SMART Active Directory Migrator 10.0

Transcription

1 SMART Active Directry Migratr 10.0 JUNE 2016

2 Table f Cntents...3 SMART Active Directry Migratr Basic Installatin...3 Wrkstatin and Member Server System...5 Netwrking...6 SSL Certificate...7 Service Accunt...7 SQL Server Reprting Services (SSRS) Accunt...7 DNS SRV Recrd Requirement...8 SID Histry Synchrnizatin...8 Passwrd SMART Directry Sync Requirement fr Synchrnize Passwrds Offline Dmain Jin Abut Binary Tree SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 2

3 SMART Active Directry Migratr Basic Installatin The SMART Active Directry Migratr suite cnsists f Binary Tree s SMART Active Directry Migratr, which i ncludes bth the cnsle and the Web service, and SMART Directry Sync sftware packages. Bth packages will require access t Micrsft SQL Server. In mst envirnments, all f these cmpnents will be installed n the same server. Single Server Installatin Supprted Operating Systems Windws Server 2008 R2 Windws Server 2012 R2 SQL Server SQL Server 2008 R2, SQL Server 2012 SP2, SQL Server 2014, r SQL Server 2016 SQL Express Editins are supprted up t 5000 bjects SQL Management Studi must be installed SQL must be cnfigured t permit mixed authenticatin, and ne lcal SQL authenticatin accunt must be created fr SMART AD Migratr and SMART Directry Sync t share Minimum Hardware 2 CPU/vCPU 6GB RAM 10 GB disk space, inclusive f the SQL install requirements Additinal Cmpnents If yur server is nt internet cnnected, yu will be required t install the fllwing cmpnents prir t installing SMART Active Directry Migratr:.NET Framewrk (Full) r newer Visual C Redistributable BOTH the x64 and x86 versins must be installed, regardless f the fact that the Windws Operating system is 64- bit Multi-Server Installatin SMART Active Directry Migratr 10.0 is scalable and supprts segregating cmpnents and can be installed in a multiserver cnfiguratin t supprt larger r cmplex envirnments. If required in larger installatins, remte SQL Servers may be used fr the primary database and the lgging database. Additinally, the primary database and the lgging database can be segregated nt separate SQL Server instances. Each f the fllwing rles/functins may be separated nt different servers as required in advanced cnfiguratins: AD Migratr Server Web Service SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 3

4 AD Migratr Administratr Cnsle SMART Directry Sync Sftware Directry Sync Database Directry Sync Lgging Database When installed independently, Binary Tree s cmpnents require the fllwing resurces: Supprted Operating Systems Windws Server 2008 R2 Windws Server 2012 R2 AD Migratr Split Rle Minimum Hardware Directry Sync Hardware 1 CPU/vCPU 2GB RAM 1 GB disk space 2 CPU/vCPU 4GB RAM 5 GB disk space SQL Server SQL Server 2008 R2, SQL Server 2012 SP2, SQL Server 2014, r SQL Server 2016 SQL must be cnfigured t permit mixed authenticatin, and ne lcal SQL authenticatin accunt must be created fr SMART AD Migratr and SMART Directry Sync t share. SQL Management Studi must be installed Express editins f SQL Server are supprted as lng as the express installatin includes SQL Management Studi Additinal Cmpnents If yur server is nt internet cnnected, yu will be required t install the fllwing cmpnents prir t installing SMART Active Directry Migratr:.NET Framewrk (Full) r newer Visual C Redistributable BOTH the x64 and x86 versins must be installed, regardless f the fact that the Windws Operating system is 64-bit SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 4

