Active Administrator 8.7 - Installation Guide

Table 12. Required permissions for the Active Directory Health module
Submodule	Console user account	AFS account
Active Directory Health Landing Page	Must have the Active Administrator Active Directory Health Analyzer role.	Must be a member of the AA_Users group.
Analyzer	Must have the Active Administrator Active Directory Health Analyzer role.	N/A
Alerts	Must have the Active Administrator Active Directory Health Analyzer role. To manage notifications, must have the Active Administrator Active Directory Health Notification Management role.	Must be a member of the AA_Users group. Must have read/write access to the DACache folder in the Active Administrator share.
Agents	To manage agents, must have the Active Administrator Active Directory Health Agent Management role. To manage notifications, must have the Active Administrator Active Directory Health Notification Management role. to manage data collectors, must have the Active Administrator Active Directory Health Data Collector Management role. To manage alerts, must have the Active Administrator Active Directory Health Alert Management role. To manage agents, must have the Active Administrator Active Directory Health Agent Management role.	To install, edit, and remove agents, must be a member of the AA_Admins group and have full control access to the target server. To update alerts and collectors, and to manage notifications, must have read/write access to the DACache folder in the Active Administrator share. NOTE: For the specific permissions required for each data collector, see Appendix A in the Quest® Active Administrator® User Guide or online help.
Troubleshooter	Must have the Active Administrator Active Directory Health Troubleshooter role. To view reports or perform troubleshooting operations, must have WMI remote access enabled and be a member of the Distributed COM users group. To run jobs, must have full control access to the target server.	N/A
Diagnostic Console	To collect performance counter values, must be a member of the local administrator group on the target domain controller.	N/A

Active Administrator Data Services (ADS) requirements

Table 13. Required permissions for Active Administrator Data Services (ADS)
Subsystem	ADS account
Loader	Must be a member of the AA_Users group and have read access to the enterprise.
Data Collectors	See the data collector permissions for forests, domains, and sites in Appendix A of the Quest® Active Administrator® User Guide or online help.
Agent Monitor and Recovery	Must have full access on the server where the Active Directory Health Analyzer agent is installed.