Windows security question.

[Anand S Malwade <Anand.Malwade () SHU EDU>]

Windows security experts, I need some guidance regarding rights.

we are developing an application that will be used to notify users of their impending password expiry (<=14 days). The 
application team is requesting an AD account with domain admin rights to read the password age attributes associated 
with the policy and calculate the user's password expiry. 

Is AD, there a way to assign limited rights to an generic ID w/o giving domain admin privileges for the purposes above 
?  Can a regular domain ID not query password attributes from command line ?

Thanks,
Anand


Anand Malwade
Seton Hall University.