Return
-
Title
Minimal permissions needed for the database user group and web service account -
Description
Minimal permissions needed for Privilege Manager for Windows database user groups and web service accounts. -
Cause
Although we generally recommend for the Super User Group and Web service accounts to have Domain Admin rights, some environments need to limit use of Domain Admins in their environment.
-
Resolution
The account to use for the web service account must be a "domain user" windows active directory account with "local admin" rights on the machine that Privilege Manager for Windows is installed on. This is needed since it is used to run a Windows service.
The same Windows account will also need to be added to the Privilege Manager for Windows target database, and have the proper SQL permissions needed by the service to update the database.These are "db_owner" and "System Administrator (sysadmin)" server roles within SQL.For any additional questions or concerns, please Contact Support for assistance.