AD Service Account for EMS

Hey folks,

I am currently working on EMS at a client side. Their operation team needs to know exact level of privileges required for AD service account required for PGP Desktop enrollment. With read only account, EMS AD test goes successful but PGP Desktop enrollment does not work. When we give full admin rights to service account, it works fine but client AD team is relucant to give full rights to service account and there is no specifics mentioned regarding the same in Symantec PGP admin and installation guides.

Would be great if I can get the specific details of rights requried for such service account on EMS.

Regards,

Atif