Meraki’s Advice to enable AD authentication for VPN is to create the Service account as …. Domain Administrator

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Active_Directory_Integration

This is big security no no ( Incase the account gets compromised then the whole domain gets compromised ) 

You can set this account as Domain User which will give the access

• Query the user database via LDAP
• Query group membership via LDAP

You can then assign the WMI permissions for : Query the domain controller via WMI 

by doing the below on the domain controller 

To set the WMI user access permissions

1. Select Start > Run.
2. On the Run dialog, type wmimgmt.msc in the Open field.
3. Click OK to display the Windows Management Infrastructure (WMI) Control Panel.
4. In the left pane of the WMI Control Panel, highlight the WMI Control (local) entry, right-click, and select the Properties menu option. This displays the WMI Control (Local) Properties dialog box.
5. Select the Security tab in the WMI Control (Local) Properties dialog box.
6. In the namespace tree within the Security tab, expand the Root folder. This action lists the available WMI name spaces.
7. Click the CIMV2 namespace to highlight it.
8. Click Security to display the Security for ROOT\CIMV2 dialog box.
9. Click Add in the Security for ROOT\CIMV2 dialog box to display the Select Users or Groups dialog box.
10. Add the domain user account that will be used as your proxy data collection user account. This should be a domain account (not a local computer account), but it does not need to be an account with administrative access.
11. Click OK to close the Select Users or Groups dialog box and return to the Security for ROOT\CIMV2 dialog box. The user account you selected should now be listed in the Name list at the top of the dialog box.
12. Select the newly added user (if it is not already selected) and enable the following permissions:
    • Enable Account
    • Remote Enable
      Enable the permissions by clicking the Allow box, if it is not already checked for that permission. The Enable Account permission should already be selected, but the Remote Enable permission will need to be selected.
13. Click OK to close the Security for ROOT\CIMV2 dialog box.
    The permissions should now be properly set for the proxy data collection user account.