ActiveRoles Server v 6.7

Transcription

1 ActiveRoles Server v 6.7

2 Slide Index Learning Objectives- Slide #3 Product Overview- Slides#4-9 Installation- Slides#16,17 Free Tools- Slides #18-22 Solutions-Slides #23,24 Role Delgation-Slides#25-30 Rule-based Auto Provisioning and Deprovisioning-Slides#31-37 Troubleshooting Checklist-Slides#48,49 Prerequisites for Contacting Support-Slide#55 2

3 Learning Objectives How To Diagnose & Troubleshoot Upon completion of this lesson, the target audience should be able to install ActiveRoles Server and have a solid understanding of the product function and intended use scenarios. This includes troubleshooting connectivity and expected results, identifying and capturing the necessary and appropriate logs as required. 3

4 Product Overview Architecture Identity and Directory management in Microsoft Active Directory environments is time consuming and at times tedious. ActiveRoles Server provides out-of-the-box user and group account management, strictly enforced role-based security, day-to-day identity administration and built-in auditing and reporting for Windows-centric environments. ActiveRoles Server offers point-and-click modular configuration for easy deployments, along with rules and a delegated administration model to ensure correct access and tight security. A multi-level workflow, Web interfaces for self service and integration points reduce costs associated with user provisioning, with no custom coding required. As enterprise networks evolve into distributed, client-service infrastructures, there is an increased need for incremental administration. This drives organizations to simplify administrative tasks, increase security, and reduce network costs. This is where ActiveRoles Server comes in. 4

5 ActiveRoles Server Architecture 5

6 Key Features of ActiveRoles Server Identity Administration automates user and group account management by automating account creation in AD, mailbox creation in Exchange, group population and resource provisioning in Windows. Also automates the process of reassigning and removing user access rights in AD and AD-joined systems Directory Management Provides Exchange recipient management, group management and computer management (shares, printers, local users/ groups) and unifies Active Directory (AD LDS) management. Includes an intuitive interface that improves day-to-day administration tasks, helpdesk operations and user-driven information changes. Self- Service Enables end users to carry out tasks such as modifying their personal data with an intuitive self-service Web Interface. Security Acts as a firewall around Active Directory so you can reliably delegate control using a least privilege model. 6

7 Key Features of ActiveRoles Server Cloud Services Supports hosted environments where accounts from a client Active Directory domain are synchronized with a hosted AD Domain. Extensibility Supports PowerShell, ADSI, SPML and customizable Web Interfaces. Integration Integrates with many Quest products to simplify and consolidate management points. Including: Quest one Quick Connect, Quest One Identity Manager, Access Manager, Quest Authentication Services, Defender, and Quest One Password Manager. 7

8 Main Components ActiveRoles Server has 5 main components: ActiveRoles Server Administration Service ActiveRoles Server Console (MMC) ActiveRoles Server Web Interface Reporting Solution (Knowledge Portal) ActiveRoles Server ADSI Provider 8

9 Putting the Components Together The ActiveRoles Server components work together as follows; An administrator uses the MMC interface or Web interface to access ActiveRoles Server. The administrator submits an operation request, such as a query or data change to the Administration Service. On receipt of the operation request, the Administration Service checks whether the administrator has sufficient permissions to perform the requested operation (access check). The Administration Service ensures that the requested operation does not violate the corporate policies (policy enforcement). The Administration Service performs all actions required by the corporate policies, before committing the request (policy enforcement). The Administration Service issues operating system function calls to perform the requested operation on network data sources. The Administration Service performs all related actions required by the corporate policies, after the request is processed by the operating system (policy enforcement). The Administration Service generates an audit trail that includes records about all operations performed or attempted with ActiveRoles Server. Directory-change tracking reports are based on the audit trail. 9

10 ActiveRoles Server Administration Service At the core of ActiveRoles Server lies the Administration Service. It features advanced delegation capabilities and ensures the reliable enforcement of administrative policies that keep data current and accurate. The Administration Service acts as a bridge between the presentation components and network data sources. In large networks, multiple Administration Services can be deployed to improve performance and ensure fault tolerance. The ActiveRoles Server Administration Service Requires a specific Service Account to be created. This account must have sufficient permissions to: Gain administrative access to the computer running the Administration Service. Publish the Administration Service in Active Directory. Access any managed domain for which an override account is not specified. The ActiveRoles Server Administration Service will be listed as a running service on the local system. 10

11 ActiveRoles Server Console (MMC) The ActiveRoles Server console, also referred to as the MMC Interface, is a comprehensive administrative tool for managing Active Directory and Microsoft Exchange. It enables you to specify administrative roles and delegate control, define administrative policies and automation scripts, easily find directory objects, and perform administrative tasks. As an alternative to Active Directory Users and Computers (dsa.msc), the MMC allows for object and mailbox creation, management, home folder creation and so on. Many available solutions can also be managed via the Applications node from the MMC. The ActiveRoles Server MMC 11

