To install One Identity Manager tools on a Windows terminal server, you need to ensure that the Windows terminal server has been fully installed and configured. This includes profile handling in particular as well as permissions for Windows terminal server use.
NOTE: Ensure that in an Active Directory Domain, users also have relevant permissions to use the Windows terminal server self.
To install One Identity Manager components on a Windows terminal server:
- Log in with a user account that has administrator permissions on the Windows terminal server.
Logging in using a console connection is recommended. Call this up with
Start/Execute: mstsc /Console /v:<servername>
where <server name> must be replaced with the server name of the terminal server (without leading "\").
- Open the command line console (CMD.exe) and switch the Windows terminal server into software installation mode with help of the command CHANGE USER /INSTALL.
- Start the installation wizard and install the One Identity Manager components as described.
- End the software installation mode on the Windows terminal server with the command CHANGE USER /EXECUTE in the command line console.
After the installation is complete, anyone who is an authorized Windows terminal server user can start the One Identity Manager tools and use them.
For more information about software installation on Windows terminal servers, refer to the Windows operating system documentation you are using.
Related topics
To set up the One Identity Manager database, use the Configuration Wizard. The Configuration Wizard executes the following steps.
- Installs the One Identity Manager schema in a database.
The Configuration Wizard can create a new database and install the One Identity Manager schema. Alternatively, the One Identity Manager schema can be installed in an existing database.
- Creates the required SQL Server logins and database users permissions for the administrative user, configuration user, and end user.
- Creates administrative system users and permissions groups.
- Encrypts the database.
- Installs and configures a One Identity Manager Service with direct access to the database for handling SQL processes and automatic server software updates.
NOTE: Additional steps are executed in One Identity Manager depending on the Edition and Configuration Wizard modules.
Additional steps are required to configure the One Identity Manager database following the schema installation:
- Configure the database for a test, development, or live system.
- Other system settings may be required for putting individual functions into operation in One Identity Manager.
Use configuration parameters to configure the behavior of the system's basic settings. One Identity Manager provides default settings for different configuration parameters. Check the configuration parameters and modify them as necessary to suit your requirements.
Configuration parameters are defined in the One Identity Manager modules. Each One Identity Manager module can also install configuration parameters. In the Designer, you can find an overview of all configuration parameters in the Base data | General | Configuration parameters category.
- In certain circumstances, it is necessary to store encrypted information in the One Identity Manager database. If you did not encrypt the database when you installed with the Configuration Wizard, use the Crypto Configuration program to encrypt.
- You can log changes to data and information from process handling in One Identity Manager. All entries logged in One Identity Manager are initially saved in the One Identity Manager database. The proportion of historical data to total volume of a One Identity Manager database should not exceed 25 percent. Otherwise performance problems may arise. You must ensure that log entries are regularly removed from the One Identity Manager database and archived.
For more information about process monitoring and process history, see the One Identity Manager Configuration Guide. For more information about archiving data, see the One Identity Manager Data Archiving Administration Guide.
Detailed information about this topic
Related topics
Important: Always start the Configuration Wizard on an administrative workstation. If you start the Configuration Wizard on a server on which you also want to configure a One Identity Manager Service, simply skip the section for installing the service on the local server in the Configuration Wizard.
To install a database in the Configuration Wizard
-
Start the Configuration Wizard.
-
On the Configuration Wizard home page, select the Create and install a database option and click Next.
-
On the Create administrative connection page, execute the following steps to use an existing database.
-
Enable the Advanced option.
-
In the Advanced options pane, set the Use an existing, empty database for installation option.
-
Enter the following connection data for the database.
-
Server: Database server.
-
(Optional) Windows Authentication: Specifies whether integrated Windows authentication is used. This type of authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication.
-
User: SQL Server Login name of the installation user.
-
Password: Password for the installation user.
-
Database: Select the database.
- OR -
To install a new database, enter the following database connection data on the Create administrative connection page.
-
Server: Database server.
-
(Optional) Windows Authentication: Specifies whether integrated Windows authentication is used. This type of authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication.
-
User: SQL Server Login name of the installation user.
-
Password: Password for the installation user.
-
If you are using an existing database, on the Create database page, Installation source view, select the directory containing the installation files.
- OR -
If you are creating a new database, perform the following tasks on the Create database page.
-
In the Database properties view, enter the following information about the database.
Table 17: Database properties
|
Database name |
Name of the database. |
|
Data directory |
Directory in which the data file is created. You have the following options:
-
<default>: The database server’s default directory.
-
<browse>: Select a directory using the file browser.
-
<directory name>: Directory in which data files are already installed. |
|
Log directory |
Directory in which the transaction log file is created. You have the following options:
-
<default>: The database server’s default directory.
-
<browse>: Select a directory using the file browser.
-
<directory name>: Directory in which transaction log files are already installed. |
|
Memory tables directory |
Directory for data file group and database file for memory-optimized tables. You have the following options:
-
<default>: The database server’s default directory.
