Enable Password less Proxy/Impersonation Functionality Without Mandatory Local Administrator Group Membership Privilege

1. Problem Statement

Following the upgrade to IBM Sterling IBM Connect:Direct version 6.4.0 on Windows platforms, the password less/no-password proxy feature for domain accounts face a significant security and compliance challenge.

Current Setting Requirement based on IBM documentation (https://www.ibm.com/docs/en/connect-direct/6.4.0?topic=impersonation-managing-no-password-proxies-domain-accounts):

To utilize the password less proxy feature, the Windows Service Account must be:
· A member of the local system's Administrators group .
· Granted the "Act as part of operating system" user privilege .

Business Impact:
· Violation of Least Privilege Principle: The IBM Connect:Direct service account is granted far more authority than necessary for file transfer operations, creating an unnecessary attack surface.
· Non-Compliance 1: HSBC security policies prohibit such kind of service accounts from holding local administrator privileges.
· Non-Compliance 2: Maintain non-compliant configurations with exception requests and associated audit risks.

This settings of password less/no-password proxy feature for domain accounts create an untenable choice between operational efficiency (password less automation) and enterprise security compliance.

2. Proposed Solution

IBM is requested to re-architect the password less/impersonation capability to eliminate dependency on high-privilege account requirements. 

Propose to rebuild Service Account Dedicated Rights based on following requirements:
· Define and document a minimum set of Windows-specific rights required exclusively for IBM Connect:Direct password less impersonation.
· Implement code changes so the service checks for these specific rights rather than assignment of administrators privilege group.

3. Business Benefits

· Improved Security: Security Hardening Eliminates domain service accounts with local administrator sprawl across hundreds of Windows nodes.
· Reduced Operational Risk: Compliance Alignment Enables password less automation without violating HSBC security policies.
· Compliance: Helps meet regulatory requirements for credential protection and rotation.