Does anyone know of a way to give a user permissions to view the Open Files of a Domain Controller via MMC without granting any unnecessary additional permissions? I don't want to have to add this person to the Administrators group, for example.