Linux Mail Server Setup and Howto Guide

Hi,

I am trying to setup a one-way windows synchronization agreement so that accounts in Active Directory get created in DS.

Everything works if the Bind as user specified in the Windows Replication agreement is a member of the Domain Admins group in AD.

As we are only doing one-way and do not need to update AD we need that bind account to have less privilages (this will make our Windows admins much happier too!).

I tried Delegating Read all rights to it in AD but that did not work.

Any ideas on the minimal rights required in AD for the bind account for one way replication to work?

Thank you!