DRA Administration Server and Web Console requirements

Domain Access Account: Using ADSI Edit, grant the Domain Access account the following Active Directory Permissions at the top domain level:

1. Launch ADSI Edit.

2. Select the domain node (DC=<Domain_Name>,DC=/?), right-click and select Properties.

3. Click Security > Advanced > Permissions.

4. Select the domain access account and click Edit.

5. Ensure that the Type list is set to Allow.

6. In the Applies to list, select Descendant builtInDomain objects.

7. Under Permissions, select the Full Control check box.

8. Repeat steps 6-7, and provide Full control for the following descendant objects:

   • Descendant Computer objects

   • Descendant Connection Point objects

   • Descendant Contact objects

   • Descendant Container objects

   • Descendant Group objects

   • Descendant InetOrgPerson objects

   • Descendant MsExchDynamicDistributionList objects

   • Descendant MsExchSystemObjectsContainer objects

   • Descendant msDS-GroupManagedServiceAccount objects

   • Descendant Organizational Unit objects

   • Descendant Printer objects

   • Descendant publicFolder objects

   • Descendant Shared Folder objects

   • Descendant User objects

9. With the Type list set to Allow, select This object and all descendant objects from the Applies to list.

10. Under Permissions, select the following check boxes:

    • Create Computer objects

    • Delete Computer objects

    • Create Contact objects

    • Delete Contact objects

    • Create Container objects

    • Delete Container objects

    • Create Group objects

    • Delete Group objects

    • Delete InetOrgPerson objects

    • Create MsExchDynamicDistributionList objects

    • Delete MsExchDynamicDistributionList objects

    • Create msDS-GroupManagedServiceAccount objects

    • Delete msDS-GroupManagedServiceAccount objects

    • Create Organizational Unit objects

    • Delete Organizational Unit objects

    • Create publicFolders objects

    • Delete publicFolders objects

    • Create Shared Folder objects

    • Delete Shared Folder objects

    • Create User objects

    • Delete User objects

    • Create Printer objects

    • Delete Printer objects

11. Click OK.

1. Launch ADSI Edit (adsiedit.msc).

2. In the left navigation pane, right-click ADSI Edit and choose Connect to.

3. Select Configuration as the well-known Naming Context, then click OK.

4. Expand the Configuration node. (CN=Configuration,DC=<Domain_Name>,DC=/?).

5. Navigate to CN=services -> CN=Microsoft Exchange.

6. Right-click CN=Microsoft Exchange and select Properties.

7. Click Security>Advanced>Permissions.

8. Locate the domain access account then click Edit.

9. Confirm that the Type list is set to Allow.

10. In the Applies to list, select Descendant objects.

11. Under Permissions, select List Contents, Read all Properties and Read Permissions check box.

12. Click OK and then Apply.

Exchange Access Account: To manage on-premises Microsoft Exchange objects, assign the Organizational Management role to the Exchange Access Account and the Exchange Access Account to the Account Operators group.

Public Folder Access Account: Assign the following Active Directory permissions to the Public Folder Access Account:

• Public Folder Management

• Mail Enabled Public Folders

Microsoft Entra Tenant: Basic authentication requires Microsoft Entra ID permissions on both the Microsoft Entra Tenant Access Account and the Entra ID application. Certificate-based authentication requires Microsoft Entra ID permissions on the Entra ID application. By default, DRA automatically creates a self-signed certificate required for authentication.

Roles:

• User administrator

• Exchange administrator

Permissions:

• Application.ReadWrite.All - Read and write all applications

• AuditLog.Read.All - Read all audit log data

• Directory.Read.All -Read directory data

• Group.ReadWrite.All - Read and write all groups

• User.ReadWrite.All - Read and writer all user’s full profiles

• Exchange.ManageAsApp - Manage Exchange As application

• Distribution Groups

• Mail Recipients

• Mail Recipient Creation

• Security Group Creation and Membership

• (Optional) Skype for Business Administrator

  If you want to manage Skype for Business Online, assign the Skype for Business Administrator power to the Microsoft Entra Tenant access account.

• User Administrator

• Privileged authentication administrator

Administration Service Account Permissions:

• Local Administrators

• Grant the least privilege override account “Full Permission” on share folders or DFS folders where Home directories are provisioned.

• Resource Management: To manage published resources within a managed Active Directory domain, the Domain Access account must be granted local administration permissions on those resources.

Post DRA installation: You must run the following commands before you manage the required domains:

• To delegate permission to the “Deleted Objects Container” from the DRA Installation folder (Note: the command must be executed by a domain administrator):

  DraDelObjsUtil.exe /domain:<NetbiosDomainName> /delegate:<Account Name>

• To delegate permission to the “NetIQRecycleBin OU” from the DRA Installation folder:

  DraRecycleBinUtil.exe /domain:<NetbiosDomainName> /delegate:<AccountName>

Remote Access to SAM: Assign Domain Controllers or member servers managed by DRA to enable the accounts listed in the GPO setting below, so they can make remote queries to the Security Account Manager's (SAM) database. The configuration needs to include the DRA service account.

1. Open the Group Policy Management console on the domain controller.

2. Expand Domains > [domain controller] > Group Policy Objects in the node tree.

3. Right-click Default Domain Controllers Policy and select Edit to open the GPO editor for this policy.

4. Expand Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies in the node tree of the GPO editor.

5. Double-click Network access: Restrict clients allowed to make remote calls to SAM in the policies pane, and select Define this policy setting.

6. Click Edit Security and enable Allow for Remote Access. Add the DRA service account if it is not already included as a user or part of the administrators group.

7. Apply the changes. This will add the security descriptor, O:BAG:BAD:(A;;RC;;;BA) to the policy settings.