User Management Resource Administrator 7.2

Transcription

1 User Management Resource Administrator 7.2

2

3 Table Of Contents What is User Management Resource Administrator... 1 UMRA Scripts... 1 UMRA Projects... 1 UMRA Software... 1 Quickstart - Sample project wizard... 3 Step 1: Prerequisites... 3 Step 2: Install User Management Resource Administrator... 3 Step 3: Start User Management Resource Administrator wizard... 3 Help on help... 5 New users... 5 All users... 5 Script actions... 5 Reference topics... 5 Release notes... 7 User Management Resource Administrator version Build 1164, July 1st, Action - Create directory: When the directory name is changed to make it unique, the new unique name is now exported. In previous versions, the incorrect already existing directory name was exported Build 1141, April 29, Build 1065, September 17, Build 1030, July 1, Notes on User Management version Features Application type Script features Other product features Reference iii

4 User Management Resource Administrator 7.2 Installation Installation Projects Different project types Scripts Mass project Form project Delegation UMRA Delegation - General UMRA Delegation - Access and security UMRA Console Installation UMRA console - Command line options Window types Log Wizard UMRA Service UMRA service - Introduction UMRA service - Service Access UMRA service - license UMRA service - Advanced options UMRA service - logging UMRA service - Installation UMRA Forms UMRA forms - Introduction UMRA forms - installation UMRA forms - service connection UMRA Automation iv

5 Table Of Contents UMRA Automation - Introduction UMRA Automation - Principle UMRA Automation - COM object UMRA Automation - COM interface UMRA Automation - COM interface UMRA Automation - Executing a project script UMRA Automation - Command Line Interface Licensing Introduction Interface modules Function modules License matrix License code Index v

6

7 What is User Management Resource Administrator Welcome to User Management Resource Administrator (UMRA). User Management Resource Administrator (UMRA) is a comprehensive User Account Management solution that can help you to control and manage Active Directory. While extremely powerful and flexible, Active Directory can be a complex environment to manage. UMRA is an enterprise solution focused on Active Directory user account management and it provides a central point of control to manage, control and report on Active Directory user accounts. Besides Active Directory, UMRA also manages all user account resources like home- and profile directories, Exchange mailboxes, Terminal Services settings, group memberships and NTFS permissions. UMRA supports a wide variety of functions and a number of different interfaces. Features include the creation, deletion and configuration of user accounts, mailboxes, (home) directories, groups, group memberships, permission settings and many more. With the different UMRA interfaces, you can create and manage user accounts in bulk, one-by-one, in a delegated manner, by a command-line interface and through a web interface. UMRA Scripts UMRA uses scripts to perform its tasks. A script is a collection of statements or actions (examples: Create user, Setup mailbox) that each perform a specifc task. The different actions available in UMRA to compose a script, focus on the management of user accounts, resources, mailboxes and so on. A script with multiple actions for instance create a user account, sets up the home and profile directories and permissions, adds the new user account to a number of groups and creates an Exchange mailbox for the user account. UMRA supports a graphical interface to setup a new script or edit existing scripts. The interface is designed to make it very easy to setup a new script or edit an existing script. UMRA Projects Different types of UMRA projects exist. Each project contains an UMRA script and a specification how the script is executed. The two main project types are: 1. Mass create-update-delete projects: The project contains a table with input data. The input data is for instance read from a csv file. For each line of the input file, the script is executed. A mass project is typically used to create, update or delete user accounts and resources. See Principle of operation for more information. 2. Form project: The project contains the definition of a form. The form typically contains a number of fields like tables, text, input fields. The form is presented in a separate interface (UMRA forms) or a web-interface (browser). When the form fields are specified by the end-user and the form is submitted, the script of the form project is executed. See Form project - Principle of operation for more information. UMRA Software UMRA consists of a number of software applications: 1. UMRA Console: The main application that is primarily used to manage all UMRA projects and manage the UMRA service. To use UMRA, you always start with the UMRA Console application. 2. UMRA Service: The UMRA service is used to execute delegated tasks. The UMRA Service is accessed through the UMRA Console, UMRA Forms and UMRA Automation software. You only need to install the UMRA Service application if you want to execute forms projects. See UMRA Delegation - General or more information. 3. UMRA Forms: The Windows interface to show and submit delegated forms. The UMRA Forms application is most often used by helpdesk employees. The UMRA Forms application interfaces with the UMRA Service application directly. See UMRA forms - Introduction for more information. 4. UMRA Automation: UMRA can be integrated with other employee management systems to automate Active Directory user account management tasks. For instance: When an employee leaves an organization and is excluded from an employee information system, Active Directory needs to be updated, by disabling or removal of the associated user account and network resources. With UMRA, the UMRA service can execute these tasks automatically when the employee information system is updated. See UMRA Automation - Introduction for more information. 1

