SMART Directory Sync 5.0. Requirements

Transcription

1 SMART Directry Sync 5.0 Requirements JUNE 2016

2 Table f Cntents Sectin 1. Intrductin...3 Sectin 2. Prerequisites Supprted Envirnments Binary Tree Dmin Server Requirements Binary Tree Windws Server Requirements SQL Server Database Requirements General Requirements Exchange Access Requirements Dmin Access Requirements...7 Sectin 3. Advanced Netwrk Requirements Abut Binary Tree SMART DIRECTORY SYNC 5.0 REQUIREMENTS 2

3 Sectin 1. Intrductin This dcument details the requirements fr implementing Binary Tree s SMART Directry Sync. These include the requirements fr each f the servers needed t run Directry Sync, as well as any envirnmental requirements. If yu are planning t use SMART Active Directry Migratr, please refer t the SMART Active Directry Migratr dcumentatin fr additinal requirements. Sectin 2. Prerequisites 2.1 Supprted Envirnments The fllwing is a list f supprted and unsupprted envirnments. If implementing directry synchrnizatin between Dmin and Active Directry, yu will need a Binary Tree Dmin Server, a Binary Tree Windws Server and an SQL Server database server. If implementing directry synchrnizatin between tw Active Directry envirnments, yu will need a Binary Tree Windws Server and an SQL Server database server. Binary Tree Dmin Server Binary Tree Windws Server SQL Server Database Exchange Envirnment Windws Server 2008 R2 64-bit Supprted Dmin (32-bit versin nly) r Dmin (32-bit versin nly) Windws Server 2008 R2 64-bit r Windws Server 2012 R2; US English Operating System SQL Server can be a new r existing database server in the custmer s envirnment. The fllwing SQL Server versins (English versins) are supprted: SQL Server 2008 R2 SQL Server 2008 R2 Express with Advanced Services SQL Server 2012 SP2 SQL Server 2012 SP2 Express with Advanced Services SQL Server 2014 SQL Server 2014 Express with Advanced Services SQL Server 2016 SQL Server 2016 Express with Advanced Services Exchange 2003, 2007, 2010, 2013, r 2016 Nt Supprted 64-bit versins f Dmin r versins prir t All ther versins f Windws Server SQL Server 2008 r previus Reprting using SQL Server Reprting Services 2016 r SQL Server Express Reprting Services 2016 Exchange 2000 r previus SMART DIRECTORY SYNC 5.0 REQUIREMENTS 3

4 Dmain Dmin Envirnment At least ne Windws Server 2003 SP2 Dmain Cntrller in Surce (if syncing frm AD t AD r AD t Dmin) and Target (if syncing frm AD t AD r Dmin t AD) Dmin 7.x r higher 2.2 Binary Tree Dmin Server Requirements The Binary Tree Dmin Server is respnsible fr the Directry Synchrnizatin prcesses between Dmin and SQL Server. This server may als be running CMT fr Cexistence (CMTC) which handles Free/Busy Lk-up, Messaging, Calendaring, and Applicatin Remediatin between Dmin and Exchange. Windws Server 2008 R2 64-bit (US English versin) Dmin (32-bit versin nly) r Dmin (32-bit versin nly) This server shuld be dedicated t Dmin and the Binary Tree slutins nly. The Binary Tree Dmin Server shuld be a separate server frm the Dmin Mail servers, and n user mail files shuld reside n it. Any Dmin directry that will have entries synched t Active Directry must be replicated t this server. Directry Assistance must be cnfigured n this server, with all Dmin directries that shuld be searched fr matches and cllisins, as well as the AD target directry (Exchange.nsf) 2.3 Binary Tree Windws Server Requirements Windws Server 2008 R2 64-bit r Windws Server 2012 R2 (US English versin) Fr Windws Server 2008 R2 64-bit, if this server is als running the Binary Tree Free/Busy service between Dmin and Exchange, it must als be running as a standalne IIS 7.0 server with the Web Server (IIS) Rle installed. Please refer t the CMT fr Cexistence Requirements dcument..net r newer IPv4 Only The user running the BTDirsync service (full name BinaryTree.Cexistence.Dirsync.Exchange.exe) must have the fllwing rights: Administratr rights t SQL Server with sysadmin rle (during installatin). Lcal administrative rights t the Binary Tree Windws server (during installatin). Exchange cannt be installed n this server. The Binary Tree Windws Server must be a dedicated server fr the Binary Tree slutins. If using the Passwrd Cpy functinality f Active Directry Migratr Synchrnizatin, PsExec must be installed in the SMART Directry Sync prgram directry (C:\Prgram Files\Binary Tree\DirSync). Ignre the PSTls SMART DIRECTORY SYNC 5.0 REQUIREMENTS 4

