Connect Active Directory

Nothing has to be set up in Active Directory beyond read access. The agent finds the domain controller through DNS and authenticates with the account its service runs under.

Authentication

The connection runs over LDAPS on port 636, authentication over Kerberos. On a member server the enterprise CA certificate is already in the machine store, so trust is established without any extra step. No password is stored anywhere, neither on the server nor in Conbool.

A group managed service account works as the service account, as does an ordinary service account with read access. If the service runs as local system, it authenticates with the computer account of the server, and the rights have to sit there.

Read access

The agent reads user objects in the parts of the directory named by the scope. Ordinary read access is enough. Passwords, password hashes and confidential attributes are not read.

Two optional replication rights

For incremental sync the agent uses DirSync. After the first full pass it then reads only what has changed since, and learns about deletions in the process. This requires two rights at the domain head:

DS-Replication-Get-Changes DS-Replication-Get-Changes-In-Filtered-Set

DS-Replication-Get-Changes-All is not required. That is the right which allows password data to be read from the directory, which is exactly why it is not listed here.

Missing those two rights is not an error. The agent then runs without DirSync and reconciles the complete set on every run. Changes and new accounts still arrive, deletions surface at the full reconciliation instead of immediately.

Recycle bin

With read access to CN=Deleted Objects the agent recognises deleted accounts directly during incremental sync. Without it, deletions stay invisible until the next full reconciliation.

Preflight

Before installation preflight checks each point and reports what is missing: reachability of the domain controller, encryption, authentication, read access, replication rights and recycle bin. Missing replication rights appear as a note, not as an error.

Which accounts are taken over

User objects with an email address are taken over. Accounts without an address are skipped, because Conbool identifies people by their address. Disabled accounts are recognised and kept marked as disabled, so they stay findable in archive search and in evidence.

Further addresses of a person come along from proxyAddresses. Signatures, licences and policies therefore also apply when somebody sends under a secondary address.

Whether a mailbox is a shared mailbox is decided by the rule chosen in the scope. With local Exchange the corresponding directory attribute can be evaluated. Without local Exchange the directory carries no such attribute, so one of the other rules belongs there, otherwise every shared mailbox takes a seat.