Configuring Active Directory security permissions

When integrating ThoughtFarmer with Active Directory (AD) using the Employee Directory Connector (EDC), you can configure directory security permissions using either a simple or an advanced configuration model.

Simple configuration (Recommended)

The simple configuration grants general read and write access across your Active Directory environment to the designated AD synchronization service account.

• Best for: Organizations that prefer a straightforward setup without custom Object Level permissions or container-level security restrictions.

• Requirement: Assign the AD synchronization service account standard read/write permissions to the relevant Organizational Units (OUs) housing your users and groups.

Advanced configuration

If your organization's security policy requires granting the absolute minimum permissions necessary, use the advanced configuration model to restrict the service account's scope.

Assign baseline read permissions

Add the AD synchronization service account as a member of the Domain Users group. By default, membership in Domain Users grants read-only access across the Active Directory domain

Delegate write permissions for distribution groups

To allow ThoughtFarmer to manage distribution group memberships, delegate permissions on the specific Active Directory container housing your groups:

1. Launch the Group Policy Management Console on your Windows Server management host.

2. Locate and right-click the Active Directory Container housing your organization's distribution groups. (Note: Depending on your domain architecture, groups may reside across multiple OUs).

3. Select the Delegation tab, then click Advanced.

4. In the advanced security settings dialog, click Advanced again.

5. Click Add, search for, and select your AD Synchronization Service Account.

6. In the Apply onto scope dropdown, select This object and all child objects.

7. In the permissions list, check the box to grant Write All Properties.

8. Click Apply, then click OK to save the permission changes.

Writing to user profile fields

If you also plan to sync profile updates from ThoughtFarmer back to employee profiles in Active Directory, you must repeat Step 2 to grant Write All Properties on every Organizational Unit (OU) container that stores user accounts.

Infrastructure environment note

The Group Policy Management Console is an installable feature within Windows Server management tools. Ensure the Remote Server Administration Tools (RSAT) suite is enabled on your domain management host before proceeding.