12 ActiveRoles Server Web Interface Via the Web interface, intranet users with sufficient administrative rights can connect to ActiveRoles Server to perform basic administrative tasks, such as modifying user data or adding users to groups. The Web interface provides departmental and help-desk personnel with the administrative capabilities they need. Multiple instances of the Web Interface, referred to as Web Interface sites, can be installed with different configurations. The following is a list of configuration templates that are available outof-the box. Default Site for Administrators Supports a broad range of tasks, including the management of directory objects and computer resources. Default Site for Help Desk Handles typical tasks performed by Help Desk operators, such as enabling/disabling accounts, resetting passwords, and modifying select properties of users and groups. Default Site for Self-service Provides self-service management capabilities, allowing users to accomplish certain IT-related tasks without assistance from the Help Desk or IT administrators. Users can perform self-administration within the scope of the administrative authority delegated to them in the ActiveRoles Server environment. 12

13 Reporting Solution (Knowledge Portal) ActiveRoles Server offers comprehensive reporting to monitor administrative actions, corporate policy compliance, and the state of directory objects. The ActiveRoles Server reporting solution includes Data Collector and Report Pack. Report Pack provides report definitions for creating reports based on the data gathered by Data Collector. ActiveRoles Server comes with an extensive suite of report definitions that cover all administrative actions available in this product. Report Pack is deployed on Microsoft SQL Server Reporting Services (SSRS). You can use the tools included with SSRS to view, save, print, publish, and schedule ActiveRoles Server reports. The Data Collector is used to gather data required for reporting. The Data Collector Wizard allows you to configure and schedule data collection jobs. Once configured, the Data Collector retrieves data from various sources, accessing them via the ActiveRoles Server Administration Service, and stores the data in a SQL Server database. Data Collector also provides a means for managing the gathered data, including the ability to export or delete obsolete data. 13

14 ADSI Provider The ActiveRoles Server ADSI Provider operates as part of Presentation Components to enable custom user interfaces and applications to access Active Directory services through ActiveRoles Server. The ActiveRoles Server ADSI Provider translates clients requests into DCOM calls and interacts with the Administration Service. The ActiveRoles Server ADSI Provider allows custom scripts and applications, such as Webbased applications, to communicate with Active Directory, while taking full advantage of the security, workflow integration and reporting benefits of ActiveRoles Server. For example, using the ActiveRoles Server ADSI Provider, Web-based pages can be created such that user property modifications made by help-desk operators are restricted by the corporate rules enforced by ActiveRoles Server. 14

15 Licensing The ActiveRoles Server license specifies the maximum number of enabled user accounts in all managed domains. When starting, adding a managed domain, or removing a managed domain, the Administration Service counts the actual number of enabled user accounts, and compares it to the maximum number specified by the license. If the actual number exceeds the maximum number, a license violation occurs. ActiveRoles Server bases its used license count by calculating the number of enabled user accounts in your managed domains. Once the license count exceeds the maximum number of user accounts specified in your license, a license violation occurs. In this case, a warning message is displayed on every start of the ActiveRoles Server console or connection to the Web Interface. In the event of a license violation, you have the following options: Disable a sufficient number of user accounts to bring your license count under the licensed value. After that, restart the Administration Service (net stop arssvc, then net start arssvc) to recalculate the license count. Remove one or more managed domain to decrease your license count. Unmanaged domains do NOT count as licensed users. Purchase a new license, with a greater number of user accounts. Then, update your license using the instructions provided later in this section. If you have any domains from which ActiveRoles Server would only select objects and retrieve data, register them as unmanaged domains. Any number of domains can be registered in this way, provided that the number of the enabled user accounts in each does not exceed the maximal number of users indicated in the license. 15

16 Installation At a very high level the installation of ActiveRoles Server would include some if not all of these components. The ActiveRoles Server Administration Service (required) The ActiveRoles Server Console (MMC) (required) The ActiveRoles Server Web Interface (Optional, depending on deployment/ delegation requirements) The ActiveRoles Server Reporting Solution (Knowledge Portal/ Collector) (Optional, for those who wish to gather and review reports) ADSI Provider (optional and required only on workstations running scripts) Detail regarding installation steps, including checklists, configuring the ActiveRoles Server Administration Service Account, and so on please review to the ActiveRoles Server Quick Start Guide starting on page

17 Installation GUI (Autorun.exe) The Installation GUI (Autorun.exe) is available at the root of the extracted ActiveRoles Server download. It offers various tabs to aid in the installation of ActiveRoles Server ActiveRoles Server All components Solutions Various solutions available Documentation Included guides Redistributables Required packages (IE.NET, SQL Express) Help and Support How to get assistance Contact Us How to contact Quest Software 17

