Preventing User Profile Field Mapping to AD

Question

We have two network domains, A and B, each with its own AD DS. We have a SharePoint 2010 implementation on domian A that has full bi directional syncing with its AD DS.

We would like to synchronise the AD information on domain B into SharePoint but currently only have read access due to internal data security rules.

There is a concern that SharePoint could be used to alter key fields on the AD records so I am trying to find a way to restrict access as much as possible. We could give control of the service account used to run UPS to domain B which would allay some concerns but is there a way of stopping someone on domain A from mapping fields to domain B's AD, even if they are Admin?

Sorry if it's not 100% but it's a little difficult to describe!!

Answer 1

Not entirely sure this is what you need, but the UPS account need the following permissions to be able to synchronize:

• Replicate Directory Changes on domain (this permissions is widely misunderstood! It does not allow an account to change anything in the AD DS, it makes it able to query changes)
• If domain runs on a Windows Server 2003, account must be member of Pre-Windows 2000 Compatible Access built-in group
• If netBIOS name differs from servers fully qualified domain name, Replicate Directory Changes on cn=configuration container
• If (and only if) you want to export values from SharePoint to AD DS, you must grant Create Child Objects and Write All properties (but it sounds like you very much so dont want that ;)

More info, and something to give to your admins for convincing:

http://technet.microsoft.com/en-us/library/ff182925.aspx#permission