What account type must the AD Gateway Service Account be assigned to the AD Gateway...

ForAD Synchronizationto function correctly, theAD Gateway Service Accounton the AD Gateway device must be assigned as aDomain User. This role provides sufficient permissions to read Active Directory information for synchronization without requiring elevated privileges.

Role of the Domain User Account:

Domain User permissions allow the service account to access and synchronize necessary AD data, ensuring that the integration functions without unnecessary security risks associated with higher-level permissions.

Why Other Account Types Are Not Suitable:

Local StandardandLocal Administrator(Options A and B) do not have the required permissions for domain-wide AD access.

Domain Administrator(Option C) provides excessive permissions, which are not needed for basic synchronization and could introduce unnecessary security risks.

References: Assigning the AD Gateway Service Account as a Domain User is a best practice for secure and functional AD synchronization in Symantec environments​.