RM Seminars spring Welcome to RM Unify

Transcription

1 RM Seminars spring 2013

2 Introduction How ICT is used in schools is being revolutionised. Historically, a school would have several ICT suites with desktop computers in them, connected by Ethernet cables to the infrastructure, applications were installed locally on these computers with users authenticating against servers housed locally within the school environment. In classrooms themselves, there may have been one or two computers in there which could be used by a small group of students, or perhaps just by the teacher with the computer connected to an interactive whiteboard. A few years ago, wireless networks became commonplace. This was when computers could break out of the ICT suite notebooks could be used in the classroom, connected by Wi-Fi to the school s infrastructure allowing users to log on and access files from the server. Teachers were provided with a notebook so they could use it in the classroom and away from school, for example at home when preparing and marking work. When working away from school, users could only access their files if products such as RM EasyLink, (or more recently RM Portico), were installed on the school network. This then gave them access to their files but not necessarily the applications these files used they had to be installed on the computer they were using away from school. Again, solutions are available to overcome this, such as CC4 Anywhere however, this meant more hardware in the school for the network support team to manage and run. Then the term the cloud started to be used. These centrally hosted solutions which are run from a data centre somewhere in the world, started to be used. Many of us have been using cloud-based apps for many years if you have a Hotmail address then you have been using a cloud service for your . In this paper we won t be looking at what the cloud is because Matt Edwards presented a session based on this at the autumn 2012 round of the RM Technical Seminars and you can find the white paper for this session by clicking on this link. Over the last few years we have seen the software that we traditionally installed on the computers that we managed in school have become available as a cloud service applications such as Microsoft Office, Exchange and SharePoint can now be used from the cloud, and the number of cloud-based applications is growing, almost on a daily basis RM Education Page 2

3 The applications are launched from a browser, files can be stored in the cloud and the cloud-based apps are no longer limited to running on a specific operating system. Although Microsoft Windows is the most popular computer operating system in the world, devices such as ipad and Android devices have exploded in popularity as personal devices both in and out of school, so the network support team has to be able to offer applications across a wide and varied array of devices. Cloud services are the perfect solution to this as they are often device agnostic. Another change we are starting to see is BYOD Bring Your Own Device schools are allowing users to bring their own devices in to school to use. This has many benefits but one thing it also brings is the lack of control over what devices can be used during lesson times. A device could range from a tablet running ios through to a MacBook Air running OS X. BYOD is a topic all of its own and during this round of the RM Seminars, a BYOD session is being presented by Simon Ansell and the white paper for this session is available. For the adoption of cloud services and BYOD it is important that the school s infrastructure can support these devices. Schools are looking to introduce managed wireless networks which provide security and capacity that makes using devices and cloud services fast, secure and with minimal support requirements. To use a cloud-based application, users simply log-on to the cloud based application through the browser on any device that has a connection to the Internet and can use the application, accessing and creating their files from anywhere in the classroom or in the local park. Simple! Everything is in place then for schools to start using cloud-based applications: Mobile devices of any type. Wireless networks. Fast Internet connections. Personal devices available away from school RM Education Page 3

4 But Productivity based applications such as Microsoft Office 365 are available in the cloud for use on any device in any location. There are a few things that the network support teams need to think about: 1. How are users going to manage the different usernames and passwords for each of the cloud-based services the school is going to offer? 2. What are the best cloud-based services that can benefit your users? 3. How does the network support team manage the access to the cloudbased services? User management of cloud-based services We saw earlier that in order to use a cloud-based service the user signs in to it through their browser and starts using the application. This starts to introduce overheads: Network support teams have to provision, or create, the user accounts for each user in the school who will be using the cloud-based service. As the number of cloud-based services the school begins to offer increases, the number of usernames and passwords the user needs to remember will grow. Even if the network support team create user accounts for each cloud-based application following a similar naming convention for usernames, it is inevitable that over time, passwords will change over the different cloud-based applications, perhaps based on policies that the cloud-based application uses. This now begins to look unappealing to the network support team: 2013 RM Education Page 4

5 There will be the initial management overhead of creating the users for each of the cloud-based applications. There will be the management overhead of password resets when users forget their passwords - and we all know they forget their passwords! Which cloud-based services should be offered? There are now hundreds, if not thousands of cloud-based services available. Some may seem like they would benefit your users but can you be sure that they couldn t, for example, offer content which wouldn t be suitable for a school? How do you control access to cloud-based services? There may be cloud-based services that are appropriate for teaching staff but not students. The network support team needs a way of controlling which services the different types of users in school can access. It should also be easy and quick to find and open these services.! RM Unify is your Launch Pad to the cloud. Through RM Unify, offering cloud-based services in your school is quick and easy. In this white paper we will look at how RM Unify makes it easy to solve the potential problems that were mentioned above. We will also take a look at how RM Unify works and some best-practice advice for you to make the management of RM Unify even easier. RM Unify is composed of two parts The Launch Pad and the Management Console. There s actually a third part which is where the magic happens allowing 2013 RM Education Page 5