5 Reprt Server SQL Server SQL Server 2008 R2, SQL Server 2012 SP2, r SQL Server 2014 Cnfigured fr Native Mde Review the Installing and Cnfiguring SQL Reprting Services tpic in the SMART AD Migratr Installatin Guide fr mre infrmatin. SQL Server Reprting Services 2016 is nt supprted at this time. The reprts included in SMART AD Migratr 10.0 are supprted n SSRS 2012 and Wrkstatin and Member Server System Supprted Operating Systems Windws XP SP3 Windws Vista SP1 Windws 7 SP1 Windws 8 Windws 8.1 Windws 2003 SP2 Windws 2008 Windws Server 2008 R2 Windws Server 2012 Windws Server 2012 R2 Imprtant! - Windws 10 is NOT SUPPORTED at this time. PwerShell All client perating systems must have at least PwerShell 2.0 installed. Please Nte: Windws XP, Windws Vista, Windws 2003, and Windws 2008 d nt natively cntain PwerShell 2.0. It must be installed/deplyed prir t installing the SMART Active Directry Migratr Agent..NET Framewrk All perating systems (with the exceptin f Windws XP) must have.net Framewrk (Full) r newer installed. This will appear as ".NET Extended" in the add/remve prgrams list. We will cntinue t supprt the use f.net Framewrk (Full) 4.0 n Windws XP devices. The client installatin f the.net Framewrk is nt sufficient and must be upgraded t the full.net Framewrk. SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 5

6 Netwrking Dmain Cntrller Access Fr mst scenaris, SMART AD Migratr requires access t at least ne read/write dmain cntrller running Windws 2003 SP2 r newer in each surce and target Active Directry dmain. Fr fault tlerance, Binary Tree recmmends at least tw dmain cntrllers in each surce and target dmain. If SID Histry will be synchrnized, any dmain cntrller listed in the Target DCs tab within a SMART Directry Sync prfile will require access t the dmain cntrller hlding the PDC Emulatr Active Directry F SMO rle in the surce. Keep in mind that even if the dmain cntrller hlding the PDC Emulatr Active Directry FSMO rle is nt listed in the Surce DCs tab, any SID Histry migratin attempts will require a DC in the target t cmmunicate with the PDC Emulatr dmain cntrller. Fr this reasn, it is a best practice t ensure that all dmain cntrllers specified in the Target DCs tab within a SMART Directry Sync prfile has the apprpriate netwrks access t cmmunicate with the surce dmain cntrller hlding the PDC Emulatr Active Directry FSMO rle befre a SID Histry migratin is attempted. In limited scenaris, it is pssible that SMART AD Migratr will nt be respnsible fr creating r updating any accunts in the surce r the target dmains. In this scenari, SMART AD Migratr can be cnfigured t cmmunicate with Read Only Dmain Cntrllers (RODCs). Netwrk/Firewall SMART Active Directry Migratr requires the fllwing netwrk prts t enable full functinality: Surce Target Prt/Prtcl Wrkstatins and Member Servers SMART AD Migratr Server SMART AD Migratr Server Target dmain cntrllers listed in the Target DCs tab SMART AD Migratr Server Surce and Target Dmain Cntrllers running Windws 2003 Surce and Target Dmain Cntrllers running Windws 2008 r newer Dmain cntrller in the surce envirnment hlding the PDC Emulatr Active Directry FSMO rle 443 (TCP) r 80 (TCP) 135, 137, 389, 445, (TCP) 389 (UDP) 135, 137, 389, 445, (TCP) 389 (UDP) 135, 137, 139, 389, 445, 3268 and (TCP) 389 (UDP) SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 6

