1. In Microsoft Active Directory, in the search-base container and all subcontainers that user accounts are located in, add the following permissions to the administrator account:
   • for containers, the List Contents permission
   • for user objects, the Read All Properties permission
2. Configure the administrator account so that the account has the correct permission to read the attributes of the crossRef objects that represent domains in the Partitions container of the Microsoft Active Directory configuration partition.

1. On the Start menu, click Run.
2. Type ldp.
3. Click OK.
4. On the Connection menu, click Connect.
5. Connect to the domain controller.
6. On the Connection menu, click Bind.
7. In the Bind dialog box, click OK.
8. To set the LDAP search base to the BaseDN and permit the BlackBerry Administration Service to search the entire directory tree for user accounts, perform the following actions:
   1. In the ldp window, on the View menu, click Tree.
   2. In the drop-down list, select the first option.
   3. Copy the BaseDN to a text file (for example, DC=yourDepartment,DC=yourOrganization,DC=net).
9. To permit the BlackBerry Administration Service to access only the part of the directory tree that includes current and prospective BlackBerry device users in your organization, specify a specific area in the directory tree as the LDAP search base (for example, OU=Users,DC=yourDepartment,DC=yourOrganization,DC=net).
10. To locate the administrator account information, in the Microsoft® Active Directory® Users and Computers console, find the user name for the administrator account. If you use Windows Server® 2003, verify that the administrator account has a password.
11. Transfer the text file to the computer that you want to install the BlackBerry Administration Service on.

During the installation process, the setup application prompts you to specify the LDAP server URL, search base, and the credentials for an LDAP administrator so that the BlackBerry® Administration Service can access the LDAP server and authenticate user accounts.

If the user accounts in your organization's environment are stored in more than one domain in a Microsoft® Active Directory® forest, you must configure the LDAP settings that the BlackBerry Administration Service uses so that the BlackBerry Administration Service can search the global catalog.

1. During the installation process, specify the DNS host name of a global catalog server as the LDAP server name that is included in the LDAP server URL.
2. Specify the LDAP port number to be 3268.
3. Specify the LDAP user name and password to be the user name and password of an administrator account that has permission to read user attributes from the global catalog.