How to give an account read-only access to everything in the domain?

Question

System administration

Good day!
There is a domain, clients win 7 controller 2008 r2.
It is necessary to give the account the following rights:
read-only access to all objects in the domain (accounts, groups, computers, policies, etc);
reading all logs from all machines in the domain;
Tell me what to read, maybe there is a built-in with such functionality.

Answer 1

If no manipulations with rights at the AD level were done, then by default DomainUsers have Read-Only rights to the entire domain. You can verify this by running the ADUC snap-in as a domain user.