7 SSL Certificate SMART Active Directry Migratr des nt require HTTPS (HTTP with SSL), and can perate using HTTP. Hwever, Binary Tree strngly recmmends implementing SMART AD Migratr using HTTPS t secure cmmunicatins between the devices t be migrated and the AD Migratr Server. In rder t activate HTTPS n the IIS c mpnent in Windws, the SMART AD Migratr system will require that a SSL certificate is present. Binary Tree des nt prvide a SSL Certificate as part f the installatin. Fr the mst secure installatin, Binary Tree recmmends purchasing a SSL Certificate frm a Windws supprted 3rd party prvider. In scenaris where this is nt pssible, self-signed SSL Certificate can be generated in Windws fllwing these directins: If using a self-signed certificate, it shuld be nted that Binary Tree s agent cmpnent wuld utilize the perating system s certificate trust list. Due t the security nature f Active Directry migratins, there is n methd f implementing an verride and frcing the agent t use an untrusted certificate. If a self-signed certificate is used, that certificate will need t be added t the trusted rt certificate list fr all cmputer bjects t be migrated. This can be accmplished via grup plicy: Service Accunt Binary Tree s SMART Active Directry Migratr requires the fllwing user accunt permissins and privileges t supprt Active Directry Migratins: One service accunt with read/write access t all rganizatinal units (OUs) cntaining user, grup, and cmputer bjects in the surce Active Directry t be migrated t the target envirnment. One service accunt with administrative rights n the target dmain(s) If administrative rights cannt be granted, the service accunt requires the fllwing rights: The ability t create and mdify user bjects in the desired OUs in the target Active Directry envirnment. Read Permissins t the cnfiguratin cntainer in Active Directry User credentials with the delegated migratesidhistry extended right. A service accunt in each surce and target dmain with the ability t mdify cmputer bjects and add cmputers t the dmain. SQL Server Reprting Services (SSRS) Accunt SMART Active Directry Migratr's Reprting feature requires the fllwing accunt permissins: The Cnnectin Credential requires an accunt that has the Cntent Manager rle and the System Administratr rle defined n the SQL Server Reprting Server. The Data Credential requires an accunt that has permissin n the SQL Server Reprting Services database. These permissins are typically the database-level rles db_datareader and db_datawriter but shuld be verified by the SQL Server Reprting Services database administratr. SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 7

8 DNS SRV Recrd Requirement In each surce dmain, a SRV DNS recrd must be created t enable autdiscver fr SMART AD Migratr Agents. T enable autdiscver when HTTPS is desired Recrd Name: _btadm._https.surcedmainname.lcal Weight and Pririty 0 Prt Number 443 T enable autdiscver when HTTP is desired Recrd Name: _btadm._http.surcedmainname.lcal Weight and Pririty 0 Prt Number 80 SID Histry Synchrnizatin Micrsft requires an administrative accunt in the surce dmain. In rder t supprt synchrnizatin f SID Histry frm the surce t the target dmains, Windws requires that a specific dmain lcal grup exists and that accunt auditing is enabled. SID Histry intra-frest migratin is supprted (with SMART AD Migratr ) with the use f an ut -f-the-bx script available frm Binary Tree. The surce and target dmains must nt have the same NETBIOS name t allw the required trust between the tw envirnments. Preparing the Surce and Target Dmains T prepare each surce and target dmain fr SID Histry Synchrnizatin, the fllwing cnfiguratin steps must be cmpleted: In the surce dmain, create a lcal grup called SurceDmain$$$, where SurceDmain is the NetBIOS name f yur surce dmain. Fr example, if yur dmain's NetBIOS name is ADM, yu must create a dmain lcal grup named ADM$$$. SID Histry synchrnizatin will fail if members are added t this lcal grup. Enable TCP/IP client supprt n the surce dmain PDC emulatr: 1. On the dmain cntrller in the surce dmain that hlds the PDC emulatr peratins master (als knwn as flexible single master peratins r FSMO) rle, click Start, and then click Run. 2. In Open, type regedit, and then click OK. 3. In Registry Editr, navigate t the fllwing registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentCntrlSet\Cntrl\LSA 4. Mdify the registry entry TcpipClientSupprt, f data type REG_DWORD, by setting the value t Clse Registry Editr, and then restart the cmputer. SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 8

