Active Directory Service Account for RSA G&L

RSA Governance and Lifecycle (G&L) connects to Active Directory using a dedicated service account. G&L authenticates with a username and password (LDAP simple bind), so the account must be a standard AD user account, not a group-managed service account (gMSA).

Before you start: Decide what G&L needs to do in Active Directory.

If G&L needs to...	Use this scenario
Read user data for collection only	Scenario 1: Read-Only
Create, update, or delete users and manage group membership	Scenario 2: Read/Write

---

Step 1: Create the Service Account

This step is the same for both scenarios. Create the account first, then follow the scenario that applies to your deployment.

Active Directory Users and Computers (ADUC) is the standard tool for managing users in Active Directory. Open it from Start > Administrative Tools > Active Directory Users and Computers, or by running dsa.msc.

tip

Create service accounts in a dedicated Organizational Unit (OU), which is a folder-like container in Active Directory, to keep them separate from regular user accounts. For example: OU=ServiceAccounts,DC=example,DC=com.

1. Open Active Directory Users and Computers.

2. In the left panel, expand your domain and navigate to the OU where you want to create the account.

3. Right-click the OU and select New > User.

4. Fill in the following fields:

   Field	Value
   First Name / Last Name	A name that identifies the service, for example RSA GL
   User Logon Name	Follow your organization's naming convention, for example svc_rsa_gl

5. Click Next.

6. Set a strong password and apply these settings:

   • Check Password never expires
   • Uncheck User must change password at next logon

7. Click Next, then Finish.

8. Right-click the new account, select Properties, go to the General tab, and add a Description such as RSA G&L service account - owned by IAM team.

---

Scenario 1: Read-Only Service Account

Use this scenario when RSA G&L only needs to read user data from Active Directory, for example to run collectors that pull account information into G&L without making any changes.

You can grant the required permissions in two ways:

• Option A: Delegation of Control Wizard. A built-in wizard with a simpler interface. Recommended if you are not familiar with advanced security settings.
• Option B: Advanced Security. Manual permission entries that give you precise control over what the account can access.

Both options produce the same result for a read-only account. Use whichever you are more comfortable with.

Option A: Delegation of Control Wizard

1. In Active Directory Users and Computers, right-click the domain root or the target OU where user accounts are stored and select Delegate Control.
2. Click Next.
3. Click Add, search for and select the service account (svc_rsa_gl), and click OK.
4. Click Next.
5. Select Read all user information from the task list.
6. Click Next, then Finish.

Option B: Advanced Security

info

The Security tab is not shown in ADUC by default. To enable it, click View > Advanced Features in the ADUC menu bar before proceeding.

1. In Active Directory Users and Computers, right-click the domain root or the target OU and select Properties.
2. Go to the Security tab and click Advanced.
3. In the Advanced Security Settings window, click Add.
4. Click Select a principal, type the service account name (svc_rsa_gl), and click OK.
5. In the permission entry, set Applies to to Descendant User objects and check Read all properties.
6. Click OK to save.

---

Scenario 2: Read/Write Service Account

Use this scenario when RSA G&L needs to provision accounts in Active Directory, for example to create users, update attributes, disable or delete accounts, or manage group membership.

For write operations, use Advanced Security. The Delegation of Control Wizard does not offer enough granularity to restrict write permissions to specific attributes.

info

The Security tab is not shown in ADUC by default. To enable it, click View > Advanced Features in the ADUC menu bar before proceeding.

1. In Active Directory Users and Computers, right-click the domain root or the target OU and select Properties.

2. Go to the Security tab and click Advanced.

3. In the Advanced Security Settings window, click Add for each of the following permission entries.

   Entry 1: Read access across the scope

   Setting	Value
   Principal	svc_rsa_gl
   Applies to	This object and all descendant objects
   Permissions	Read all properties

   Click OK, then click Add again for the next entry.

   Entry 2: Create, update, and delete user accounts

   Setting	Value
   Principal	svc_rsa_gl
   Applies to	Descendant User objects
   Permissions	Read all properties, Write all properties, Create User objects, Delete User objects

   Click OK, then click Add again for the next entry.

   Entry 3: Manage group membership

   Setting	Value
   Principal	svc_rsa_gl
   Applies to	Descendant Group objects
   Permissions	Read all properties, Write Members

   Click OK.

4. Click OK to close the Advanced Security Settings window, then click OK to close Properties.

note

Write Members controls the ability to add or remove users from a group. It writes to the member attribute on Group objects. This is more restrictive than granting full write access to all group properties.