does the service account that scan domain controllers need to have Domain access permission?

[skhan]

Do we need the service account that scan domain controllers to have domain access permission? can they still be discovered if we just give them regular admin not domain access? is there a documentation for it?

[doug_schulze · Accepted solution]

Yes, when discovering Domain Controllers you must have a domain admin account. You have options including utilizing JEA and/or using the Agent Client Collector

[skhan]

Thank You Doug!

[SELECT Username]

Doug is correct.

Domain Controllers are special.  They don't actually have a local admin account like other services.  The local administrator account goes away when they're promoted to a DC.  That's a Microsoft item not a ServiceNow limitation:

https://social.technet.microsoft.com/Forums/en-US/b095b851-d2e7-4dd3-9678-f50088debe59/how-to-access-local-administrator-account-on-domain-controller?forum=windowsserver2008r2general