Permissions to set on user to read from Active Directory only

Question

I have to setup user accounts for applications to use to get a list of users and group memberships from our domain. As such, I'd like these applications to use credentials for user accounts with bare minimum access to my network as possible.

What I've done was create basic users that cannot change passwords, group membership is "Domain Users", and I set the password to an obnoxiously long randomly generated one.

Is there a particular built-in security group that I should be using instead? Is there another, more secure way of creating a user and granting them this kind of access?

Any and all help would be greatly appreciated!

Solution

Since you didn't mention any restrictions as far as the account only being able to read portions of the directory, I see no need to overthink this. The "Domain Users" default group already has bare minimum rights. It has the rights to read user, group and computer objects from the directory though, which is what you want to do.

I would create a group called "Service Accounts," or something similar, and add your special user to that group. Then I would modify a domain-level GPO that sets the "Deny log on locally" and "Deny log on through Remote Desktop" settings for the Service Accounts group.

Even if someone did compromise that account, they won't be able to interactively log on to any domain computers with it, nor will they have sufficient privileges to do anything useful using a network logon.

Comments

[tony roth]

The issue with "domain users" is that you don't (maybe you do) know where its been applied and which permissions were granted.

[someone1]

Right, and if the credentials were ever stolen due to the 3rd party app being unsafe, then someone can use them to logon to domain PCs. I have security settings in place to prevent server access and access to shared resources, but limiting access to solely being able to list active directory users/group memberships would be ideal

[tony roth]

you could just give the user read access to the root of the ou that contains the groups/users and remove the account from domain users.