Skip to main content

​
What it is

The idemeum service account is an Active Directory user account that the idemeum agent uses to manage just-in-time (JIT) domain accounts for technicians. With it, idemeum can create a technician’s account when it’s needed, set a one-time password, grant admin access, and disable the account afterwards, without storing any person’s admin credentials.
Don’t move this account to a different OU or rename it. The agent expects it in the configured location and recreates it there if it can’t find it. The recreated account is a new AD object with a new SID, so group memberships or delegations added to the old one are lost. To change the location, update the JIT OU setting in your tenant.

​
How it’s used when a technician signs in to a domain computer

Here is the flow for how service account is used when managing domain JIT accounts.
The service account is used only when technicians sign in with domain accounts, which covers domain controllers and tenants that use domain JIT accounts on workstations. When technicians use local JIT accounts on workstations, the service account isn’t involved.

​
Service account password rotation

​
Domain policy for password age

If your domain password policy sets a maximum password age, the service account can expire like any other user. When it does, JIT sign-ins fail until the next sync on the domain controller, which renews the password.

​
Who has access to the account

​
Why it needs Domain Admin privileges

Here is why the service account needs to have Domain Admins privilege:
  1. Technicians need administrative access, so by default their JIT accounts are added to the Domain Admins group. Windows protects that group and every account in it: only accounts with Domain Admin–level rights can add members, reset those members’ passwords, or enable and disable them.
  2. The service account also tells all domain controllers to replicate each change immediately, which by default requires administrator rights on the domain.