SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have two network domains, A and B, each with its own AD DS. We have a SharePoint 2010 implementation on domian A that has full bi directional syncing with its AD DS.

We would like to synchronise the AD information on domain B into SharePoint but currently only have read access due to internal data security rules.

There is a concern that SharePoint could be used to alter key fields on the AD records so I am trying to find a way to restrict access as much as possible. We could give control of the service account used to run UPS to domain B which would allay some concerns but is there a way of stopping someone on domain A from mapping fields to domain B's AD, even if they are Admin?

share|improve this question

Not entirely sure this is what you need, but the UPS account need the following permissions to be able to synchronize:

  • Replicate Directory Changes on domain (this permissions is widely misunderstood! It does not allow an account to change anything in the AD DS, it makes it able to query changes)
  • If domain runs on a Windows Server 2003, account must be member of Pre-Windows 2000 Compatible Access built-in group
  • If netBIOS name differs from servers fully qualified domain name, Replicate Directory Changes on cn=configuration container
  • If (and only if) you want to export values from SharePoint to AD DS, you must grant Create Child Objects and Write All properties (but it sounds like you very much so dont want that ;)

More info, and something to give to your admins for convincing:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.