-
<browse>: Select a directory using the file browser.
-
<Directory name>: Directory in which data files for memory-optimized tables are already installed. |
|
Initial size |
Initial size of the database files. You have the following options:
-
<Default>: Default entry for the database server.
-
<custom>: User-defined entry.
-
Different recommended sizes: Depending on the number of employees being administrated. |
-
In the Installation source pane, select the directory with the installation files.
-
On the Select configuration module page, select the configuration module .
- If you started the from the install wizard, the configuration modules for the selected edition are already activated. Check the module selection in this case.
- Select the configuration module at this point if you started the Configuration Wizard directly. Dependent configuration modules are selected automatically.
-
On the Create a new login for administrators page, decide which SQL server login to use for administrative users. You have the following options:
-
Create new SQL Server logins for the database: Select this option if you want to set up a new administrative login on the SQL Server. Other SQL Server logins with permissions for system configuration and for end users are created after the database has been migrated.
Enter the login name, password, and password confirmation for the new SQL Server login.
NOTE: The password must meet the Windows policy requirements for passwords.
-
Use the current SQL Server login for the database: When you select this option, no additional SQL Server logins are created for the database. In this case, you cannot work with the granular permissions concept at SQL level. The user you specified is used to connect to the database.
-
Error that prevent processing the database are displayed on the Database check page. Correct the errors before you continue with the installation.
-
The installation steps are shown on the Processing database page.
Installation and configuration of the database are automatically carried out by the Configuration Wizard. This procedure may take some time depending on the amount of data and system performance. Once processing is complete, click Next.
TIP: Set Advanced to obtain detailed information about processing steps and the migration log.
-
On the Create SQL server logins page, enter the login name, the password, and password confirmation for the SQL Server logins for configuration users and end users.
NOTE: The password must meet the Windows policy requirements for passwords.
-
On the System information page, enter the customer information and create administrative system users for One Identity Manager.
-
In the Customer information view, enter the full name of the company.
-
In the System user view, configure the predefined administrative system users and enter your own administrative system users.
-
Enter a password and password confirmation for the predefined system users.
-
To create customer-specific system users, click the 
button and enter the name, password, and password confirmation.
TIP: Use the <...> button next to the name of a system user to configure additional settings for that system user. You can also adjust these settings in the Designer at a later time.
-
(Optional) Create custom permissions groups.
The Configuration Wizard creates custom permissions groups, which you can use to define permissions for any custom schema extensions you require.
-
For non role-based login, the CCCViewPermissions and CCCEditPermissions are created permission groups. Administrative system users are automatically added to these permissions groups.
-
For role-based login, the CCCViewRole and CCCEditRole permission groups are created.
To create additional permissions groups
-
Enable the Advanced option and in the Permissions groups view, click the button.
-
Enter the name for the permissions group. Label custom permission groups with the prefix CCC.
-
For role-based permissions groups, enable the Role-based option.
-
On the Enable database encryption page, select one of the following options:
-
Skip database encryption: The database is not encrypted. You can encrypt the database at later date using the Crypto Configuration program.
-
Enable database encryption: The database is encrypted in the next step.
-
In the Private key field, enter the name of the key file.
-
Click New and, using the file browser, select the where you want to store the key file.
Click Save.
-
Confirm that you have saved the key file.
Take the Advice on working with an encrypted One Identity Manager database into account.
-
On the Service installation page, you can create a Job server for the server on which the One Identity Manager database is installed.
NOTE: If you do not want to set up a Job server with the One Identity Manager Service at this stage, select the Skip service installation option.
-
In the Installation data pane, enter the following data for installing the One Identity Manager Service.
-
Computer: Name or IP address of the server that the service is installed and started on.
-
Service account: User account data for the One Identity Manager Service.
-
To start the service under the NT AUTHORITY\SYSTEM account, set the Local system account option.
-
To start the service under another account, disable the Local system account option and enter the user account, password and password confirmation.
-
To change the install directory, names, display names or description of the One Identity Manager Service, use the other options.
-
(Optional): Enable the Advanced option and enter the Installation account data.
-
To use the current user’s account, set the option Current user.
-
To use another user account, disable the Current user option and enter the user account, password and password confirmation.
-
In the Machine roles pane, select the machine role for the service. The Job server machine role is defined by default. You can add more machine roles.
-
(Optional) In the Configuration pane, check the One Identity Manager Service configuration. Enable the Advanced option.
NOTE: The initial service configuration is predefined already. If additional changes need to be made to the configuration, you can do this later with the Designer. For more detailed information about configuring the One Identity Manager Service, see the One Identity Manager Configuration Guide.
-
Click Next to start installing the service.
Installation of the service occurs automatically and may take some time.
NOTE: In a default installation, the service is entered in the server’s service management with the name One Identity Manager Service.
-
On the last page of the Configuration Wizard, click Finish.
Related topics
