SMART Active Directory Migrator Requirements

Transcription

1 SMART Active Directry Migratr January 2016

2 Table f Cntents... 3 SMART Active Directry Migratr Basic Installatin... 3 Wrkstatin and Member Server System... 5 Netwrking... 5 SSL Certificate... 6 Service Accunt... 6 DNS SRV Recrd Requirement... 7 SID Histry Synchrnizatin... 7 Passwrd... 9 SMART Directry Sync Requirement fr Synchrnize Passwrds... 9 Abut Binary Tree SMART ACTIVE DIRECTORY MIGRATOR REQUIREMENTS 2

3 SMART Active Directry Migratr Basic Installatin The SMART Active Directry Migratr suite cnsists f Binary Tree s SMART Active Directry Migratr, which includes bth the cnsle and the Web service, and SMART Directry Sync sftware packages. Bth packages will require access t Micrsft SQL Server. In mst envirnments, all f these cmpnents will be installed n the same server. Single Server Installatin Supprted Operating Systems Windws Server 2008 R2 Windws Server 2012 R2 SQL Server SQL 2008 R2 r SQL 2012 SP2 SQL Express Editins are supprted up t 5000 bjects SQL Management Studi must be installed SQL must be cnfigured t permit mixed authenticatin, and ne lcal SQL authenticatin accunt must be created fr SMART AD Migratr and SMART Directry Sync t share Minimum Hardware 2 CPU/vCPU 6GB RAM 10 GB disk space, inclusive f the SQL install requirements Additinal Cmpnents If yur server is nt internet cnnected, yu will be required t install the fllwing cmpnents prir t installing SMART Active Directry Migratr:.NET Framewrk (Full) r newer Visual C Redistributable BOTH the x64 and x86 versins must be installed, regardless f the fact that the Windws Operating system is 64-bit Multi-Server Installatin SMART Active Directry Migratr is scalable and supprts segregating cmpnents and can be installed in a multi-server cnfiguratin t supprt larger r cmplex envirnments. If required in larger installatins, remte SQL Servers may be used fr the primary database and the lgging database. Additinally, the primary database and the lgging database can be segregated nt separate SQL Server instances. Each f the fllwing rles/functins may be separated nt different servers as required in advanced cnfiguratins: SMART ACTIVE DIRECTORY MIGRATOR REQUIREMENTS 3

4 AD Migratr Server Web Service AD Migratr Administratr Cnsle SMART Directry Sync Sftware Directry Sync Database Directry Sync Lgging Database When installed independently, Binary Tree s cmpnents require the fllwing resurces: Supprted Operating Systems Windws Server 2008 R2 Windws Server 2012 R2 AD Migratr Split Rle Minimum Hardware 1 CPU/vCPU 2GB RAM 1 GB disk space Directry Sync Hardware 2 CPU/vCPU 4GB RAM 5 GB disk space SQL Server SQL 2008 R2 r SQL 2012 SP2 SQL must be cnfigured t permit mixed authenticatin, and ne lcal SQL authenticatin accunt must be created fr SMART AD Migratr and SMART Directry Sync t share. SQL Management Studi must be installed Express editins f SQL Server are supprted as lng as the express installatin includes SQL Management Studi Additinal Cmpnents If yur server is nt internet cnnected, yu will be required t install the fllwing cmpnents prir t installing SMART Active Directry Migratr:.NET Framewrk (Full) r newer Visual C Redistributable BOTH the x64 and x86 versins must be installed, regardless f the fact that the Windws Operating system is 64-bit SMART ACTIVE DIRECTORY MIGRATOR REQUIREMENTS 4

5 Wrkstatin and Member Server System Supprted Operating Systems Windws XP SP3 Windws Vista SP1 Windws 7 SP1 Windws 8 Windws 8.1 Windws 2003 SP2 Windws 2008 Windws Server 2008 R2 Windws Server 2012 Windws Server 2012 R2 PwerShell All client perating systems must have at least PwerShell 2.0 installed. Please Nte: Windws XP, Windws Vista, Windws 2003, and Windws 2008 d nt natively cntain PwerShell 2.0. It must be installed/deplyed prir t installing the SMART Active Directry Migratr Agent..NET Framewrk All perating systems must have.net Framewrk 4.0 (Full Versin) r newer installed. This will appear as ".NET 4.0 Extended" in the add/remve prgrams list. The client installatin f the.net Framewrk is nt sufficient and must be upgraded t the full.net Framewrk. Netwrking Dmain Cntrller Access Fr mst scenaris, SMART AD Migratr requires access t at least ne read/write dmain cntrller running Windws 2003 SP2 r newer in each surce and target Active Directry dmain. Fr fault tlerance, Binary Tree recmmends at least tw dmain cntrllers in each surce and target dmain. If SID Histry will be synchrnized, SMART Active Directry Migratr will require access t the dmain cntrller hlding the PDC Emulatr Active Directry FSMO rle in all surce and target dmains. In limited scenaris, it is pssible that SMART AD Migratr will nt be respnsible fr creating r updating any accunts in the surce r the target dmains. In this scenari, SMART AD Migratr can be cnfigured t cmmunicate with Read Only Dmain Cntrllers (RODCs). SMART ACTIVE DIRECTORY MIGRATOR REQUIREMENTS 5

6 Netwrk/Firewall SMART Active Directry Migratr requires the fllwing netwrk prts t enable full functinality: Surce Target Prt/Prtcl Wrkstatins and Member Servers SMART AD Migratr Server SMART AD Migratr Server SMART AD Migratr Server Surce and Target Dmain Cntrllers running Windws 2003 Surce and Target Dmain Cntrllers running Windws 2008 r newer 443 (TCP) r 80 (TCP) 135, 137, 389, 445, (TCP) 389 (UDP) 135, 137, 389, 445, (TCP) 389 (UDP) SSL Certificate SMART Active Directry Migratr des nt require HTTPS (HTTP with SSL), and can perate using HTTP. Hwever, Binary Tree strngly recmmends implementing SMART AD Migratr using HTTPS t secure cmmunicatins between the devices t be migrated and the AD Migratr Server. In rder t activate HTTPS n the IIS cmpnent in Windws, the SMART AD Migratr system will require that a SSL certificate is present. Binary Tree des nt prvide a SSL Certificate as part f the installatin. Fr the mst secure installatin, Binary Tree recmmends purchasing a SSL Certificate frm a Windws supprted 3rd party prvider. In scenaris where this is nt pssible, self-signed SSL Certificate can be generated in Windws fllwing these directins: If using a self-signed certificate, it shuld be nted that Binary Tree s agent cmpnent wuld utilize the perating system s certificate trust list. Due t the security nature f Active Directry migratins, there is n methd f implementing an verride and frcing the agent t use an untrusted certificate. If a self-signed certificate is used, that certificate will need t be added t the trusted rt certificate list fr all cmputer bjects t be migrated. This can be accmplished via grup plicy: Service Accunt Binary Tree s SMART Active Directry Migratr requires the fllwing user accunt permissins and privileges t supprt Active Directry Migratins: One service accunt with read/write access t all rganizatinal units (OUs) cntaining user, grup, and cmputer bjects in the surce Active Directry t be migrated t the target envirnment. One service accunt with administrative rights n the target dmain(s) SMART ACTIVE DIRECTORY MIGRATOR REQUIREMENTS 6

7 If administrative rights cannt be granted, the service accunt requires the fllwing rights: The ability t create and mdify user bjects in the desired OUs in the target Active Directry envirnment. Read Permissins t the cnfiguratin cntainer in Active Directry User credentials with the delegated migratesidhistry extended right. A service accunt in each surce and target dmain with the ability t mdify cmputer bjects and add cmputers t the dmain. DNS SRV Recrd Requirement In each surce dmain, a SRV DNS recrd must be created t enable autdiscver fr SMART AD Migratr Agents. T enable autdiscver when HTTPS is desired Recrd Name: _btadm._https.surcedmainname.lcal Weight and Pririty 0 Prt Number 443 T enable autdiscver when HTTP is desired Recrd Name: _btadm._http.surcedmainname.lcal Weight and Pririty 0 Prt Number 80 SID Histry Synchrnizatin In rder t supprt synchrnizatin f SID Histry frm the surce t the target dmains, Windws requires that a specific dmain lcal grup exists and that accunt auditing is enabled. Preparing the Surce and Target Dmains T prepare each surce and target dmain fr SID Histry Synchrnizatin, the fllwing cnfiguratin steps must be cmpleted: In the surce dmain, create a lcal grup called SurceDmain$$$, where SurceDmain is the NetBIOS name f yur surce dmain. Fr example, if yur dmain's NetBIOS name is ADM, yu must create a dmain lcal grup named ADM$$$. SID Histry synchrnizatin will fail if members are added t this lcal grup. Enable TCP/IP client supprt n the surce dmain PDC emulatr: 1. On the dmain cntrller in the surce dmain that hlds the PDC emulatr peratins master (als knwn as flexible single master peratins r FSMO) rle, click Start, and then click Run. 2. In Open, type regedit, and then click OK. SMART ACTIVE DIRECTORY MIGRATOR REQUIREMENTS 7

