Active Directory Management Agent Deployment Guide Document Revision Date: April 26, 2013
Active Directory Management Deployment Guide i Contents System Requirements... 1 Hardware Requirements... 2 Agent Download... 3 Installation... 7 SQL Connection... 9 AD Mgmt Agent... 10 If issues arise during installation... 12 MMC... 20 Service... 21 Control Panel... 22 Connection Settings... 22 License Key... 23 Metadata Sync... 24
Active Directory Management Deployment Guide 1 System Requirements The following is a list of what is needed to successfully send data to and from the API: The Active Directory Management (AD Mgmt) service must have access to the gateway agent machine on the IP and Port configured (https). The AD Mgmt machine must be able to connect to http://licensing.identitysyncronizer.com for license key verification..net Framework 4.0 (this is a prerequisite in the installer if it is not on the machine, it will be automatically installed before AD Mgmt. AD Mgmt is typically installed on a single machine on which the AD Mgmt service runs. AD Mgmt requires connectivity to the domain controllers for the Windows Network and to a Microsoft SQL database server. If Microsoft SQL is not available at the location, AD Mgmt can (optionally) install Microsoft SQL Express. 1. AD Mgmt Installation information needed prior to Installation: a. Domain Administrator Credentials b. SQL Database Credentials (for existing SQL Server only) You will need to create credentials if you are installing SQL Express. c. Domain Controller details and access information d. Basic network information IP Subnet Information Location of Operations Automation (OA) Server URL of OA Web Service e. Parallels Credentials Administrator Credentials OA Web Service Credentials 2. AD Mgmt Installation Requirements: a. Service Machine: Windows Server 2003, 2008 (all versions) or 2012 32 or 64-bit Supported.NET Framework 4.0 (or above) * Microsoft SQL Native Client* b. Administrator s Workstations (Optionally): Windows XP/Vista/Windows 7 32 or 64-bit Supported.NET Framework 4.0 (or above)* Microsoft SQL Native Client* c. Microsoft SQL Server Can use an existing Microsoft SQL Server Can (optionally) install Microsoft SQL Express 3. Security Requirements: a. Domain Administrator access privileges
Active Directory Management Deployment Guide 2 b. Domain Controller access c. Database Administrator account d. SQL Service account for AD Mgmt Account that AD Mgmt will utilize to connect to the database Domain controllers will need to be restarted to complete the installation. * These items will be automatically installed by AD Mgmt if not available on the machine. Hardware Requirements 2 GHz processor 2 GB RAM Supported Operating Systems (both 32 and 64 bit): Windows Server 2003 Windows Server 2003 R2 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012
Active Directory Management Deployment Guide 3 Agent Download 1. Log into the Control Panel. The main dashboard, or home page, displays: 2. Select More Services from the menu bar. The More Services screen displays:
Active Directory Management Deployment Guide 4 3. Click on the Active Directory Management link. The Identity Synchronizer Service screen appears. 4. Click [Create]. The activation screen displays: 5. Enter the account parameters that were provided by your support representative in the fields provided, and then click [Next]. The summary screen of the Identity Synchronizer Service wizard displays. Click [Finish].
Active Directory Management Deployment Guide 5 You will now see the Identity Synchronizer Service menu: 6. From the Identity Synchronizer Service menu, click on the General link. The General screen will display. 7. Click on the Download Identity Synchronizer URL. A new screen will display two download options. Download the agent that matches your system (32 vs 64- bit).
Active Directory Management Deployment Guide 6
Active Directory Management Deployment Guide 7 Installation NOTE: It is important to point out that the configuration on your primary domain controller must be fully deployed in order to ensure that the AD Mgmt service functions properly. 1. Run the AD Mgmt installer executable on the machine that will host the AD Mgmt service. If this machine is a 32-bit machine run ADMgmt x86.exe ; if it is 64-bit, run ADMgmt x64.exe. 2. Click [Next] on the Installer Welcome screen: 3. Click [Install] on the Ready to Install the Program screen:
Active Directory Management Deployment Guide 8 4. Click [Finish] on the Wizard Completed screen: 5. When the installation is complete, open the AD Mgmt Studio from the Start menu: 6. From the AD Mgmt Studio, you will be able to configure AD Mgmt:
Active Directory Management Deployment Guide 9 SQL Connection When the AD Mgmt Studio is run for the first time, the connection to the SQL server will need to be configured. 1. Enter the necessary SQL server information in the dialog above. AD Mgmt uses a SQL server user name and password, so mixed mode authentication will need to be enabled. AD Mgmt also communicates with SQL server via TCP/IP and named pipes so these protocols will need to be enabled. The database specified in the Database Name field will be automatically created by AD Mgmt, so the SQL user specified in this configuration screen will need to have permissions to create databases on the SQL server. 2. Once the SQL connection data has been entered, click the ellipsis ( ) button to test the connection. 3. If the connection is successful, click the [OK] button to continue configuration.
