MQ

Hello all 

I've some users in AD domain1 asking read only access to use MQ Explorer on their windows workstations. These users belong to AD domain1 and the queue manager is running in another domain: AD domain2. How can I validate, from my queue manager, running with a service user from AD domain1, the users from another AD domain? Does my service used need some special permissions? 

After solving this part of the question, I need to five some accesses to que queue manager queues, and the examples I found suggests to give 

setmqaut -m <qmgr>  -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -g "read_group" +dsp +inq +put

Put to SYSTEM.ADMIN.COMMAND.QUEUE can be a risk, I guess. 

Thanks for your suggestions