Microsoft AD spoke – Permissions required to execute actions

Microsoft AD spoke provides several actions to automate tasks in Microsoft AD. Each action or set of actions requires permissions for its successful execution. This article provides information about these required roles or permissions.

These are from minimum required permissions to maximum.

Example:

Minimum permissions required to execute Lookup User action is Svc account. Similarly Add User to Group action will work with Account Operator group and does not require domain admin explicitly.

Affected Versions: All

Required permissions:

Action

Svc account

Member of Built-in Account Operator

Group

Domain Admins

Computer Management

Create Computer

No

Yes

Delete Computer

No

Yes

Disable Computer

No

Yes

Enable Computer

No

Yes

Get Computer OU

Yes

Is Computer Enabled

Yes

Move Computer To OU

No

Yes

Group Management

Add User To Group

No

Yes

Create Group

No

Yes

Delete Group

No

Yes

Lookup Group

Yes

Remove User From Group

No

Yes

Object Management

Create AD Object

No

Yes

Delete AD Object

No

Yes

Query AD

Yes

Update AD Object OU *

No

Partially

Yes

Update AD Object Expiration

No

Yes

Password Management

Change User Password

Yes

Is User Account Locked

Yes

Reset AD User Password

No

Yes

User Management

Create User

No

Yes

Delete User

No

Yes

Disable User

No

Yes

Enable User

No

Yes

Is User Enabled

Yes

Is User In Group

Yes

Lookup User

Yes

Unlock AD Account

No

Yes

Update User

No

Yes

Update User Home Location

No

Yes

Note :

Update AD Object OU* - Partially – This action executes successfully when updating the OU for Users or Groups but fails with Computers as it does not have enough permissions on Computer.

Customers can also provide delegated permissions if they do not wish to use any of the above pre-defined groups.