8 User Management Resource Administrator 7.2 2

9 Quickstart - Sample project wizard The main goals of UMRA are to: 1. Create, edit and delete user accounts in bulk and setup all resources for each user account, including homeand profile directories, group memberships, Exchange mailbox and so on. 2. Delegate control to the helpdesk, for instance by providing the helpdesk employees with a form to reset passwords. This quickstart guide shows you how to setup UMRA and start working with the UMRA sample projects. Step 1: Prerequisites 1. To run this quickstart, you need to be an administrator of the Active Directory domain in which you want to manage. If you do not have sufficient access rights, User Management Resource Administrator will not be able (have access) to setup the accounts and resources. 2. You can run User Management Resource Administrator on any computer that runs Windows XP/2003/2000. From this computer, you must have access to the domain(s) in which you want to setup the accounts. Although you can create accounts in Windows NT 4 domains with User Management Resource Administrator, you cannot run User Management Resource Administrator on a computer that runs Windows NT4. Step 2: Install User Management Resource Administrator To start, download the most recent version of the User Management Resource Administrator software from All of the User Management Resource Administrator software is contained in a single executable file: SETUPUSERMANAGEMENT.EXE. Run the file. Select the options to install UMRA Console, UMRA Forms and UMRA Automation.This will setup the User Management Resource Administrator software on the local computer. The User Management Resource Administrator setup procedure is straightforward and takes less then 1 minute. If User Management Resource Administrator is already installed on the computer, you can upgrade to the latest version by running the same file. Step 3: Start User Management Resource Administrator wizard When User Management Resource Administrator is installed, start User Management Resource Administrator from the desktop menu: Start, Programs, User Management Resource Administrator, UMRA Console. If you are running the demo version, a demo version introduction dialog window is shown. Wait until you can close this window and press Close. By default, the application will automatically start the User Management Resource Administrator wizard. When this option is disabled, select Tools, Wizard to start the User Management Resource Administrator wizard. With the wizard you can install and configure 4 sample projects. These projects are specifically desgined to show you the concept of User Management Resource Administrator. To run the wizard sample projects, follow the instructions shown in the wizard. More information: Mass project - Principle of operation Form project - Principle of operation 3

10

11 Help on help This section shows a number of links to help topics and is presented to help you to find what you are looking for. New users To get a basic understanding of User Management Resource Administrator, read the following topics. These topics cover most of the concepts used and show how to use the product. What is User Management Resource Administrator Different project types Principle of operation Form project - Principle of operation License model All users The links below show the topics that might be of interest once you have a basic understanding of the product Project operations - Input data Project operations - Manage script actions Project operations - Manage script action properties Project operations - Variables Script actions The list below shows all of the available script actions User actions Other actions Variable actions Script Action: Create User (AD) Script Action: Create Directory Script Action: Set Variable Script Action: Create User (no AD) Script Action: Execute Command Line Script Action: Split Variable Script Action: Create Exchange Mailbox (2000/2003) Script Action: Format Variable Value Script Action: Set User Group Memberships (AD) Script_Action: Map variable Script Action: Create User (no AD) Script Action: Export Variables Script Action: Go to Label Script Action: Log Variables Reference topics The links below show the first topic of series of topics on a particular subject. Each topic contains links to the next topic of the subject. Name Generation Algorithms Security - Overview Password generation 5

