ITOps AI: On-Prem AD & Exchange Prerequisites

Purpose: This document defines the required permissions for the 'beaksvc' service account to execute automated IT operations through the Beak ITOps agent using UI-based provisioning steps.

---

Executive Summary

This document outlines the prerequisites and required permissions for the beaksvc service account to execute automated IT operations managed by the Beak ITOps agent. The service account will be granted delegated permissions in on-premises Active Directory and Exchange Server 2016/2019 to perform user lifecycle management, group management, computer administration, and mailbox operations.

All provisioning steps are provided using native UI interfaces with two delegation approaches:

• Delegation of Control Wizard – simpler, task-based delegation
• Advanced Permissions Tab – granular ACL configuration (including List Contents)

The configuration is designed according to the principle of least privilege while ensuring the Beak ITOps agent can reliably discover and manage objects.

Key Automation Capabilities:

• User account lifecycle management (create, disable, delete, unlock, password reset)
• Group membership and distribution list management
• Computer organizational unit transitions
• AD attribute synchronization and policy enforcement
• Exchange Server mailbox provisioning and delegation management
• Printer and peripheral configuration management

---

1. Service Account Configuration

1.1 Account Details

Attribute	Value
Account Name	beaksvc
Account Type	Service Account (Domain User)
Location OU	CN=beaksvc,OU=Service Accounts,DC=domain,DC=com
Password Policy	Non-expiring (recommended for service accounts)
Account Options	Enabled, Password never expires, Cannot change password
Email Address	beaksvc@domain.com (required for Exchange permissions)

1.2 Service Account Creation Steps (UI - Active Directory Users and Computers)

Step 1: Open Active Directory Users and Computers

1. On a Domain Controller or administrative workstation with Active Directory Users and Computers installed
2. Open "Active Directory Users and Computers"
3. Navigate to the Service Accounts OU (or desired OU for service accounts)

Step 2: Create the User Account

1. Right-click on the Service Accounts OU
2. Select New > User
3. In the "New Object – User" dialog:
   • First name: (leave blank or use "Beak")
   • Last name: (leave blank or use "Service")
   • Full name: beaksvc
   • User logon name: beaksvc
   • User logon name (pre-Windows 2000): DOMAIN\beaksvc
4. Click Next

Step 3: Set Password

1. In the password dialog:
   • Password: Enter a strong password (minimum 16 characters, mix of uppercase, lowercase, numbers, special characters)
   • Confirm password: Re-enter the password
   • Check Password never expires
   • Check User cannot change password
   • Uncheck User must change password at next logon
2. Click Next

Step 4: Confirm and Finish

1. Review the settings
2. Click Finish

1.3 Configure Exchange Mailbox for Service Account (UI - Exchange Admin Center)

Prerequisites: Exchange Server 2016 or 2019 must be installed

Step 1: Connect to Exchange Admin Center

1. Open a web browser
2. Navigate to https://exchangeserver.domain.com/ecp (replace exchangeserver.domain.com with your actual server)
3. Log in with an account that has Exchange administrator permissions

Step 2: Enable Mailbox for beaksvc

1. In the EAC, click Recipients in the feature pane
2. Click the Mailboxes tab
3. Click New (+ icon)
4. Select User Mailbox
5. In the "New User Mailbox" dialog:
   • User type: New User
   • First name: Beak
   • Last name: Service
   • Display name: beaksvc (Service Account)
   • Name: beaksvc
   • Alias: beaksvc
   • Email address: beaksvc@domain.com
   • Check Active Directory user already exists
   • Click Browse and select the beaksvc user account created in Active Directory
6. Click Next
7. Select the mailbox database where the mailbox should be stored
8. Click New to create the mailbox

Step 3: Verify Mailbox Creation

1. Navigate to Recipients > Mailboxes
2. Search for "beaksvc"
3. Verify the mailbox appears in the list and status is "Enabled"

1.4 Security Configuration

Disable Interactive Logon (via Group Policy)

1. Open Group Policy Editor on a domain-connected workstation
2. Navigate to: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
3. Open "Deny log on locally"
4. Add the beaksvc account to this policy
5. Do the same for "Deny log on through Remote Desktop Services"