6 the single sign-on to work between cloud services. This will be examined in more detail later in this white paper. The Launch Pad This is the part of RM Unify that users see and interact with. From any browser a user can browse to the RM Unify web address which will then display the RM Unify sign in page. As you can see from the screen shot above, RM Unify can be launched from a computer or from a mobile device such as ipad or an Android device. After a user has logged in to RM Unify, the Launch Pad is displayed displaying the cloud services the user has access to: 2013 RM Education Page 6

7 RM Seminars spring 2013 The Launch Pad is managed by the administrator of RM Unify and makes cloud services available to the different types of users that can be configured in RM Unify. These different types of users are: Students Teaching staff Non-Teaching staff When a user signs in to RM Unify they only have the ability to launch the cloud services that have been made available on their Launch Pad. When a teacher signs in they have the ability to browse the RM Unify App Library. The App Library contains all the cloud services that work with RM Unify and by clicking the Visit App Library link along the top of the RM Unify Launch Pad teachers can see the cloud services they could have access to RM Education Page 7

8 RM Seminars spring 2013 By clicking on the information badge for an app, RM Unify provides more information on what this service provides access to. Teachers don t have the ability to add these apps to the Launch Pad however, if they would like it available to students, or themselves, then they can request it is added to the Launch Pad so users have access to it when they sign in to RM Unify. Managing the Launch Pad Management of the RM Unify Launch Pad is carried out by the RM Unify administrator. Just like the administrator of a network, they have access to the management capabilities of RM Unify. The administrator can manage user accounts and access to cloud services through the RM Unify Launch Pad for the different types of users in a school RM Education Page 8

9 Organising cloud services The RM Unify administrator has the ability to organise the cloud services the user has available to them in the Launch Pad. App tiles are organised through screens which the user can click through using the navigation arrows or swipe if the device has a touch screen. It would make sense to have the most commonly accessed apps available on the first two or three screens of the Launch Pad, probably like you have done with your smart phone. To make changes to the layout of the grid the RM Unify administrator can: 1. Click the Edit Grid icon on the RM Unify Launch Pad screen. 2. Select the Launch Pad the administrator wants to edit from the available types of users on the left-hand side of the screen. You will notice that now, rather than the app tiles being displayed on separate screens, they are now displayed on a single page and each Launch Pad screen can be viewed by scrolling down the page. 3. Simply click and drag the app tiles to the location the administrator wants them to appear on the Launch Pad RM Education Page 9

10 4. Letting go of the app tile releases it and places it in the new location. 5. Once the changes have been made, clicking on the Save Changes button makes the changes to the Launch Pad. RM Unify users will be able to see these changes straight away. On each app tile there is a settings icon and when this is clicked, the following options are available: Hide: This hides the app tile from the Launch Pad. The cloud service is still on the Launch Pad however it cannot be seen, and used by the type of user of the Launch Pad being edited. This is useful if the app has been added to a type of users Launch Pad for a particular task, for example an exam. Uninstall: This option removes the cloud service from the Launch Pad of the type of user whose Launch Pad is being edited. It can be easily added back at a later date through the App Library RM Education Page 10

11 Adding new apps to the Launch Pad We have already looked at the App Library as a teacher who has access to the App Library when they are signed in to RM Unify. When viewing the App Library as the RM Unify administrator it is possible to add app tiles to the Launch Pad of the different types of users available in RM Unify. In the App Library (when signed it to RM Unify as an administrator) the available cloud services can be managed. By clicking on the Manage button, RM Unify displays the following information about the cloud service: Description: A description of the cloud service that can be added to the Launch Pad for users. It also provides details about the cloud service provider. Shared information: Many cloud services require information so that the service can be accessed. This could be to create user accounts so the service is unique to the user. RM Unify only shares the required information to the cloud service so that it can be used. The information that will be passed to the cloud service being accessed is listed and the administrator has to accept that they are happy with this information being shared. User roles: The RM Unify administrator can select which types of user can access the cloud service. By placing a tick in Installed Roles, all users of RM Unify will have access to the app, or alternatively specific user roles can be selected so that, for example, if a cloud service is only being accessed by Teaching Staff then only this user role can be selected. It is possible here to hide the app if you are configuring the Launch Pad but don t want the app to be initially available RM Education Page 11

