CCM5.1.4, what privilege to read all LDAP users?

[cjrchoi11]

I want to create an account to read all users from LDAP server and the question is what prvilege required to do to configure in CCM 'LDAP manager distinguished name' field. e.g. administrator or domain admin or,,,,

Advise pleaes,

[gogasca]

Cisco recommends that you create a specific account with permissions to allow it to read all user objects within the sub-tree that was specified by the user search base.

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_implementation_design_guide_chapter09186a008063748a.html#wp1055587

[cjrchoi11]

what premission is required to read all user objects within the sub-tree?

I created new account and tried with 'domain administrator' or 'schema master',,,, and so on... but fails to read the user object...

The users in AD is 'Domain Users' permission and what permission do I need to read those Users?

Thanks,