Active Administrator 7.0 May 2014 These release notes provide information about the Active Administrator release. About New features Resolved issues Known issues System requirements Product licensing Getting started with Globalization About Dell About Active Administrator is a complete, integrated, and proactive Microsoft Active Directory administration solution that fills the management gaps native tools leave behind. From a single console, the solution addresses the most important areas of Active Directory including security and delegation, auditing and alerting, backup and recovery, Group Policy, health and replication, and accounts and configurations. Active Administrator makes it easier and faster than native tools to meet auditing requirements, tighten security, maintain business continuity, and increase IT efficiency. is a major release, with new features and functionality. See New features. New features New features in : Unified console In, there is now one unified console that incorporates almost all the functionality previously made available through the server console. The server console is now a lightweight utility whose main functions are service and licensing management. The main console navigation tree is two-tiered. The main functional areas of the console, such as Security and Delegation, are root nodes on the navigation tree, which provide at-a-glance status information of various sub-functions. The sub-functions, such as Active Templates or Password Policies, are presented as second-tier nodes in the navigation tree. Each main functional area has a landing page that presents an overview of each sub-function in active tiles. You can choose to access sub-functions by clicking an active tile or choosing from the navigation tree. 1
Performance improvements In, Active Directory object information, once acquired, is cached in memory for 30 for minutes, after which the cache item is marked as dead. Every two minutes the cache store is locked and all cache items marked as dead are deleted. These default time values can be altered by modifying the appropriate registry settings. Domain controller management With the new DC Management module, you can select the specific domain controller through which all operations will be performed, manage its services, and monitor its status, performance metrics, and event logs to identify potential issues or trends before they become critical. Delegation wizard and status A new Active Template Delegation Wizard lets you choose multiple delegation paths in a single path and set delegations to apply automatically, as well as expire automatically, at a set date. You can access the new delegation wizard from the Security and Active Template areas of the Security & Delegation module. Account expiration With the new Account Expiration feature in the Security & Delegation module, you can configure daily email notifications of pending account expirations, as well as preview all accounts in the selected domain(s) that will expire by the user-defined threshold. Active Directory search now includes a universal search function that easily and efficiently enables you to locate any user, group, contact, computer, or Organizational Unit in a selected domain. Once the object is located, you can view its properties and perform management tasks appropriate to the object directly from the Search page. You can initiate Active Directory searches from both the Home page and the Search module. Quick tasks Accessible from the Home page, Quick Tasks are six of the most common tasks AD administrators perform. From this page, you can initiate a search for an Active Directory object, perform four different operations against user accounts (enable/disable, reset password, unlock, or add/remove from a group), or reset a computer account. Additionally, the most commonly performed Active Directory tasks are listed, which take you to the appropriate sub-function in the navigation tree. User logon activity screen The Workstation Logon Agent, which is deployed through group policy software installation, tracks both remote and interactive logons, logoffs, and lock/unlock events. In addition to the graphical display on the Dashboard, the new User Logon Activity sub-function in the Security & Delegation module provides a more detailed display of activity across the enterprise, including the details and history of each event. You can locate a user through the integrated search function, and, if required, disable a user account. Dashboard charts The dashboard provides a graphical summary of Active Directory data. With version 7.0, the dashboard now includes a count of domain computers, users, and groups of various scopes. The range of charts for audited events and notification alerts is expanded to help administrators identify trends that might otherwise have gone unnoticed. You also can now print the charts. See also: Resolved issues Resolved issues The following is a list of issues addressed in this release. Table 1. Resolved issues Resolved issue The Server Configuration Wizard now states the ramifications of not backing up computer account passwords. Fixed a problem where a SQL query submitted from a client using a different Region and Language setting than the Active Administrator database would result in an error (per Knowledge Article 103209). Fixed a problem where the Inactive Accounts move and disable options would generate an error for computer accounts that had never logged on to the domain. (Issue was previously resolved in a HOTFIX.) Issue ID 4344 4343 4387 2
Resolved issue Fixed a problem where fine-grained password policies created in a tree-root trusted domain with a discontiguous name space could be created but not enumerated. Fixed an issue where the Console's Dashboard Top Event pie charts would not display expected activity. Corrected a problem where the Workstation Logon Auditing Agent would send all workstation events to the ASM regardless of whether or not the event was enabled by the user. (Issue was previously resolved in a HOTFIX.) Issue ID 4437 4580 4984 Known issues The following is a list of issues, including those attributed to third-party products, known to exist at the time of release. Table 2. Known issues Known issue Objects contained by an OU that includes a forward slash (/) in its name cannot be recovered using the And all objects it contains restore option. There is no keyboard navigation method for the toolbar menu. 4807 If a user or group has been delegated permissions and that security principal is subsequently renamed, it is necessary to either manually clear the Foundation Service cache or wait for the object to be expunged from the cache through its normal cycle, before the security principal appears in Active Administrator under the new name. Group object properties will also be unavailable until the cache is cleared. When Active Administrator is installed onto Windows 8.1, a Start screen tile is not created. Errors will occur when trying to check out or publish to AD any GPO that was added from a domain connected through an external or forest trust. Issue ID 4565 5112 5209 5328 System requirements Before installing Active Administrator, ensure that your system meets the following minimum hardware and software requirements. Server hardware requirements Console hardware requirements Audit agents hardware requirements Software requirements SQL requirements User privilege requirements Service privilege considerations Upgrade and compatibility 3