12 Clicking on the Update button saves the changes and makes or updates the settings for the app on the users Launch Pad. The Management Console The Management Console allows most of the user management to be carried out in RM Unify. One of the great things about RM Unify is that, if you choose to, RM Unify can carry out most of the user management for you. There are several options for adding users to RM Unify, these are: Adding users by creating your own CSV (comma separated value) file. Creating a CSV file from Active Directory. Synchronising Active Directory with RM Unify. Adding users by creating your own CSV file Some schools, such as small primary schools, may not have an Active-Directory based network, or the network support team would like to manage users in RM Unify manually. For this reason, it is possible to create your own CSV file to add users to RM Unify. In the RM Unify Management Console it is possible to download a CSV file template, which you can then populate with the information RM Unify needs in order to create user accounts that can then be used to sign in to RM Unify. The CSV template is accessed through the RM Unify Management Console: 1. Log on to RM Unify as the RM Unify administrator. 2. From the menu bar, along the top of the RM Unify Launch Pad, click on Management Console RM Education Page 12

13 3. From the User Dashboard, click Sync users from CSV. 4. In the Need a new CSV? link, click on Download a sample CSV The sample CSV file will be saved to your Downloads folder for your browser. You can edit the CSV file in a spreadsheet application such as Microsoft Excel or a text editor like Windows Notepad. There are ten columns in the CSV file which should be completed as follows: PersonID: This is a unique identifier for the user account. RM Unify uses this information to identify the user within the system so it should never change. If you are creating users manually then you might want to consider your own numbering conventions for this. Username: This is the local username for the user. If a user uses a username to log on to a school computer then you might want to consider using the same format for this user name in RM Unify. The maximum length of a username is twenty-characters. Password: In this field you can enter the password for the RM Unify user to use when it creates the user account. The maximum length of an RM Unify password is twenty-characters RM Education Page 13

14 DisplayName: As the field name suggests, this is the display name that will be shown in RM Unify, and any cloud services that uses this information when launching a web app from the RM Unify Launch Pad. Web apps that will use this information include RM Books and Microsoft Office 365 Outlook. It s also a simple check a teacher or parent could use to make sure that a student is logged in to RM Unify as the correct user. The maximum length of a display name is 256-characters. FirstName This should be self-explanatory as this field requires the first name of the user you are adding to the CSV file for RM Unify to create a user account for. The maximum length of a first name is 64-characters. LastName Again, this should be self-explanatory and this field requires the last name of the user for the account you are adding to the CSV file for RM Unify. The maximum length of a last name is also 64-characters. Role: This field tells RM Unify the user role of the user you are adding to the CSV file. There are three user roles available in RM Unify: o Student o NonTeachingStaff o TeachingStaff Select one of these roles for the user you are adding. YearOfEntry: In this field you should enter the year of entry the student user entered the school. If you have a Community Connect 4 network, you may be familiar with adding this data to the properties of a user account. Sometimes this 2013 RM Education Page 14

15 data can cause confusion, particularly if a student user doesn t join the school in their first year, (e.g. Year 7). The YearOfEntry data should be the year the student would have started school so, for example, if a student joined the school in Year 9 in 2012, then their year of entry should be The reason this is important is that this information could be used in a web app to organise users for permissions-based access based on intake years. If the year 9 student s year of entry was added as 2013, (because this is when they joined the school), then they could have the same access rights for a web app as a year 7 student today. The year of entry data should be entered in the format yyyy (e.g. 2013). Home Address: This is an optional field where you can enter an address for the user. This information could be used in the future by RM Unify to a reset password request. The maximum number of characters that can be entered in to this field is 128. MisID: This is an optional list of identifiers that can be taken from a school s MIS system, such as RM Integris or SIMS. This information can help RM Unify identify a user should it need to. The accepted data in this field can be: UPN SIMSAdmissionNumber MISInternalKey SIFRefID TeacherID SCN ULN User Principle Name A reference from the SIMS Management Information System This is a piece of data that can be extracted from SIMS. This is the RefID that can be extracted from an MIS. The Teacher s ID number extracted from the MIS. This is the Scottish Candidate Number. This is the Unique Learner Number. Once this data has been entered in to your CSV file it can then be uploaded in to RM Unify by following these steps: 2013 RM Education Page 15

16 1. In the RM Unify Management Console, click on Sync users from CSV. 2. In the Upload CSV section, click the Browse button to locate your CSV file. 3. Choose the relevant options by ticking the relevant boxes: Overwrite passwords for existing RM Unify users : If a user account in the CSV file already exists as an RM Unify user, then replace the password of the existing user with the one in the CSV file. This is useful if you want to perform a blanket password reset of the existing users in RM Unify. Delete users from RM Unify if they are not present in CSV : If there is a user account in RM Unify that isn t present in the CSV file that you are uploading then RM Unify will delete this user account preventing the user from logging on. This is a powerful option and you should normally only use this if you are using a single CSV file for creating users and want to remove any users from RM Unify because they are no longer using the Launch Pad. 4. Click on the Upload button. RM Unify will then be synchronised based on the contents of the CSV file and the options selected in the Management Console to create new users, or update existing ones. Once the file has been uploaded to RM Unify, the user accounts will be created in about 24 hours and you will be informed by when the user accounts have been created. You can carry on using the original spreadsheet you have created to add or remove users going forward because the RM Unify process for managing users synchronises the contents of the CSV file with the information it holds in its information store. What that means to the network support team from a user management point of view is: 2013 RM Education Page 16

