Active Directory Account Manager Guide (for AD accounts on state servers used for state-provided applications)

Transcription

1 Active Directory Account Manager Guide (for AD accounts on state servers used for state-provided applications) This document will guide the Active Directory Account Manager as to how to create and manage Active Directory accounts, assign AD accounts to security groups, and reset AD account passwords. NOTE: It is important to remember that an Active Directory Account Manager (ADAM) is not necessarily a System Administrator in another application. For example, the ADAM might be a member of the technology department and not be a System Administrator in any of the APSCN applications, not be the Cognos Account Manager, etc. Those duties might belong to a bookkeeper or registrar, for example. It is possible to be an ADAM and not have access to APSCN applications at all. It is also important to remember that the converse is true as well: being a Cognos Account Manager, eschool System Administrator, or administrator of any other application does not mean a user is also an ADAM for your location. *When creating AD accounts, it is important to follow the format on page 3, and the account MUST be for an actual staff member. Per audit, accounts such as '6502teacher' or '6502datapull' are not permissible. There should only be one account per user. Create an Active Directory Account Connect to the APSCN Active Directory Terminal Server either via the desktop shortcut or your operating system menu. See the Active Directory Creating Remote Desktop Connection document found under the Security link on the menu at apscn.org for more information. Once you are connected to the server and properly logged in, you will need to start the Administrative Tool called Active Directory Users and Computers. This is accomplished by double-clicking the Icon on the desktop. 1

2 To display Organizational Units, in the left pane: Click the + sign in front "APSCN.local Click the "+" sign in front of "School Districts" Click your Organization Unit, based on your LEA In this example, you see in the right pane that one account has already been created. 2

3 Adding New Active Directory Accounts Click the "Create new user..." icon. *When creating AD accounts, it is important to follow the following format, and the account MUST be for an actual staff member. Per audit, accounts such as '6502teacher' or '6502datapull' are not permissible. There should only be one account per user. Enter the First Name, Last Name, and User logon name for the new user. (Please use Proper Case, not ALL CAPS) The logon name MUST be in the format <####><first initial><last name> where <####> are the first four digits of the district LEA. In this example, adding Sam Jones would yield a logon name of 6502sjones. 3

4 Enter a user password, and make sure that no items are checked. Note: If you have more than one user named Jones with a first name that begins with s you may also add middle initials: for example, 6502smjones, but it is important to remember the 6502 prefix. Select Next and then Finish to create the new Active Directory account. Now that the account has been created and assigned a temporary password, the user must navigate the following menu on the APSCN website to change their password before use: > Security > Self Management of State Active Directory Account Passwords With this utility, an ADAM will rarely need to reset a user password. Once enrolled, users will be able to maintain their own passwords. Even if the password has been forgotten, users will be prompted to answer security questions to assign a new password. 4

5 Assigning Group Membership to an existing Active Directory Account Active Directory accounts may be assigned membership to existing groups. You may see many existing security groups and may not necessarily have security level to assign membership to all groups. ####eschool ####efinance ####FFATA ####EdFi Teacher Etc. Note: It is important to note that an Active Directory account does not necessarily have to be assigned membership to any of the existing security groups by the ADAM. For example, Sam Jones may not need access to any of the programs listed above, but may be a Cycle Coordinator, or need access to ARRA, or another program that requires a form, or may need membership to Cognos groups, which are assigned by the local Cognos Account Manager (CAM). To grant membership to an existing security group, right-click the user name and select Properties. Select the Member Of tab and then select Add. 5

6 Type your LEA number and click 'OK' to see available security groups. Select the desired group(s), then 'OK'. In this example we want to make the account a member of the ####eschool security group. (Adding to this group allows communication with the eschool server and database, but does not assign resources in eschool eschool resources are assigned by the eschool System Administrator). The account is now listed as a Member Of the ####eschool security group. *THIS IS ONLY AN EXAMPLE Not all accounts will need to be a member of the eschool group used in the example. For example, a bookkeeper may never use eschool, and therefore would not need to be a member of the eschool group, yet may need to be assigned to Cognos Security Groups by the Cognos Account Manager. Also be aware that as an ADAM you are not able to assign membership to all groups that you see. 6

7 Removing Group Membership for an existing Active Directory Account To remove group membership for a user, while in the Member Of area, simply highlight the group to remove and select Remove. Resetting Password for an existing Active Directory Account Right-click the user account, then select Reset Password and assign a temporary password. Once the temporary password has been assigned, have the user visit the path below to enroll in the Self Management of Passwords and they will be able to maintain their password from that point forward. > Security > Self Management of State Active Directory Account Passwords 7

8 Granting State VPN Access for an existing Active Directory Account Right-click the user account, then select Properties. On the Dial-In tab, select Allow Access. 8

9 Deleting an existing Active Directory Account Note: As an ADAM, you should ALWAYS check with administrators of other software before deleting an Active Directory account. Steps should always be taken first in any appropriate software to avoid problems caused by the deletion of the Active Directory account. For example, if the account utilizes TAC, the deletion of the Active Directory account will also remove grades associated with that user. Right-click the user account, then select Delete Disable an existing Active Directory Account There may be times that an account needs to be temporarily disabled for a time period so that it may be re-enabled at a later date. Right-click the user account, then select Disable Account 9

10 Final Step After Active Directory Account Creation Now that an Active Directory account has been created for a particular user, the next step would be to give the account information to the appropriate party to assign resources. Possible Examples: Remember, as the ADAM you may or may not be assigned administration responsibilities in other software. Contact the Cognos Account Manager to assign Cognos groups membership(s) for the AD account. Send in a Cycle Coordinator Form to have resources assigned for the AD account. Contact the eschool System Administrator to assign resources for the AD account. Contact or send the form for X to have resources assigned for the AD account. There may be many possibilities for an existing AD account, and those choices will change over time. 10