12

13 Release notes User Management Resource Administrator version 7.2 Build 1164, July 1st, 2005 New features 1. Form project - Generic table: A new form field has been introduced. Using the generic table, data resulting from an LDAP or MS Access query can be shown in a form project. This allows you to access data from both the Active Directory and user information stored in other information systems. For more detailed information see Generic table - Introduction. 2. New action - For-Each function: The For-Each function evaluates the rows of a table and executes a script for each row which is defined in another project form. This script action is created in <Project form1> whereas the action which needs to be executed as a result of the For-Each action is created in <Project form2>. This way, you can reuse complex For-Each constructions in other projects. For more information, see Script Action: For- Each. 3. New action - Generate generic table: The generic table has also been made available as a script action. This makes it possible to use this functionality in scripts and MASS projects as well (1163). 4. New action - Get primary group: This script action retrieves the primary group of the user. For more information, see Script action: Get primary group. 5. New action - If-Then-Else function: The introduction of a conditional construction opens up a wide spectrum of possible applications. This new script action makes it possible for instance, to verify the last logon time of a user and to execute a certain action if the last logon time was more than an X number of months ago. For more information, see Script Action: If-Then-Else. 6. New action - Manage table data: Allows you to manipulate data in an existing table or to create a new table. For more details, see Script Action: Manage table data. 7. New action - Merge multi-text variable values: Merges Variable1 and Variable2. For more details, see Script Action: Merge multi-text variable values. 8. New action - Rename file or directory: With this action you can rename files and directories and move files to another volume. In previous versions this was only feasible by using the Copy directory, Delete directory and Execute command line script actions. For more information see Script Action: Rename file or directory. 9. New action - Remove group member: This action has been added to remove the group member from a specific group. For more details, see Script Action: Remove group member. 10. New action - Remove specific group memberships (AD): This script action allows you to remove specific group memberships. So far it was only possible to remove all group memberships using the action Remove user group memberships (AD). For more information, see Script Action: Remove specific group memberships (AD). 11. New action - Send mail message: This script action allows you to send an message as a result of a previous script action. For more information, see Script Action: Send mail message. 12. New action - Set primary group (AD): This script action is only of interest for those customers who need to change the primary group. This is the case when there are any users who log on to the network from a Macintosh client or who run POSIX-compliant applications. For more details, see Script Action: Set primary group (AD). 13. New action - Update numeric variable: With this new function you can increment the value of a variable. For more details, see Script Action: Update numeric variable. 14. Action - Delete directory: An property is added to ignore errors from being generated when the action is executed. Critical fixes 1. Name generation algorithm: When a name generation algorithm contains an endless loop or when no unique names are generated by the algorithm, the UMRA software will now end the execution of the algorithm after a number of iterations. Major fixes 1. Action - Create directory: When the directory name is changed to make it unique, the new unique name is now exported. In previous versions, the incorrect already existing directory name was exported. 2. UMRA Forms: When the Control key is pressed while working with a table, the vertical scroll position of the table is no longer changed. In previous versions, the table was scrolled to the first entry of the list. 7

14 User Management Resource Administrator Action - Get attribute (AD): If the property is specified to get a multi-value attribute, the output Attribute value will always contain a multi text list, even if there are no values or just a single attribute value found. Minor fixes 1. Action - Search object: In the properties pane of a project window the properties values shown for properties Error if nothing found and Error if multiple found are now correct. 2. UMRA Service: When the UMRA Console or UMRA Automation software build number do not correspond with the build number of the UMRA Service, you are now forced to up- or downgrade the UMRA Service. In previous versions, you could continue to open a project. Cosmetic fixes 1. Action - Manage Exchange recipient mail addresses (2000/2003): The default variable input name is changed from %AdObject% to %ActiveDirectoryObject%. Build 1141, April 29, 2005 New features 1. UMRA Automation: A new module is introduced. The module supports the integration of the functions of User Management Resource Administrator with other products that are used to manage employee and user accounts. See UMRA Automation - Introduction for more information. (1141) 2. Delegation: With UMRA, you can delegate control to helpdesk employees. See UMRA Delegation - General for more information (1117). 3. Command line startup: Run a project automatically with UMRA console when the application is started. See UMRA console - Command line options for more information.(1141) 4. Network tree: For all Active Directory objects, all properties can be shown and managed from the UMRA console application.(1117) 5. Action - Set attribute (AD): A property is added to prevent the action from updating the user attribute if the new attribute value is empty. See Script Action: Set user attribute (AD) for more information.(1117) 6. Action - Get attribute (AD): The action now supports multi-values and all Active Directory objects, not only users. See Script Action: Get attribute (AD) for more information.(1141) 7. Action - Modify Exchange mailbox permissions (2000/2003): With this action you can add and remove permission for Exchange mailboxes. See Script Action: Modify Exchange mailbox permissions (2000/2003) for more information.(1117) 8. Action - Set Variable: An option is added to specify when (other) variable names specified as part of the variable value must be resolved. See Script Action: Set Variable for more information.(1141) 9. New action - Create contact (AD): Create contact accounts in Active Directory. See Script Action: Create contact (AD) for more information.(1117) 10. New action - Edit user logon: Reset passwords and manage logon properties of user accounts. See Script Action: Edit user logon (AD) for more information.(1117) 11. New action - Modify Exchange mailbox permissions: Setup the permissions for new or existing Exchange 2003/2000 mailboxes. See Script Action: Modify Exchange mailbox permissions (2000/2003) for more information.(1117) 12. New action - Manage Exchange recipient mail addresses: Setup mail addresses for Exchange 2003/2000 mail recipients. See Script Action: Manage Exchange recipient mail addresses (2003/2000) for more information.(1117) 13. New action - Dial-in user settings: Specify dial-in and VPN settings for user accounts. See Script Action: Dial-in user settings for more information.(1117) 14. New action - Set group membership (AD): Set the Active Directory group memberships for user accounts and other Active Directory objects. See Script Action: Set group membership (AD) for more information.(1117) 15. New action - Create group (AD): Create a group in Active Directory. See Script Action: Create group (AD) for more information.(1117) 16. New action - Get object (AD): Access any Active Directory object to set and read properties. See Script Action: Get object (AD) for more information.(1117) 17. New action - Create share: Create a share on a directory and setup the share properties including security settings. See Script Action: Create share for more information.(1117) 18. New action - Delete share: Deletes a share from a directory. See Script Action: Delete share for more information.(1141) 19. New action - Convert to multi-value variable: Manage values of variables to be converted to multi-value values. See Script Action: Convert to multi-value variable for more information.(1117) 8