17 When a CSV file is uploaded to RM Unify, any details that exist in the file but aren t in the information store will result in a new user account being created. When user details exists in the RM Unify information store but don t exist in the CSV file, and the Delete users from RM Unify if they are not present in CSV is ticked then the user account will be deleted. If user details exist in the information store and in the CSV file but the details are different in the CSV file, the existing user will be updated. This rule excludes passwords, (unless the Overwrite passwords for existing RM Unify users is ticked), You should use this option with caution though, as the password in RM Unify may have been changed since the CSV file was first used to create the user account. Troubleshooting There are some important things to remember if you are manually creating users using a CSV file in RM Unify: 1. If you are creating your own CSV file, and not using the one which can be downloaded from RM Unify then include all the column headers above, even if you are going to be leaving some blank. 2. Use the same names for the column headers as the ones above. 3. If you have extracted the data from another system, it shouldn t include commas, (this is how a.csv file separates the field in its text file). You may see that RM Unify generates an error when you upload the CSV file, here is some guidance on how to correct the problem: Empty file: I hope this is self-explanatory and an empty CSV file has been uploaded to RM Unify. Invalid headers: The column headers in the CSV file do not match the naming conventions that RM Unify expects. Correct the column header names and upload the CSV file again RM Education Page 17

18 Missing field: For one of the users in the CSV file, there is a mandatory field that is empty and RM Unify cannot create the account. Internal error please try again later: There may be an issue with RM Unify and you should attempt to upload the CSV file again later. If you keep seeing this error you should use the RM Knowledge Library to check the system status of RM Unify. Adding users from Active Directory For schools with a client-server network, the point-of-truth with regard to users is likely to be Active Directory. When a user logs on to a computer, (for example on a Community Connect 4 network), the user must have a username and password. When they log on, Active Directory authenticates those credentials. Probably the easiest way to add users, and keep them synchronised, with RM Unify is to use Active Directory to create your user accounts. There are two ways that you can use Active Directory to manage the user accounts in RM Unify: Synchronise the local copy of Active Directory with RM Unify. Create a CSV file from the contents of Active Directory to synchronise with RM Unify. Preparing the users on Community Connect 4 for synchronisation with RM Unify All of the required data to synchronise Active Directory with RM Unify will already be present, however, there is some optional information that can be taken from Active Directory, and therefore Community Connect 4, to make management of users easier. Earlier, we looked at the data that is added to the CSV file for managing user accounts in RM Unify. This is the same data that is synchronised with Active Directory on a Community Connect 4, (or a vanilla Active Directory network) RM Education Page 18

19 If we consider this data we will see that most of this information can be taken from Community Connect 4: RM Unify Data PersonID Username Password DisplayName FirstName LastName Role YearOfEntry Home Address MisID In CC4? ü ü ü ü ü ü ü ü û ü Some of the data above which would be synchronised with RM Unify from Community Connect 4 is optional. On a Community Connect 4 network, the following properties aren t required and therefore may not exist in the data used to create RM Unify user accounts: User first name. User last name. User display name. User year of entry. In order to prepare the user accounts ready for synchronising with RM Unify, it makes sense to get the data ready in Community Connect 4. To reduce the amount of work required to do this, we can use the Import User option in Community Connect 4 to update the existing user accounts with the information that allows RM Unify to create the users. You may use the Import Users wizard to create users on your Community Connect 4 network as it is particularly useful when you are adding lots of users, for example at the start of a new school year. We can use this wizard to update existing user accounts as well though, so if there is any information missing from Community Connect 4 we can easily add it. The first step to update the users that currently exist on a Community Connect 4 network is to obtain a CSV file from the school s MIS system that contains the missing data RM Education Page 19

20 Note: You will also need any data that will be required for the username, for example the first and last name of the users. The MIS system is probably where the file initially used to create the users came from. This file should be recreated in the MIS system, including all the data that RM Unify requires, or it s recommended is added to RM Unify. Once you have the CSV file, the following steps will allow the existing user accounts to be updated in Community Connect 4: 1. Log on to a Community Connect 4 computer with the RM Management Console installed. 2. From the File menu, click Import and click on Users. The import users wizard will start. 3. In the first screen of the Import Users wizard, click the Browse button and select the CSV file which will be used to update the existing users and choose Open. The data in the CSV file will be previewed. You can review the data to make sure it contains the data needed to update the existing users on your network. Click Next > when you are happy with the data you have. 4. In the Name Clash Options section of the next screen of the wizard, choose Update user and click Next >. This tells Community Connect 4 to update the existing user accounts with the new data that is in the CSV file. 5. On the next screen the data in the CSV file needs to be mapped to the properties of the existing users on the network. Important: If the user accounts that exist have had their usernames generated using the <Auto Generate> option then you must use the same rule so that when the wizard attempts to match users that exist in Community 2013 RM Education Page 20

