We have two network domains, A and B, each with its own AD DS. We have a SharePoint 2010 implementation on domian A that has full bi directional syncing with its AD DS.
We would like to synchronise the AD information on domain B into SharePoint but currently only have read access due to internal data security rules.
There is a concern that SharePoint could be used to alter key fields on the AD records so I am trying to find a way to restrict access as much as possible. We could give control of the service account used to run UPS to domain B which would allay some concerns but is there a way of stopping someone on domain A from mapping fields to domain B's AD, even if they are Admin?