restrict permissions for domain users