What is the exact privilege that the AD account needs for auto-fulfillment:
Add account to group
Account lock & unlock
Account password reset
The client has requested privileges recommendation from RSA.
They don't want to give the service account domain admin privileges and want granular privilege details.