I have set up a small Server 2008 R2 domain network at home so I can learn and practice administering it.
Lets say I want to create a temporary user account to allow an auditor access to all files on workstations and servers within the domain, but I dont want to give full administrator permissions, just read-only access to all files.
Secondarily I would like to enable the auditor to perform WMI queries as necessary.
How should I go about doing this? Do I create a group for the user and generate a GPO that applies to that group? What properties would I need to set?
Thanks for any advice!
I assigned the auditor account to Backup Operators but I found that I could not access administrative shares, eg. "\MyPC.testserver.com\c$\" was accessible with the administrator account but not with the Backup Operator one.
I read about the Backup Operators built in group here: http://technet.microsoft.com/en-us/library/cc756898%28v=ws.10%29.aspx
It indicates that
Members of this group can back up and restore all files on domain controllers in the domain, regardless of their own individual permissions on those files. Backup Operators can also log on to domain controllers and shut them down...
Is there a way I can modify an Administrator account so it has read-only access to workstations?