Server hardware requirements Table 3. Hardware requirements for the server Requirement Processor Memory Hard Disk Space Monitor 1 GHz or higher For Windows Server 2008, 512 MB minimum, 2 GB recommended For Windows Server 2008 R2, 512 MB minimum, 2 GB recommended For Windows Server 2012, 1 GB minimum, 2 GB recommended For Windows Server 2012 R2, 1 GB minimum, 2 GB recommended 100 MB 1024 x 768 screen resolution with 16-bit color Operating System Windows Server 2008 Windows Server 2008 R2 (32 bit or non-itanium 64 bit) Windows Server 2012 Windows Server 2012 R2 Console hardware requirements Table 4. Hardware requirements for the console Requirement Processor Memory Hard Disk Space Monitor Operating System 1 GHz 256 MB 100 MB 1024 x 768 screen resolution with 16-bit color Windows Vista Windows 7 Windows 8 Windows 8.1 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2 Audit agents hardware requirements Table 5. Hardware requirements for the audit agent Requirement Processor Memory Hard Disk Space 1 GHz or higher 256 MB 100 MB 4
Requirement Operating System Windows 2003 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2 Software requirements Table 6. Software requirements Requirement.Net Framework v.4.5 or later Group Policy Management Console (GPMC) Install either the Full or Standalone version. Do not install just the Client Profile. GPMC is included with Windows Server 2008 and later. SQL requirements Table 7. Supported versions of SQL Requirement Microsoft SQL Server 2005 Microsoft SQL Server 2008 Microsoft SQL Server 2008 R2 Microsoft SQL Server 2012 These versions of SQL are supported, including Express versions. See the Microsoft web site for the hardware and software requirements for your version of SQL server. User privilege requirements Table 8. User privilege requirements Requirement User must hold administrative rights User must be a member of the AA_Admin database access group To install Active Administrator, a user must hold administrative rights on the local system and the SQL instance that will host the Active Administrator database. To use Active Administrator, a user must hold administrative rights on both the local system and the domain, and be a member of the AA_Admin database access group, which is created during the installation process. 5
Service privilege considerations The Domain Administrator account provides the necessary permissions for the various Active Administrator services to operate properly. When choosing an account, keep these considerations in mind: Active Administrator Advanced Auditing runs as the Local System account, regardless of the user account configured for the Active Administrator Agent service. Active Administrator Agent can also run under a domain user account provided it is either a local admin account, which gives it the rights to logon as a service and log on locally, or these two privileges can be granted individually. This user or service account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and it can be found under the Users container object of Active Directory. Active Administrator Notification service needs to have access to the database. Upgrade and compatibility only supports in-place upgrades from Active Administrator 6.5.0.1160. Upgrades from previous editions are not supported. To perform an in-place upgrade to from a version of Active Administrator that is earlier that v6.5, the user must first upgrade to Active Administrator 6.5. Installing onto an existing Active Administrator 6.5 installation will result in the removal of the earlier version. Active Administrator 6.5 databases, both live and archive databases, will be automatically upgraded to version 7.0. A database upgraded by cannot be used by previous version and the database upgrade cannot be rolled back. Data within the Active Administrator share can be used by. Auditing Agents cannot be installed on Windows 2000 hosts. Workstation Logon Auditing Agents (WLAA) can be upgraded in-place from v6 to v7 by replacing the v6.5 install package at the software distribution share with the 7.0 version. Computers will upgrade automatically to the WLAA the next time they are started. Product licensing You need either a trial or full license to use Active Administrator. If you have questions about your license, contact your sales representative. NOTE: The full and trial versions of Active Administrator are identical. The license file is the sole determinant of program functionality. Limitations during the free 30-day trial period include: Auditing of domain controllers is unlimited. Perform Active Directory and GPO backups on two domains only. Reports generated have an Evaluation watermark. You apply the license the first time you launch the AA Configuration Wizard following the installation of the server component. You must have your license available prior to beginning the install process. NOTE: If you are upgrading to from a previous version, you must obtain a new license key prior to installing the new version. To obtain a new license key 6
1 Start Server Management, and choose Help About. 2 Click License. 3 Select the license, and click. 4 Copy the license key that displays. 5 Go to the Licensing Assistance page (https://support.software.dell.com/licensing-assistance). 6 Fill out the form. 7 Paste the license key into the License Key field. 8 Click Submit. A Dell Software License Representative will contact you within one business day. To apply the license file when you first start the configuration wizard 1 If you are installing Active Administrator, the configuration wizard opens automatically. Otherwise, open the AA Configuration Wizard from the Start menu. The first time you start the configuration wizard, you must apply a valid license file. 2 Select Active Administrator, and click Update License. 3 Locate the license file. The license file is approximately 1KB in size and has an.asc file extension. Once applied, the License Status should indicate Installed or Trial depending on the type of license. 4 Click OK to continue with the configuration wizard. To update your license 1 From the Start menu, open AA Server Manager. 2 To view details about the current license, click. 3 To update the license, click Updated License. 4 Locate the license file (*.asc), and click Open. Getting started with Upgrade and installation instructions Additional resources Upgrade and installation instructions To upgrade to : Install the server component Complete the configuration wizard Install the console component Update the audit agents For detailed instructions, see the Active Administrator Install Guide and the Active Administrator User Guide. 7
Installing Active Administrator server NOTE: The server needs to be installed on only one computer. To install Active Administrator server 1 Launch the autorun. 2 On the Home page, click Install. 3 Click Install next to Active Administrator Server. 4 On the Welcome screen, click Next. 5 Accept the license agreement and click Next. 6 Click Next to accept the default installation directory. 7 Click Install. 8 Click Finish. Configuring the server If you are upgrading Active Administrator, your previous settings appear on each page. You can quickly page through the wizard accepting the current settings or take the opportunity to make changes to your setup. For detailed instructions on the configuration wizard, see the Active Administrator Install Guide. To run the AA Configuration Wizard 1 If you are installing Active Administrator, the configuration wizard opens automatically. Otherwise, open the AA Configuration Wizard from the Start menu. 2 Select Active Administrator, and click Update License. 3 Locate the license file, and click OK. 4 On the Welcome page, click Next. 5 Select Use an existing Active Administrator database. 6 Accept the displayed server and database or select a different server and database. 7 Click Next. 8 Select Use an existing Active Administrator Archive database. 9 Accept the displayed server and database or select a different server and database. 10 Click Next. 11 Select the purge and archive options to enable or disable. 12 Click Next. 13 Select the path to the Active Administrator share. 14 Click Next. 15 Accept the SMTP server setup or make any necessary changes. 16 Click Next. 17 Type a valid email address or accept the default. 18 Click Next. 19 Accept the active template settings or name any necessary changes. 20 Click Next. 21 Accept the group policy history settings or make any necessary changes. 8
22 Click Next. 23 Accept the Active Directory backup settings or make any necessary changes. 24 Click Next. 25 To add additional users, click Add, find and select users, click OK. 26 Click Next. 27 Type the account password for the Active Administrator Foundation Service account. 28 The default service port number is 15600. To change the port number, type a value. 29 To use the same account for the notification service, select the check box. Otherwise, type or browse for an account with Domain Admin rights, and type the password. 30 Click Next. 31 Click Finish. 32 Click Finish. Installing Active Administrator console Install the Administrator Console on any workstation that requires the use of Active Administrator. To install Active Administrator console 1 Launch the autorun. 2 On the Home page, click Install. 3 Click Install next to Active Administrator Console. 4 On the Welcome screen, click Next. 5 Accept the license agreement, and click Next. 6 Click Next to accept the default installation directory. 7 Click Install. 8 Click Finish. 9 Type the name of the server where Active Administrator Server is installed, or browse to locate a server. 10 Click OK. Updating audit agents To collect data on a computer, you must install and activate the audit agent. A wizard guides you through installing the audit agent. To update audit agents 1 Select Auditing & Alerting Agents. 2 To update selected domain controller(s), select More Update. OR- To update all listed domain controllers, select More Update All. NOTE: You may need to refresh the audit agents to correct the display. Click Refresh or select domain controllers, and click Refresh Selected. 9
Additional resources Additional information is available from the following: Online product documentation (https://support.software.dell.com/active-administrator/7.0/releasenotes-guides) What s New Guide Installation Guide User Guide Globalization This section contains information about installing and operating this product in non-english configurations, such as those needed by customers outside of North America. This section does not replace the materials about supported platforms and configurations found elsewhere in the product documentation. This release is Unicode-enabled and supports any character set. In this release, all product components should be configured to use the same or compatible character encodings and should be installed to use the same locale and regional options. This release is targeted to support operations in the following regions: North America, Western Europe and Latin America, Central and Eastern Europe, Far-East Asia, Japan. About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit www.software.dell.com. Contacting Dell Technical support: Online support Product questions and sales: (800) 306-9329 Email: info@software.dell.com Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. To access the Support Portal, go to https://support.software.dell.com/. The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. The site enables you to: Create, update, and manage Service Requests (cases) View Knowledge Base articles Obtain product notifications 10
Download software. For trial software, go to Trial Downloads. View how-to videos Engage in community discussions Chat with a support engineer 11
2014 Dell Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Dell Inc. The information in this document is provided in connection with Dell products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Dell products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, DELL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL DELL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF DELL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Dell makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Dell does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Dell Inc. Attn: LEGAL Dept 5 Polaris Way Aliso Viejo, CA 92656 Refer to our web site (software.dell.com) for regional and international office information. Trademarks Dell, the Dell logo, and Active Administrator are trademarks of Dell Inc. Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products. Dell disclaims any proprietary interest in the marks and names of others. Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT NOTE, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. 12