15 Release notes 20. New action - Manage multi-text value variable: Manage values of multi-value variables. See Script Action: Manage multi-text value variable for more information.(1117) 21. New action - Generate random number: Generate a random number and assign the value to a variable. See Script Action: Generate random number for more information.(1141) 22. New action - Generate name(s): The name generation algoritms can now be used as a separate action. See Script Action: Generate name(s) for more information.(1141) 23. New action - Convert text to date/time: Convert a text value to a date/time value. Both values are stored in a variable. The method used to convert the text to a date/time value can be specified. See Script Action: Convert text to date/time for more information.(1141) 24. New form action - Return other form: When a submit button is pressed in a form, another form can be returned. This allows the configuration of wizards with UMRA Forms. See Form action - Return other form for more information.(1141) 25. New form action - Iteratively execute project script: Execute the project script for each item selected in a table. See Form action - Iteratively execute project script for more information.(1141) 26. Name generation algorithm: The configuration of the name generation algorithm is now always stored in the action that uses the algorithm, e.g. the actions Script Action: Create User (AD) and Script Action: Create User (no AD). In previous versions, the algorithm could be reloaded from configuration files each time a project was executed. See Name Generation: Embedded algorithms for more information.(1117) 27. Action - Export Variables The name of the export file can contains date related variables. See Script Action: Export Variables for more information.(1117) 28. Action - Export Variables: For multi-value variables, a value separator character can be specified. See Script Action: Export Variables for more information.(1141) 29. Action - Create directory: When creating a share for the new directory, the maximum number of connections for the share can now be specified.(1117) 30. Name generation algorithm: Methods can now be copied to make it more easy to create similar name generation methods.(1141) 31. Form project: The type of popup messages that must be shown when a form is submitted can now be configured. See Form properties - Options for more information.(1141) 32. Logon hours: The action to create and edit user accounts, both in Active Directory and NT support user account logon hours. See Script Action: Create User (AD), Script Action: Edit user (AD), Script Action: Create User (no AD) and Script Action: Edit user (no AD) for more information.(1141) 33. Formatting functions: A function is added to replace a substring in a text fragement with ASCII codes. With this function, a user defined control sequence (for example \n) can be converted to a carriage return - line feed sequence (13,10).(1141) 34. UMRA Console: The drag- and drop and cut-copy-paste functions are extended.(1141) 35. UMRA Service: A new variable is automatically generated and updated when a form is submitted: %UmraFormSubmitAccount%. The variable contains the name fo the user account that submitted a form. See Built-in variables for more information.(1141) Critical fixes 1. Demo version: The demo version now supports all script actions.(1117) Major fixes 1. Action - Edit user (AD): The attribute of a user account can now be cleared. In previous versions, an error occurred when the attribute was set to an empty value.(1117) 2. Action - Move - rename user (AD): When renaming a user account, the new name can contain comma's (,).(1117) 3. Action - Create directory - Copy directory: When setting the permissions of the target directories and files, in previous the versions, the specification of the Read permission incorrectly granted the Delete access right as well. The problem is fixed.(1117) 4. Action - Create directory: When specifying the permissions for a share, an account can now be removed for the share from the list with permissions.(1141) 5. Action - Delete directory: The script action now also delete files and directory that start with a dot (.).(1117) 6. Action - Format variable value: A specification problem regarding the format functions and format function arguments has been resolved.(1141) 7. Action - Export Variables The variables can now be exported in UNICODE format. See Script Action: Export Variables for more information.(1141) 8. Variables: The special variables %NowMonth%, %NowDay% and %NowYear% can be used in all modules (not only mass-projects). See Built-in variables for more information.(1141) 9. Mass projects - input data: The maximum number of columns read from a CSV file is increased from 26 to 75 columns.(1117) Minor fixes 9

