The Active Directory User configured for Windows Discovery needs which permission(s) or membership?

The user account configured for Windows Discovery in CyberArk performs a scan of the Active Directory environment to identify computer objects. This is a read-only operation that queries the directory service. To adhere to the principle of least privilege, the discovery user only requires permissions to read the directory. Standard "Domain User" accounts in Active Directory possess sufficient read permissions by default to enumerate objects within the domain, making them suitable for this task without granting excessive privileges.

A. Domain Admin membership grants excessive privileges, including write and delete capabilities, which are unnecessary and a security risk for a discovery-only account.

B. There is no standard, built-in "LDAP Admin Group" in Active Directory, and administrative-level permissions are not required for discovery.

C. Write permissions are not needed for the discovery process, which only reads information from Active Directory, not modifies it.

1. CyberArk Privileged Access Manager - Self-Hosted Documentation (Version 14.0). Section: Administration > Managing automatic onboarding and discovery > Discovery and onboarding processes > Windows discovery. Under the subsection "Permissions for the discovery user

" it states

"The discovery user requires read permissions for the domains that will be scanned. By default

a domain user has read permissions for the domain."

2. CyberArk Privileged Access Manager - Self-Hosted Documentation (Version 13.2). Section: Installation > Post-Installation > Accounts Discovery > Configure accounts discovery > Windows discovery. The "Permissions for the discovery user" section specifies

"The discovery user requires read permissions for the domains that will be scanned."