Local Admin

Question

We've recently had to remove the ARS svc account from the local admin of the server, but this causes the service account to fail with an access denied. If there a minimum amount of granular perms required to offset the need for a local admin? thanks!

Terrance.Crombie · Answer

The officially-supported configuration is that the Active Roles service account MUST be a member of the local Administrators group on the machine hosting the service. 
 From the ActiveRoles Server 6.9 Quick Start Guide: 
 support.software.dell.com/.../downloads 
 "The service account must be a member of the Administrators group on the computer running the Administration Service. Because of this requirement, installing the Administration Service on a domain controller effectively grants the service account administrator rights in the entire domain."