16 User Management Resource Administrator Action - Edit user (AD): When a property is specified is an text with no length, the property value is shown as <empty text>. In previous versions, nothing was shown for the empty value.(1117) 2. Menu option - Add action to script: The menu option can be used for mass and form projects.(1141) 3. Menu option - File, Save: The shortcut key combination Ctrl+S can be used to save projects.(1141) 4. Action - Get User (AD): When a user account is specified using a domain name, OU-name and common name (full name), a warning is now displayed if the user account cannot be found and no (empty) OU-name is specified.(1141) 5. Action - Format variable value: The name of the formatting functions are updated.(1141) 6. Mass projects - column variable: When a variable is associated with a column, the name of the variable can now be selected from the list with variable names when specifying script action properties. In previous versions, these variables could be specified but were not shown on the list with variable names.(1141) 7. Form projects - script message: When submitting a local form from the UMRA Console application, the script message was shown twice. The problem has been resolved.(1141) 8. Form projects: When the form project properties (format, fonts, options and security) are updated, the project is now marked as changed.(1141) 9. Form project: The calculation of the length of a form is now more accurate. This results in better vertical scroll bar settings in a form.(1141) 10. Form project: The mouse scroll-wheel is now supported in a form.(1141) 11. Form project: When changing the table type of a form network table, the columns are now updated.(1141) 12. UMRA Console: When the application is closed and a project has not been saved, you can now Cancel the application close operation.(1141) 13. UMRA Console: When the error settings or label of a script action is specified, the project is now marked as changed.(1141) 14. UMRA Console: When dragging and dropping a script action on the same position now nothing happens (as expected). In previous versions, the actions was incorrectly moved to the last position in the script.(1141) Cosmetic fixes 1. Form projects: When form projects are opened to be designed, the column width is automaticlly updated.(1141) 2. Form projects: When editing form fields and the Cancel button is pressed, the window no longer indicates that something is changed.(1141) 3. Tooltips: The What's This tooltips for form projects are now correct.(1141) 4. Tooltips: The tooltips shown in various tree windows are hidden when the mouse is moved in the tooltip area.(1141) 5. Action - Create directory: The action now logs test only when the script action is executed in test mode. In previous versions, the test only phrase was not shown for this action.(1141) 6. Action - Create user (AD): The action now logs test only more explicitly when the script action is executed in test mode.(1141) 7. All actions - Properties: When selecting a variable as the new value for a property, the name of the variable is now immediately inserted as the property value if the property value is empty. In previous versions, you always needed to press the Insert button.(1141) 8. Menu: In rare occasions, the menu text shown could be updated incorrectly in previous versions. The problem has been fixed.(1141) 9. Icons: The icons for the script actions to delete a share and execute a command line are updated.(1141) Build 1065, September 17, 2004 New features 1. Terminal Services Support: The new version supports the configuration and specification of Terminal Services settings for new and existing user accounts (1033). 2. Name generation: A new function is added to add characters at the end of a name to lengthen the name (1065). 3. Action - Add account to local group: A new action is added to add user and global group account to local groups of domains, member servers and workstations. See Script Action: Add account to local group for more information. (1065) 4. Action - Create user (AD): The property Computer account is added to allow the creation of workstation - computer accounts. See Script Action: Create User (AD) and Script Action: Create User (no AD) for more information.(1065) 5. Action - Create directory: The option to setup permissions of shares and the maximum number of connections for shares is added. See Script Action: Create Directory for more information.(1065) 6. Action - Create directory: The option to set the owner of a directory is added. The owner is specified by using the security property of Script Action: Create Directory.(1065) 7. Action - Set User Group Memberships (AD): Property Group names (Pre-W2K name) is added to allow the specification of multiple groups using variables. See Script Action: Set User Group Memberships (AD) for more information.(1065) 10

