What rights does “Replicating Directory Changes” actually grant in Active Directory?

Question

We need to grant a service ID the Replicating Directory Changes to Active Directory. People are concerned that we might accidentally let the service ID write data in Active Directory, or have somebody abuse the service ID and change Active Directory data.

Does somebody know what rights are part of "Replicating Directory Changes?"

Answer 1

http://support.microsoft.com/kb/303972

Note Using either method, setting the Replicating Directory Changes permission for each domain within your forest enables the discovery of objects in the domain within the Active Directory forest. However, enabling discovery of the connected directory does not imply that other operations can be performed.

To create, modify, and delete objects within Active Directory using a non-administrative account, you may need to add additional permissions as appropriate. For example, for Microsoft Metadirectory Services (MMS) to create new user objects in an Organizational Unit (OU) or container, the account that is being used must be explicitly granted the Create All Child Objects permission, as the Replicating Directory Changes permission is not sufficient to allow the creation of objects.

In a similar fashion, the deletion of objects requires the Delete All Child Objects permission.

It is possible that there are limitations on other operations, such as attribute flow, depending on the specific security settings that are assigned to the object in question, and whether or not inheritance is a factor.

Answer 2

To delegate the service to replicate in Active Directory, you have to enable the send as and receive as delegation.