Enterprise read-only console

OK, so I want a "Read Only" console for the Plebs and I don't want them to be able to move or delete computers, assign policies or protect computers within the Enterprise Console!  However, there are 9 DEFAULT rights for a new role that are fixed and unchangeable :smileysad:  That's not exactly what I would call flexible....

Below are the default rights that are assigned to new roles and useless if you want a Read Only console in v4 - v4.5;

Find computers.

Import computers from a file.

Import computers and containers from Active Directory.

Synchronize a group with Active Directory.

Change group synchronization properties and remove group synchronization.

Protect computers.

Move and delete computers.

Create, rename, move and delete groups.

Assign policies to groups.

OK, so I want a "Read Only" console for the Plebs and I don't want them to be able to move or delete computers, assign policies or protect computers within the Enterprise Console!  However, there are 9 DEFAULT rights for a new role that are fixed and unchangeable :smileysad:  That's not exactly what I would call flexible....

Below are the default rights that are assigned to new roles and useless if you want a Read Only console in v4 - v4.5;

Find computers.

Import computers from a file.

Import computers and containers from Active Directory.

Synchronize a group with Active Directory.

Change group synchronization properties and remove group synchronization.

Protect computers.

Move and delete computers.

Create, rename, move and delete groups.

Assign policies to groups.