Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We need to grant a service ID the Replicating Directory Changes to Active Directory. People are concerned that we might accidentally let the service ID write data in Active Directory, or have somebody abuse the service ID and change Active Directory data.

Does somebody know what rights are part of "Replicating Directory Changes?"

share|improve this question

2 Answers 2

up vote 2 down vote accepted


Note Using either method, setting the Replicating Directory Changes permission for each domain within your forest enables the discovery of objects in the domain within the Active Directory forest. However, enabling discovery of the connected directory does not imply that other operations can be performed.

To create, modify, and delete objects within Active Directory using a non-administrative account, you may need to add additional permissions as appropriate. For example, for Microsoft Metadirectory Services (MMS) to create new user objects in an Organizational Unit (OU) or container, the account that is being used must be explicitly granted the Create All Child Objects permission, as the Replicating Directory Changes permission is not sufficient to allow the creation of objects.

In a similar fashion, the deletion of objects requires the Delete All Child Objects permission.

It is possible that there are limitations on other operations, such as attribute flow, depending on the specific security settings that are assigned to the object in question, and whether or not inheritance is a factor.

share|improve this answer
So, it "enables the discovery of objects in the domain within the Active Directory forest." Sounds a lot like "read." –  Jim May 3 '11 at 18:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.