Although it's no longer required to manually create a domain service account since ADC 4.3.0, we recommend maintaining a separate account for domain management and giving the domain service account the minimum permissions required to run a service and no other access. This maximizes your organization's security by ensuring that any credentials exposed in the course of domain service do not link back to any other high-access administrative accounts.

1. Create a new user in Active Directory and give it a descriptive name, e.g. OneLoginService.

2. On the member server machine, open Computer Management and go to Groups in the console tree.

3. Select the local administrators group, then click Add to Group.

4. In the Select Users, Computers, or Groups dialog that appears, add your newly created user to the machine's local administrators group.

5. Go to Active Directory Users and Computers. Right-click the domain and select Delegate Control to launch the Delegation of Control Wizard.

6. Add your new domain service account to the Users or Groups list and select Create a custom task to delegate.

   

7. Delegate control of Only the following objects in the folder: User objects.

   

8. Configure the permissions you want to delegate. At minimum, you must enable the following, but may enable Read or Write for any additional attributes necessary to your domain management. To import additional attributes into OneLogin, grant Read permissions, and to enable OneLogin to provision attributes in Active Directory, select Write for those attributes.

   • Change Password
   • Reset password
   • Read lockout time
   • Write lockout time
   • Read Display Name
   • Read E-Mail Address(Others)
   • Read Logon Name
   • Read Logon Name (pre-Windows 2000)
   • Read Member Of
   • Read Middle Name
   • Read Name
   • Read objectSid
   • Read userAccountControl
   • Write userAccountControl

   

9. If an ADC service is running, stop and restart it using the new service user's credentials.

10. To provide the domain service account permission to view deleted users, install AD Lightweight Directory Services as a Role, then open Powershell or a command prompt and run the following commands:

    dsacls "CN=Deleted Objects,your_base_DN" /takeownership

    dsacls "CN=Deleted Objects,your_base_DN" /G your-domain\service-user:GR