....to log into the domain controller remotely, they "have" to be domain admins, so...meaning they won't have read only access. You could add them to the local user's group and have them access the server interactively, not a good idea though.