Reference Material | Account Permissions
The following is a list of all the permissions the service account running the Gatekeeper requires:
Permission | Scope |
---|---|
Local administrator | Gatekeeper computer |
Service Connection Point | Gatekeeper computer |
Create and Delete | classStore objects beneath user objects |
Read | - userAccountControl attribute on user objects - msDS-User-Account-Control-Computed attribute on user objects - displayName attribute on user objects - mail attribute on user objects - manager attribute on user objects - mobile attribute on user objects - objectGUID attribute on user objects - sAMAccountName attribute on user objects - userAccountControl attribute on user objects |
Change and Reset Password | User objects |
Unlock account | User objects |
Change password at next logon | User objects |
List child objects | User objects |
Write | Mobile attribute on user objects Note: This allows users to enroll by entering their mobile number, not already set in Active Directory by the administrator. |