I was having an issue with the User Profile Sync not importing users from
Active Directory. I tried configuring the connection to point to different
containers, but nothing seemed to work. Out of desperation I had one of the
domain admins enter their domain credentials, and then try to run the
profile sync. I was surprised that the import succeeded. So it has me
wondering what level of permissions the User Profile Sync account needs.
Using a domain admin account is not an option, but was just a test to see if
the issue was permissions related. I'm going to do some more testing
tomorrow to see if i can find anything else.