Prerequisites for Setting Up Universal Group Account Templates

Before you can set up an account template for a universal group, ensure that you understand the following prerequisites:

Account Permissions: An account that is used to acquire or modify the Active Directory endpoint must have ‘Enterprise Administrator’, or cross-domain group member modification permissions. These permissions are required because CA Identity Manager modifies group members using the credentials that are specified for the domain hosting the account (not the group).
Use DN for User ID on the endpoint: CA Identity Manager modifies group members using the credentials that you specified for the domain hosting the account. To allow these modifications, supply the distinguished name as the User ID in the ADS Endpoint properties.
For example, the following DN is an acceptable user ID:
```
cn=adsadmin,ou=IM,dc=vic,dc=ca,dc=com
```
The following samples cannot work, because they cannot be authenticated correctly by other sibling endpoints:
```
adsadmin@vic.ca.com
vic\adsadmin
```
Network Access: All computers hosting Java CS must be able to resolve the IP addresses of sibling domains. Being able to resolve the IP addresses of sibling domain controllers is insufficient.
For example, the following commands must both work properly on the Java CS host, if the Active DIrectory endpoint is adsendpoint1.vic.ca.com:
```
ping vic.ca.com
ping adsendpoint1.vic.ca.com
```