| Summary: | Clarify the perms required on the Windows side for winsync to work | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Deon Ballard <dlackey> |
| Component: | doc-Identity_Management_Guide | Assignee: | Deon Ballard <dlackey> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | ecs-bugs |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.2 | CC: | lars, pkennedy |
| Target Milestone: | rc | Keywords: | Documentation |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-12-12 19:15:31 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Deon Ballard
2011-10-25 19:58:37 UTC
This popped up on the #freeipa channel (hat tip, Lars Sjöström), and it sounds good. "Add the AD sync user to the AD domain (with adsiedit.msc) and allow the user to do "Replicating directory changes" instead of using the Enterprise Read-only domain controller role." Also from the channel... "If you're about to perform a winsync the AD-binduser account can be memberof "Account Operator" as well as "Enterprise Read-Only Domain controller" .. no need to be full "Domain Admin"." |