Locking down AGPM fit for least privilege

AGPM Least Privilege Scenario

Ask the Directory Services Team — Tue, 16 Dec 2008 18:58:44 GMT

Mike here again. A customer recently asked how they should configure their Advanced Group Policy Management

Locking down AGPM for least privilege

Group Policy Team Blog — Fri, 12 Dec 2008 20:34:01 GMT

I actually wrote this post awhile ago on my blog and forgot to cross post this to the GP blog. Bad me...though

re: Locking down AGPM fit for least privilege

Michael Kleef [AppSense] — Fri, 28 Nov 2008 23:20:33 GMT

I have a caveat to this. These are the correct permissions to give it and everything works correctly though we have noticed a bug in deletion of a GPO that indicates in the progress UI the deletion failed when in fact it actually succeeds. We are investigating this bug.

There are two workarounds:

1. Revert back to using Domain Admins for the service account

2. Ignore this error in this least privilege configuration

I will report back if we find anything of further concern though we havent yet.

re: Locking down AGPM fit for least privilege

Nick Thompson — Fri, 28 Nov 2008 20:57:10 GMT

Hurrah.. we've been wondering what rights to give our Service Account.