What Active Directory rights are needed for the Adaxes service user?

Question

We originally installed Adaxes and assigned the Adaxes Service user to the Domain Admins group. We are now locking down that group and have removed the Adaxes Serivce from that group, and we're starting to get messages where users don't have rights to do things. What rights does Adaxes Service need in order to administer users?

Answer 1

Hello,

The Adaxes service account only needs the permissions to publish the service in Active Directory. For information on how to grant the permissions, have a look at section How do I grant permissions to publish Adaxes service of our installation guide: https://www.adaxes.com/help/InstallationGuide/#how-do-i.

At the same time, all operations in a managed domain are performed with the credentials of the domain service account. It is recommended to use an account different from the Adaxes service one. For information on how to check/change the account, see https://www.adaxes.com/help/ChangeManagedDomainServiceAccount. The account must have all the necessary native AD permissions to perform the operations you need. It is recommended that the account is a member of the BUILTIN/Administrators group.