How to create a limited Active Directory service account

How to create a limited Active Directory service account

Problem:  For webNetwork installation, you will need a Schema Admin and Domain Admin account.  For daily operation, you will need a service account to connect to Active Directory, but you may not want to run it with this same high-level account.  webNetwork uses a "proxy" style account to connect into your directory.  This means the proxy account is the only user that accesses the Active Directory server.



Cause:  webNetwork must have the proper rights to be able to modify objects in the Active Directory tree or it will not function.  General guidelines are the service account needs read/write access on swareXXX attributes  and ability full access to swareXXX objects in Stoneware OU. 


Prerequisite(s):
  • Active Directory Users and Computers console
  • Domain Admins have two accounts (ex: joe-regular-user and joe-domain-admin-user)
  • webNetwork will need to be taken offline to switch account


Solution(s):  Create a lower-privileged account easily using the built-in Account Operators group.  

  1. Create a standard user in desired OU
  2. Add user to Account Operators group (under Builtin) 
  3. Right-click on Stoneware OU and click Properties 
  4. Go to Security tab and click Add... 
  5. Search and select for created user 
  6. Select Full Control for permissions
  7. Click Apply button
  8. Click Advanced button
  9. Find the created user and click Edit 
  10. Change "Apply onto" field to "This object and all child objects" 
  11. Click OK and OK 
  12. Go to webNetwork Server Management console (8090 console)
  13. Enter new service account and password on Directory Services tab
  14. Validate user/password then click Save
  15. Go to Settings tab and click Shutdown
  16. Startup webNetwork service again




IMPORTANT - limitations of above service account:
  • Members of Enterprise/Domain Admins will not be able to login to webNetwork because we cannot update their swareXXX attributes (hence the need for a secondary regular-user accounts for domain admin members)
  • Must use groups/users for assignments; the Account Operators group does not give write access to OUs, although you can add write to specific OUs manually
  • May experience errors in webNetworkTrace.log (start-up log) about missing ability to flush schema; lines should all start with INFO and webNetwork will still function
  • webNetwork updates that require additional schema extensions (new features), you will need to switch the service account to a higher-privileged account or configure the schema credentials in Server Management Console (8090 console) 
  • Full control of the Stoneware OU will allow webAdmin users to create new users and groups; if you wish to remove this right, you'll need to edit the security further on Stoneware OU further



Reference:
Active Directory Default Groups