third party log-agent on domaincontroller

Question

Hello, we wanted to install in log-agent (wazuh / graylog / etc) on a domaincontroller (centrally managed) for IT-security-department If we do this, the administrator of management - tool (it-security-department) is also a domain-Administrator. Is it possible to do this only with read-rights? I am the Domain-Admin what is Microsoft best practice in this case?

Answer 1

Hi @Tangoball76

You cannot install agent on a domain controller with only read permission. On member server you have to use a local admin account but on domain controller there is no local administrator

If you want install the agent on domain controller , you have to use a admin account member of domain administrators group.

In this case, you have to ask a admin alreday member of domain admins or administrators group to install the agent.

Microsoft recommend to not install 3^rd party applications on DCs and limit the use of Domain Admin privileges as mentioned in this Microsoft article : Updating best practices for Domain Controllers

You should discuss with your security team if you can avoid to install this agent on all your domain controller in order to respect Microsoft best practise.

---

Please don't forget to accept helpful answer