Active Directory Permissions - TruU Docs

TAMS performs all AD operations under the Windows service account identity it runs as. No AD credentials are stored in the application configuration or registry. Grant this account the least privilege needed to unlock accounts — nothing more.

Minimum Required Permissions

The service account must have the following permissions granted in Active Directory:

Permission	Scope	Required For
Log on as a service	Local machine	Running the TAMS Windows Service
Read (objectClass, userPrincipalName, distinguishedName)	All user objects in the forest (via Global Catalog)	Forest-wide user lookup by UPN
Read all user properties	User objects in the target domain	Checking `IsAccountLockedOut()` status
Reset Password / Unlock User Accounts	User objects in the target domain	Unlocking the AD account (`UnlockAccount()` + `Save()`)

Recommended approach: Create a dedicated service account and delegate the “Unlock User Accounts” task using the Active Directory Delegation of Control Wizard, scoped to the specific OUs containing end-user accounts. Avoid adding the account to Account Operators or Domain Admins.

What the Service Does NOT Require

TAMS is intentionally scoped to a single privileged action. The service account does not need:

Domain Admin or Enterprise Admin rights
Write access to AD objects other than unlocking accounts
The ability to create, delete, or move AD objects
Access to password hashes or credential attributes

⌘I