Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I do have a third party product (Jira) that has Active Directory integration via LDAP.

I want to enable Jira administrators to edit group memberships and have them syncronized inside Active Directory.

This currently works but I needed to use a Domain Administrator service account in order to do this.

The question is how can I do this without giving the entire Domain Administrator permission to the service account.

share|improve this question

1 Answer 1

You can delegate administration to your service account in order to allow it to edit group membership, without giving it full Domain Admin rights. This can be done for a single group, for all groups in give OU, or for all groups in the whole domain,

http://www.windowsecurity.com/articles/Implementing-Active-Directory-Delegation-Administration.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.