1

What are the basic permissions I would need to query AD users and security groups permission. I have a 3th party application that needs AD read privileges. This is for a privileged account management tool.

What would be the basic permissions the service account that I want to create for this would need, as I don't want to use a domain admin for this?

2
  • Are you asking what permissions you need to find out what permissions users / groups have in your environment (i.e. logon rights, file system rights, etc.)? Or just what access these principals have to active directory itself?
    – Semicolon
    May 8, 2018 at 15:14
  • Hello, I'm asking what perissions you need to find out what permissions users/groups game in my enviroment. May 11, 2018 at 10:28

1 Answer 1

0

It would require read permissions access to the entire file system on every computer in the environment (so, likely a local administrator - and a domain administrator to read the whole file system on Domain Controllers); though a standard user may be able to read permissions on most (if not all) of AD itself.

This doesn't even take into account what access you would need to read and interpret permissions on any databases, web applications and other services in the environment.

The thing is, there is no real practical method to determine what access each principal has to everything in an environment - aside from a detailed, methodical, documentation process when initially configuring access. That is, leveraging numerous groups unique to each application, resource, and service that are noted with the precise access that each group confers. Of course, this all has to be planned and implemented before attempting to gather this information.

But if you're just looking for windows file system permissions, user righs assignments, and AD access, a domain admin combined with a local admin on all computers (assuming you're following best practices and domain admins do NOT have access to member servers and workstations).

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .