bv-control for Active Directory v8.50 User Guide

Transcription

1 bv-control for Active Directory v8.50 User Guide

2 bv-control for Active Directory v8.50 bv-control for Active Directory User Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version 8.50 Copyright and Trademark Notice Copyright 2007 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, BindView, bv-control, and ActiveAdmin are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED AS IS AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON- INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , Rights in Commercial Computer Software or Commercial Computer Software Documentation, as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. Symantec Corporation Stevens Creek Blvd. Cupertino, CA

3 Technical support Licensing and registration As part of Symantec Security Response, the Symantec global Technical Support group maintains support centers throughout the world. The Technical Support group s primary role is to respond to specific questions on product feature/ function, installation, and configuration, as well as to author content for our Web-accessible Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering as well as Symantec Security Response to provide Alerting Services and Virus Definition Updates for virus outbreaks and security alerts. Symantec technical support offerings include: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and Web support components that provide rapid response and up-to-the-minute information Upgrade insurance that delivers automatic software upgrade protection Content Updates for virus definitions and security signatures that ensure the highest level of protection Global support from Symantec Security Response experts, which is available 24 hours a day, 7 days a week worldwide in a variety of languages for those customers enrolled in the Platinum Support Program Advanced features, such as the Symantec Alerting Service and Technical Account Manager role, offer enhanced response and proactive security support Please visit our Web site for current information on Support Programs. The specific features available may vary based on the level of support purchased and the specific product that you are using. If the product that you are implementing requires registration and/or a license key, the fastest and easiest way to register your service is to access the Symantec licensing and registration site at Alternatively, you may go to select the product that you wish to register, and from the Product Home Page, select the Licensing and Registration link.

4 Contacting Technical Support Customers with a current support agreement may contact the Technical Support group via phone or online at Customers with Platinum support agreements may contact Platinum Technical Support via the Platinum Web site at www-secure.symantec.com/platinum/. When contacting the Technical Support group, please have the following: Product release level Hardware information Available memory, disk space, NIC information Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description Error messages/log files Troubleshooting performed prior to contacting Symantec Recent software configuration changes and/or network changes Customer Service To contact Enterprise Customer Service online, go to select the appropriate Global Site for your country, then choose Service and Support. Customer Service is available to assist with the following types of issues: Questions regarding product licensing or serialization Product registration updates such as address or name changes General product information (features, language availability, local dealers) Latest information on product updates and upgrades Information on upgrade insurance and maintenance contracts Information on Symantec Value License Program Advice on Symantec's technical support options Nontechnical presales questions Missing or defective CD-ROMs or manuals

5 Contents Technical support Chapter 1 Chapter 2 Chapter 3 Overview About the RMS Console... 7 About bv-control for Active Directory... 7 bv-control for Active Directory architecture... 9 Client component... 9 Information Server component... 9 Key features of bv-control for Active Directory Installing, Configuring, and Uninstalling the Product System requirements Preinstallation considerations Installing bv-control for Active Directory Configuring the Console Configuring bv-control for Active Directory About the credential database Credential requirements Uninstalling bv-control for Active Directory Using the Product About query-related features Understanding a query Creating a query About the Query building process Creating a query Saving a query definition Multiple forest support Requirements Specifying credentials Microsoft network Enterprise directories Running a query Task status monitoring Accessing a previously saved query... 26

6 6 Contents Displaying query results Grid format Chart format Report format About Baselining Creating a baseline About Task lists Building task lists Generating a field list Effective trustees field Credential requirements Limitations Group policy objects (GPOs) functionality Group policy data source Chapter 4 Chapter 5 Appendix A Evaluating the Product Introduction Reporting on multiple forests Verifying credentials across forests Using generic scopes Troubleshooting Problems and solutions RMS Console Windows Groups Administrator and user rights Index

7 Chapter 1 Overview This chapter includes the following topics: About the RMS Console About bv-control for Active Directory bv-control for Active Directory architecture Key features of bv-control for Active Directory About the RMS Console The RMS Console installs as a snap-in to the Microsoft Management Console (MMC). The MMC is a host application that provides a common user interface enabling you to navigate the RMS Console application. The RMS Console, along with bv-control for Active Directory is a powerful tool. This tool is designed to help you manage your Microsoft Windows 2000 and Microsoft Windows Server 2003 environment. The RMS Console serves as a host application to other products. The products include bv-control for Active Directory, bv- Control IntelliPACS, bv-control for Microsoft Exchange, and other products. The RMS Console provides query-based data retrieval to gather information from your Active Directory service. When a query is processed, the RMS Console queries Active Directory to gather information about the Active Directory objects and properties. Once the data is collected, it is returned to the RMS Console and displayed as either a grid, chart, or a report. For more information, see the BindView RMS Console and Information Server Getting Started Guide. About bv-control for Active Directory The bv-control for Active Directory snap-in provides comprehensive administrative reporting capabilities for Active Directory service objects and

8 8 Overview About bv-control for Active Directory properties. This product provides broad querying capabilities. The bv-control for Active Directory product focuses on automating tasks. These tasks include collecting and reporting information about an Active Directory service relative to containers and OUs, domains, groups, group policies (GPO) and users. The bv- Control for Active Directory product can query information in multiple trees and domains across an enterprise. It can query specific objects in the trees and domains. Multi-forest support is also available. From the centralized RMS Console, you can document and report on virtually every aspect of Active Directory and Group Policies. bv-control for Active Directory provides IT personnel with key abilities to perform security checks across the enterprise for possible security or configuration breaches. bv-control for Active Directory also provides hundreds of detailed fields for reporting on the configuration of Active Directory and Group Policies. This helps the administrators save time and money over native or third-party tools. These key and unique capabilities of bv-control for Active Directory allow administrators to communicate the current state of Active Directory. The product also lets you easily highlight configuration and security issues for immediate resolution. bv-control for Active Directory also provides easy report modification and a vast amount of exporting venues for further analysis. This product leverages our leadership in the vulnerability assessment market by providing industryleading technology for assessing, auditing, and administering Microsoft, Novell, and UNIX enterprises. bv-control for Active Directory contains the following new features: Reports on the new permissions and new delegated tasks offered by the Delegation Control Wizard. Reports on the new Group Policy settings for Terminal Services, Network Management, and Computer Management. Provides a way to enable features in a domain or forest throughout an organization. bv-control for Active Directory reports on the different levels. Supports the Forests Trusts Effective Permissions, Effective Permissions Analysis, and Effective Trustees. These features take into account the permissions obtained through security principals and memberships in groups across the forest. Reports on InetOrgPerson object through the user s data source. This object is also a security principal. bv-control for Active Directory also reports on the effective permissions and effective delegated tasks for this security principal. Reports on attributes available to Active Directory objects through Auxiliary classes.

