If its from the ACS for windows follow this steps,
W2K Read Only Permissions Version 2.1
1) In AD create a special account, lets call it ?acsaccount?, that has no special privileges or
group memberships.
2) On Member Server run all ACS services using this account:
a) For all ACS Services do the following:
? Double-Click on Service Name.
? Choose the ?Log-On? Tab.
? Choose ?This Account? radio button.
? type ?domainname\acsaccount? and its corresponding password.
? Click "OK".
b) Restart all ACS Services:
? CSAdmin
? CSLog
? CSAuth
? CSRadius
? CSTacacs
? CSDBSync
? CSMon
3) On the Member Server add ?Log on as a Service? and ?Act as part of the OS? user rights:
a) Open Local Security Settings.
b) Open Local Policies.
c) Open User Rights Assignments.
d) Add the ?acsaccount? domain user created in step 1 to the permissions: ?Log on as a Service? and
?Act as part of the OS?.
e) Make sure both Local Setting and Effective Setting include the Domainname\Acsaccountname for
above user rights.
4) In AD, Open the active directory management console on domain controller.
a) Right-click on the folder called ?Users?. Choose the ?Delegate Control..." option. Click
"Next".
b) Click Add.
c) Find and double-click the user that is running the ACS services. Click OK. Click Next.
d) Click ?Only the following objects in the folder.? Put a check in ?User Objects.?
e) Click Next.
f) Put a check in ?Read All Properties.?
g) Click Next.
h) Click Finish.
