Skip to main content

Active Directory

For an on-premises deployment, three separate Active Directory service accounts must be provided.

1. Read-Only Account

This account is used to query LDAP for information about users and groups.

  • Role:Read-Only.

  • Function: Retrieves user and group information via the LDAP (or LDAPS) protocol.

  • Required Permissions: Must have the necessary rights to search for and read user attributes in the Active Directory directory.

  • Location in the application: The credentials for this account will be configured in the Medulla configuration file (information requested in the delivery form).

2. Machine Enrollment Account (Imaging/Mastering)

This account is dedicated to provisioning and registering new machines in the domain during the imaging (or mastering) process.

  • Role: Rights to enroll machines in the domain.

  • Function: Enables the addition of computers to the Active Directory domain.

  • Required Permissions: Must have the "Add workstations to the domain" permission .

  • Integration into the process: This account will be integrated and used bySysprep to perform the domain join operation during machine mastering.

3. Script Execution Account (Medulla Agent Installation)

This account is required for post-deployment administration tasks, specifically forthe remote installation of the Medulla agent via PowerShell, targeting a defined Organizational Unit (OU).

  • Role: List computers in Active Directory and run PowerShell scripts remotely with delegated permissions.

  • Function: List computers in Active Directory. Install and configure the Medulla agent on workstations, targeting machines in a specific OU.

  • Required Permissions:

    • Delegated Permissions on the Target OU: Must have permissions to modify Computer objects and permissions to execute remote commands (via WinRM or an equivalent solution) on machines in the specified OU.

    • Access to the network share: If the Medulla agent script or installer is stored on a network share, the account must have read permissions on that share.

    • List AD computers: Musthave permission to list AD computers in order to select the computers on which the agent should be installed.

  • Usage: This account will be used by the Python application to initiate and validate the execution of PowerShell scripts on the machines, ensuring that the agent is installed and that the machine is correctly assigned to the appropriate OU structure.

Back to top