Active Directory sync user account
The Sync User created for Active Directory (AD) is added to the cn=Administrators branch and is given most of a root user’s permissions. If this account cannot be secured and there is a need to configure the permissions required by the Sync User, the following are required to perform synchronization tasks.
As a Sync Source, these permissions are needed:
-
List contents
-
Read all properties
-
Read permissions
Deleted items are a special case. For the PingDataSync server to see deleted entries, the user account must have sufficient access to cn=Deleted Objects,<domain name>. Giving access to that distinguished name (DN) requires using the dsacls tool, such as:
# Take ownership may be required to make the needed changes. dsacls "CN=Deleted Objects,DC=example,DC=com" /takeOwnership
# Give the Sync User generic read permission to the domain. dsacls "CN=Deleted Objects,DC=example,DC=com" /G "example\SyncUser":GR
# List the permission for the domain. dsacls "CN=Deleted Objects,DC=example,DC=com"
To revoke all permissions from the Sync User, run the following dsacls command:
dsacls "CN=Deleted Objects,DC=example,DC=com" /R "example\SyncUser"
If Active Directory is used as a destination for synchronization, the Sync User account should not be changed.