Document Secure Storage

1. Store the beaksvc password in a secure credential vault (e.g., Thycotic Secret Server, HashiCorp Vault, Azure Key Vault)
2. Document:
   • Service account creation date
   • Initial password (encrypted storage only)
   • Password rotation schedule
   • Service account purpose and approver

---

2. Active Directory Permissions

2.1 User Management Permissions

Required Permissions Table

Operation	Scope	Permissions Needed
Create User Accounts	Target OU(s)	Create User objects
Delete User Accounts	Target OU(s)	Delete User objects
Unlock User Account	Target OU(s)	Reset Password
Reset User Password	Target OU(s)	Reset Password
Force Password Change	Target OU(s)	Write to pwdLastSet
Disable User Account	Target OU(s)	Write to userAccountControl

UI Steps: Delegate User Management Permissions

Step 1: Open Active Directory Users and Computers

1. On a Domain Controller or administrative workstation
2. Open "Active Directory Users and Computers"
3. Navigate to the OU containing user objects (e.g., CN=Users or custom Users OU)

Step 2: Initiate Delegation Wizard

1. Right-click on the target OU containing users
2. Select Delegate Control...
3. The "Delegation of Control Wizard" opens

Step 3: Select User/Group to Delegate To

1. Click Next (after wizard introduction)
2. Click Add...
3. In the "Select Users, Computers, or Groups" dialog:
   • Type: beaksvc
   • Click Check Names
   • Verify the name resolves to DOMAIN\beaksvc
4. Click OK
5. Click Next

Step 4: Select Tasks to Delegate - Password Reset

1. On the "Tasks to Delegate" page, select Create a custom task to delegate
2. Click Next
3. In "Active Directory Object Type" dialog:
   • Select Only the following objects in the folder
   • Check User objects
4. Click Next
5. In "Permissions" dialog:
   • Check General section:
     • ☑ Reset Password
   • Check Property-Specific section:
     • ☑ Read lockoutTime (for reading current lock status)
     • ☑ Write lockoutTime (for unlocking accounts)
     • ☑ Read pwdLastSet (for checking password age)
     • ☑ Write pwdLastSet (for forcing password change)
6. Click Next
7. Review the delegation summary
8. Click Finish

Step 5: Add User Enable/Disable Permissions

1. Repeat steps 1-3 above
2. At "Tasks to Delegate" page, select Create a custom task to delegate
3. Click Next
4. Select Only the following objects in the folder and check User objects
5. Click Next
6. In "Permissions" dialog:
   • Under Property-Specific:
     • ☑ Write userAccountControl (allows enable/disable operations)
7. Click Next
8. Click Finish

Step 6: Add User Creation/Deletion Permissions

1. Repeat steps 1-3 above
2. At "Tasks to Delegate" page, select Create a custom task to delegate
3. Click Next
4. In "Active Directory Object Type" dialog:
   • Select This folder, existing objects in this folder, and creation of new objects in this folder
5. Click Next
6. In "Permissions" dialog:
   • Check Creation/deletion of specific child objects:
     • ☑ User (this allows creation and deletion of user objects)
7. Click Next
8. Click Finish

2.2 Group Management Permissions

UI Steps: Delegate Group Management Permissions

Step 1: Open Active Directory Users and Computers

1. Navigate to the OU containing group objects (e.g., CN=Groups OU)
2. Right-click on the Groups OU
3. Select Delegate Control...

Step 2: Select User/Group to Delegate To

1. Click Next
2. Click Add...
3. Type: beaksvc
4. Click Check Names and verify
5. Click OK > Next

Step 3: Delegate Group Membership Modification

1. Select Modify the membership of a group
2. Click Next
3. Review the confirmation
4. Click Finish

This permission allows beaksvc to add/remove members to/from existing groups.

Step 4: Add Group Creation Permissions

1. Right-click on the Groups OU again
2. Select Delegate Control...
3. Click Next
4. Click Add... > Type beaksvc > Check Names > OK > Next
5. Select Create a custom task to delegate
6. Click Next
7. Select This folder, existing objects in this folder, and creation of new objects in this folder
8. Click Next
9. In "Permissions" dialog:
   • Check Creation/deletion of specific child objects:
     • ☑ Group (allows creating and deleting groups)
10. Click Next > Finish

2.3 Computer Management Permissions

UI Steps: Delegate Computer Management Permissions

Step 1: Navigate to Computer OU

1. Open Active Directory Users and Computers
2. Navigate to the OU containing computer objects (e.g., Computers OU or Workstations OU)
3. Right-click on the Computers OU
4. Select Delegate Control...

