# Windows Server Action

**URL:** <https://developer.sailpoint.com/discuss/t/windows-server-action/192849>\
**Category:** SHF Discussion and Questions\
**Tags:** windows, workflows, sailpoint-identity-security\
**Created:** [January 9, 2026, 5:46pm UTC](https://developer.sailpoint.com/discuss/t/windows-server-action/192849 "2026-01-09T17:46:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rpriya](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rpriya](https://developer.sailpoint.com/discuss/u/rpriya)\
**Post date:** [January 9, 2026, 5:46pm UTC](https://developer.sailpoint.com/discuss/t/windows-server-action/192849/1 "2026-01-09T17:46:25Z")

</div>

What are the minimum privileges required for a service account to execute the ‘Windows Server’ workflow action, specifically for connecting to a Windows Server or IQService server to execute PowerShell script?

It works fine when the service account is added as a local admin into the Windows Server or IQService server. Does anyone know if there’s a way to achieve this with lesser privileges?

---

<div class="post-metadata">

**Author:** ![kevisoliveira](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kevisoliveira/32/25510_2.png) [@kevisoliveira](https://developer.sailpoint.com/discuss/u/kevisoliveira)\
**Post date:** [January 9, 2026, 7:10pm UTC](https://developer.sailpoint.com/discuss/t/windows-server-action/192849/2 "2026-01-09T19:10:26Z")

</div>

Hi @rpriya,

Good point — the documentation doesn’t seem to provide detailed information about required permissions.

You might try something along these lines:

- Add the service account to the Remote Management Users group so it can establish a remote PowerShell session.
- Use Just Enough Administration (JEA) to delegate only the specific cmdlets or tasks that the workflow needs to perform.
- Delegate permissions only on the relevant OUs, attributes, or files/services instead of granting full admin rights.

Additionally, you could open a support ticket to ask SailPoint for best practices around least privilege configuration.

Hope this helps, and good luck!

---

<div class="post-metadata">

**Author:** ![kompala](https://avatars.discourse-cdn.com/v4/letter/k/ea5d25/32.png) [@kompala](https://developer.sailpoint.com/discuss/u/kompala)\
**Post date:** [January 11, 2026, 5:23am UTC](https://developer.sailpoint.com/discuss/t/windows-server-action/192849/3 "2026-01-11T05:23:51Z")

</div>

@rpriya Service account permission requirements would remain the same as mentioned in this url -[Required Permissions](https://documentation.sailpoint.com/connectors/active_directory/help/integrating_active_directory/required_permissions.html)

If you are executing the AD commands from the script, then the service acount would need the permission to execute them.

---

<div class="post-metadata">

**Author:** ![RAKRHEEM](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@RAKRHEEM](https://developer.sailpoint.com/discuss/u/RAKRHEEM)\
**Post date:** [January 12, 2026, 10:17am UTC](https://developer.sailpoint.com/discuss/t/windows-server-action/192849/4 "2026-01-12T10:17:11Z")

</div>

> [@rpriya](#):
>
> What are the minimum privileges required for a service account to execute the ‘Windows Server’ workflow action, specifically for connecting to a Windows Server or IQService server to execute PowerShell script?
> 
> It works fine when the service account is added as a local admin into the Windows Server or IQService server. Does anyone know if there’s a way to achieve this with lesser privileges?

The Windows Server workflow action doesn’t require local admin rights. Instead, consider these least-privilege approaches:

1. **Add to Remote Management Users group** to establish PowerShell remoting sessions

2. **Use Just Enough Administration (JEA)** to delegate only specific cmdlets/tasks needed

3. **Grant targeted permissions** on relevant OUs, attributes, or services instead of full admin rights

For Active Directory operations specifically, follow the [required permissions for AD connectors](https://documentation.sailpoint.com/connectors/active_directory/help/integrating_active_directory/required_permissions.html).

Opening a support ticket for SailPoint’s recommended least-privilege configuration is also suggested, as detailed documentation on workflow action permissions is limited.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [March 13, 2026, 10:18am UTC](https://developer.sailpoint.com/discuss/t/windows-server-action/192849/5 "2026-03-13T10:18:10Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.