5 Installatin Guide cncerning the prper installatin lcatin. PsExec is available at: SQL Server Database Requirements SQL Server can be a new r existing database server in the custmer s envirnment. The fllwing SQL Server versins (English versins) are supprted: SQL Server 2008 R2 SQL Server 2008 R2 Express with Advanced Services SQL Server 2012 SP2 SQL Server 2012 SP2 Express with Advanced Services SQL Server 2014 SQL Server 2014 Express with Advanced Services SQL Server 2016 SQL Server 2016 Express with Advanced Services The IP address and either the default SQL prt (1433) r an alternate prt must be pen t all Binary Tree servers. The ability t create and mdify tables in the Dirsync database n the SQL Server database server. It is strngly recmmended that the SQL Server database server is dedicated t SQL Server. This server can hst ther SQL databases, but shuld serve n ther purpse than being a SQL Server dat abase server. SQL Server must be cnfigured using Mixed Mde authenticatin. Using the default system administratr SQL Server lgin accunt is nt recmmended. A Directry Sync SQL Server lgin accunt shuld be created. This accunt must have sysadmin and database wner rights t create the Dirsync database. The sysadmin right can be remved frm this accunt nce the install is cmplete. 2.5 General Requirements If synchrnizing between Dmin and Exchange: All Ltus Dmin Servers need t be at a release level currently supprted by IBM/Ltus. All Dmin entries t be synchrnized with Exchange must have valid and unique SMTP addresses in the Dmin Directry. This includes peple, grups, mail-in databases, and rms and resurces. An Organizatinal Unit (OU) must be created in Active Directry (AD), with which the Dmin bjects will be synchrnized. It is recmmended that this directry be a direct subdirectry f the rt in Active Directry (AD) t avid exceeding character length limits in AD. At least ne end-user wrkstatin with a Ltus Ntes Client (versin 7.x r higher), and ne end-user wrkstatin with a Micrsft Outlk Client (versin 2003 r higher) shuld be available t represent end users. These wrkstatins may run n physical r virtual machines and will be used t validate the end-user experience. At least ne Micrsft Exchange Server versin 2007 r higher with Send and Receive Cnnectrs cnfigured fr cmmunicatin with Dmin fr message ruting between Dmin and Exchange. SMART DIRECTORY SYNC 5.0 REQUIREMENTS 5

6 All cmpnents f SMART Directry Sync are fully functinal n physical as well as virtual machines. When setting up Prf f Cncept r Pilt envirnments, Binary Tree fully supprts, in fact, recmmends the use f virtual machines as a means f lwering the expense f such prjects. Hwever, when it cmes t prductin envirnments, Binary Tree has nt yet gathered sufficient infrmatin t determine whether virtual envirnments have the same stability and perfrmance characteristics as physical machines. Because a majrity f prductin envirnments have been and are deplyed n physical machines, Binary Tree advises ptential custmers f these facts, but defers t them t make the final decisin. Binary Tree will prvide prduct supprt in bth physical and virtual envirnments. Hwever, if either stability r perfrmance issues are fund in a virtual envirnment, Binary Tree may recmmend switching t a physical ne as a means f issue crrectin. Binary Tree Servers must be cnnected via a LAN (10MB r higher) cnnectin. A high-speed WAN (5MB r higher) cnnectin may be acceptable, but is nt recmmended. Where pssible, it is recmmended t have these servers, as well as Exchange and Dmin n the same physical netwrk. SID Histry Synchrnizatin requires an administrative accunt in the surce dmain. 2.6 Exchange Access Requirements T deply Directry Sync n the Binary Tree Windws Server, an AD accunt with Server Administratin rights must be able t lg n t the server interactively. The accunt must be able t run prgrams with Administratin-level access n the target Exchange Server and specifically be able t pen the Exchange Management Shell (PwerShell). Binary Tree recmmends the fllwing setup fr the service accunt: Active Directry Minimum membership f Dmain Users (least privilege) built-in security grup Read & List Cntents rights t "Deleted Objects" cntainer. Yu may fllw these steps if yur accunt is nt a Dmain Administratr r equivalent (see KB892806): Using a dmain admin accunt, pen a cmmand prmpt and cnfirm the successful executin f the fllwing cmmands: dsacls "CN=Deleted Objects,DC=dmain,DC=cm" /takewnership dsacls "CN=Deleted Objects,DC=dmain,DC=cm" /g Dmain\ServiceAccunt:LCRP Full Cntrl rights t destinatin OU in Active Directry Exchange Administrative rights t Exchange SQL Server Create a new lgin in the SQL Server Management Studi. In Server Rles, grant public and sysadmin rights (yu may remve these rights after the database has been created). In User Mapping, select the Dirsync database and grant public and database wner rights. SMART DIRECTORY SYNC 5.0 REQUIREMENTS 6

