Is it possible to create a read-only Administrator account that would be able to read everything but change nothing? It would be used by a Sarbanes-Oxley (SOX) IT auditor to check access rights and so on.

To view anything security-related in Active Directory (AD), all you need is an authentic user account—even one from a trusted domain—because authority to read organizational units (OUs), Group Policy Objects (GPOs), users, and groups is granted by default to the Authenticated Users well-known security principal. Unfortunately, to directly check many of the local security settings on a given Windows system, you need local Administrator access. However, the Group Policy Management Console (GPMC) Group Policy Results feature provides the same information by allowing you to select a computer object and obtain a report of all the effective Group Policy settings (including security settings) from that system.

To run the report, AD requires you to have the Generate Resultant Set of Policy (Logging) permission on the OU that includes the computer whose settings you want to see. Figure 1 shows the ACL of a Domain Controllers OU. I've created a group called GPMC Users and granted the group the Generate Resultant Set of Policy (Logging) permission.