18 Free Tools There are 11 Free Tools that ship with ActiveRoles Server that are supported. (Tools and solutions downloaded from the ActiveRoles Server Community or downloads from Quest.com listed as free tools are not supported by Quest Support, only those that ship with the product.) The Free Tools can be found \\\Unzipped\Solutions\Free Tools in the ActiveRoles Server extracted download package. Most can also be installed from the Installation GUI (Autorun.exe) by selecting the solutions tab. ActiveRoles Server Import Tool Administrative Template ADSI Provider (ADSI Provider x64) Configuration Transfer Wizard Delegation Manager for Windows Services Management Pack for MOM Management Shell for Active Directory Script Validity Checker SPML Provider Support Pack for HP Protect Tools Authentication Services Support Pack for OCS 18

19 Free Tools The Executable, MSI and Admin Guide or Readme file for each tool is found within the appropriate tool folder in the location previously mentioned. (Note: Information regarding the ADSI Provider (including x64) is found in the ActiveRoles Server Quick Start Guide under Installing Additional Features.) ActiveRoles Server Import Tool - ActiveRoles Import Tool simplifies transition from ActiveRoles Direct to ActiveRoles Server. The tool is intended to import roles and rules definitions from an ActiveRoles Direct environment to ActiveRoles Server. It analyses ActiveRoles and Business Views deployed with ActiveRoles Direct, and creates the structure of administrative rights, views, and policies in ActiveRoles Server, that mirrors the administrative structure implemented by using ActiveRoles Direct. Administrative Template for ActiveRoles Server Console - The Administrative Template ARServer.adm allows administrators to control registry settings using Group Policy, providing the means to configure the behavior and appearance of the ActiveRoles Server console (MMC Interface). With this Administrative Template you can: Cause the console to hide some portions of the user interface Specify default settings for some user interface elements Specify settings to register extension snap-ins with the ActiveRoles Server console 19

20 Free Tools ADSI Provider covered earlier in this presentation. The ADSI Provider is available for installation from both the main setup screen, and the free tools folder. Configuration Transfer Wizard - With ActiveRoles Server Configuration Transfer Wizard you can export ActiveRoles Server configuration objects (such as Access Templates, Managed Units, Policy Objects, Policy Type objects, etc.) to an XML file and then import them from that file to populate another instance of ActiveRoles Server. The export and import operations provide a way to move configuration objects from a test environment to a production environment. Delegation Manager for Windows Services - extends ActiveRoles Server to add new capabilities for service administration, providing the ability to delegate service management tasks on a per-service basis. The solution also adds the service management related commands to the computer management section of the ActiveRoles Server Web Interface so that delegated administrators can use the Web Interface to perform service management tasks. Management Pack for Microsoft Operations Manager (MOM) - The Management Pack provides a basic ActiveRoles Server management solution for MOM by monitoring availability of the Administration Service (AR Server Service) and its information store, ActiveRoles Server replication status, and availability of ActiveRoles Server Web Interfaces. 20

21 Free Tools Management Shell for Active Directory - An Active Directory-specific automation and scripting shell that provides a command-line management interface for administering directory data either via Quest ActiveRoles Server or by directly accessing Active Directory domain controllers. ActiveRoles Management Shell is built on Microsoft Windows PowerShell technology. Script Validity Checker - Script Validity Checker allows administrators to verify the status and validity of ActiveRoles Server script modules that are used to implement script-based policies and scheduled tasks. SPML Provider - SPML Provider is designed to exchange the user, resource, and service provisioning information between SPML-enabled enterprise applications and Active Directory. SPML Provider supports the Service Provisioning Markup Language Version 2 (SPML v2), an open standard approved by the Organization for the Advancement of Structured Information Standards (OASIS). SPML - is an XML-based provisioning request-and-response protocol that provides a means of representing provisioning requests and responses as SPML documents. Support Pack for HP ProtectTools Authentication Services - forces ActiveRoles Server to manage passwords by using the approved password generation and password hashing algorithms of HP ProtectTools Authentication Services. The Support Pack modifies the password-setting mechanism available in ActiveRoles Server so that the passwords are generated by HP ProtectTools. 21

22 Free Tools Support Pack for Office Communication Server (OCS) - extends the ActiveRoles Server capabilities to enable the management of user accounts for Microsoft Office Communications Server 2007 or Microsoft Office Communications Server 2007 R2 (ActiveRoles Server 6.7.x). The Support Pack provides Automated user provisioning and deprovisioning and simplified administration of OCS user accounts. Microsoft Lync Support is coming June 30,

23 Solutions In addition to the Free Tools just reviewed, there are other Solutions available from the Solutions area of the Installation GUI (Autorun.exe) Quick Connect (Quest One Quick Connect) offers synchronization for identity data (users, groups, etc.) to a variety of platforms such as AD, AS/400, Exchange Resource Forests, Lotus, Mainframes, PeopleSoft, RACF, SAP Solutions, Virtual Directory Server. Quest One Quick Connect is a separate product that integrates closely with ActiveRoles Server. It is purchased and licensed separately. (Quest One Quick Connect for Base Systems is free for users licensed to use ActiveRoles). ActiveRoles SharePoint Extensions - allows administrators to synchronize the group memberships between Active Directory groups and SharePoint Server groups. SharePoint Extensions supports the bidirectional (two-way) synchronization of all changes in the group memberships since the last synchronization operation. For example, adding or removing a user from an Active Directory group will result in an automatic adding or removing that user from the group's counterpart on SharePoint Server. ActiveRoles Server Support Pack for Quest Authentication Services (QAS) - extends the capabilities of the ActiveRoles Server Web interface to include the management of Unix and Linux identities such as Unix-enabled users and groups. You define all management operations by means of the ActiveRoles Server console. Then when managing the users and groups in the Web interface, the defined provisioning and security policies will be followed. 23

24 Solutions Defender Integration Pack - extends the management and administration of users Defender Properties allowing token assignments and token administration through the Web Interface. ActiveRoles Server Knowledge Pack for InTrust uses InTrust workflow to control administrative operations inside and beyond the ActiveRoles Server environment, ensuring the compliance of directory data with business rules and regulations. Free for customers who own both ActiveRoles Server and InTrust. 24

25 ActiveRoles Server Role Delegation ActiveRoles Server is built to provide automation (provisioning/ deprovisioning) and defining roles for delegation to various staff and Help Desk personnel. This relieves highly skilled administrators from routine day-to-day tasks, saving time and increasing productivity. For example, an administrator can allow the Help Desk to perform specific tasks, such as resetting passwords or managing group memberships, without granting full administrative privileges. This can be narrowed down so that specific delegated users can only complete specific tasks on certain OUs, and even further to specific Object types. As you develop your administration and security design, you define delegated administrators (Trustees) and administrative roles (Access Templates). Then, you define Managed Units and apply Access Templates, designating Trustees for each Managed Unit. You can also apply Access Templates to objects and folders in Active Directory, assigning the permissions to the necessary Trustees. This three-way relationship between Trustees, Access Templates, and managed objects is central to the implementation of your role-based administration model. The Active Directory Users and Computers tool provides the facility to delegate administrative responsibilities. However, every time you want to delegate rights, you need to define a set of permissions. This makes the delegation procedure time-consuming and prone to errors. ActiveRoles Server overcomes this problem by consolidating permissions into customizable administrative roles Access Templates. The logical grouping of permissions simplifies the management of delegation settings. 25

26 Role Delegation Access Templates The main two features offered by ActiveRoles Server to facilitate in Role Delegation are Access Templates and Managed Units. ActiveRoles Server implements delegated administration by linking Access Templates to collections of objects (Managed Units), directory folders (containers), or individual (leaf) objects. When applied to a directory object, an Access Template specifies permission settings for that object and its child objects. Applying Access Templates to Managed Units is a convenient way to manage permissions on collections of directory objects. Each Access Template is applied in relation to some users and/or groups (Trustees), and the permissions specified in the Access Template determine their access to managed objects. When an Access Template is modified or no longer applied, permissions set for the directory objects are modified accordingly. Permissions defined in an Access Template can be propagated to Active Directory, with all changes made to them in ActiveRoles Server being automatically synchronized to Active Directory. 26

27 Role Delegation Access Templates ActiveRoles Server ships with a set of pre-defined Access Templates. These can be copied and modified as required, or new Access templates can be created. Predefined Access Templates Access Template Name Trustee associated with Linked Template Linked Directory Object (OU), Container or Domain Sync to Native AD Enabled/ Disabled 27

28 Role Delegation Managed Units Rules-based administrative views called Managed Units make it easy to view and manage the enterprise, without changing the underlying domain and organizational unit structures. By dynamically adapting to changes in the enterprise, Managed Units dramatically simplify the maintenance of business rules. The use of Managed Units helps to overcome the limitations inherent in rigid organizational unit structures, and addresses the need to perform administration outside organizational unit, domain, and forest boundaries. A Managed Unit is a collection of objects collectively managed with ActiveRoles Server, created for the distribution of administrative responsibilities, enforcement of business rules and corporate standards, and management of complex network environments. Using Managed Units, the management framework can be separated from the Active Directory design. Directory objects can easily be grouped into administrative views, regardless of their location in Active Directory. 28

29 Role Delegation Managed Units The Active Directory design might be based on geographic location, with domains named after cities or regions and organizational units named after corporate departments or groups. However, Managed Units (MU) could be designed to manage specific departments or groups that are divided across multiple geographic locations. In this example, each AD domain has a Human Resources (HR) OU and a Sales OU. The ActiveRoles Server design has an HR MU and a Sales MU. The HR MU enables administrators to configure the policies and security restrictions needed for all HR users regardless of their location, while the Sales MU enables the same for all Sales users. 29

30 Role Delegation Managed Units Managed Units are defined with the use of membership rules criteria used by ActiveRoles Server to evaluate whether or not an object belongs to a given Managed Unit. This enables Managed Units to dynamically change as the network environment changes. For example, you can define a Managed Unit by specifying rules that include all objects whose properties match specific conditions. The specified rules will force the new or modified objects to be members of the correct Managed Unit. Managed Units are also found within the Configuration Container in the ActiveRoles Server MMC. Please note that using excessively complex managed units which incorporate LDAP queries for include/exclude can degrade ARS performance if they are in sufficiently large (>1000) amounts) 30

31 Rule-based Auto Provisioning and Deprovisioning Active Directory enables delegation of control with very fine granularity. However, the ability to restrict access may not be sufficient. Many directory administration activities exhibit a predefined workflow. This workflow involves accomplishing a number of tasks in a particular sequence. Administrators and other personnel have to perform almost identical tasks repeatedly. Some examples are creating user accounts, resetting passwords, disabling inactive user accounts, and enforcing user naming conventions. ActiveRoles Server provides the facility to specify how, when, and what must change, whenever directory objects are created, modified, or deleted. Furthermore, it is possible to configure ActiveRoles Server to only accept data changes that conform to certain formatting requirements. This helps maintain control of the data stored in the directory. In ActiveRoles Server, administrative policies are defined by using Policy Objects collections of policies. Policy Objects define the behavior of the system when directory objects are created, modified, or deleted. You can create a Policy Object that includes any number of different policies, such as format validation, generation rules for the values of object attributes, scripts that supplement administrative operations, automatic creation of user mailboxes on prescribed Exchange servers, automatic creation of user home folders and home shares, and relocation of an object to a specified container when it 31 meets certain criteria.

32 Rule-based Auto Provisioning and Deprovisioning Through the use of Policy Objects, ActiveRoles Server automates user provisioning tasks to reduce your administrative workload and get new users up and running faster. It automates reprovisioning and deprovisioning as well, so when a user s access needs to be changed or removed, updates in Active Directory, Exchange, and Windows are made automatically, thereby reducing administrative workloads and making users more productive faster. To help you configure and apply Policy Objects, they are broken into two categories: Provisioning Policy Objects These are used to specify provisioning rules, including the population and validation of directory data, creation of resources such as home folders and mailboxes, and provision of access to resources. Deprovisioning Policy Objects These are used to specify deprovisioning rules, including the removal of user and accounts, home folders, security and distribution lists, and application access upon requests to deprovision users or groups. It is possible to create and apply any number of Policy Objects in each category. 32

33 Rule-based Auto Provisioning and Deprovisioning A Policy Object is a collection of administrative policies that specify business rules to be enforced, and stored policy procedures and specifications of events that activate each procedure. A Policy Object associates specific events with its policy procedures (built in or custom scripts). This provides an easy way to define constraints, implement validation criteria, synchronize data sources, and perform a number of admin tasks as a batch. 33

34 Rule-based Auto Provisioning and Deprovisioning To create a Policy Object 1. In the console tree, under Configuration Policies Administration, locate and select the folder in which you want to add the Policy Object. You can create a new folder as follows: Right-click Administration and select New Container. Similarly, you can create a sub-folder in a folder: Right-click the folder and select New Container. 2. Right-click the folder, point to New, and then click Provisioning Policy or Deprovisioning Policy. 3. On the Welcome page of the wizard, click Next. 4. On the Name and Description page, do the following, and then click Next: a) In the Name box, type a name for the Policy Object. b) Under Description, type any optional information about the Policy Object. 5. On the Policy to Configure page, select a policy type, and click Next to configure policy settings. 6. On the Enforce Policy page, you can specify the objects to which this Policy Object is to be applied: Click Add, and use the Select Objects to locate and select the objects you want. 7. Click Next, and then click Finish. 34

35 Rule-based Auto Provisioning and Deprovisioning Provisioning Policy Objects allow configuration and application of the following policies: User Logon Name Generation Generates a user logon name (pre-windows 2000) for the account being created. Alias Generation Ensures that newly created user accounts have the appropriate aliases set up. Exchange Mailbox AutoProvisioning Ensures user mailboxes are created in appropriate mailbox stores or databases. Group Membership AutoProvisioning Ensures user accounts below to the appropriate groups Home Folder Provisioning Performs tasks to assign home folders and home shares to user accounts. Property Generation and Validation Generates and validates directory data, such as user properties. Script Execution Runs a script upon requests to perform certain operations, such as creation or updating of a user account. 35

36 Rule-based Auto Provisioning and Deprovisioning Deprovisioning Policy Objects allow configuration and application of the following policies: User Account Deprovisioning Modifies the user account so that the user cannot log on. Group Membership Removal Removes the user account from groups. (as specified) User Account Relocation Moves the user account do a different location. Exchange Mailbox Deprovisioning Policy makes changes needed to deprovision Microsoft Exchange Resources for the user. Home Folder Deprovisioning Makes changes to prevent user from accessing home folder or share. User Account Permanent Deletion Schedules the account for deletion. Group Object Deprovisioning When deprovisioning a group, changes the group object to prevent use. Group Object Relocation When deprovisioning a group, policy can move the group to another container in AD. Group Object Permanent Deletion Schedules the group for deletion. 36

37 Rule-based Auto Provisioning and Deprovisioning Notification Distribution In the case of deprovisioning operations the policy sends a notification message to the e- mail recipients specified. Report Distribution Upon completion of deprovisioning the policy sends a report to the recipients specified. Script Execution In the course of a deprovisioning operation, the policy runs the specified script. For further explanations of all Provisioning and Deprovisioning Policies, please review the detailed definition in the ActiveRoles Server 6.7 Admin Guide on Page 113 For a more granular review of available Policy Object Management Tasks, please review Policy Object Management tasks starting on P117 of the ActiveRoles Server 6.7 Admin Guide. Available Policy Object Management Tasks: Creating a Policy Object Adding, Modifying, and Removing Policies Applying Policy Objects Managing Policy Scope Copying a Policy Scope Renaming a Policy Object Exporting and Importing Policy Objects Deleting a Policy Object 37

38 ActiveRoles Server Attestation Review ActiveRoles Server provides a process for presenting fine-grained directory data to managers or data owners for certification on the accuracy of the data, and supplies the managers and data owners with the means to review the data, correct inaccuracies, or apply remediation measures such as deprovisioning. Any aspect of directory data could be subject to certification, including the data specific to user logon accounts, service logon accounts, group memberships, computers, contacts, and other types of directory objects. The process of reviewing and certifying objects and data held in the directory is referred to as Attestation Review. ActiveRoles Server Supports the following attestation scenarios; ~ Group Owners attest membership of their groups ~ Managers attest user accounts of their subordinates ~ Service owners attest their service accounts ~ Users attest their own accounts (Self-Attestation) ~ Managers or object owners attest their objects Since it is logon accounts, group memberships, and related access controls that govern access to IT resources, the ability to automate attestation of user accounts, service accounts, and group memberships addresses the need for frequent and timely reviews of user profiles that permit or restrict access to various systems and applications within the enterprise. Automated attestation provides a means to verify access control related data, quickly and periodically, to ensure compliance with relevant business laws and regulations. 38

39 Attestation Review Key design elements of the Attestation Review feature include: ~ Step-by-step configuration of attestation processes ~ Flexible definition of what objects are exposed to attestation ~ Ability to start reviews on a scheduled or ad-hoc basis ~ Support for parallel multiple reviews ~ Notifications regarding attestation-related events ~ Web Console for performing reviews ~ Operational reports on reviews that are in progress ~ Historical reports on reviews that are completed By deploying the automated attestation solution, organizations can achieve major benefits in terms of time and cost saving. Automating the process of attesting to directory data provides a way to expedite audit reviews, making it easier to meet regulatory compliance requirements in a timely manner. This Video Solution outlines how to setup a basic Attestation Review in ActiveRoles Server 6.7; 39

40 ActiveRoles Server Reporting The ActiveRoles Server reporting solution leverages Microsoft SQL Server Reporting Services (SSRS) as a platform for managing, generating, and viewing reports. The use of Reporting Services provides a way to centralize report storage and management, enable secure access to reports, control how reports are processed and distributed, and standardize how reports are used. A comprehensive collection of report definitions, referred to as the ActiveRoles Server Report Pack, are published to the report server, a component of Reporting Services. Installing the Report Pack creates published reports that can be accessed through Web addresses (URLs), through SharePoint Web parts, or through Report Manager, a Web-based report access and management tool included with SSRS. Another option for accessing published reports is Quest Knowledge Portal, a Web-based application that extends functionality of SSRS to provide easy report management and delivery. With Quest Knowledge Portal, an administrator can quickly and easily organize reports into a hierarchy of folders, configure data sources, modify report properties, export and import reports, and search through reports. By default, the report server renders reports in HTML format. In addition to HTML, reports can be rendered in a variety of output formats, including Excel, XML, PDF, TIFF, and CSV. Report users can choose to render reports on demand in preferred formats for data manipulation or printing. 40

41 ActiveRoles Server Reporting The reports that can be generated once the ActiveRoles Server Report Pack is deployed are instrumental in change tracking audits, directory data monitoring and analysis, and assessment of ActiveRoles Server security and policy configurations. The reports fall into these categories: ActiveRoles Server Tracking Log Check what changes were made to directory data through the use of ActiveRoles, who made the changes, and when the changes were made. Active Directory Assessment Examine the state of directory data, such as properties of users, groups and other directory objects, group membership lists, and contents of organizational units. Administrative Roles View details on who has access to what data when using ActiveRoles Server, and what changes administrative users or groups are authorized to make. Managed Units View details on the Managed Units defined in the ActiveRoles Server environment, what policies are applied to Managed Units, and what users or groups have administrative access to what Managed Units. Policy Objects View details on what administrative policies are defined in the ActiveRoles Server environment, where particular policies are applied, and what policies are in effect on particular objects and containers. Policy Compliance View details on what data in the directory is incompliant with ActiveRoles Server policies that are in effect, and what policy rules are violated. Reports are built on data prepared by the ActiveRoles Server Collector. 41

42 ActiveRoles Server Collector The ActiveRoles Server Collector allows you to collect data from computers running the Administration Service and store it in a SQL Server database, making the data available for reporting. The ActiveRoles Server Collector is installed as a separate component of ActiveRoles Server. Data for reports is collected from the following sources: Active Directory The Collector accesses Active Directory through the Administration Service. Reports built on this data provide detailed information about domains, accounts, groups, and other Active Directory objects. ActiveRoles Server configuration database Reports built on this data provide detailed information about who can carry out what actions and to which directory objects using ActiveRoles Server, as well as information about the policies defined by ActiveRoles Server. Event log on computers running the Administration Service Reports built on this data provide detailed information about actions performed, the success or failure of each action, and object properties that were modified using ActiveRoles Server. The scope of data that the Collector can retrieve from Active Directory is restricted by the access rights of the user account under which the Collector performs the data collection task. 42

43 Management History The Management History feature provides information on who did what and when it was done with regard to the Active Directory management tasks performed using ActiveRoles Server. This feature gives you a clear log documenting the changes that have been made to a given object, such as a user or group object. The log includes entries detailing actions performed, success or failure of the actions, as well as which attributes were changed. By using the Management History feature, you can examine: Change History Information on changes that were made to directory data via ActiveRoles Server. User Activity Information on management actions that were performed by a given user. Both Change History and User Activity use the same source of information the Management History log, also referred to as the Change Tracking log. ActiveRoles Server also includes reports to examine management history by collecting and analyzing event log records (see ActiveRoles Server Reporting earlier in this document). However, the process of retrieving and consolidating records from the event log may be timeconsuming and inefficient. 43

44 Management History The Management History feature includes a dedicated repository to store information about data changes, referred to as the Change Tracking Log, and GUI to retrieve and display information from that repository. No additional actions, such as collecting or consolidating information, are required to build Management History results based on the Change Tracking Log. The advantages of the Management History feature also has some limitations. The Change Tracking Log is somewhat incomplete in that it does not reflect data changes made by certain policies, such as Group Membership AutoProvisioning. One more factor to consider is the size of the Change Tracking Log. To ensure real-time update of the Log on all Administration Services, the Log is normally stored in the ActiveRoles Server configuration database. This imposes some limitations on the Log size. By default, the Change Tracking Log is configured to only store information about changes that occurred within last 30 days. If you increase this setting, do it carefully; otherwise, you may encounter the following problems: 1. Excessive increase in the Log size significantly increases the time to build and display Change History and User Activity Results 2. As the Log size grows, so does the size of the Configuration Database, increasing backup and restore jobs and increased network traffic. 3. GUI is not suitable to represent large volumes of Management History results in a manageable fashion. There are no filtering options, hence you may find it difficult to sort the results. 44

45 Management History To address these limitations, ActiveRoles Server gives you a different means for change auditing change tracking reports, included with the ActiveRoles Server Report Pack. These reports are designed to help you answer the following questions: What management tasks were performed on a given object within a certain period of time? What management tasks were performed on a given object during the object s entire life time? When was a certain attribute of a given object modified? To alleviate issues with the size of the ActiveRoles Server Configuration database, it is possible to break-out management history data to a separate database. The steps to complete this are covered in the ActiveRoles Server 6.7 Admin Guide P424 (Ref Option 2). Follow all sections as outlined: Database 1. Separate database to Store the Management History Data 2. Creating a Management History Database 3. Importing Data to the New Management History Database 4. Configuring the Administration Service to Use the New Management History 45

46 ActiveRoles Server Environment Example SQL Server Knowledge Portal SSRS (SQL Server Reporting Services) Optional to Separate Management History DB Reporting DB/ Collector Configuration DB Management History DB ARS Admin Service Active Directory/ ADAM Clients MMC Web Interface SPML ADSI Provider 46

47 Known Issues The Release notes for each General Availability (GA) Build include a section that outlines the Known Issues for that specific build (as well as New Features, Resolved Issues, Upgrade and Compatibility information, and sections regarding System Requirements and Getting Started). For many known issues the Release Notes will also outline a workaround if available. 47

48 Troubleshooting Checklists When opening the ActiveRoles Server MMC "No Administration Services Found. To establish a connection, on the Action menu, click Connect. This is a common error with a few easily resolved possible causes The Administration Service is not started. Check this in the Services Control Panel. If it did not start, and does not start upon attempting to manually start investigate this. Is the Administration Service Account correct? Has the password been changed? Is the Account locked out? The MMC and Service Versions are not the same (SOL63954) Event ID 2501 exists in the server EDM Server Event Log. The local SQL native client may need to be reinstalled, assuming SQL is on a different box. (SOL50102) This may be caused by "System cryptography: Use FIPS compliant algorithms" Setting enabled in Computer Configuration/ GPO (SOL53180) Error "You have performed an unauthorized operation, or any error that indicates that the user attempting to make a change (create user, mail enable, or modify a user object) does not have the appropriate permissions. First can a DSAdministrators make this change? (DSAdmins are defined Administrators of ActiveRoles Server, this defaults to the local Admin group where ActiveRoles Server is installed, for more information see SOL65110.) It is a general practice to create a Domain Security Group specifically for this access, and place the appropriate users into that group. If the DSAdmin cannot make the desired changes/ creations the Administration Service Account likely does not have the necessary permissions. If the DSAdmin can make changes, ensure that the user experiencing the issue has the appropriate access delegated via Access Templates (an example SOL89598) 48