9 Overview bv-control for Active Directory architecture 9 bv-control for Active Directory architecture Client component This section provides the information required to understand the bv-control for Active Directory architecture. bv-control for Active Directory consists of two RMS Console components: Client Information Server The Client component provides the user interface extensions to the RMS Console. This component enables you to configure the bv-control for Active Directory product. It extends the RMS Console shell to facilitate utilities that do not fit within the query model. Information Server component The Information Server is primarily used to perform task processing and data storage. There are two types of Information Servers: local and remote. A local Information Server exists on the same computer as the Console you are using. A remote Information Server exists on a computer other than the one where your Console resides. Data Collections The Information Server component provides data collection facilities for the RMS Console. This component exposes the user schema to the RMS Console. The user schema constitutes the data sources and fields that the user may select for creating reports. The user schema provides User Interface components, such as dialog pages that are specific to the data sources and fields of the product. This component is responsible for combining information in a way that recognizes requests from the RMS Console. Data sources Within bv-control for Active Directory are categories of information called data sources. A data source is a collection of multiple related fields you select when defining a query. It is a key component of the product. By using bv-control for Active Directory, administrators can analyze virtually every aspect of Active Directory. The first step in determining exactly what information you want to gather is to select a data source to query. See Creating a query on page 18.

10 10 Overview Key features of bv-control for Active Directory Key features of bv-control for Active Directory System administrators who are responsible for administering and securing their Active Directory can rely on bv-control for Active Directory for computer solutions. The following key features of bv-control for Active Directory let you administer and configure Microsoft Active Directory: Predefined query binder and task list Easily performed custom queries Advanced report, graph, and export capability Predefined query binder and task list The bv-control for Active Directory snap-in comes with hundreds of predefined Query Binders that identify key issues. With a simple point-and-click interface that can get the computer up and running in a matter of minutes, bv-control for Active Directory lets you quickly and proactively determine the state of Active Directory. We periodically extend the number of predefined Query Binders and ship them with each future release. Easily performed custom queries bv-control for Active Directory provides sample reports for out-of-the-box use. The product also provides a full query-based interface letting Active Directory administrators easily build custom queries for information specific to their environment. Results from the queries can be saved for trend analysis and capability planning at a later time. Advanced report, graph, and export capability bv-control for Active Directory provides flexible, comprehensive reporting and graphing that produces reports aimed at a variety of audiences. This feature lets an Active Directory administrator quickly identify and document a specific problem. The ultimate in flexibility is achieved by advanced capabilities that allow report information to be graphed, compared to an established baseline. The reported information can be exported into a variety of data formats such as Microsoft Excel, Microsoft Word, dbase, PDF, and Microsoft Access.

11 Chapter 2 Installing, Configuring, and Uninstalling the Product This chapter includes the following topics: System requirements Preinstallation considerations Installing bv-control for Active Directory Configuring the Console Configuring bv-control for Active Directory About the credential database Uninstalling bv-control for Active Directory System requirements For general system requirements for the RMS Console and Information Server, see the Control Compliance Suite Installation Guide. Before installing bv-control for Active Directory, ensure that your workstation and network environment meet the following minimum hardware and software requirements: RMS Console and Information Server 8.50 Microsoft XML Parser 3.0 or later Virtual memory size three times the size of RAM

12 12 Installing, Configuring, and Uninstalling the Product Preinstallation considerations Note: bv-control for Active Directory is not supported for Microsoft Windows Server 2003 R2 or Microsoft Windows Server 2003 SP2. Vast amounts of data can be gathered from Active Directory. This data is stored on the hard drive of the computer that the Information Server was installed on. Although 90 MB is sufficient storage space for the application, space is also needed for the data retrieved. The amount of space needed is dependent on the following factors: Size of your operational environment Information retrieved How often the data is refreshed and saved? Preinstallation considerations bv-control for Active Directory requires a Console and Information Server to function. Before you install bv-control for Active Directory v8.50, you must install RMS Console and Information Server v8.50. During the Console installation process, you must choose the Information Server for the Console you are installing. You can choose to install a local Information Server, or you can connect the Console to an existing Information Server. The Information Server you install or connect to is the default Information Server for the Console. For more information on installing the RMS Console and Information Server, see the Control Compliance Suite Installation Guide. Installing bv-control for Active Directory The bv-control for Active Directory product is shipped on a DVD. The DVD must be available from either a local or remotely mounted DVD-ROM drive. If you do not have access to a DVD-ROM drive, contact Symantec Technical Support for assistance. Before you install the product, we recommend that you review the Readme files for the Console and bv-control for Active Directory. The Documentation menu on the product DVD Install panel provides access to the product Readme. For more information on installing and upgrading, see the Control Compliance Suite Installation Guide.

13 Installing, Configuring, and Uninstalling the Product Configuring the Console 13 Configuring the Console Before using bv-control for Active Directory, you must configure the RMS Console. For more information, see the BindView RMS Console and Information Server Getting Started Guide. Configuring bv-control for Active Directory Before using bv-control for Active Directory, you must configure the bv-control for Active Directory product. To configure bv-control for Active Directory 1 Click the Not Configured icon in the RMS Console tree. 2 Double-click the Configuration Wizard icon. 3 On the bv-control for Active Directory Configuration Wizard - Welcome panel, click Next. 4 Enter a Database Name in the Add Credential Databases panel and click Next. To add a database 1 Enter a password in the Create New Database dialog box and verify this password for this database. 2 Click OK and then click Next to load the credentials. Note: Install the RMS Console and Information Server. After the installation, the bv-control for Active Directory Configuration Wizard guides you through the steps needed to configure the product. To add credentials and apply a credential database to a user 1 Select a domain under Resource Objects area in the Select Credentials panel. 2 On the Additional Settings dialog box, click OK. 3 Click the dropdown list in the Assign a Credential Database to Each user panel and select a database, then click Next. 4 On the bv-control for Active Directory Configuration Wizard - Summary panel to close the wizard, click Finish.

14 14 Installing, Configuring, and Uninstalling the Product About the credential database About the credential database Credential requirements The RMS Console Job Processor is running as a local system account. Because the Job Processor is running locally, it has no network credentials. To collect information from the resource objects you are querying, the Information Server must have rights to those objects. A credential database provides the Information Server with the necessary credentials to authenticate the user of those resources. The Console uses the credential data so that the Information Server can logon to the resources during query processing. This enables the Console to obtain the information it needs to generate the results. Once a credential database is created, you must add that credential database to the user s account. To configure the Console with the credential databases, you must perform the following tasks: Create a credential database Add a database Add credentials to the credential database Assign a credential database to a user To create a credential database 1 From the RMS Console, click the RMS Configuration folder. 2 Double-click the Credentials Manager icon in the details pane. To add a database 1 Under Database Operations in the Credentials Manager dialog box, click Add. 2 Enter a Database Name in the Create New Database dialog box. 3 Enter a password and verify the password for this database and click OK. Note: You can create and configure credential databases for each user to meet their requirements. To add credentials 1 Under Credential Operations, click Add.

15 Installing, Configuring, and Uninstalling the Product Uninstalling bv-control for Active Directory 15 2 In the Add Credentials dialog box, select the Domain Controller (DC) from the main forest you want to add credentials for and click Add. 3 On the Domain and Credential tab, enter the Domain Name\User Name and Password. Click OK. The domain name\user name may be entered by either using a backslash \ to separate domain name and user name or by entering the user logon name. For example, WIN2000\Administraor Local refers to the Information Server being installed in this forest. 4 To add credentials to multiple databases, repeat Steps 2 through 3 and click OK on the Add Credentials dialog box. 5 On the Credentials Manager dialog box, click Close. To assign a credential database to a user 1 Double-click the User Manager icon in the details pane. 2 In the User Manager dialog box, select a user name and click Modify. 3 Select the Credential Databases tab on the <User> Properties dialog box. 4 Select the database name from the Credential Database dropdown list. 5 Enter the password that is assigned to the database. 6 Click OK to return to the User Manager dialog box. You can add, modify, or delete users by selecting the appropriate buttons. 7 When you have completed this process, click Close. You have added the credential database to the user s account. Uninstalling bv-control for Active Directory You can uninstall bv-control for Active Directory from your computer by using the recommended process of removing programs through the Add/Remove Programs dialog box. For more information on uninstalling, see the Control Compliance Suite Installation Guide.

16 16 Installing, Configuring, and Uninstalling the Product Uninstalling bv-control for Active Directory

17 Chapter 3 Using the Product This chapter includes the following topics: About query-related features About the Query building process Multiple forest support Running a query Displaying query results About Baselining About Task lists Effective trustees field Group policy objects (GPOs) functionality About query-related features bv-control for Active Directory provides features to help administrators gather and manage their Active Directory environment. The query related features provided by bv-control for Active Directory are as follows: Building a query Saving a query Running a query Displaying query results Baselining

18 18 Using the Product About the Query building process Building a task list Understanding a query Creating a query A query is a series of structured questions posed to obtain specific information about the Active Directory structure. The query results are returned in the form of a grid, chart, or report that can be viewed on-screen or printed. System administrators use various administrative tools, such as Active Directory Users and Computers, to monitor computer, security and application issues. This task can be a difficult process depending on how much data you have to query. By querying with bv-control for Active Directory, administrators can centrally view objects without having to manually scan through Active Directory. Using the Query Builder process, administrators can create a report that is specific to the data sources and fields of the query. About the Query building process Creating a query Query Building is a tool used to create a query. To create a new query, you must select the appropriate data source, field specification, filter specification, sort specification, and the scope of the query. Once the specifications have been made, you can run the query. To accomplish this process, selections must be made from two dialogs: the Data Source dialog box and the Query Builder dialog box. For more information, see the BindView RMS Console and Information Server Getting Started Guide. The first step in creating a query is determining what information you want to gather about your Active Directory environment. When defining a query, you use the Data Source dialog box and Query Builder dialog box to specify the information you want. You can also specify the manner in which you want the data to be collected. The dialog boxes used to create a new query are accessed from the New Query icon on the toolbar. To create a query 1 From the RMS Console, click the New Query icon on the toolbar.

19 Using the Product About the Query building process 19 To view the Internal Data Source module, you must check the Show Advanced Data Sources option. 2 Click the plus (+) sign in the Select Data Source dialog box to expand the list of available data sources. 3 Select the data source to be queried and click OK. Field Specification tab The Query Builder dialog box allows you to select the specific information you need to generate a query. By adding fields to a query, you define which fields of information should be collected when a query is executed. To add a field to a query On the Field Specification tab of the Query Builder dialog box, select the desired field from the Available Fields list. Click Add or double-click the field. The fields that you select appear in the Selected Fields box. Fields appear in the dataset in the order they appear in the Selected Fields list. You change the field order by dragging fields to the desired position. You can also select multiple fields by pressing the Ctrl key and clicking on each field you want to select. Filter Specification tab While defining a query to include specific fields, bv-control for Active Directory examines every available occurrence of the fields. However, you can define a filter to instruct bv-control for Active Directory not to display all occurrences. You can filter the fields by using the Filter Specification tab. Multiple filters can be grouped using the Add or Remove buttons, and further grouped through the use of parentheses. For more information on filters, see the BindView RMS Console and Information Server Getting Started Guide. To define a filter 1 Use the Available Fields list in the Filter Specification tab to select the field where you want to apply a filter and click Add. 2 Select the desired filter option in the Filter Term Definition dialog box. 3 In the Specify a value text box, enter a specific value for the filter and click OK.

20 20 Using the Product About the Query building process Sort Specification tab The Sort Specification tab lets you change the way information is sorted. Using the Toggle Sort button, a sort can be set to either ascending or descending order. Another feature is the ability to determine how the product handles records with duplicate sort keys. This is achieved by selecting an option button from the Select Duplicate Key Options. To specify a sort order 1 From the Sort Specification tab, use the Available Fields list to apply a sort specification. 2 Highlight and Add the field to the Selected Fields list and click OK to save the order. Scope tab The last component of a query is Scope. Using the Scope tab, you can select the items you want to query, and limit the area of the report. This reduces the amount of time it takes to receive query results. A scope consists of user-selected scope items. The Information Server only queries the resource objects indicated by the scope. You can use scopes to significantly reduce the time it takes to retrieve a dataset. The Add Scope button adds the resource object selected in the Available Item(s) box to the Selected Item(s) box and to the scope. Using Configure Dynamic Indexing reduces the display time of the scope items on the Scope tab and quickly finds selected scope items. Note: The default scope has the contents of the current credential database. The Scope tab requires you to select a Named Scope. The Named Scope determines which files, folders, or servers the Query Builder should use to obtain information. You have a choice to either define and save a Named Scope or select from a previously saved Named Scope to query. See To save a named scope on page 21. See To select an existing named scope on page 21. To define a named scope On the Scope tab of the Query Builder dialog box, expand the folders in the Available Item(s) box. Select the appropriate items. Click Add Scope.

21 Using the Product About the Query building process 21 Additional Settings Depending on which data source you selected, the Additional Settings dialog box is displayed to give you additional advanced scope filter options. To add a named scope 1 Select a level you would like to scope in the Adsi Scope tab on the Additional Settings dialog box The Adsi scope tab has the following options:. Base One Level Only Subtree applies scoping to a selected folder applies scoping to a selected folder and the contents of the selected folder applies scoping to a selected folder, sub-folders, and all items contained in the folders 2 Click OK. The Named Scope you added appears in the Selected Item(s) box on the Query Builder dialog box. To save a named scope 1 From the Selected Item(s) box, select the Named Scope you want to save. 2 Click Save as Named Scope. 3 Enter a name for the Named Scope in the Named Scope dialog box and click OK. The Named Scope is saved in the Named Scopes folder. To select an existing named scope 1 From the Named Scopes folder, select the Named Scope you want to query. The Named Scope you selected appears in the Selected Item(s) box. 2 Click OK. Saving a query definition A query s definition is referred to as the Query Binder by the RMS Console. By default, the Query Binder file is saved in the My Items folder. It is a subfolder found in the Risk Assessment and Control folder of the RMS Console. If you wish to save your Query Binder in a different location, you may do so by browsing for the location and selecting it.

22 22 Using the Product Multiple forest support To save a new or modified query 1 On the Query Options dialog box, click Save. 2 Enter the name of your Query Binder in the Selection Name field on the Save Query dialog box and click Save. The Query Options dialog box is displayed. Select a View As type option to run, modify, or save another query, or click Cancel to close the dialog box. Multiple forest support Requirements Specifying credentials This feature lets you report on different Windows 2000 and Windows Server 2003 forests. You can install your Information Server in one forest and report on that forest and other forests on your network. To report on other forests, physical installation of the Information Server on the forests is not necessary. You can also install the Information Server on a Windows 2000 or Windows Server 2003 computer within an NT4 domain. After installation, you can report on other Windows 2000 and Windows Server 2003 forests on your network. Multiple forest support relies on your DNS configuration. The DNS must be configured properly. The Information Server must be installed on the computer where the DNS name resolution is working properly. The Global Catalog server and at least one Domain Controller in the domain must be reachable from the Information Server. The options for using the multi-forest feature are as follows: Specifying credentials Microsoft network Enterprise directories The option you select depends on your network configuration. This feature lets you enter credentials for the domains that are not seen in the Microsoft Network folder. The Specify Credentials option assumes that the domain can be reached from your Information Server. This feature requires the DNS name of the domain that you want to use. To specify credentials 1 In the RMS Configuration folder, open the Credentials Manager icon in the details pane.

23 Using the Product Multiple forest support 23 2 Click Add on the Credential Manager dialog box under Credential Operations. 3 Enter the database password in the password dialog box and click OK. 4 Double-click Specify Credentials or click Add in the Add Credentials dialog box to open the Specify Domain. 5 Double-click Specify Domain. The Domain and Credential tab opens in the Credentials dialog box. 6 Enter the Domain DNS Name, Domain Name\User Name, and Password. The domain name\user name may be entered by either using a backslash \ to separate domain name and user name. For example, WIN2000\Administrator 7 Click OK. The added credential is listed as a Generic Credential under Selected Item(s). Microsoft network Use the Microsoft Network option to select available domains listed in your Microsoft Windows network or Network Neighborhood. This typically is the list of domains seen by your network browser. To use Microsoft Network 1 Follow steps 1 through 3 given in Specify Credentials. See Specifying credentials on page Double-click Microsoft Network on the Add Credentials dialog box. The list of available domains within the Microsoft Network appear in the Available Item(s) panel. 3 Double-click on a domain from the Available Item(s) to open the Credentials dialog box. 4 Enter the Domain Name\User Name and Password in the Credentials dialog box. The domain name\user name may be entered by either using a backslash \ to separate domain name and user name. For example, WIN2000\Administrator 5 On the Credentials dialog box, click OK. The credential is added under Selected Item(s). 6 Click OK to close this dialog box.

24 24 Using the Product Multiple forest support Enterprise directories The Enterprise Directories feature allows you to select a domain from your forest domain tree. This tree is created using the information entered in the credential database. It does not automatically browse your network to find all the forests. By default, your local or native forest is seen. If you added another domain that resides in a different forest, the additional forest is seen. To use enterprise directories 1 Follow steps 1 through 3 given in Specify Credentials. See Specifying credentials on page Double-click Enterprise Directories to open the available directories from the Available Item(s) in the add Credentials dialog box. 3 Double-click on a directory to open the available domains. 4 Double-click on a domain, or select a domain and click Add to open the Domain Credential tab on the Credentials dialog box. 5 Enter the Domain Name\User Name and Password. The user name is samaccountname, which is the user logon name format. The samaccountname property is a single-valued property that is the logon name used to support clients and servers from a previous version of Windows. 6 On the Credentials dialog box, click OK. The credential is added under Selected Item(s). 7 Click OK to close this dialog box. Using configured forests This list of forests is displayed by the product in the Enterprise Directories folder in the Credential Manager dialog box. This list is generated as you continue entering the credentials for different domains in your credential database. Every new domain added to the credential database is verified and its forest information is recorded in Configured Forests. This domain need not always be the root of your forest. Any child domain causes the forest information to be entered in this folder. Removing the credentials from the credential database does not remove the recorded forest information. The information continues to appear in the Enterprise Directories. To stop a forest from being displayed in the Enterprise Directories, you must delete it from the Configured Forests folder.

25 Using the Product Multiple forest support 25 To use configured forests 1 In the details pane of the bv-control for Active Directory Configuration folder in the RMS Console, open the Configured Forests folder. 2 Select the forest you want to delete and click Delete. If you wish to delete all forests, click Delete All. 3 To complete the delete process, click OK. The selected forest is deleted and the Configured Forests dialog box closes. If you wish to cancel the delete process, click Cancel. The Configured Forests dialog box closes but when it is reopened, the forest you previously selected to delete remains in the list. Credential verification After you enter the credentials, bv-control for Active Directory verifies the credentials before they can be used to run a query. This verification process does not verify the account password. It only verifies that the account name exists in the domain. Use the Refresh button in the Credentials Manager dialog box to update the account properties. Update the account properties if the user is moved between domains in a forest. The bv-control for Active Directory product indicates the verification results by displaying the appropriate icon for that credential. A credential with a question mark icon indicates that the account could not be verified. The bv-control for Active Directory product can use this credential to run a query on objects in the specified domain. A credential with a red line across the icon indicates that the account is invalid. It also indicates that the bv- Control for Active Directory product does not use this account to run a query. A credential without any such overlays indicates that the account was verified and can be tracked. Note: The credential verification process does not use the password entered in the credentials. This process uses the Information Server security context. If your remote domain or forest does not grant anonymous access rights to the domain object, the credential verification fails. A question mark icon is seen in the credential entry. This means that there is no certainty of the accuracy of the account name entered.

26 26 Using the Product Running a query Running a query Task status monitoring When you run a query, the settings you defined in your query definition are polled for the information you requested. The results are returned in the selected view type: Grid, Chart, or Report. The queries can be launched from the following places: A new Query Options dialog box An existing Query Binder The Query Options dialog box appears after you click OK on the Query Builder dialog box. The following is an example of a query being run from the Query Options dialog box. To run a query 1 In the View As area of the Query Options dialog box, select the view type you want for the query results. 2 Click Run to execute the query. The Task Status message offers you a quick and easy way to monitor and manage your tasks while they are running. The Task Status message displays the status of Error, Successful, Incomplete, Waiting, or Running. The Task Status message can be accessed by clicking on the Task Status icon. For example, while waiting for your query results, you may want to open the Task Status message to view the status of your query. The message tells you if the query is still processing, or if it did not process due to an error. The lower end of the Task Status message displays an example of each task status symbol and its meaning. Accessing a previously saved query bv-control for Active Directory provides a comprehensive reporting capability. The administrator view a previously saved query for purposes such as trend analysis and capacity planning. During the query definition process, you have the option to create and save a Query Binder. A Query Binder contains the query s definition. By default, the Query Binder files are saved in the RMS under the Risk Assessment and Control folder. Click the My Items subfolder to locate queries that have been saved.

27 Using the Product Displaying query results 27 To access a previously saved query 1 From the RMS Console container, open the Risk Assessment and Control folder. 2 To view all previously saved queries, open the My Items subfolder. 3 Highlight and right-click the query you want to access. 4 From the Run option list, select the And View As type option to run the query. You can select to view the results in the grid or chart format. Displaying query results The results obtained from the query are displayed in the format that you selected as the View As option. These formats are Grid, Chart, or Report. Note: After running a query, always check for messages that have been returned with the query results. Click the Messages button at the lower right side of the results window. View any messages in this window. Grid format Chart format A grid is a tool used to analyze and display information about resources in your Active Directory environment. It is displayed in the form of a spreadsheet interface. The grid toolbar, also includes options to create charts and print reports of your query results. A chart displays the results of a query in a graphic format (column, pie, or histogram). Charts are created and modified using the Chart Builder Wizard. The wizard guides you through the process of building a custom chart for your query. During the building process, you have the option to determine the type of chart you want to build. You also have the option to label the chart. For more information, see the BindView RMS Console and Information Server Getting Started Guide.

28 28 Using the Product About Baselining The basic types of chart style are the following: Series Chart Histogram Chart It displays the relative values for each record depicted on the chart, using column or pie style. It displays the record frequencies for a single field in a dataset. Report format About Baselining Creating a baseline The reporting feature lets you create a variety of customized reports for your query results. You can print a report of the data results from your query. The appearance of your report is dictated by the print settings defined on the Print Setup dialog box. The RMS Console is installed with default settings. If you wish to customize the default settings, you can do so from the Global Print Setup item in the Console Setup folder. For more information, see the BindView RMS Console and Information Server Getting Started Guide. Another key feature that bv-control for Active Directory provides to assist administrators is baselining. Baselining is a comparison of two historical datasets from the Query Binder. Baselining can help administrators perform risk management by allowing them to view exceptions and monitor changes in the Active Directory environment. Administrators can then analyze the differences to determine how the Active Directory environment has changed over a particular time period. You can baseline any two historical datasets in a query binder. You can also select the type of records that you want compared between the two historical datasets. Before running a baseline, you must select any two historical datasets for a selected query binder to compare. To create a baseline 1 Select the query binder that contains the historical datasets you want to baseline.

29 Using the Product About Task lists 29 About Task lists Building task lists 2 Right-click the query binder to display the shortcut menu. 3 From the Manage option select Historical Data options. 4 In the Manage Historical Data dialog box, select two historical datasets you want to baseline from the list. Click Run Baseline. 5 In the Baseline Options dialog box, select the record types to be included in the baseline. 6 Click OK to run the baseline. bv-control for Active Directory provides a task list capability to help you administer your environment. You can organize and run multiple tasks as a single task unit. When you run the task list file, all of the queries and baselines defined in the file are automatically run. A task list is an organized collection of individual tasks which can be managed and run as a single unit. A task list file can contain the following items: Query tasks Baseline tasks Post process commands for added tasks Summary file commands For more information, see the BindView RMS Console and Information Server Getting Started Guide. Task Lists are created from the Task List dialog box. The following steps explain how to create and run a task list. To create a new task list 1 On the toolbar, click the New Task List icon. 2 On the Task List message, click Add. 3 In the Select a Task Type dialog box, select the baseline or query you want to add to the task list and click Add. To run a new task list 1 From the Task List message, click Run Task List.

30 30 Using the Product About Task lists Generating a field list 2 Close the Task List message. To monitor the progress of the task list as it runs, open the Task Status dialog box. The first requirement for reporting on a specific area in your Active Directory is to know what fields are available. Then you can filter the fields that you do not want to be reported when running a query. bv-control for Active Directory offers a quick way to gather a list of all available fields. To generate a field list 1 On the toolbar, click the New Query icon. 2 Select the Show Advanced Data Sources option. 3 Double-click the BindView Internal Data Sources folder. 4 Highlight the BindView Fields data source, and click OK. 5 Double-click on a field from the Available Fields box in the Query Builder dialog box to cause the field to appear in the Selected Fields box. 6 Click OK. 7 Select the type of view (grid, chart, or report) and click Run to launch the query.

31 Using the Product Effective trustees field 31 The dataset of a generated field list contains the following: Database Name Field Name Field Glossary Displays the name of the Data Source in the query. Displays the fields associated with the data source. Displays the definition of that particular field. Effective trustees field The Effective Trustee field indicates whether a security principal gains the specified permissions on the specified Active Directory object. The permissions and the Active Directory object should be specified in the descriptor of this field. The security principal(s) should be specified through the scope. The Default scope of this query scans all the security principals in the domains available in the credential database. The following permissions are supported in the descriptor: Create, delete, and manage user accounts Reset user passwords and force password change at next logon (Windows 2003) Read All User Information Create, Delete and Manage groups Modify the membership of a group Manage Group Policy Links This is the permission to create, delete, and manage user accounts in the specified object and all of its container child objects. This is the permission to reset passwords. It also can force password change on next logon of user accounts in the specified object and all of its container child objects. This is the permission to read all information of user accounts in the specified object and all of its container child objects. This is the permission to create, delete, and manage group accounts in the specified object and all of its container child objects. This is the permission to modify the membership of group accounts in the specified object and all of its container child objects. This is the permission to manage group policy links of container, OUs and sites in the specified object and all of its container child objects.

32 32 Using the Product Effective trustees field Generate Resultant Set of Policy (Planning) (Windows 2003) Generate Resultant Set of Policy (Logging) (Windows 2003) Create, delete and manage inetorgperson accounts (Windows 2003) Reset inetorgperson passwords and force password change at next logon (Windows 2003) Read All inetorgperson Information (Windows 2003) This is the permission to manage group policy links of container, OUs and sites in the specified object. It also manages all of the container child objects. This is the permission to create, delete, and manage user accounts in the specified object and all of its container child objects. This is the permission to create, delete, and manage inetorgperson accounts in the specified object and all of its container child objects. This is the permission to reset passwords. It can also force password changes on next logon of inetorgperson accounts in the specified object and all of its container child objects. This is the permission to read all information of inetorgperson accounts in the specified object and all of its container child objects. Credential requirements The accuracy of the result of the 'Is Effective Trustee?' field depends on the availability of credentials for the domains of the security principals. Its accuracy also depedes on the members of the groups that have been assigned permissions on the selected Active Directory object. Sometimes the credentials are not available on a security principal's domains. In such instances, the security principal is not considered while calculating the effective trustees. The following factors have to be considered for the Is Effective Trustee field to report accurately: The credential database should have credentials for searching the Global Catalog of the forest hosting the selected object. The object DACL includes ACEs, that grant or deny the permissions for security principal(s) in any trusted domains in a different forest. In such instances, the credentials for all such domains must be entered in the credential database. The object DACL includes ACEs that grant or deny the permissions to the security principals which have been migrated to other domain(s). If such domains are trusted by the domain hosting the object, then the credentials for all such domains calculate the effective trustees.

33 Using the Product Group policy objects (GPOs) functionality 33 The responsiveness of the 'Is Effective Trustee?' field is dependent on the complexity of the permissions assigned on the specified Active Directory object. It also depends on the nesting and hierarchy of the members of the group(s) that have been assigned these permissions. All possible combinations of the assigned permissions and the assigned trustees are considered for calculating the effective trustees. Hence, the query with the 'Is Effective Trustee?' field is time intensive. Limitations The limitations of the Effective Trustee fields Only domain, OU, or container objects can be selected for reporting the effective trustees. Memberships of the Logon-related, well-known pseudo groups such as Everyone, Network, etc., are not considered. You can include these wellknown security principals in the scope and the query includes them in the final result. Windows NT 4.0 or earlier system domains are not supported. Group policy objects (GPOs) functionality A Group Policy Object (GPO) is a collection of policies that are included within an Active Directory container, domain, group, organizational unit (OU), or user. In Active Directory, GPOs define user and computer settings for groups of user and computers in a domain, site or organizational unit (OU). Group policies define the following components of the user s environment that system administrators need to manage: Software settings Application deployment options Scripts User desktop Document folder settings Security settings. Group Policy includes registry-based policies found in Windows NT Server 4.0. It also includes policies enabled by directory services to store various types of policy data. A Policy is applied when the computer starts up and the user logs on. When a user starts up the computer, the computer applies the computer policy. When a

34 34 Using the Product Group policy objects (GPOs) functionality Group policy data source user logs on interactively, the computer loads the user s profile, then applies the user policy. The Policy can be optionally reapplied on a periodic basis. In the Group Policies data source in the All Fields folder there are three Available Fields. In these fields, you can change the descriptor by clicking the Change Descriptor button. The Available Fields in the All Fields folder are as follows: Domains linked to GPO Returns a list of domains to which the group policy object is applied. Organizational Units linked to GPO Returns a list of organizational units to which the group policy object is applied. Sites linked to GPO Returns a list of sites to which the group policy object is applied. The above three fields are used to select a credential for the following items to which the Group Policy Object is applied: Sites Domains Organizational Units All the unique user names in a currently assigned credential database appear in the Available Item(s) list.

35 Chapter 4 Evaluating the Product This chapter includes the following topics: Introduction Reporting on multiple forests Verifying credentials across forests Using generic scopes Introduction This chapter contains different scenarios for advanced usage of the bv-control for Active Directory product in certain circumstances. Reporting on multiple forests With bv-control for Active Directory you can report on multiple forests. You don t need a Information Server in every forest and you don t need any trusts between the forests. You can install the Information Server on a Windows 2000 computer within an NT4 domain. After installation, you can report on other Windows 2000 forests on your network. Multiple forests support relies on your Domain Naming Service (DNS) configuration. The DNS must be configured properly. The Information Server must be installed on the computer where the DNS name resolution is working properly. To report on multiple forests 1 On the toolbar, click the New Query icon. 2 On the Select Data Source dialog box, double-click on a data source.

36 36 Evaluating the Product Verifying credentials across forests 3 Click the Scope tab. The default scope of a query includes all the domains listed in your credentials database. You can expand the domains to see a list of Containers and OUs in the domain and select an item to scope. You can also use predefined reports with multiple forests. Right-click a report and select Settings. Change the scope to use required domains or Containers/OUs. See Running a query on page 26. Verifying credentials across forests The RMS Console and bv-control for Active Directory validate credentials as they are entered into the credential database. You can synchronize the changes in the user accounts, such as user rename, user move, and other processes. This verification may not work if you are entering the credentials for a domain that is not a part of your current forest. Within the bv-control for Active Directory product, queries are executed on the Information Server computer. For internal operations the product uses the security context of the Job Processor. By default, this process runs under the Local System account. Avoid entering credentials for a domain that is not a part of the forest in which your Information Server is installed. In such an instance, it may not always be possible to validate the account name entered in the credentials. The security settings on the remote domain/forest (outside of your current forest) determine the success of this validation. The queries which run under the Local System account are seen as Anonymous queries by the remote domain. By default, Active Directory grants anonymous access permissions on the domain/forest and verification succeeds. If these are turned off, the query to that domain/forest does not succeed. The credential is still accepted but is flagged as an unknown credential icon. If you want the credential to be verified you have to make changes to the security settings of the remote domain/forest. Note: You can use ADSI Edit or the Active Directory Users and Computers snapin. Grant the Read All properties right to the domain object. To verify the credentials across forests 1 Select the Domain. 2 Right-click and select Properties. 3 Select the Security tab.

37 Evaluating the Product Using generic scopes 37 4 Click Advanced. 5 On the Access Control Settings dialog box, click Add then click OK. 6 On the Select User, Computer, or Group dialog box, select Everyone or enter in the Name text box. 7 Click OK to accept selection. 8 Using the Permission Entry dialog box, set the Apply onto setting to This object only. In the Permissions section, check the Allow column for Read All Properties permission. 9 Click OK to close this dialog box. To change the membership of Pre-Windows 2000 compatible access 1 Select the group from the built-in container. Use ADSI Edit to modify this group. 2 Connect to the domain using Domain NC and Configuration Container. 3 Go to Configuration Container \ CN=Configuration, DC=<your domain controller name>\ CN=WellKnown Security Principals. 4 Select CN=Everyone. Using generic scopes 5 On the CN=Everyone dialog box, copy the distinguishedname attribute to the clipboard in the Select a property to view list box. 6 On the CN=Everyone Properties dialog box, click OK. 7 On the CN=Pre-Windows 2000 Compatible Access Properties dialog box, go to Domain NC \ CN=Builtin. Select CN=Pre-Windows 2000 Compatible Access. Select member attribute of this object in the Select a property to view list box. 8 In the Edit Attribute text box, paste the DN that was copied in step 5. 9 Click Add and then OK to close this dialog box. With bv-control for Active Directory v8.50 you can scope to an object by specifying the Distinguished Name (DN) of an object. Use the Generic Scope option on the Query Binder scope page. The objects searched are determined by the data source selected in the Query Binder.

38 38 Evaluating the Product Using generic scopes The Generic Scope option lets you enter any arbitrary path in the directory to start your search. You can use this option to start your search at object paths not listed in the standard scope pages. To use this facility you need to specify the DNS name of the domain. You also need to specify the distinguished name (DN) of the object path where you want to start your search. Use this facility to search through the portions of Active Directory that are not directly accessible from the standard scope UI. For example, consider a search through the configuration of Active Directory in an Active Directory forest. The three parameters of the search are as follows: Starting point (domain and the DN) Object to search for (Data source) Fields to retrieve (Field list) Select the fields from the standard list of fields. You can also select the fields from the User Defined Fields as listed in the Query Binder. You can also mix these in a query. For this example use a forest with an Exchange 2000 installation, which results in Active Directory Schema extension. We search to find out the Public Key Services installed in the forest. This example assumes that the credential database has been configured and assigned to a user. The Windows 2000 Active Directory domain for this example is q-durian.com. To use a generic scope 1 Select Query Builder. 2 Remove the default fields and select Container name, Container children, and Distinguished Name from the list of available fields. 3 Click Scope tab. 4 Remove the default scope from the list of Selected Items. 5 Open Generic Scopes, select Active Directory Path and click Add Scope. To use the Adsi Scope tab of the Additional Settings dialog box: 1 On the Adsi scope tab in the Additional Settings dialog box, select Subtree search. 2 In the Querying Domain text box, enter the DNS name of the domain that you want to search. For example, q-durian.com.

39 Evaluating the Product Using generic scopes 39 3 In the Querying DN text box, enter the DN of the object path where you want to start your search. For example, you can start searching in Configuration container, (CN=Public Key Services, CN=Services, CN=Configuration, DC=Q- DURIAN, DC=com). 4 Click OK to close the Additional Settings dialog box. 5 Click OK to close the Query Builder dialog box. 6 Run this Query.

40 40 Evaluating the Product Using generic scopes

41 Chapter 5 Troubleshooting This chapter includes the following topic: Problems and solutions Problems and solutions This chapter helps you resolve difficulties that you may encounter while using or installing bv-control for Active Directory. The following are the problems and their solutions: Some field descriptors, such as Effective Permissions / Effective Permissions Analysis / Effective Trustees, may not show appropriate selections. Cannot Initialize ADSI search object. Incorrect function. You may see this error while adding credentials to the credential database or browsing through the scope pages. This is because the Global Catalog server was not available or could not be reached. If the canonicalname attribute is not accessible using the credentials available in the credentials database, then some field descriptors such as Effective Permissions / Effective Permissions Analysis / Effective Trustees, may not show appropriate selections. The typical result is that the names added to the list of selected item is blank. This is by design. No action is required. Check DNS setting on Information Server computer. Make sure that GC server is running and can be reached from Information Server computer.

42 42 Troubleshooting Problems and solutions When an object is moved in Active Directory, the scope in saved queries displays the old path of the object. As an example, if a query was scooping to an OU and the OU is then moved, the query still displays the old path of the OU. While running the query the server uses the correct path. This is a display refresh problem. When an object, such as an OU, is moved in Active Directory and a new OU with the same name is created at the same location, the saved queries use the moved path but the display still shows the old path. To reproduce this behavior, create a query and scope to an OU. Move the OU to some other OU/ Domain and create a new OU with the same name. Now rerun the query. The query returns data from the moved OU but the query scope still points to the old OU. A query fails with Unavailable scope, and search fields were not found. The bv-control for Active Directory search engine is not able to get the data from FSR database. The error message is as follows: Modify the saved query. Remove the scope and add the new path. Modify the saved query. Remove the scope and add the new path. Install Windows 2000 SP1. Unavailable Scope: (AdsiScope LDAP:ADS_SCOPE_SUBTREE). Search Fields were not found. When new user credentials are added to the credentials database, the validation process may return an error message saying that the credentials are invalid. This typically happens when the domain hosting the account could not be reached. Verify that your DNS server is available and can be reached. Also, verify that your DNS server can resolve the DNS name of the domain.

43 Troubleshooting Problems and solutions 43 Queries running Users data source uses 100% CPU. If a query is running fields in the Users data source, the CPU utilization stays at 100% for the duration of that query. This data source uses multiple threads to complete the search through the supplied scope. In large Active Directory installations this design practice improves the query performance. In version 8.50 of the product, only the Users data source is expected to return very large number of records. So only Users data source uses multiple threads. This can change in subsequent releases of the product. Uninformative computer failure message. While a query is in progress, if the network gets disconnected, the query fails with the following message: This is by design. No action is required. This is by design. No action is required. Logon failure: unknown user name or bad password. The query uses the credentials supplied in the credentials database to bind to the Active Directory Object. The network problems prevent Active Directory Service Interfaces from logging on to the domain. The query returns the error returned by ADSI. This error message may change, depending on the point of failure. Containers query on a domain scope includes System container. A query that scopes to System container can return objects in the System container and its child containers. There are many hidden /unwanted records in the System container. To avoid reporting System container objects, include the following filter in the query Active Directory Path Doesn t Contain CN=System

44 44 Troubleshooting Problems and solutions GPO data source reports Not Configured value when the Customize??? option is unchecked for options in User Configuration\Windows Settings\Internet Explorer Maintenance\* *. Microsoft GPO snap-in shows the URL path details even when the Customize??? is unchecked. The value set in the policy file is Empty and the original value is saved in a separate variable. The Microsoft Group Policy snap-in shows the old value. This affects the settings under the mentioned folder hierarchy. Containers and OUs data source.-- Container Children fields and Groups data source Group member fields require more time than other fields. These fields require nested computation and take longer than other fields The performance impact is more if the network bandwidth is narrower between Information Server and the connected DC/GC is small. The problem seems to occur largely on 10 MBPS connections between these two servers. Information Server memory utilization may increase before stabilizing a steady state. Information Server uses Access Database to save temporary data. Microsoft Jet Engine that is used to access this database caches some information locally. The buffers allocated to cache this information may not be released for the life of the process. This causes the memory utilization to go up and then stabilize. This behavior is by design. No action is required. This may change in subsequent releases. No action is required. This may change in subsequent releases. Set the MaxBufferSize value to some reasonable number such as For more information on MaxBufferSize setting, see Chapter 7-Optimizing Your Application in Microsoft Access 2000 Building Applications with Forms and Reports. See, Adjusting Windows Registry Settings to Improve Performance.

45 Troubleshooting Problems and solutions 45 When the Active Directory credentials are removed from the credential database, the forest that they were used in is still listed in the configuration folder. The Enterprise Directories folder in the Add Credentials page lists these forests until they are removed. The product does not automatically remove those configured forests. Adding credentials to the credential database using the Specify Domain option does not accept the addition of more than one domain. Once you add the credential using Specify Domain option, the credential gets added to the Selected Items list as Generic Credential. If you try to add any more credentials without closing the Add Credentials dialog box, the new credentials are neither accepted nor is there any error message. If the installation path is longer than 50 characters, the installation fails. The predefined reports shipped with the product fail to install. Group Policy Windows Settings\Windows Settings\User Configuration\Folder Redirection fields return data that is inconsistent with Microsoft Group Policy snap-in. Run Microsoft Group Policy snap-in and select a policy. Go to User Configuration\Windows Settings\Folder Redirection. Select any setting and open the property page On the Target page select the Advanced setting. The contents of the Settings tab are all disabled when the Security Group Membership list on Target page is empty. bv-control for Active Directory v8.50 shows the previously set values By default this is set to Leave the folder in its location. Click the Configuration folder. Double click the Configured Forests item in the right pane. Select the forest and click Delete. Click OK to save the changes. Close the Add Credential dialog box before entering the second credential. Choose the install path less than 50 characters. No action is required.

46 46 Troubleshooting Problems and solutions

47 Appendix A RMS Console Windows Groups This chapter includes the following topic: Administrator and user rights Administrator and user rights The following are the Windows user groups: BV Console Admins BV Console Users Table A-1 lists the rights of the Windows user groups created by the RMS Console along with those required for the Windows administrator. Table A-1 Administrator and user rights Right RMS Console administrator RMS Console user Windows administrator Install a Console or Information Server on a computer X Add or remove BindView licenses to or from the Information Server X Add or remove Information Server users X X Add or remove users to or from the BV Console Admins and BV Console Users groups Assign RMS Console administrator right Assign right to create and modify queries X X X X

48 48 RMS Console Windows Groups Administrator and user rights Table A-1 Administrator and user rights Right RMS Console administrator RMS Console user Windows administrator Assign right to use ActiveAdmin X Create and run ActiveAdmin session log queries X Create and run historical dataset queries X Assign a credential database to a user (password required). The credential database lets the user query resource objects for information and delete or edit a resource object using ActiveAdmin. X Modify or delete a credential database (password required) X Assign right to create and modify task lists X Assign right to launch programs on the Information Server computer (Run Program post process command) X Assign right to send export files to directories on the Information Server computer X Modify other users rights and properties X X Modify your own rights and properties X X X Modify all named scopes stored on the Information Server Assign default scopes for all users X X Assign default scopes for yourself X Define global report style settings Define global export style settings Link to other users My Items folders Manage other users queries X X X X Disable or modify your dynamic index settings X

49 Index A Adding a database 14 Adding credentials 14-?? administrator rights 47 Advanced reporting 10 Advanced use scenarios Generic scopes 37 Reporting 35 Verifying credentials 36 Architecture, illustrated 9 B Baseline options 28 Building queries 18 BV Console Admins 47 BV Console Users 47 C Charts 27 Histogram 28 Series 28 Client 9 Creating a baseline 28 Credential database Adding credentials 14 Requirements 14 Credential verification 25 Custom queries 10 D Data sources 9, 18 Showing 30 Data storage 9 Displaying query results 27 Duplicate key options 20 E Effective Trustees 31 Exporting 10 F Features Advanced reporting 10 Custom queries 10 Graphing 10 Predefined Query Binder 10 Field tab 19 Filter tab 19 Forests 22, 35, 36 G Generic scopes 37 Global print setup 28 GPOs, Group Policies see Group Policy Objects Graphing 10 Grids 27 Group Policy Objects 33 Defined 33 H Histogram charts 28 Historical data 29 I Information Servers 9 Data sources 9 Task processing 9 K Key options 20 M Microsoft Management Console 7 MMC See Microsoft Management Console 7 Monitoring task status 26 Multiple forests 22 Reporting 35

50 50 Index Requirements 22 Verifying credentials 36 P Predefined Query Binders 10 Print setup 28 Q Queries Accessing 26 Defining 18 Displaying results 27 Filters 19 Running 26 Saving 21 Scopes 20 Query 18 Query binder defined 10 Query Builder Field tab 19 Filter tab 19 Scope tab 20 Sort tab 20 Query features Baselining 28 Building process 18 Task lists 29 Query results 27 Selecting Duplicate key options 20 Series charts 28 Sort tab 20 System requirements Security checks 7 Snap-in defined 7 T Task Lists 29 Task processing 9 Task Status 26 U user rights 47 V Verifying Credentials 25 Credentials across forests 36 View types Charts 27 Grids 27 Reports 28 R Reports 28 Requirements Credential databases 14 Multiple forest support 22 rights user and administrator 47 RMS Console 7 Components 9 Running a query 26 S Saving queries 21 Scope tab 20 Scopes 20 Generic 37 Named 21 Settings 21