17 Release notes 8. Action - Setup user global group memberships: By using the new option Error if already member you can configure the application not to generate an error when adding a user to a global group and the account is already a member. (1065) 9. General: To facilitate the specification of groups and other properties, you can now assign multiple values to a single variable. (1065) 10. General: The input data of all projects can now be exported and printed. (1065) Critical fixes No critical fixes were found or reported Major fixes 1. Active Directory: The comma (,) character can now be used in the name of user accounts (1033). 2. Name generation: When no name generation algorithm is specified, the application no longer uses the last 'configured' algorithm. This feature is particularly used when the user name is directly specified in the import file when creating user accounts (1033). 3. Name generation: The names generated by the name generation algorithms can now be used in subsequent actions of the same script. Example: If you create a user account using a name generation algorithm you might want the algorithm to generate a separate name for an Exchange mailbox for the same user account. This name can now be stored in another variable that can be used in the action that creates the Exchange mailbox (1033). 4. Name generation: The function Add if empty now correctly does not add the specified character if the name is not empty. (1065) 5. Script execution: The Security Identifier (SID) can now be exported in text format. (1065) Minor fixes 1. When a read-only project is started from the User Management Resource Administrator wizard, the project is now correctly shown in the projects bar (1033). 2. The on-line help is shown always when F1 is pressed. In previous versions, the on-line help was not activated when F1 was pressed and some windows were active (1033). 3. The help text of some of the sample projects has been updated (1033). 4. The information shown for the action Execute command line is no longer shown with the error icon. (1065) Build 1030, July 1, 2004 This is the first build of User Management Resource Administrator version 6.0. The new version 6 is considerably different compared to version 5. For more information on UserManagemeNT version 5, see Notes on UserManagemeNT version 5. More information: Principle of operation Project operations - Input data Project operations - Manage script actions Project operations - Variables Help on help 11

18 User Management Resource Administrator 7.2 Notes on User Management version 5 User Management version 5.4 is the predecessor of UMRA. The new version is considerably different compared to version 5. UMRA is build from scratch and is build with a complete new engine, concept and software architecture. The basic functionality, e.g. manage user accounts and resources is still the same. Because of the new concept and design, it is not possible to upgrade configuration files and settings from version 5.x to the new version. To facilitate the usage of the new version, the product does contain a number of build-in sample projects. UserManagemeNT version 5.4 consists of 3 modules: Professional, Delegation and Import (the free module UserManagemeNT Lite is considered part of UserManagemeNT Professional). The following tabel shows the relationship between the old UserManagemeNT 5.4 modules and UMRA: UserManagemeNT 5.4 UserManagemeNT Professional UserManagemeNT Import UserManagemeNT Delegation UMRA UMRA Console UMRA Console UMRA Console+Service+Forms Because of the new design and architecture, it is expected that UMRA is regarded as more easy to configure, more flexible in usage and better scalable. For instance, the number of complicated steps to configure 5.4 initially are no longer required in UMRA. More information: What is User Management Resource Administrator Principle of operation Project operations - Input data Project operations - Manage script actions Project operations - Variables Help on help 12

19 Release notes Features Application type Graphical user interface application to perform user account administration tasks for Windows 2003/2000/NT network in bulk. Reads data from text files or the network environment containing appropriate input information and executes configurable scripts for each input line. Supports a rich straightforward simple programming language to setup scripts containing script actions. Script actions interact with the network environment to setup, modify and delete user accounts and all associated resources, e.g. mailboxes, group memberships, home- and profile directories and so on. Supports Microsoft's COM object model and several command line interfaces to integrate with many other software packages and application to automate the management of user accounts. Network features Create user accounts in Active Directory Windows 2003/2000 networks Create user accounts in Windows NT4 networks Create user accounts on non-domain controller computers Automatic unique name generation according to configurable algorithms Automatically generate and set passwords for user account according to configurable password generation rules Setup attributes for Active Directory Windows 2003/2000 network user accounts Setup built-in attributes for Windows NT4 SAM accounts Setup user account groupmemberships for local, global and universal groups for security and distribution groups Setup Exchange 2003/2000 mailbox for new user accounts Setup Terminal Server user settings Create user account directories (home-, profile- terminal server- and other directories) Setup shares for user account directories Setup configurable permissions for user account directories Execute any command for each user account with configurable parameters Script features Graphical interface to setup scripts Drag- and drop support to setup scripts and manage script actions Supports test- and real-mode script execution Supports step-mode, single line mode, all data mode, selected lines mode Supports ability to abort running scripts Extensive logging available Configurable error handling (continue, abort script, abort session) Supports any number of configurable variables Supports variable management functions to set, split, format, map, log and export variables and values Supports multiple programming features to control the order of script action executions Other product features Shipped with built-in sample scripts Shipped with multiple name generation algorithms Configurable comment fields for scripts and variables Supports printing input data Wizards available for all major functions More information: 13

20 User Management Resource Administrator 7.2 Principle of operation Project operations - Input data Project operations - Manage script actions Project operations - Variables UMRA Automation - Introduction Help on help 14