49 Troubleshooting Checklists Errors in one of the ActiveRoles Server Web Interfaces: Does the issue occur in the ActiveRoles Server MMC as well? If no, the issue is purely related to the Web Interface. If yes it is a problem with ActiveRoles Server, capture a ds.log of the issue, steps to reproduce, which users/ groups are involved and the exact error message. Is the ActiveRoles Server Web Interface customized in any way (either supported or unsupported changes IE Via PSO or Custom Dev). Is it an option to deploy a new Web Interface from template to test (via the Web Interface Sites Configuration Wizard)? Capture a DS.log and a Web Interface log of the issue being reproduced. Ensure that information regarding what steps, what users/ groups are involved, etc. are also captured along with the exact error message. 49

50 Generic Patches With every full build of ActiveRoles Server, Product Management and Development periodically release Generic Patches that address various Known Issues, discovered defects, and incorporate various hotfixes provided to customers since the release of the GA Build. Each Generic Patch comes with its own release notes that outline the resolved issues. Also, Generic Patches are cumulative meaning if Generic Patch 3 is available, it is not necessary to install previously available Generic Patches 1 and 2. Simply install the GA Build and apply the latest Generic Patch. Shown is a list of the currently available and supported ActiveRoles Server builds. All are available for download from the Support Portal. The Resolved Issues section of release notes for the GA and Generic Patch builds are good resources to identify if an issue has already been identified and resolved, or in some cases if a workaround exists. 50

51 ActiveRoles Server Logging Note: with all log files please always capture a detailed account of how to replicate the issue (Step-by-step), and the names of any (all) users / groups, domains, OUs etc. involved for investigation of the associated log files. SOL How to gather DS logging for ActiveRoles Server A ds.log should be captured for any error or unexpected/ missing behavior in ActiveRoles Server. Collect with the EDM Server Event log (outlined below) SOL How to gather ADSI logging for ActiveRoles Server ADSI Logging is required for any ADSI errors or failures SOL How to gather MMC logging for ActiveRoles Server MMC Logging is required for errors or issues that only occur within the MMC. A DS.log capture should accompany. 51

52 ActiveRoles Server Logging continued SOL How to gather Collector logging for ActiveRoles Server Collector logging is required when the data collector is not capturing all data as expected, or experiencing any failures/ errors. SOL How to gather Configuration Transfer Wizard logging for ActiveRoles Server Required when the Transfer Wizard is not capturing/ transferring all data as specified, or if there are any errors/ failures. SOL How to gather EDM Server Event logging for ActiveRoles Server The EDM Server Event Log should always accompany the Ds.log when captured. SOL How to gather Web Interface logging for ActiveRoles Server (v 6.x) To be captured anytime there is an error, missing or unexpected behavior with the ActiveRoles Server Web interfaces. Also collect the ds.log and EDM server event log for the same time period. 52

53 ActiveRoles Server Product Integration ActiveRoles Server integrates with many Quest Products: Quest One Quick Connect (Sync Engine 5.0 Admin Guide for all connector types) Quest One Identity Manager (Integration via PSO engagement only) Access Manager Quest Authentication Services Defender Quest One Password Manager ChangeAuditor Integration of these products is linked above for each product where applicable. Some links are ActiveRoles Server, others are for the corresponding products. Quest One Quick Connect has 13+ available connectors, Quest One Quick Connect for Base Systems is free for licensed ActiveRoles Server customers. ChangeAuditor has functionality to monitor ActiveRoles Server and include the logged in user who completed changes via ActiveRoles rather than reporting the Administration Service Account (as in previous versions). This feature/ option ships with ChangeAuditor not ActiveRoles Server. 53

54 Recommended Reading ActiveRoles Server 6.7 Admin Guide: (The entire Guide is valuable and recommended to read) Security and Administration Elements P25 Rule based Administrative Views P49 Role based Administration P71 Rule-based Auto-Provisioning and Deprovisioning P111 Attestation Review P285 Workflows P305 Temporal Group Memberships P351 Group Family P357 Dynamic Groups P387 ActiveRoles Server Reporting P397 Management History 415 Managing Configuration of ActiveRoles Server P469 ActiveRoles Server 6.7 Predefined Access Templates ActiveRoles Server 6.7 Web Admin Guide All available logging SOL