It is recommended to set up a separate user account to use for connecting to Active Directory through for Active Roles. Use Active Roles Access Templates for the configuration. By using access templates, you delegate administration-relevant permissions to an Active Directory user account but without issuing the permissions directly in Active Directory. For more information about Active Roles Access Templates, see your One Identity Active Roles documentation.

The following Access Templates are suggested for delegating permissions:

• All Objects - Read All Properties

• All Objects - Full Control

Starling CertAccess Agent works without controlling Active Roles workflows. To avoid any existing Active Roles workflows, you must add the user account to the Active Roles administrators group.

• Up to and including Active Roles version 6.9, the administrative group is created during installation of Active Roles. The name of the group is saved in the registry database under:

  • Registration key: HKEY_Local_Machine\Software\Aelita\Enterprise Directory Manager

  • Value: DSAdministrators

• As from Active Roles version 7.0, you edit the Active Roles Admins in the Active Roles Configuration Center. If a user account is entered in the Active Roles Configuration Center as an Active Roles Admin, this use account must be used. For more information about editing the group or the user account for administrative access, see your One Identity Active Roles documentation.