21 Reference Installation Installation Installing UMRA Console is simple and straightforward. The whole installation and configuration process takes less then 5 minutes. System Requirements The following table shows all of the requirements to run the User Management Resource Administrator application. Description Required Recommended Operating system to run the application on: Supported network operating system: Required privileges of logged on user: Windows XP, Windows 2003 (all versions), Windows 2000 (all versions) Windows 2003 (all modes), Windows 2000 (all modes), Windows NT4 (SP6) Administrative access to Active Directory and/or all computers and domains with managed user accounts Available hard disk space: 10 MB 20 MB or more Required processor: Pentium III, 600 MHz, AMD 900 MHz Pentium IV, > 1 GHz or AMD > 1.6 GHz System memory: 256 MB 512 MB or more Exchange 2003/2000 requirements In order to use the Exchange 2003/2000 features within User Management Resource Administrator, you must have a functional Exchange server in your network. Additionally, it is required to have the Exchange system Management tools installed on the local machine that runs the User Management Resource Administrator application. To install the Exchange system management tools for Exchange 2003, do the following: 1. Insert the CD containing the Microsoft Exchange 2003 Software (standard or enterprise edition), and run setup.exe. 2. Under Deployment select Exchange deployment tools. 3. Choose the option Install Exchange System Management Tools Only. 4. Follow the instructions presented for your specific operating system. For Exchange 2000, the procedure is similar. Installing UMRA Console To start, download the most recent version of the User Management Resource Administrator software from All of the User Management Resource Administrator software is contained in a single executable file: SETUPUSERMANAGEMENT.EXE. Run the file. When asked, you can setup both the UMRA Console, UMRA Forms and UMRA Automation software. This will setup the UMRA software on the local computer. The User Management Resource Administrator setup procedure is straightforward and takes less then 1 minute. If User Management Resource Administrator is already installed on the computer, you can upgrade to the latest version by running the same file. Configuring User Management Resource Administrator Once User Management Resource Administrator is installed, no specific options need to be configured. To continue you can run a project using the wizard or start a new mass or form project. 15

22 User Management Resource Administrator 7.2 More information: Principle of operation Project operations - Input data Project operations - Manage script actions Project operations - Variables Help on help 16

23 Reference Projects Different project types UMRA supports 2 basic project types: 1. Mass project: To create, manage and delete multiple users and associated resources and other objects. A mass project typically uses a text file (csv) or network data as input. Project examples: Create multiple user accounts in a domain, OU, multiple OU's or NT4 domain, move users to another OU/domain, setup groupmemberships for multiple users, migrate users from one domain to another domain, restructure home directories and directory permissions, setup Exchange mailbox (properties) for multiple users. A mass project is created and executed with the UMRA Console application. 2. Form project: Used to execute a single task, for example to reset the password of a user, create a user in an OU and setup all associated resources, add a user to a group etc. The input data is specified in a configurable form. The form is very easy to use, for instance by helpdesk employees. By using the UMRA Service, forms execution is controlled in a delegated manner: With delegation, a helpdesk employee runs the UMRA Forms application and is presented only the forms he is allowed to run. Form projects are always maintained and stored at the UMRA Service. Functions are available to import and export form projects. The following table summarizes the different project options. Project type Mass project Form project Form project Project storage location UMRA Console (local) Project executed by UMRA Console Description and usage To create, manage and delete multiple users and associated resources and other objects. UMRA Service UMRA Console Design and test phase of a form project. UMRA Service UMRA Forms Production environment. Execution of the form is delegated to helpdesk employees. Helpdesk employees run UMRA Forms to submit the presented form that is executed and access controlled by the UMRA Service. To start a new project, start UMRA Console. Select menu option, File, New. The Select type of new project is presented. 17

24 User Management Resource Administrator 7.2 For the new project, you have two options: Mass project Start a new mass project. See Principle of operation for more information. Form project Start a new form project. See Form project - Principle of operation for more information on form projects. This option is avaialble only if the application is connected to an UMRA Service. If this is not the case, a Connect... button is shown. Press the button to connect to or start the installation of an UMRA Service. 18

