enforced read-only in tree-view when using external AD mode