reason for admin user in AD / ACS 5.2 join

[hans.velez]

hi everyone,

I need to know that the ACS must have a user with elevated privileges so as to create and delete users on the AD, please do not report the reasons given in the user manual by 5.2 acs that reason is not enough to that the customer will provide this type of user.

The specific question:
what would be the reason for that software has to access the AD to a user with these privileges so high?

thanks for your help!!

[mansrini]

Hello,

Its not really necessary for the acs to have a domain admin user.. Any user with permissions to add/remove computers on the domain will do. This username will be used just during the time when the acs joins itself to the domain as a domain computer. Hope this helps.

Thanks,

Mani

[smartnet_2s]

Hi;

I have a integration of the acs 5.2 with MS ACTIVIE DIRECTORY, and my customer is using the same user and password  with read permission in acive directory database, but this follow message happen:

I believed that message was by not enough account privilegies.

Can I help me?

Regards;

Pietro

[a-ford · Accepted solution]

I just recently integrated 5.2 boxes with AD and we found the easiest way was to simply grant the system account for the ACS full control over its own machine object. We didn't have to give it any additional rights to other domain objects and it appears to be suffcient for it to perform the join operation each time the service is restarted as well as performing authentication actions.

Hope this helps.

Adam