groups from Active Directory.

For this I normally use a dedicated user which belongs to the Domain Admins group.

But... I don't want to create a so powerful user for this!

Is there any way to create a non privileged user which:

  • can browse Active Directory for application binding purposes
  • does not belong to the Domain Admins group
  • cannot logon on any client
  • can only be used from the server which runs the application



Any authorised (after LDAP bind operation) Acrive Directory domain user by default can search other users in domain. It is suitable for your task.

I'm talking about the possibility of the presence of an authorized search under any domain user. Nevertheless, I did not just faced with badly written applications (including enterprise) - with such applications have to deal individually.

We should also highlight applications such as samba (or containing samba) - domain administrator credentials they need only to perfom domain join operation - these credentials are not stored and used only once.

Unfortunately you can not restrict the hosts to which the domain user can perform LDAP Bind. But you can with domain policy prohibit such interactive logon user on windose computers in the domain:

  1. Add this users to some group, for example 'Service Accounts'
  2. Go to GPO Computer Configuration/ Windows Settings/Security Settings/Local Policies/User Rights Assignment Add the 'Service Accounts' Security Group to Deny log on locally and Deny log on through Terminal Services
  3. Apply created GPO for all domain member Windows hosts where you want deny logon.
  • I'm not sure this is true for all application. For example, FreeNAS asks for an Administrator account (doc.freenas.org/9.3/freenas_directoryservice.html), and others too (like Pydio for example). What's wrong? – Mat Nov 17 '16 at 12:10
  • 1
    FreeNAS ask administrative account for domain join, not for user authentification. – Slipeer Nov 17 '16 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.