Step 2: Add beaksvc

1. Click Next
2. Click Add... > Type beaksvc > Check Names > OK > Next

Step 3: Delegate Computer Management Tasks

1. Select Create a custom task to delegate
2. Click Next
3. Select Only the following objects in the folder
4. Check Computer objects
5. Click Next
6. In "Permissions" dialog:
   • Check General:
     • ☑ Write all properties (this allows moving computers between OUs)
7. Click Next > Finish

This allows beaksvc to move computers to different organizational units.

2.4 Attribute Synchronization Permissions

UI Steps: Delegate Attribute Write Permissions

Step 1: Navigate to Users OU

1. Open Active Directory Users and Computers
2. Right-click on the Users OU
3. Select Delegate Control...

Step 2: Add beaksvc

1. Click Next
2. Click Add... > Type beaksvc > Check Names > OK > Next

Step 3: Delegate Specific Attribute Permissions

1. Select Create a custom task to delegate
2. Click Next
3. Select Only the following objects in the folder
4. Check User objects
5. Click Next
6. In "Permissions" dialog, select Property-Specific
7. Check the following attributes:
   • ☑ Write displayName
   • ☑ Write mail
   • ☑ Write telephoneNumber
   • ☑ Write streetAddress
   • ☑ Write city
   • ☑ Write st (state)
   • ☑ Write postalCode
   • ☑ Write department
   • ☑ Write title
   • ☑ Write company
   • ☑ Write manager
   • ☑ Write description
8. Click Next > Finish

---

3. Exchange Server Permissions

3.1 Exchange Admin Center Access

Step 1: Open Exchange Admin Center

1. From a web browser: https://exchangeserver.domain.com/ecp
2. Log in with an account that has Organization Management rights

Step 2: Verify beaksvc Mailbox Exists

1. Navigate to Recipients > Mailboxes
2. Search for "beaksvc"
3. Confirm the mailbox is created and enabled

3.2 Add beaksvc to Role Groups (UI Method)

Step 1: Navigate to Admin Roles

1. In Exchange Admin Center, click Permissions in the feature pane
2. Click Admin Roles tab

Step 2: Add beaksvc to "Recipient Management" Role Group

1. In the list of role groups, find and click Recipient Management
2. The role group details panel opens on the right side
3. Under "Members" section, click Edit (pencil icon)
4. In the "Recipient Management" dialog:
   • Click Add (+)
   • A selection dialog appears
   • Type: beaksvc
   • Click Search or press Enter
   • Select beaksvc (beaksvc@domain.com)
   • Click Add > OK
5. Click Save

What this grants: Permission to manage mailbox recipients, create/modify/delete recipients, manage distribution groups

Step 3: Add beaksvc to "Mail Recipients" Role Group (If Not Already Included)

1. Click Mail Recipients role group
2. Click Edit
3. Click Add under Members
4. Type: beaksvc
5. Click Search
6. Select beaksvc
7. Click Add > OK > Save

What this grants: Basic mailbox and recipient management permissions

Step 4: Verify Role Group Membership

1. Navigate to Permissions > Admin Roles
2. Click on Recipient Management
3. Under "Members" section, verify beaksvc appears in the list

3.3 Assign Specific Mailbox Permissions (Individual Mailbox Delegation)

Use this process if you need to grant beaksvc specific permissions on individual mailboxes (e.g., for shared mailbox management).

Step 1: Navigate to Target Mailbox

1. Go to Recipients > Mailboxes (or Shared for shared mailboxes)
2. Search for and select the mailbox you want to assign permissions for
3. Click Edit (pencil icon)

Step 2: Configure Mailbox Delegation

The mailbox properties page opens. Click Mailbox delegation section.

