Domain Admin accout for ACS

xianglingzj · ‎05-09-2008

Hi, Everybody. Recently I am installing ACS for one of my customer who can not give me the domain administrator account to run ACS service. Anyone knows that is there any workaround for this? Thanks.

smahbub · ‎05-15-2008

It's mandatory to have the domain administrator account to run ACS service.Without domain administrator account the ACS service cannot be used.

Refer the ACS config gide in the url below:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/windows/install.html

andypalfrey · ‎07-09-2008

The doc says that BUT We have it happily running with the ACS service account as a member of "domain users" only, membership of the local admins group on the ACS server(s) and additional user rights granted via GPO - "log on as a service", "log on as a batch job", "act as part of the operating system" - It all depends on the DACLs set on AD - the ACS account needs to be able to bind to AD and read attributes.

Regards

Andy