CUCM LDAP Sync distinguished user interactive logon

[joeharb]

We have an auditor that is requesting that the ad account that is used for LDAP synchronization have interactive logon deactivated, is this supported.  I have found that this account only needs Read Access to the domain structure, but it also states it needs to be an admin.  Are there any guidelines for restricting access or any type of hardening for this account?

Thanks,

Joe

[Jonathan Schulenberg]

The CUCM LDAP sync is read-only so no elevated privileges are required. I believe LDAP bonds fail if you disable the account but this would be easy to test and undo if it breaks. Check both a synchronization and authentication. Ensure you wait until after AD site replication completes or make the change on the same DC as CUCM is pointing at.