What are the basic permissions I would need to query AD users and security groups permission. I have a 3th party application that needs AD read privileges. This is for a privileged account management tool.

What would be the basic permissions the service account that I want to create for this would need, as I don't want to use a domain admin for this?

  • Are you asking what permissions you need to find out what permissions users / groups have in your environment (i.e. logon rights, file system rights, etc.)? Or just what access these principals have to active directory itself? – Semicolon May 8 '18 at 15:14
  • Hello, I'm asking what perissions you need to find out what permissions users/groups game in my enviroment. – kevin rennenberg May 11 '18 at 10:28

It would require read permissions access to the entire file system on every computer in the environment (so, likely a local administrator - and a domain administrator to read the whole file system on Domain Controllers); though a standard user may be able to read permissions on most (if not all) of AD itself.

This doesn't even take into account what access you would need to read and interpret permissions on any databases, web applications and other services in the environment.

The thing is, there is no real practical method to determine what access each principal has to everything in an environment - aside from a detailed, methodical, documentation process when initially configuring access. That is, leveraging numerous groups unique to each application, resource, and service that are noted with the precise access that each group confers. Of course, this all has to be planned and implemented before attempting to gather this information.

But if you're just looking for windows file system permissions, user righs assignments, and AD access, a domain admin combined with a local admin on all computers (assuming you're following best practices and domain admins do NOT have access to member servers and workstations).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.