Minimum permissions to perform a Active Directory Discovery (4216607)

An Active Directory Discovery can be performed with any active account of the domain as the AD Discovery needs only READ permissions on the domain structure i.e any account member of 'Domain Users'.

If you require the Discovery to collect on AD object permissions, the account running the discovery needs to have the Read Control right (ADS_RIGHT_DS_CONTROL_ACCESS) in AD. It is recommended to use a Domain Admin account as Domain Admins have this right by default on all objects in AD.