9 Enable auditing in the target dmain: 1. Lg n as an administratr t any dmain cntrller in the target dmain. 2. Click Start, pint t All Prgrams, pint t Administrative Tls, and then click Grup Plicy Management. 3. Navigate t the fllwing nde: Frest Dmains Dmain Name Dmain Cntrllers Default Dmain Cntrllers Plicy 4. Right-click Default Dmain Cntrllers Plicy and click Edit. 5. In Grup Plicy Management Editr, in the cnsle tree, navigate t the fllwing nde: Cmputer Cnfiguratin Plicies Windws Settings Security Settings Lcal Plicies Audit Plicy 6. In the details pane, right-click Audit accunt management, and then click Prperties. 7. Click Define these plicy settings, and then click Success and Failure. 8. Click Apply, and then click OK. 9. In the details pane, right-click Audit directry service access and then click Prperties. 10. Click Define these plicy settings and then click Success. 11. Click Apply, and then click OK. 12. If the changes need t be immediately reflected n the dmain cntrller, pen an elevated cmmand prmpt and type gpupdate /frce. 13. Repeat the abve steps in the surce dmain. It may als be necessary t rebt the dmain cntrller t have auditing take effect. Even with grup plicy applied n the default dmain cntrller fr the dmain audit, the server audit setting n the primary dmain cntrller (PDC) may nt be enabled. Please cnfirm this setting is enabled fr the lcal security plicy n the PDC server. If nt enabled, use the lcal security plicy t enable this setting. Validate Crss-Dmain Verificatin A trust is nt required t synchrnize SID Histry in SMART AD Migratr. Hwever, when a trust is present, it is necessary t ensure that the trust is prperly cnfigured t permit crss-dmain verificatin. T d s, first identify if the trust between the surce and target dmain is an external trust r a frest trust. Next, fllwing cmmands must be run frm an administrative cmmand prmpt: If the trust between the surce and target is an external trust: Frm the surce dmain: Netdm trust SurceDmain /dmain: TargetDmain /quarantine:n /user: dmainadministratracct /passwrd: dmainadminpwd Netdm trust TargetDmain /dmain: SurceDmain /quarantine:n /user: dmainadministratracct /passwrd: dmainadminpwd SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 9

10 If the trust between the surce and target is a frest trust: Frm the surce dmain: Netdm trust SurceDmain /dmain: TargetDmain /enablesidhistry:yes /user: dmainadministratracct /passwrd: dmainadminpwd Frm the target dmain: Netdm trust TargetDmain /dmain: SurceDmain /enablesidhistry:yes /user: dmainadministratracct /passwrd: dmainadminpwd Passwrd SMART Directry Sync des nt validate the passwrd plicies present within yur dmains. Verify that the passwrd entered as the Default Passwrd cmplies with the passwrd plicy f yur target envirnment. Objects will fail t be created if the passwrd vilates that plicy. SMART Directry Sync Requirement fr Synchrnize Passwrds If planning t use the Passwrd Cpy functinality f SMART Directry Sync, PsExec must be installed in the SMART Directry Sync prgram directry (C:\Prgram Files\Binary Tree\DirSync). Ignre the PSExec Installatin Guide cncerning the prper installatin lcatin. PsExec is available at: Offline Dmain Jin In rder t successfully facilitate the new Cached Credentials jb (which supprts the Offline Dmain Jin feature) a neway external trust must be cnfigured frm the surce dmain t the target dmain. Be aware that Micrsft's Djin.exe utility nly supprts the Windws 7, Windws 8, Windws 8.1, Windws Server 2008 R2, Windws 2012, and Windws 2012 R2 perating systems. Offline dmain jin files must be created prir t running the Offline Dmain Jin prcess. A full explanatin f Micrsft s Djin.exe utility and hw t create these files can be fund here: SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 10

11 Abut Binary Tree Binary Tree prvides rganizatins with the mst direct and predictable path t a successful technlgy transfrmatin. We ffer sftware and services t integrate and migrate crprate , directry and server envirnments. Our technlgy, methdlgy and expertise is uniquely suited t prvide fast and manageable migratins, with lw risk, little t n user dwntime, and adapted t each custmer s envirnment and requirements. Since 1993, Binary Tree has enabled thusands f enterprise custmers t migrate mre than 35 millin users and facilitated sme f the mst cmplex technlgy transfrmatins n the planet. Binary Tree is a Micrsft Gld Partner and a glbally preferred vendr fr Micrsft Office 365 migratins and slutins. The Cmpany is headquartered utside f New Yrk City with ffices in Hng Kng, Lndn, Paris, Stckhlm and Sydney. Fr mre infrmatin, visit us at Binary Tree Scial Media Resurces Cpyright 2016, Binary Tree, Inc. All rights reserved. The Binary Tree lg and The SMART Migratin Cmpany tagline are registered trademarks, plus any references f Binary Tree, SMART Migratin, r Binary Tree s sftware r services, are trademarks, f Binary Tree, Inc. All ther trademarks are the trademarks r registered trademarks f their respective rights hlders. SMART ACTIVE DIRECTORY MIGRATOR 10.0 REQUIREMENTS 11