Active Directory Service Account FAQ

Under what scenarios modify, create or delete actual user objects? It can create users only.

Under what scenarios does WSM modify, create or delete actual user groups? It only modifies user groups to remove a user when a workspace is terminated after being created via an AutoProvision profile.

Under what scenarios does WSM modify, create or delete computer objects? It modifies the description of a computer object to add the friendly name when the option is toggled on in settings. Objects are created by Amazon during workspace creation. We only remove the computer object when the option is toggled on in settings, otherwise it is orphaned. At this point we only list orphaned objects but do not manipulate them.

The answers above are based on a delegated service account, and are therefore subject to the permissions and OU restrictions placed on the service account in your AD environment.