topic Re: do we need domain admin rights for the service account in Identity awareness in Firewall and Security Management

do we need domain admin rights for the service account in Identity awareness

tavi0906 — Thu, 07 Dec 2023 01:47:39 GMT

do we need domain admin rights for the service account in Identity awareness

Re: do we need domain admin rights for the service account in Identity awareness

Chris_Atkinson — Thu, 07 Dec 2023 02:05:34 GMT

Please explore Identity Collector further as the preferred method.

Identity Collector - Requirements (checkpoint.com)

Re: do we need domain admin rights for the service account in Identity awareness

the_rock — Thu, 07 Dec 2023 02:05:39 GMT

Im fairly sure you do. Though below sk, if you can make it work, should suffice, but I was never able to get it going, even with TAC on the phone.

Andy

https://support.checkpoint.com/results/sk/sk93938

Re: do we need domain admin rights for the service account in Identity awareness

cassiomaciel — Thu, 07 Dec 2023 13:48:00 GMT

@tavi0906 you can use the sk93938 mentioned by @the_rock .

I'm using ad query in my enviroment and it's working properly.

You must configure the permissions for the service account in all ad servers, it's not necessary be a domain admin.

Re: do we need domain admin rights for the service account in Identity awareness

the_rock — Thu, 07 Dec 2023 14:50:46 GMT

If you got that sk going, then it sefinitely would work : - )

I dont know, I was never able to succeed at it, even with TAC help.

Andy

Re: do we need domain admin rights for the service account in Identity awareness

tavi0906 — Thu, 21 Dec 2023 02:59:41 GMT

why do we need the domain admin rights for service account ? any reason ?

Re: do we need domain admin rights for the service account in Identity awareness

Alex- — Thu, 21 Dec 2023 06:42:49 GMT

It is not if you use the Identity Collector, and you should, as per the documentation that @Chris_Atkinson shared:

Requirements for Integration with Active Directory Windows Server must connect to the Active Directory (AD) domain controllers of the organization with DNS, LDAP, and DCOM. The Identity Collector requires an Active Directory (AD) user that belongs to the default Event Log Readers group. Note - An administrative role is not required for this user.

Re: do we need domain admin rights for the service account in Identity awareness

the_rock — Thu, 21 Dec 2023 11:50:39 GMT

According to the sk we shared, you do not need an account with admin right, but as I said, I tried this with few different clients (TAC was on the phone every time) and we could never get it working. Clearly, we missed something... : - )

Andy

Re: do we need domain admin rights for the service account in Identity awareness

Vincent_Bacher — Thu, 21 Dec 2023 12:22:37 GMT

You are talking about LDAP AU or something different?
For LDAP AU admin permissions are not required.