25 Reference Scripts 19

26 User Management Resource Administrator 7.2 Basics Manage script actions Both the UMRA mass and form projects contain a script. The scripts contains the actions that perform a specific task. A script for example creates a user account, sets up the Exchange mailbox, creates a home directory and adds the new user account to a number of groups. Such a script is shown in the mass project below. The available actions that can be added to a script are predefined and shown in the Actions bar. Add script action to script There are several ways to add actions to a script. For a basic understanding of projects, input data and scripts, see Principle of operation. With the following operations you can add an action to a script. Note that a project window must be open to perform these operations: 1. Select the script action in the Actions bar and select menu option Actions, Add action to script, or right click on the script action and select the menu option. 2. Drag and drop the script action from the Action bar to the script area of the project window. 3. Drag and drop a script action from another project to the script area of the target window. In this case, all the properties are copied to the new project as well. 4. If you drag and drop a script action in the same project script with the Ctrl key pressed down, the script action is copied to the new position. Move script action in script The position of a script action in a script is important. If the order is not correct, the script cannot be executed correctly. Example: if you create a user account and Exchange mailbox, the action to create the user must precede the action that creates the Exchange mailbox. To move a script action in the script to another position, drag and drop the script action to the desired position. Delete script action from script To delete a script action from a script, select the action and press the Del key or select menu option Actions, Delete script action. Script action execution order By default, script actions are executed in the order as they appear in the script. But depending on the result of script actions and by special variable actions you can control the order in which script actions are executed. With these possibilities the script becomes a program with conditional jumps and better controller action execution. From this point of view, User Management Resource Administrator is a programming language to program the Windows network. To change the order in which actions are executed, labels are used for script actions. A label refers to a script action. To set a label for a script action, select the action in the script of the project (lower left part of the project window) and select menu option Actions, Set script action label. Each action can have only one label. When script execution continues at a label, the next action executed is the action with the specified label. If no action has the label specified, an error is generated and script execution is stopped. Note: since you can also jump to previous script actions, you can introduce deadlock situations where script execution never ends. It is the responsibility of the user to prevent this situation from happening. There are two general ways to change the order used to execute the script actions, described in the sections below. Script action execution order: Error handling When the execution of an script action fails, you have several options to control the execution of script action. To specify these settings, select the action in the script of the project (lower left part of the project window) and select menu option Actions, Script action error handling. Option Continue with the script. Jump to the script action with label Description If this script actions encounters an error, it will (try to) continue normally with the next consecutive script action in the script If this script actions encounters an error, it will jump to the script actions specified 20

27 Reference xxxx Terminate the script but continue the session with the next line Terminate the session by the here specified destination label If this script actions encounters an error the current script execution is terminated. The session continues by running the script with the next line of input. If this script actions encounters an error the current script execution is terminated and also the current session is terminated Script action execution order: Variable actions The GOTO script action is used to continue script execution with another script action than the next script action. The referenced label can be a variable name. More information: Principle of operation Project operations - Input data Project operations - Variables Help on help 21

28 User Management Resource Administrator 7.2 Project operations - Manage script action properties Each script action has a predefined set of properties. A property specifies a characteristic of an action. To setup a script action, you need to specify the values for the script action properties but you cannot add or remove properties from a script action. For more information on projects, scripts, actions and properties, see Different project types and Principle of operation. To set the value for script action property, select the script action in the lower left part of the project window. Once selected, the script action properties are shown in the lower right part of the project window. In the example shown, the selected script action is Create user (AD). In the lower right part of the window the properties are shown. In this example the selected property is SurName with value %LastName%. To specify the value of a property, double click the property or select menu option Actions, Properties of action property. The Properties window shows up: 22

29 Reference The window shows the name of the property, a description of the property and in the bottom section of the window, you need to specify the value of the property. You have three options: 1. Value specified as a constant value: Select option Use the following value. In this case, the value of the property is set to a fixed constant value. You can use this option only if the property value must be the same each time the script is executed. This method is advised for fixed constant properties that have a value that is not used for other properties of the same or other script actions. Examples: the password flags (user cannot change password, password expired), the flag indicating if a share must be created for a home directory. These values are probably the same each time the script is executed. 2. Value specified as a variable: Select option Use the following value. With this option instead of specifying a value you specify the name of a variable. By default, the name of a variable should be enclosed with %- characters. At run-time, the name of the variable is replaced by the value of the variable. There are 2 major reasons to use variables: link to input data: a column of the input data specifies the value for the variable. If you want to use the value of a column from the input data in a script, you need to use variables. In the example shown, the second column of the input data contains the last name of the user accounts that must be created. For script action Create user (AD) the value of property SurName is set to variable %LastName%. Next, the second column is linked to variable %LastName%. For more information in this topic, see Project operations - Variables. The second reason to use variables is to simplify the configuration of script action properties. This happens when multiple script action properties should get the same constant value. In this case you can specify the constant value for each property but you can also introduce a variable at the beginning of the script and specify the variable name for the script action properties. Example: if you setup a user account and associated resources (mailbox, group membership, home directory,...) you need to specify the name of the domain for various properties of these actions. Instead of specifying the name of the domain as a constant for each of these properties you can also introduce the variable %Domain% as a separate script action and set the value to the target domain. Next, you can specify the value %Domain% for all script actions properties that should contain the name of the domain. Note that a variable is automatically created if you specify a variable name %...%. 3. Value not specified: Select option Do not specify a value for this property. Some action properties are mandatory, others are optional. For optional properties, you do not always need to specify the property value. For instance, if you don't want to use it, you don't need to specify Active Directory attribute Phone number for a user account. 23