21 Connect 4 already it will use this auto generate rule to match them. 6. For the user properties that need updating for the existing users, map this data with the contents of the file you are using to update the users. You can check that the data is being updated in the Preview section of the screen. 7. Once you have confirmed the data is correct, click Import. The import wizard will now run and update the existing user accounts that exist in Community Connect 4 with the additional data supplied in the CSV file. Preparing the users on a vanilla network for synchronisation with RM Unify If the network support team use Active Directory to manage the network then, as with Community Connect 4, the data that will make RM Unify, and the cloud services work better together should be present. As with Community Connect 4 networks, the user data that should be present in Active Directory is: Username. First Name. Last Name. Display Name. The optional data that can be available in Active Directory is: address. There are several options for updating this information in user accounts in Active Directory. The obvious way would be to manually make the changes in every user home account. This is obviously going to take a long time so it makes sense to try and automate this process. Microsoft PowerShell PowerShell is a scripting tool, which is being used more and more on Windows Server networks. The PowerShell scripting tool is beyond the scope of this white paper however Simon Ansell has produced a white paper, and presented a session in the spring 2013 round of the RM Seminars on this subject. To learn more about 2013 RM Education Page 21

22 PowerShell you can view his white paper, and there are also lots of resources available on the Internet about using PowerShell to update user properties in Active Directory. You may find these links useful: Important: Microsoft TechNet: Set-ADUser Hey, Scripting Guy! Blog: Use PowerShell and Active Directory cmdlets to update Users in Active Directory: You must make sure you have a good working backup of your domain controller, and Active Directory before using PowerShell and scripts to modify the data contained in it. The RM Active Directory synchronisation tool The tool that requires the least management capacity from the network support team is the Active Directory synchronisation tool. The Active Directory synchronisation tool is available to premium users of RM Unify and is downloaded from the RM Unify Management Console. There are two components that need to be installed for RM Unify to synchronise with Active Directory on a Windows Server network: The RM Unify AD Sync tool: This tool, which runs as a service on a domain controller, is used to synchronise user accounts with RM Unify. This includes the creation or deletion of user accounts, and any changes to existing users, such as the renaming of a user account. The RM Unify Password Filter: This component, which again runs as a service, is installed on every domain controller that is part of the network. This component captures password changes on the network and synchronises RM Unify with the changed password RM Education Page 22

23 There are seven steps to installing the RM Unify Active Directory synchronisation tool: 1. Install any pre-requisites required for the tool to work correctly. 2. Download the RM Unify AD sync tool. 3. Install the RM Unify Active Directory synchronisation tool. 4. Install the RM Unify password filter on all the domain controllers on the network. 5. Map account roles to RM Unify. 6. Get a LAN sync tool registration code. 7. Synchronise the user accounts. Downloading and installing the RM Unify Active Directory synchronisation tool The RM Unify AD sync tool is downloaded from the RM Knowledge Library but can be accessed from the Management Console in RM Unify: 1. Sign in to RM Unify as an administrator. 2. Click on the Management Console link and click on Sync users from LAN in the left-hand pane. 3. In the right-hand pane, click on the Get the LAN Sync Tool button. This will open a page in the RM Knowledge Library where you can download the RM Unify AD sync tool. It is important to note there is a 32-bit (for Windows Server 2003 domain controllers) version and a 64-bit version (for Windows Server 2008 R2 and Windows Server 2012 domain controllers) of this tool. You must install the correct version of this tool for the operating systems installed on your domain controllers RM Education Page 23

24 RM Unify Active Directory synchronisation tool pre-requisites For the RM Unify Active Directory synchronisation tool to work the following components need to be installed on some of your domain controllers: Microsoft SQL Server 2008 R2: When the RM Unify Active Directory synchronisation tool extracts data from Active Directory it stores it in an SQL database instance. You may already be using Microsoft SQL Server 2008 R2 on your domain controllers, (it will be installed by default on a Community Connect 4 managed network with RM Portico installed). If Microsoft SQL Server 2008 Full or Express isn t installed on your network then you can follow the instructions for the installation of it in the RM Knowledge Library, by searching for the article TEC This article was originally written for installing RM Portico however the same instructions can be used to install Microsoft SQL Server 2008 R2 express for the RM Unify Active Directory synchronisation tool. Create an RM Unify security group, (Community Connect 4 managed networks only). On a network that is managed by the Community Connect 4 management tools you should create a security group in the RM Management Console with a meaningful name such as (RM Unify Users). It may be that you do not want all users on the network to use RM Unify, for example in a primary school, users in foundation or key stage one. To allow you to control who has access to RM Unify, you should make users who you want to use RM Unify members of this security group. When the RM Unify Active Directory synchronisation tool is running, it will only detect users who are a member of this security group. During the installation of the tool, you will be prompted to tell the installation program the name of the security group you have created. If you need help creating a security group in the RM Management Console, please consult the on-software help. Once the pre-requisites for using the RM Active Directory synchronisation tool have been checked you can now install the tool itself. On a Community Connect RM Education Page 24

