# Stopping Active Directory users having default Graylog access
**URL:** https://community.graylog.org/t/stopping-active-directory-users-having-default-graylog-access/17246
**Category:** Graylog Central (peer support)
**Created:** [September 21, 2020, 5:42pm UTC](https://community.graylog.org/t/stopping-active-directory-users-having-default-graylog-access/17246 "2020-09-21T17:42:25Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@nick](https://community.graylog.org/u/nick)
#### Post date: [September 21, 2020, 5:42pm UTC](https://community.graylog.org/t/stopping-active-directory-users-having-default-graylog-access/17246/1 "2020-09-21T17:42:26Z")
I have Active Directory integration setup with LDAP group mapping working.
However I find that all AD users are granted a Reader role within the application by default.
By default I don’t want AD users to have a Graylog account at all, only those within the mapped AD groups setup in LDAP group mappings should have access to Graylog.
I’ve tried removing the Default User Role in the LDAP settings but it just sets back to Reader again.
Can I default block access to Graylog while still retaining AD integration?
---
### Author:  [@nick](https://community.graylog.org/u/nick)
#### Post date: [September 21, 2020, 5:49pm UTC](https://community.graylog.org/t/stopping-active-directory-users-having-default-graylog-access/17246/2 "2020-09-21T17:49:24Z")
To add to this if I create a new AD group called Graylog\_Blocked, add a user to it and set the Group to have Role: None in the LDAP group mappings, the members of the Graylog\_Blocked group still appear to get Reader access even with Role group assigned to None.
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [September 22, 2020, 7:30am UTC](https://community.graylog.org/t/stopping-active-directory-users-having-default-graylog-access/17246/3 "2020-09-22T07:30:40Z")
Please use LDAP filter for users, so it will contain only members of group.
1. Your User Search Pattern probably is probably too wide, so it can include also another users. Use rather filter like this which include user members of group Graylog\_users:
`(&(objectCategory=person)(objectClass=user)(sAMAccountName={0})(memberOf:CN=Graylog_users,DC=domain,DC=net)))`
2. I always try to use filter using AD mmc filter or powershell to check if it works (to debug), only remove part `(sAMAccountName={0})`
[https://theitbros.com/ldap-query-examples-active-directory/](https://theitbros.com/ldap-query-examples-active-directory/)
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [October 6, 2020, 7:30am UTC](https://community.graylog.org/t/stopping-active-directory-users-having-default-graylog-access/17246/4 "2020-10-06T07:30:47Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.