Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have set up a small Server 2008 R2 domain network at home so I can learn and practice administering it.

Lets say I want to create a temporary user account to allow an auditor access to all files on workstations and servers within the domain, but I dont want to give full administrator permissions, just read-only access to all files.

Secondarily I would like to enable the auditor to perform WMI queries as necessary.

How should I go about doing this? Do I create a group for the user and generate a GPO that applies to that group? What properties would I need to set?

Thanks for any advice!

EDIT

I assigned the auditor account to Backup Operators but I found that I could not access administrative shares, eg. "\MyPC.testserver.com\c$\" was accessible with the administrator account but not with the Backup Operator one.

I read about the Backup Operators built in group here: http://technet.microsoft.com/en-us/library/cc756898%28v=ws.10%29.aspx

It indicates that

Members of this group can back up and restore all files on domain controllers in the domain, regardless of their own individual permissions on those files. Backup Operators can also log on to domain controllers and shut them down...

Is there a way I can modify an Administrator account so it has read-only access to workstations?

share|improve this question
add comment

1 Answer

I always create new AD groups for auditors and the like. It makes it easier to find them, apply any GPOs to the group, enable/disable, etc...

Add that group to the Backup Operator group built into AD. A member of the Backup Operators group can read files and directories for which the user would normally not have access. Membership in this group permits users to open any file for "backup" purposes.

This will allow them to read any file on a machine connected to AD without being an Admin.

share|improve this answer
    
Thanks, great advice. Regarding the WMI part, does it allow WMI queries to be performed by default? –  TripleAntigen Feb 7 '13 at 7:14
    
I believe it should... not 100% sure. –  Keltari Feb 7 '13 at 16:22
    
Regrettably the Backup Operators group did not work for workstations see edits. –  TripleAntigen Feb 9 '13 at 4:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.