25 network we recommend that you install this tool on a replica domain controller; on a vanilla network you need to assess the most suitable domain controller to install the tool on. You should choose a domain controller with the most resources available. During installation, the tool will detect some of the required information but it will also prompt you for the following information: SQL Server details: During installation the setup program will prompt you for the following information: o The name of the server (if SQL Server is installed). o The instance name, if this is applicable. o The SQL Server Authentication details, again if this is applicable. The Active Directory organisational unit: When running, the RM Unify Active Directory synchronisation tool will search the organisational unit, (OU), (and any sub-ous), for user changes. Any user account objects that exist outside of this structure will be ignored and any changes won t be synchronised with RM Unify. On a Community Connect 4 network, the information in here would typically be: OU=<Site code>, OU=Establishments, DC=<Schoolname>, DC=internal e.g. OU=MPS, OU=Establishments,DC=MiltonPark, DC=internal Domain Controller used to check for user changes: This will be the domain controller that the tool uses to check if user details have changed. You can use the name of the domain controller that you are installing this tool on. Proxy Server address: If you connect to the Internet using a proxy server, then you should add the details in here, including the port to use for sending the user changes 2013 RM Education Page 25

26 data to RM Unify. The RM Unify Security Group, (Community Connect 4 managed networks only): You should add in here the name of the security group that you have created for the user accounts that will be synchronised with RM Unify. Once the setup has completed, the RM Unify Active Directory synchronisation tool will be installed. Installing the RM Unify Password Filter Once the RM Unify Active Directory synchronisation tool has been installed, the second required component, the RM Unify Password Filter needs to be installed. This component needs to be installed on every domain controller that is part of the network. There are two important points to remember for the installation of this component: 1. A server restart will be required after installing the RM Unify Password Filter so schedule this installation at an appropriate time. 2. When installing the tool on multiple domain controllers, you must ensure the installation completes on a domain controller, (including the server restart) before installing on the next domain controller. During the installation of the RM Unify Password Filter, you will be prompted to enter the name of the server where the RM Unify AD sync tool has been installed, you should have this information to hand so the details can be entered correctly. RM Unify LAN sync tool registration code RM Unify has been designed from the ground-up to be safe and secure and this extends to the transfer of user data from Active Directory on the network up to RM Unify. To ensure that user data can only be sent from your school network to the establishment s RM Unify site, a LAN sync registration code is required from RM Unify and needs to be installed on the domain controller that has the RM AD Sync tool installed so that RM Unify knows that it is your network that is sending user data to it. This secure key, which takes the format of A512B-R123G-KJM96-8AD2S is created in RM Unify. To obtain a key: 2013 RM Education Page 26

27 1. Sign in to RM Unify as an administrator-level user. 2. Click on the Management Console link and then the Sync users from LAN link. 3. In the right-hand pane, click on the Generate New Registration Code button. If the button is greyed-out then you have the standard version of RM Unify that doesn t support the synchronisation of user changes from Active Directory. You can upgrade at any time to RM Unify Premium by clicking on the Upgrade Subscription link. Note: This code is only valid for 48 hours. If the RM Unify AD sync tool hasn t been registered with RM Unify by this time, a new registration code will need to be generated. You should record the Registration code because this will need to be entered into the RM Unify AD sync tool before any user changes will be synchronised with RM Unify. Adding the registration code to the RM Unify AD sync tool Once the RM Unify AD sync tool has been installed and you have generated the LAN sync tool registration code, it must be added to the tool before any user changes will be sent to RM Unify. As we have already seen, this ensures that RM Unify knows it is your network that is sending these changes. This registration code is added to the RM Unify AD Sync tool using a utility that was installed on the domain controller as part of the installation of the tool this is called the RM Unify Organisation Setup Tool. You use this tool to make any changes to the setup of the RM Unify AD Sync tool after it has been installed. To add the registration code: 1. Log on to your domain controller that has the RM AD sync tool installed RM Education Page 27