8 3. In Registry Editr, navigate t the fllwing registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentCntrlSet\Cntrl\LSA 4. Mdify the registry entry TcpipClientSupprt, f data type REG_DWORD, by setting the value t Clse Registry Editr, and then restart the cmputer. Enable auditing in the target dmain: 1. Lg n as an administratr t any dmain cntrller in the target dmain. 2. Click Start, pint t All Prgrams, pint t Administrative Tls, and then click Grup Plicy Management. 3. Navigate t the fllwing nde: Frest Dmains Dmain Name Dmain Cntrllers Default Dmain Cntrllers Plicy 4. Right-click Default Dmain Cntrllers Plicy and click Edit. 5. In Grup Plicy Management Editr, in the cnsle tree, navigate t the fllwing nde: Cmputer Cnfiguratin Plicies Windws Settings Security Settings Lcal Plicies Audit Plicy 6. In the details pane, right-click Audit accunt management, and then click Prperties. 7. Click Define these plicy settings, and then click Success and Failure. 8. Click Apply, and then click OK. 9. In the details pane, right-click Audit directry service access and then click Prperties. 10. Click Define these plicy settings and then click Success. 11. Click Apply, and then click OK. 12. If the changes need t be immediately reflected n the dmain cntrller, pen an elevated cmmand prmpt and type gpupdate /frce. 13. Repeat the abve steps in the surce dmain. It may als be necessary t rebt the dmain cntrller t have auditing take effect. Even with grup plicy applied n the default dmain cntrller fr the dmain audit, the server audit setting n the primary dmain cntrller (PDC) may nt be enabled. Please cnfirm this setting is enabled fr the lcal security plicy n the PDC server. If nt enabled, use the lcal security plicy t enable this setting. Validate Crss-Dmain Verificatin A trust is nt required t synchrnize SID Histry in SMART AD Migratr. Hwever, when a trust is present, it is necessary t ensure that the trust is prperly cnfigured t permit crss-dmain verificatin. T d s, first identify if the trust between the surce and target dmain is an external trust r a frest trust. Next, fllwing cmmands must be run frm an administrative cmmand prmpt: SMART ACTIVE DIRECTORY MIGRATOR REQUIREMENTS 8

9 If the trust between the surce and target is an external trust: Frm the surce dmain: Netdm trust SurceDmain /dmain: TargetDmain /quarantine:n /user: dmainadministratracct /passwrd: dmainadminpwd Frm the target dmain: Netdm trust TargetDmain /dmain: SurceDmain /quarantine:n /user: dmainadministratracct /passwrd: dmainadminpwd If the trust between the surce and target is a frest trust: Frm the surce dmain: Netdm trust SurceDmain /dmain: TargetDmain /enablesidhistry:yes /user: dmainadministratracct /passwrd: dmainadminpwd Frm the target dmain: Netdm trust TargetDmain /dmain: SurceDmain /enablesidhistry:yes /user: dmainadministratracct /passwrd: dmainadminpwd Passwrd SMART Directry Sync des nt validate the passwrd plicies present within yur dmains. Verify that the passwrd entered as the Default Passwrd cmplies with the passwrd plicy f yur target envirnment. Objects will fail t be created if the passwrd vilates that plicy. SMART Directry Sync Requirement fr Synchrnize Passwrds If planning t use the Passwrd Cpy functinality f SMART Directry Sync, PsExec must be installed in the SMART Directry Sync prgram directry (C:\Prgram Files\Binary Tree\DirSync). Ignre the PSExec Installatin Guide cncerning the prper installatin lcatin. PsExec is available at: SMART ACTIVE DIRECTORY MIGRATOR REQUIREMENTS 9

10 Abut Binary Tree Binary Tree is a singularly fcused glbal prvider f migratin sftware and slutins fr Ltus Ntes, Micrsft Exchange, Active Directry, and Windws Server envirnments. Since 1993, Binary Tree has enabled mre than 6,000 custmers t migrate mre than 35 millin users, and facilitated sme f the mst cmplex migratins n the planet. Its sftware slutins are available fr migrating frm Exchange 2003/2007/2010/2013 and Ltus Ntes t npremises and nline versins f Micrsft Exchange, as well as migratins f Active Directry and Windws Server envirnments. Binary Tree is a Micrsft Gld Messaging Partner, an IBM Advanced Business Partner, and is ne f Micrsft s preferred vendrs fr migrating t Micrsft Office 365. The Cmpany is headquartered utside f New Yrk City with ffices in Hng Kng, Lndn, Paris, Stckhlm and Sydney. Fr mre infrmatin, visit us at Binary Tree Scial Media Resurces Cpyright 2016, Binary Tree, Inc. All rights reserved. Binary Tree, the Binary Tree lg, the SMART Migratin graphics, and any references t SMART Migratin and Binary Tree s sftware prducts, are trademarks f Binary Tree, Inc. All ther trademarks are the trademarks r registered trademarks f their respective rights hlders. SMART ACTIVE DIRECTORY MIGRATOR REQUIREMENTS 10