Unity Accounts with Domain Admin Rights

[mgvogt11]

We are having an Audit and I need to explain why I need to log onto the server with a Domain Admin and why the Eadministrator is a Domain Admin. Can anyone point me to a paper explaining what Unity Accounts need domain admin rights.

Thank you.

[kechambe]

They don't need that level of rights. In fact the EAdministrator account should be disabled.

You can take a look at the rights that Unity does need here:

http://www.ciscounitytools.com/HelpFiles/PW403+/PWHelpPermissionsSet_ENU.htm

Rather than manually remove the rights from the account you have Unity running as I would make new accounts, run the permissions wizard against them and then change the Unity services. After that you can delete the account from AD. Make sure to never delete the Unity_servername account (you can disable it) or the Eadministrator unless you have done the following:

http://www.cisco.com/en/US/products/sw/voicesw/ps2237/products_administration_guide_chapter09186a0080080e22.html#xtocid296762

Thanks,

Keith