28 2. From the Start menu, (or in Windows Server 2012, the Start screen), open Services and locate the RM Unify AD Sync Service and click on the Stop Service button to stop this service. 3. Leave the Services window open. 4. From the Start menu, click on All Programs, RM Unify AD Sync service, RM Unify Organisation Setup Tool. Note: On a domain controller running Windows Server 2012, on the Start screen you can type RM Unify AD Sync Service to find and open this tool. 5. Click on the Register button. 6. Enter your RM Unify organisation code and registration key, then click Continue. 7. A message will be displayed confirming you have entered the correct details. Click on OK. 8. Return to the Services window and start the RM Unify AD Sync service. Any user changes will now be synchronised between Active Directory on your network and RM Unify. Should you ever need to reinstall the RM Unify AD sync tool then you will need to re-enter this registration code. If for some reason you are not sure what the registration code was when you first configured the tool then a new one can be generated in the RM Unify Management Console. Once a new registration code has been generated however, the old one becomes invalid so any existing installations, (which there shouldn t be because the RM Unify AD sync tool should only ever be installed on one domain controller on the network), will stop synchronising with RM Unify RM Education Page 28

29 RM Unify role mapping In RM Unify there are three roles that are currently supported: Students Teaching Staff Non-Teaching Staff Schools often have users of the network who wouldn t be grouped in to one of the three types of users above. These could include Associates and System Administrators. It is possible to make user roles on a network use one of the three above roles in RM Unify using the RM Unify Organisation set up tool that we looked at earlier in this white paper. There are three ways that RM Unify roles can be mapped to network user accounts: Based on the profile path of the user account. The organisational unit the user account object exists in in Active Directory. The security group the user account is a member of. On many networks, where roaming profiles are used, a folder is required on a server to store this profile. When a user logs on to a computer, the contents of this folder are downloaded and when they log on, the profile is updated back on the server this allows for a consistent user experience when users roam between computers. These folders are typically grouped together into types of users therefore we can use that in the RM Unify AD sync tool as an indicator to the type of user we are looking at. On a Community Connect 4 network, this is how the type of user is identified for roles in RM Unify because the profile path share name for a user s roaming profile is based on the type of user they are. For a vanilla Windows server network, the profile path is unknown to us, so through the RM Unify Organisation Setup Tool it is possible to tell the RM Unify AD sync tool what the profile path is for the different user roles available in RM Unify. If the user profiles for all types of user are accessed from a single network share, (i.e. it is a flat folder structure), then it isn t possible for the RM Unify AD sync tool to use this method of identifying the type of user role to be used in RM Unify. The second method that RM Unify can use to map roles to user accounts is the location of the user account object in Active Directory RM Education Page 29

30 In the screenshot of Active Directory below, we can see the structure of OUs for user accounts: The OU names are pretty self-explanatory, student user accounts are in the Student Users OU, teacher user accounts in the Teaching Staff OU and so on. If user accounts are organised like this, as they are on a Community Connect 4 network then it is possible to map RM Unify roles to user accounts in OU locations in Active Directory. For example, we could map users in the NonTeaching Staff OU to be Teaching Staff roles in RM Unify using the RM Unify Organisation setup tool. The final method of mapping RM Unify roles to user accounts that exist on the network is to use security groups. In the RM Unify Organisation setup tool we can tell the RM Unify AD Sync tool to match roles based on group membership. Whilst this is possible, we consider this the last resort option if none of the above two methods can be used. The reason this is the least preferred option is that examining group membership is a time consuming task and it will take the RM Unify AD sync service longer to create users in RM Unify, (especially during the first synchronisation), if we are using this method. The RM Unify AD Sync service. Any changes made using the RM Unify Organisation Setup tool won t be implemented until the RM AD Sync service, which runs on one of the domain controllers that are part of the network, is stopped and started so you must remember that after making any changes to the configuration of the RM Unify AD Sync tool, such as those we have just looked at, the service must be stopped and started for the changes to take effect. Synchronising Active Directory users with RM Unify for the first time Once the RM Unify AD Sync tool has been installed and configured using the RM Unify Organisation Setup tool, the first synchronisation can take place RM Education Page 30

31 Earlier in this white paper the steps were taken to create a Windows Security Group that users who are going to be using RM Unify should be a member of. This is the final stage of the setup which will allow Active Directory to synchronise with RM Unify. To trigger the synchronisation with RM Unify for the first time you need to make the user accounts who will be using RM Unify members of the security group you have created, (in the example earlier in this white paper, the security group was called RM Unify users). If you have a Community Connect 4 managed network then this can be done using the RM Management Console. So that any new users you create will automatically be made a member of this group you may want to consider adding it to the User Templates used to create new user accounts. With a vanilla network, Active Directory Users and Computers can be used to add user accounts to the security group you have already created. Once the users have been made membesr of this group they will be synchronised with RM Unify. RM Unify user account creation and passwords We have seen that RM Unify will synchronise network user accounts, including passwords once the RM Unify AD Sync tool has been installed and configured. The first time the synchronisation tool runs however, it will create any new user accounts in RM Unify but it is unable to extract the passwords from Active Directory. This is because the passwords are encrypted in Active Directory and it is impossible for this encryption to be reverse engineered. Network passwords will only be synchronised with RM Unify once the users have changed their network passwords, so it is recommended that after the RM Unify AD Sync tool is installed a system-wide password change is implemented. You can request users change their passwords the next time they log on or you can enforce this in the RM Management Console by performing these steps: 1. Group select the users whose password you want to change. 2. Right-click within the selection and choose Reset Password. 3. Enter the new password for the users you have selected. 4. Optionally place a tick in Force user to change password at next logon 2013 RM Education Page 31

