Connector Account
To deploy the AD Connector, create a new user account in the AD domain. This account should have:
- The logon name (sAMAccountName) set to Cisco_Connector. You can use a custom username, but you must configure it with the required permissions.
- Select Password never expires.
Passwords can not include backslashes, quotations (single or double), greater-than or less-than chevron brackets (< >), or colons. - Assign Read and Replicating Directory Changes permissions. Alternatively, you can make the AD Connector account a member of the built-in Enterprise Read-only Domain Controllers group, which will automatically assign these permissions.
- The AD Connector does an initial synchronization of the AD structure to Secure Access. After this, it detects changes to the AD structure and communicates these changes only. The detection of changes requires the Replicating Directory Changes permission. The AD Connector cannot function without this permission.
- The Replicating Directory Changes permission is different from the Replicating Directory Changes All permission, which enables the retrieval of password hashes. The AD Connector does not read password hashes. Thus, the AD Connector does not require the Replicating Directory Changes All permission.