7 Binary Tree Windws Server Member f lcal administratrs grup 2.7 Dmin Access Requirements Fr prgram installatin and restarts, if necessary, an AD accunt with remte lgn and server administratin rights t Windws Servers n which the Dmin Servers reside. Fr the mdificatin f the ruting scheme in Dmin, a Ltus Ntes ID with a minimum f Editr rights t the Dmin Directry is required. In additin, the ID must at a minimum have the fllwing rles assigned: NetCreatr NetMdifier ServerCreatr ServerMdifier A Ntes ID with greater administratin rights is preferred fr mdificatin f the Dmin ruting scheme. 2.8 SID Histry and Passwrd Synchrnizatin Requirements SID Histry Synchrnizatin Requirements Micrsft requires an administrative accunt in the surce dmain. In rder t supprt synchrnizatin f SID Histry frm the surce t the target dmains, Windws requires that a specific dmain lcal grup exists and that accunt auditing is enabled. SID Histry intra-frest migratin is supprted (with SMART AD Migratr ) with the use f an ut -f-the-bx script available frm Binary Tree. The surce and target dmains must nt have the same NETBIOS name t allw the required trust between the tw envirnments. Preparing the Surce and Target Dmains T prepare each surce and target dmain fr SID Histry Synchrnizatin, the fllwing cnfiguratin steps must be cmpleted: In the surce dmain, create a lcal grup called SurceDmain$$$, where SurceDmain is the NetBIOS name f yur surce dmain. Fr example, if yur dmain's NetBIOS name is ADM, yu must create a dmain lcal grup named ADM$$$. SID Histry synchrnizatin will fail if members are added t this lcal grup. Enable TCP/IP client supprt n the surce dmain PDC emulatr: 1. On the dmain cntrller in the surce dmain that hlds the PDC emulatr peratins master (als knwn as flexible single master peratins r FSMO) rle, click Start, and then click Run. 2. In Open, type regedit, and then click OK. SMART DIRECTORY SYNC 5.0 REQUIREMENTS 7

8 3. In Registry Editr, navigate t the fllwing registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentCntrlSet\Cntrl\LSA 4. Mdify the registry entry TcpipClientSupprt, f data type REG_DWORD, by setting the value t Clse Registry Editr, and then restart the cmputer. Enable auditing in the target dmain: 1. Lg n as an administratr t any dmain cntrller in the target dmain. 2. Click Start, pint t All Prgrams, pint t Administrative Tls, and then click Grup Plicy Management. 3. Navigate t the fllwing nde: Frest Dmains Dmain Name Dmain Cntrllers Default Dmain Cntrllers Plicy 4. Right-click Default Dmain Cntrllers Plicy and click Edit. 5. In Grup Plicy Management Editr, in the cnsle tree, navigate t the fllwing nde: Cmputer Cnfiguratin Plicies Windws Settings Security Settings Lcal Plicies Audit Plicy 6. In the details pane, right-click Audit accunt management, and then click Prperties. 7. Click Define these plicy settings, and then click Success and Failure. 8. Click Apply, and then click OK. 9. In the details pane, right-click Audit directry service access and then click Prperties. 10. Click Define these plicy settings and then click Success. 11. Click Apply, and then click OK. 12. If the changes need t be immediately reflected n the dmain cntrller, pen an elevated cmmand prmpt and type gpupdate /frce. 13. Repeat the abve steps in the surce dmain. It may als be necessary t rebt the dmain cntrller t have auditing take effect. Even with grup plicy applied n the default dmain cntrller fr the dmain audit, the server audit setting n the primary dmain cntrller (PDC) may nt be enabled. Please cnfirm this setting is enabled fr the lcal security plicy n the PDC server. If nt enabled, use the lcal security plicy t enable this setting. SMART DIRECTORY SYNC 5.0 REQUIREMENTS 8

