-
Titre
Does Active Administrator support the AA service account and AA Console user accounts being a member of the Protected Users group? -
Description
Is it supported to add the Active Administrator Service account and AA Console user accounts to the Protected Users group in Active Directory? -
Résolution
It is Not supported to have the AA service account as a member of the Protected Users group. There are inherit restrictions placed on the Protected Users group and are intentionally not configurable. These restrictions can interfere with operation of AA and its agents. In addition, as per the following Microsoft document, service accounts should never be members of the Protected Users group:
https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group
Also, users running AA console are either Domain Admins, or highly permissioned users in the AD environment so that they may execute administrative operations, and we recommend that those users not be placed in the Protected Users group.