1

in an Active Directory managed from Samba 4 I have to bind some application to let it use and select users and groups from Active Directory.

For this I normally use a dedicated user which belongs to the Domain Admins group.

But... I don't want to create a so powerful user for this!

Is there any way to create a non privileged user which:

  • can browse Active Directory for application binding purposes
  • does not belong to the Domain Admins group
  • cannot logon on any client
  • can only be used from the server which runs the application

?

Improve this question

1 Answer 1

Reset to default
2

Any authorised (after LDAP bind operation) Acrive Directory domain user by default can search other users in domain. It is suitable for your task.

I'm talking about the possibility of the presence of an authorized search under any domain user. Nevertheless, I did not just faced with badly written applications (including enterprise) - with such applications have to deal individually.

We should also highlight applications such as samba (or containing samba) - domain administrator credentials they need only to perfom domain join operation - these credentials are not stored and used only once.

Unfortunately you can not restrict the hosts to which the domain user can perform LDAP Bind. But you can with domain policy prohibit such interactive logon user on windose computers in the domain:

  1. Add this users to some group, for example 'Service Accounts'
  2. Go to GPO Computer Configuration/ Windows Settings/Security Settings/Local Policies/User Rights Assignment Add the 'Service Accounts' Security Group to Deny log on locally and Deny log on through Terminal Services
  3. Apply created GPO for all domain member Windows hosts where you want deny logon.
Improve this answer
2
  • I'm not sure this is true for all application. For example, FreeNAS asks for an Administrator account (doc.freenas.org/9.3/freenas_directoryservice.html), and others too (like Pydio for example). What's wrong? Commented Nov 17, 2016 at 12:10
  • 1
    FreeNAS ask administrative account for domain join, not for user authentification. Commented Nov 17, 2016 at 12:11

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.