For Full Access Permission:

1. Under Full Access section, click Add (+)
2. A user selection dialog appears
3. Type: beaksvc
4. Click Search
5. Select beaksvc
6. Click Add > OK
7. Under Full Access, verify beaksvc is now listed

For Send As Permission:

1. Under Send As section, click Add (+)
2. Type: beaksvc
3. Click Search
4. Select beaksvc
5. Click Add > OK
6. Under Send As, verify beaksvc is now listed

For Send on Behalf Permission:

1. Under Send on Behalf section, click Add (+)
2. Type: beaksvc
3. Click Search
4. Select beaksvc
5. Click Add > OK
6. Under Send on Behalf, verify beaksvc is now listed

Step 3: Save Changes

1. After configuring required delegations, click Save
2. A confirmation message appears
3. The mailbox now has the configured permissions for beaksvc

3.4 Assign Group Delegation Permissions

If you need beaksvc to manage delegates on distribution groups:

Step 1: Navigate to Groups

1. Go to Recipients > Groups
2. Search for and select the distribution group
3. Click Edit

Step 2: Configure Group Delegation

The group properties page opens. Click Group delegation section.

For Send As Permission on Group:

1. Under Send As, click Add (+)
2. Type: beaksvc
3. Click Search
4. Select beaksvc
5. Click Add > OK

For Send on Behalf Permission on Group:

1. Under Send on Behalf, click Add (+)
2. Type: beaksvc
3. Click Search
4. Select beaksvc
5. Click Add > OK

Step 3: Save Changes

1. Click Save
2. Confirm the changes are applied

3.5 Assign Mailbox Import/Export Role (For Bulk Operations)

Step 1: Navigate to Admin Roles

1. Click Permissions > Admin Roles
2. Look for "Mailbox Import Export" or search for a similar role

Step 2: Create Custom Role (If Needed)

If there's no pre-existing "Mailbox Import Export" role that includes the necessary permissions:

1. At the top of the role groups list, click New (+)
2. In the "New role group" dialog:
   • Name: Mailbox Management (or similar)
   • Description: Service account for mailbox provisioning and management
   • Roles:
     • Click Add
     • Scroll through available roles
     • Select: Mail Recipients, Recipient Management, Mailbox Import Export
     • Click OK
3. Members:
   • Click Add
   • Type: beaksvc
   • Click Search
   • Select beaksvc
   • Click Add > OK
4. Click Save

---

4. Printer and Peripheral Configuration

4.1 Local Administrator Access on Print Servers

Step 1: Access Print Server

1. Connect to the Windows print server
2. Open "Computer Management"
3. Navigate to System Tools > Local Users and Groups

Step 2: Add beaksvc to Administrators Group

1. Double-click Administrators group
2. Click Add
3. In "Select Users, Computers, Service Accounts, or Groups" dialog:
   • Type: DOMAIN\beaksvc
   • Click Check Names
   • Verify the name resolves
4. Click OK
5. Close the dialog

Step 3: Add beaksvc to Print Operators Group (Alternative)

1. If local admin access not required, use Print Operators group instead
2. Double-click Print Operators group
3. Repeat steps in section above
4. This grants printer management without full system admin rights

Step 4: Verify Changes

1. Disconnect and reconnect to print server to refresh permissions
2. Test printer management operations

---

5. Infrastructure and Network Requirements

5.1 Network Connectivity Checklist

Component	Port	Protocol	Required
Domain Controllers	389	LDAP	Yes
Domain Controllers	636	LDAPS	Yes (if using secure LDAP)
Domain Controllers	88	Kerberos	Yes
Exchange Server	443	HTTPS	Yes
Print Servers	445	SMB	Yes
Print Servers	9100	LPR	Yes (if using LPR)

5.2 Firewall Rules

Create outbound firewall rules allowing:

• From Beak ITOps Agent server to Domain Controllers on ports 389, 636, 88
• From Beak ITOps Agent server to Exchange Server on port 443
• From Beak ITOps Agent server to Print Servers on ports 445, 9100

5.3 Authentication Configuration

Kerberos Authentication (Recommended):

• Ensure beaksvc account has Kerberos authentication enabled (default for user accounts)
• Verify Beak ITOps Agent can reach a Key Distribution Center (KDC)
• Test Kerberos authentication from the agent server

LDAPS Authentication (Alternative):

• Exchange Server and Domain Controllers should have valid SSL certificates
• LDAPS port (636) must be accessible from Beak ITOps Agent server

---