Connector Account
To deploy the Connector, create a new user account in the AD domain. This account should have:
- The logon name (sAMAccountName) set to Cisco_Connector. You can use a custom username, but you must configure it with the required permissions.
- Select
Password never expires.
Passwords can not include backslashes, quotations (single or double), greater-than or less-than chevron brackets (< >), or colons. - Assign
ReadandReplicating Directory Changespermissions. Alternatively, you can make the Connector account a member of the built-inEnterprise Read-only Domain Controllersgroup which will automatically assign these permissions.
The Connector does an initial synchronization of the AD structure to Secure Access. After this, it detects changes to the AD structure and communicates these changes only. The detection of changes requires theReplicating Directory Changespermission, so the Connector cannot function without this permission. TheReplicating Directory Changespermission is different from theReplicating Directory Changes Allpermission which enables the retrieval of password hashes. The Connector does not read password hashes and hence does not require theReplicating Directory Changes Allpermission.