3

I have set up a small Server 2008 R2 domain network at home so I can learn and practice administering it.

Lets say I want to create a temporary user account to allow an auditor access to all files on workstations and servers within the domain, but I dont want to give full administrator permissions, just read-only access to all files.

Secondarily I would like to enable the auditor to perform WMI queries as necessary.

How should I go about doing this? Do I create a group for the user and generate a GPO that applies to that group? What properties would I need to set?

Thanks for any advice!

EDIT

I assigned the auditor account to Backup Operators but I found that I could not access administrative shares, eg. "\MyPC.testserver.com\c$\" was accessible with the administrator account but not with the Backup Operator one.

I read about the Backup Operators built in group here: http://technet.microsoft.com/en-us/library/cc756898%28v=ws.10%29.aspx

It indicates that

Members of this group can back up and restore all files on domain controllers in the domain, regardless of their own individual permissions on those files. Backup Operators can also log on to domain controllers and shut them down...

Is there a way I can modify an Administrator account so it has read-only access to workstations?

1 Answer 1

1

I always create new AD groups for auditors and the like. It makes it easier to find them, apply any GPOs to the group, enable/disable, etc...

Add that group to the Backup Operator group built into AD. A member of the Backup Operators group can read files and directories for which the user would normally not have access. Membership in this group permits users to open any file for "backup" purposes.

This will allow them to read any file on a machine connected to AD without being an Admin.

3
  • Thanks, great advice. Regarding the WMI part, does it allow WMI queries to be performed by default? Feb 7, 2013 at 7:14
  • I believe it should... not 100% sure.
    – Keltari
    Feb 7, 2013 at 16:22
  • Regrettably the Backup Operators group did not work for workstations see edits. Feb 9, 2013 at 4:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .