The ClassLink Gateway 2.0 server requires an AD account to read your AD. Create a dedicated AD service account that has read access to your entire AD or access to organizational units where LaunchPad users reside. At a minimum, the account must be a domain user. However, if you want to use AD password reset in LaunchPad, see Enabling password reset.