Domain Users replication rights

Question

We just found out our Domain Users security group has the following permissions:

Replicate Directory Changes, Replicate Directory Changes All and Replicate Directory Changes In Filtered Set

Is it safe to remove these permissions from the Domain Users and other users/groups that are not part of domain admins?

Thanks!

Answer 1

In short, yes - a non-privileged user should not have these permissions.

More at https://serverfault.com/questions/265943/what-rights-does-replicating-directory-changes-actually-grant-in-active-direct

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Hello,

 

Thank you for posting in Q&A forum.

Yes, it's safe to remove AD Replication permission from the domain Users security group. This permission is only used for AD replication purpose. You can only provide this permission to specific users or group hence they will be able to initiate AD replication when needed (For daily maintenance or issue fix).

 

To help other customers who may be facing the same issue, please don't forget to vote if the reply is helpful.

Hope this answer can help you well.

 

Best regards，

Jill Zhou