Return
-
Title
Do the Active Roles Administration Service or Active Roles Synchronization Service service accounts require interactive logon rights? -
Description
Do the Active Roles Administration Service or Active Roles Synchronization Service service accounts or domain management/connection management accounts require the following permissions:
- Allow log on locally
- Allow log on through Terminal Services
- Allow log on through Remote Desktop Services
-
Cause
No. Expected Active Roles functionality does not require an interactive logon. -
Resolution
These permissions can be revoked via GPO or in the local security policy of the Active Roles Administration Service or Active Roles Synchronization Service host without negatively impacting expected Active Roles functionality.