---
title: Initial Setup & Requirements
slug: initial-setup-and-requirements
createdAt: 2025-11-06T19:22:22.878Z
---

This document outlines the initial setup and configuration steps required to deploy Activate Security Group Compliance Manager (SGCM) within an existing Activate environment.

# Prerequisites

Before configuring SGCM, ensure the following requirements are met:

- **Activate Platform Installed** – Activate Server and Web components must be installed and operational. 
- **Active Directory Access** – A service account with sufficient permissions to read and monitor Active Directory changes. 
- **Replicate Directory Changes Permission** – Required to use the AD DirSync control for change detection. 
- **Network Connectivity** – The Activate Job Service must be able to communicate with the monitored Domain Controllers. 
- **Database Capacity** – The Activate database must have adequate storage for AD object data and compliance event history. 

# Required Permissions

The account used for synchronisation must have **Replicate Directory Changes** permission on the monitored domain. By default, members of the **Domain Admins** group have this permission.

To delegate the permission to a non-administrative account:

1. Open **Active Directory Users and Computers**. 
2. Right-click the domain root and select **Delegate Control**. 
3. Use the wizard to assign **Replicate Directory Changes** to the service account. 

Alternatively, refer to Microsoft KB **303972** – *How to Grant the “Replicating Directory Changes” Permission for the Microsoft Metadirectory Services ADMA Service Account*.

# Initial Synchronisation

SGCM relies on an initial synchronisation of Active Directory data to establish the baseline for change detection. This process should be completed before enabling background polling.

**To perform the initial synchronisation:**

1. Open **Activate Studio**. 
2. Navigate to Resources > Active Directory. 
3. Select the subfolder for the target domain. 
4. Create a new parameter named Connector\_ADServer and set the value to the fully qualified domain name (FQDN) of the Domain Controller to be used. 
5. Right-click the domain resource and select **Regenerate Schema**. 
6. Once the schema is generated, select **Show Data** to open the data view. 
7. From the cog menu, choose **Import Workflow** to start the initial import. 

Once the import completes, verify that objects and memberships have been populated correctly under the **Data** and **Members** tabs.

# Changing the Domain Controller

If it becomes necessary to change the Domain Controller used for synchronisation:

1. Delete the parameter Connector\_DirSyncCookie from the domain resource. 
2. Update the Connector\_ADServer parameter with the new Domain Controller name. 
3. Re-run the import workflow to perform a full resynchronisation. 

This ensures SGCM resets its baseline and aligns with the new Domain Controller’s DirSync cookie.

# Verifying Data Synchronisation

After the initial import, confirm successful synchronisation:

- Review object counts for users, groups, and computers. 
- Validate that key AD attributes (displayName, samAccountName, department, etc.) appear correctly. 
- Ensure that group membership lists are populated. 

If synchronisation issues occur, check the Activate Job Service logs and confirm that the service account has the correct permissions.

# Recommended Schedule

Following the initial import, SGCM should be configured for continuous polling to detect and process changes automatically. Use the **FullWorkflowWithGroups** workflow for this purpose.

Typical polling intervals range between **5 to 15 minutes**, depending on organisational scale and performance considerations.

# Summary

The initial setup establishes the foundation for real-time compliance monitoring by ensuring:

- The correct Domain Controller and service account are configured. 
- Schema and connector space are initialised. 
- The initial Active Directory data import completes successfully. 

Once verified, SGCM can begin automated monitoring and enforcement of security group compliance policies.