Zentyal 4.1 e AD win2008

[vinny74]

Hi all, I have to create a vpn server that connects to a win2008 AD, so it must be a member of the AD, to use domain users and authorize At attachment via VPN with the same credentials.
I set up the whole thing, but I noticed that I have enabled the "PAM" on Zentyal sever, and then Zentyal can also create and delete users and groups.
I wish only win2008 AD can create and / or modify users and groups.

It's possible?

Thank you.

P.S. This is an on-line translation

[trysomething]

I haven't done something like that in a long time but I remember something about giving a user with the same credentials ownership on both ends.
So username 'adcontrol' with password 'abc1234' has root privilege and AD admin on the respective box.
The user in the AD has to be way at the top too.