EV service account domain admin

[ashks2014]

Hi All,

Does the VSA need domain admin credentials? Ours is and our security team want to remove the domain admin membership.

Has anyone done this and what were the consequences?

I can see why the domain admin permissions might be needed during install or upgrade but on day-to-basis are they required?

Any advice is appreciated!

[Kai_Schröer]

Hello Ashks,

please have a look here:

https://www.veritas.com/support/en_US/article.TECH76700#Vault_Service_Account

It is recommended that the VSA not be a member of the the Domain Admins group.

Have a nice day.

Kai

[Rob_Wilcox1]

I don't know of *anyone* that gives the VSA domain admin.

[GertjanA]

Hi,

In the Installing and Configuring guide it is specifically recommended to NOT make the VSA Domain Admin. Being a Domain Admin grants (and denies) permissions which are required for the VSA to have. It most likely will mess up the archiving functionality.

So, remove VSA from Domain Admin group asap. The rerun Deployment Scanner on your EV (after you relogged on with the VSA), and verify the required permissions on SQL and Exchange (or what ever else archiving target you use) are still correct.

[ashks2014]

Thanks Guys, it's probably just a legacy thing but our security were very keen to remove the domain admin rights. This will make them happy to hear this.

[GertjanA]

Your welcome. Can you mark one of the answers as solution?

That 'closes' the question, so other users don't open it to answer, and others might have similar question, and then get the answer.

Thanks in advance!

Gertjan

[VirgilDobos]

Hi mate,

As Gertjan pointed, the Domain Admins have some deny permissions ie. deny permissions on mailboxes.

See below:

EV Service Account Permissions: https://www.veritas.com/support/en_US/article.TECH76700#Vault_Service_Account

"It is recommended that the VSA not be a member of the Enterprise Admins group, the Domain Admins group, or any other group that contains a default DENY permission on mailboxes. It is better to start with a standard domain user account and explicitly assign only the required permissions."