Active Directory Management Deployment Guide 10 AD Mgmt Agent AD Mgmt requires an agent service to be installed on each domain controller to capture password changes. 1. In the AD Mgmt Studio, click the Agent tab; this will list each domain controller in the domain and allow the installation of the agent software without having to remotely connect to each machine. 2. To install the agent on a domain controller click the [Install] button in the row associated with the machine. You will be asked for domain administrator credentials. 3. Enter these credentials and click [OK].
Active Directory Management Deployment Guide 11 There will be a message in the studio stating that the installation is in process once the installation is complete, this message will disappear. 4. Repeat this process for each domain controller. **Each domain controller MUST be restarted after the agent has been installed for the agent to collect passwords.**
Active Directory Management Deployment Guide 12 If issues arise during installation Follow these steps (use either the instructions for a new installation or for an upgrade): New installation 1. Copy the IDSync.msi from either C:\Program Files\Identity Syncronizer\Plugins\Installers\x64 or C:\Program Files\Identity Syncronizer\Plugins\Installers\x86 (based on the processor on the domain controller) to the root of the C: drive on each domain controller. 2. Run the installer it may throw errors as it is expecting certain data, which may not be available click [OK] or [Continue] on these to install all of the necessary files.
Active Directory Management Deployment Guide 13 3. Once the files have installed, run the Syncronizer.Installer executable found in C:\Program Files\Identity Syncronizer:
4. Fill in the necessary database information and click [OK]: Active Directory Management Deployment Guide 14
Active Directory Management Deployment Guide 15 5. Run the Syncronizer.Agent.Config executable found in C:\Program Files\Identity Syncronizer: 6. Check the enable synchronization checkbox, then click the [Install] button, and finally click [OK]:
Active Directory Management Deployment Guide 16 7. Run the Syncronizer.Managementconsole.Installer executable in C:\Program Files\Identity Syncronizer: 8. Check the Enable AD Users and Computers checkbox and click [OK]:
Active Directory Management Deployment Guide 17 Upgrade 1. Stop the Identity Syncronizer Agent Service: 2. Copy the IDSync.msi from either C:\Program Files\Identity Syncronizer\Plugins\Installers\x64 or C:\Program Files\Identity Syncronizer\Plugins\Installers\x86 (based on the processor on the domain controller) to the root of the C: drive on the domain controller. 3. Run the following from the command line: Msiexec /i c:\idsync.msi REINSTALLMODE=vomus REINSTALL=ALL /norestart 4. Once the upgrade has completed, run the Syncronizer.Managementconsole.Installer executable in
C:\Program Files\Identity Syncronizer. Ensure that the Enable AD Users and Computers checkbox is checked and click [OK]: Active Directory Management Deployment Guide 18
5. Start the Identity Syncronizer Agent Service: Active Directory Management Deployment Guide 19
Active Directory Management Deployment Guide 20 MMC If there are any machines on your domain that are not domain controllers that have Active Directory Users and Computers (ADUC) installed, components can be installed on those machines so that they show the AD Mgmt tabs in ADUC. 1. To install these components, click the MMC tab in the AD Mgmt Studio. This will show a list of all of the machines in the domain. 2. To install the MMC components, click the [Install] button to the right of the machine you would like to install them on. This will display a dialog requesting a domain administrator user name and password. 3. Enter these credentials and click [OK].
Active Directory Management Deployment Guide 21 Service 1. To install the AD Mgmt service, click the Service tab in the AD Mgmt studio. 2. Click the [Install Service] button. This will install the service and start it up. The service state is reflected by the indicator above the [Start Service] and [Stop Service] buttons. If the service is running, it will be green; if it is stopped, it will be red. The service can be started or stopped using the [Start Service] and [Stop Service] buttons.
Active Directory Management Deployment Guide 22 Control Panel To configure the AD Mgmt connector, click the Parallels tab in the AD Mgmt Studio. Enter a valid gateway user and gateway password that has been provided by your CBT representative. Click the [Authenticate] button. The user s account ID and the subscription will sync (if there is one defined). The Account Number and Subscription ID fields are read-only, so they cannot be updated by the user. For requests to get through the gateway they must match the gateway user, gateway password, and account number; so if these values are changed in the database to something other than what is in the gateway, the request will be discarded. Connection Settings The database connection settings will be set to the values entered in the connection setup dialog. Webservice URL This is the URL to the API. Account Number This is the account number of the customer in the Control Panel to which AD Mgmt will be synchronizing data. AD Admin User This should be set to a domain administrator account in the Active Directory where AD Mgmt is installed. AD Admin Password This is the password for the AD Admin User account.
Active Directory Management Deployment Guide 23 License Key This value will need to be set to the license key provided to you with the AD Mgmt installers. Click the ellipsis ( ) button to verify your key is valid. A separate key is needed for each installation.
Active Directory Management Deployment Guide 24 Metadata Sync This tab displays all of the fields that AD Mgmt is able to synchronize between Active Directory and the Control Panel. 1. To enable a field for synchronization, check the checkbox next to its name. 2. To save any changes made to the Control Panel connector configuration, click either the [Apply] or [OK] button in the AD Mgmt Studio.