32 5. Click OK. The Community Connect 4 management tools will then change the passwords of the selected users. You should consider carrying out this task in blocks of users, for example, types of user, such as Students, or intake years. This is particularly important if you have a lot of users on your network. You should plan this change in order to reduce the potential of users not being able to log on which could be disruptive to the start of a lesson. You should ensure that this change is communicated around the school so that all users are aware that, after you have implemented the change, they will have to log on with their temporary password and, if configured, they will have to change their password following log on. Creating a CSV file from the contents of Active Directory to synchronise with RM Unify The second option for using Active Directory to create user accounts in RM Unify is to extract the contents of Active Directory into a CSV file which can then be synchronised with RM Unify through the Management Console. We have made available a tool called the RM Unify CSV Extraction Tool which will export the user data from Active Directory on a Community Connect 4, Community Connect 3 or vanilla network and create a CSV file from the user information that s in Active Directory. The CSV file can then be used to synchronise the user data with RM Unify. If this tool is run on a network which has the Community Connect 4 management tools installed, then additional data which can be used with cloud services will also be extracted along with the data from Active Directory. The RM Unify CSV Extraction Tool can be run on any Windows domain controller that has the following installed: Windows Server 2003, Windows Server 2008 R2 or Windows Server Microsoft.NET Framework v3.5 SP1 Active Directory 2013 RM Education Page 32

33 Installing the RM Unify CSV Extraction Tool 1. Sign in to RM Unify as an RM Unify administrator. 2. Click on the Management Console link at the top of the page. 3. In the left-hand pane, click on Sync users from CSV. 4. In the right-hand pane, click on Generate a CSV from your AD. This will open a new article in the RM Knowledge Library. If you are prompted to sign in to the RM Knowledge Library, enter your username and password and click Log in. 5. Download the file RM_Unify_CSV_Extraction_Tool.zip and save it to a temporary location on your Forest Root domain controller or Community Connect 4 First server if you have a CC4 Matrix or CC4 TEN (Tools for Existing Networks) installation. 6. On this server, browse to where you saved the file in step 5, and doubleclick the file to extract it. 7. In the folder where the files were extracted to, double-click on: RMUnifyCSV.exe A setup wizard will start. 8. When prompted, click Continue and Finish to install the RM Unify CSV Extraction Tool. The tool will install and a shortcut will be created and added to the Start menu or on the Start screen on Windows Server 2012 domain controllers RM Education Page 33

34 Mapping users to RM Unify roles We have already seen that users have roles in RM Unify. There are three roles that users can be configured to use: Students Teaching Staff Non-Teaching Staff To synchronise the users in Active Directory with the roles available in RM Unify, you have to map the user accounts in Active Directory to these roles. As with the RM Unify AD Sync tool, roles can be mapped with user accounts through their: Profile path. Organisational Unit. Security group membership. To create the CSV file which can then be used to synchronise Active Directory with RM Unify you need to perform the following steps: 1. From the Start menu, (or Start screen), open the RM Unify CSV Extraction Tool RM Education Page 34

35 2. When the tool opens, configure the following information: Unify Role Mapping: This is where you tell the tool how to map user accounts to role using one of the three options above. Remember that if you choose the third option, security group membership, it will take longer to extract the data from Active Directory due to the work required to examine security group membership. On a Community Connect 4 managed network, these paths will be defined for you and on a vanilla network these can be added. The Add, Edit and Remove buttons allow you to add additional role mappings so that you could, for example, create RM Unify user accounts for Associate users and assign them the role of Non- Teaching Staff in RM Unify. Active Directory Search Path: This is the location in the Active Directory structure where the user accounts would be. On a Community Connect 4 network this would be: OU=<SiteCode>,OU=Establishments,DC=<SchoolName>,DC= internal For example: OU=MPS,OU=Establishments,DC=MiltonPark,DC=internal Initial Passwords: There is an option for the user accounts in RM Unify to either have a randomly generated eight-character password or a default password selected by the person running the tool. CSV Output Path: This is the location where the CSV file will be saved. You need to remember this location, as you will need to browse for the CSV file later when you are ready to upload it to RM Unify RM Education Page 35