9 Validate Crss-Dmain Verificatin In rder t receive the maximum benefit a trust shuld be in place. When a trust is present, it is necessary t ensure that the trust is prperly cnfigured t permit crss-dmain verificatin. T d s, first identify if the trust between the surce and target dmain is an external trust r a frest trust. Next, fllwing cmmands must be run frm an administrative cmmand prmpt: If the trust between the surce and target is an external trust: Frm the surce dmain: Netdm trust SurceDmain /dmain: TargetDmain /quarantine:n /user: dmainadministratracct /passwrd: dmainadminpwd Frm the target dmain: Netdm trust TargetDmain /dmain: SurceDmain /quarantine:n /user: dmainadministratracct /passwrd: dmainadminpwd If the trust between the surce and target is a frest trust: Frm the surce dmain: Netdm trust SurceDmain /dmain: TargetDmain /enablesidhistry:yes /user: dmainadministratracct /passwrd: dmainadminpwd Frm the target dmain: Netdm trust TargetDmain /dmain: SurceDmain /enablesidhistry:yes /user: dmainadministratracct /passwrd: dmainadminpwd Dmain Cntrller Access If SID Histry will be synchrnized, any Dmain Cntrller listed in the Target DCs tab within a SMART Directry Sync prfile will require access t the Dmain Cntrller hlding the PDC Emulatr Active Directry FSMO rle in the surce. Keep in mind that even if the Dmain Cntrller hlding the PDC Emulatr Active Directry FSMO rle is nt listed in the Surce DCs tab, any SID Histry migratin attempts will require a DC in the target t cmmunicate with the PDC Emulatr dmain cntrller. Fr this reasn, it is a best practice t ensure that all Dmain Cntrllers specified in the Target DCs tab within a SMART Directry Sync prfile has the apprpriat e netwrks access t cmmunicate with the surce Dmain Cntrller hlding the PDC Emulatr Active Directry FSMO rle befre a SID Histry migratin is attempted. Passwrd Requirements SMART Directry Sync des nt validate the passwrd plicies present within yur dmains. Verify that the passwrd entered as the Default Passwrd cmplies with the passwrd plicy f yur target envirnment. Objects will fail t be created if the passwrd vilates that plicy. SMART DIRECTORY SYNC 5.0 REQUIREMENTS 9

10 Sectin 3. Advanced Netwrk Requirements SMART Directry Sync t SQL Server Access Surce Target Prts Prtcl Directry Sync SQL Server hlding the primary database 1433 TCP & UDP Directry Sync SQL Server hlding the lgging database 1433 TCP & UDP SMART Directry Sync Prfile Specific Scenari Requirements Directry Sync Match Only r Update Only Prfile (n bject creatin) Surce Target Prts Prtcl Directry Sync Surce Dmain cntrllers 389, 445*, 3268 Directry Sync Target Dmain cntrllers 389, 445, 3268 UDP (389) UDP (389) * Prt 445 nly needs t be pen t the Surce Dmain Cntrller during Directry Sync Prfile creatin Directry Sync Prfile with Create Only r Create/Update Matching Optin Surce Target Prts Prtcl Directry Sync Surce Dmain cntrllers 389, 445*, 3268 Directry Sync Target Dmain cntrllers 139, 389, 445, 3268 UDP (389) UDP (389) * Prt 445 nly needs t be pen t the Surce Dmain Cntrller during Directry Sync Prfile creatin SMART DIRECTORY SYNC 5.0 REQUIREMENTS 10

11 Directry Sync Prfile with Synchrnize Passwrds selected Surce Target Prts Prtcl Directry Sync Surce r Target Dmain cntrllers 139, 389, 445, 3268 UDP (389) Directry Sync Prfile with SID Histry Synchrnizatin selected Surce Target Prts Prtcl Directry Sync Surce r Target Dmain cntrllers running Windws 2008 r newer 135, 137, 139, 389, 445, 3268 and UDP (389) Directry Sync Surce r Target Dmain cntrllers running Windws , 137, 139, 389, 445, 3268 and UDP (389) SMART DIRECTORY SYNC 5.0 REQUIREMENTS 11

12 Abut Binary Tree Binary Tree prvides rganizatins with the mst direct and predictable path t a successful technlgy transfrmatin. We ffer sftware and services t integrate and migrate crprate , directry and server envirnments. Our technlgy, methdlgy and expertise is uniquely suited t prvide fast and manageable migratins, with lw risk, little t n user dwntime, and adapted t each custmer s envirnment and r equirements. Since 1993, Binary Tree has enabled thusands f enterprise custmers t migrate mre than 35 millin users and facilitated sme f the mst cmplex technlgy transfrmatins n the planet. Binary Tree is a Micrsft Gld Partner and a glbally preferred vendr fr Micrsft Office 365 migratins and slutins. The Cmpany is headquartered utside f New Yrk City with ffices in Hng Kng, Lndn, Paris, Stckhlm and Sydney. Fr mre infrmatin, visit us at Binary Tree Scial Media Resurces Cpyright 2016, Binary Tree, Inc. All rights reserved. The Binary Tree lg and The SMART Migratin Cmpany tagline are registered trademarks, plus any references f Binary Tree, SMART Migratin, r Binary Tree s sftware r services, are trademarks, f Binary Tree, Inc. All ther trademarks are the trademarks r registered trademarks f their respective rights hlders. SMART DIRECTORY SYNC 5.0 REQUIREMENTS 12