Service Account not Domain Admin

Question

Hi,

is there any guide what to do if the service account is not a domain admin?
Especially what rights does the account need for the Exchange connection?

The event log is full of errors that the account cannot read several things via LDAP (Permission denied).
And what is need for the Exchange servers (WinRM?).

Thanks!

Answer 1

is there any guide what to do if the service account is not a domain admin?

All operations in a managed domain are performed using the credentials of the account that was specified during the domain registration in Adaxes (domain service account). When you install Adaxes, the domain of the Adaxes service account is automatically registered using the credentials of this account. As long as the account does not have required permissions, you get the error messages. To remedy the issue, you need to specify a domain service account that has appropriate permissions in the domain. For details, see https://www.adaxes.com/help/?HowDoI.Man ... nInfo.html.

what rights does the account need for the Exchange connection?

The account that was used for registering your domain in Adaxes must be assigned to an appropriate role group in Exchange. We recommend assigning the service account to the Organization Management role group. It provides administrative access to an entire Exchange organization and can perform almost any task.

If, for some reason, you do not want to provide the account administrative access to your Exchange organization, you need to assign the account to the following role groups in Exchange:

• View-Only Organization Management - to be able to read Exchange configuration,
• Recipient Management - to be able to create and manage Exchange recipients (except the Unified Messaging feature),
• UM Management - to be able to manage the Unified Messaging feature.

For more details, see Understanding Management Roles.

Comments

Thank you very much!
I'll try that and report back.