What are the Least Privilege Permissions for an LDAP AD Account for Registered Servers?

[mpsnyder]

Looking for what the least privilege permissions are for the user account used when registering an LDAP Active Directory server.

[cdinet]

Read access should be sufficient, we don't make any changes to AD itself, only read from it.

[mpsnyder]

Does the Windows Authentication use these Registered LDAP Servers for authentication, and if so are there any special permissions needed for authentication?  We had the user account for the registered server overprivileged and when removing permissions it seems that users could not login to ePO with their AD user account until we reverted the permissions changes we made.

[cdinet]

Windows authentication should use the ldap server that the epo server itself discovers - you don't have to have a registered ldap server to log into the console with a windows account.  I would suggest maybe taking away the rights one at a time to see which one affected user logins.  Are you using user autocreation or creating the accounts manually?  The only permissions I am aware of for a windows account is that if the account is used to connect to the database, it has to have logon rights to the epo server and be a local administrator.  But that is different than console login accounts.