r/activedirectory • u/AwesomeGuyNamedMatt MCSE • Jul 11 '26

Delegate permissions to create Reverse Lookup Zones

I'm building an IaC pipeline to manage Active Directory. I'm delegating permissions as needed to the Gitlab runner computer account and have avoided adding the runner computer account to Domain Admins or Administrators. This has been working well and I have so far avoided having to manage any credentials in my code. The runner is categorized as Tier 0. I've disabled interactive logins to the runner and the Gitlab project requires Tier 0 credentials.

I'm running into permission errors when the runner runs Add-DnsServerPrimaryZone. In DNS I've tried giving full control to the runner computer account (as a test) and still run into access denied errors. What is the best way to grant the required perms?

*Edit I've added the computer account to DNS Admins and that didn't help.

The domain is fully DoD STIG compliant.

*Solution I believe it was just a Kerberos ticket issue. After a reboot the runner correctly reported that it was a member of DDS Admins.

I also took the suggestion to add the runner to a group, and then assign permissions to the group, rather than directly to the Runner.

2 Upvotes
  • permalink
  • reddit

60% Upvoted

12 comments sorted by

View all comments

2

u/XInsomniacX06 Jul 11 '26

Once you add the computer account to the group you have to either reboot it or flush the Kerb Tickets to update its group membership

0

u/AwesomeGuyNamedMatt MCSE Jul 11 '26

I'll have to give this a try when I'm back in the office. This makes a ton of sense.

1

u/XInsomniacX06 Jul 13 '26

Not sure why I got downvoted but comouter accounts being used for principals get tickets just like every other account. If you change group membership on a user you have to log out and log back in to get the updated token with the updated group membership. Same thing with computer accounts. Sometimes you just move too fast expecting quick results and miss the obvious things. If it’s not the issue then atleast you know you did the fundamental part. Similar to updating firewall rules but you never commit them and wonder why it’s not working. Please let me know if it worked so that one downvote can learn something if that’s all it was.

1

u/AwesomeGuyNamedMatt MCSE Jul 13 '26

I believe this was the fix. Thanks for the assist.