By default, Active Roles attempts to create or rename a (non-local) home folder on the file server when the Home Directory property is set or modified on a user account in Active Directory. If creation or renaming of the home folder fails (for example, because the file server is inaccessible), then the creation or modification of the user account fails as well. To prevent such an error condition, a Home Folder AutoProvisioning policy can be configured so that Active Roles applies the changes to the Home Drive and Home Directory properties in Active Directory without attempting an operation on the file server. This policy option enables the use of a tool other than Active Roles for creating home folders on the file server.
Active Roles comes with a pre-configured Policy Object that allows the creation or renaming of home folders when setting home folder properties on user accounts in Active Directory. The Policy Object is located in the Configuration/Policies/Administration/Builtin container in Active Roles console tree. The name of the Policy Object is Built-in Policy - Default Rules to Provision Home Folders. If you want to prevent Active Roles from attempting to create or rename home folders, you could modify the policy in the built-in Policy Object or configure and apply another Home Folder AutoProvisioning policy with the respective option turned off.
To configure a Home Folder AutoProvisioning policy, select Home Folder AutoProvisioning on the Policy to Configure page in the New Provisioning Policy Object wizard or in the Add Provisioning Policy wizard. Then, click Next to display the Home Folder Management page.
Figure 59: Home folder management
On this page, you can configure the following options.
Upon creation or renaming of a user account, the policy can configure the user account in Active Directory to connect the home folder to the specified network path. From the Connect list, select the drive letter to which you want the policy to map the home folder. In the To box, specify a network path to the home folder. Ensure that the path meets the following requirements:
Use this option to have Active Roles verify whether the Home Drive and Home Directory properties on user accounts in Active Directory are in compliance with the Connect: <drive letter> To: <network path> setting specified by this policy.
For example, with the Connect: Z: To: \\Server\Share\%username% policy setting, this option causes a policy violation condition in Active Roles upon an attempt to modify a user account so that the Home Drive property is assigned a drive letter other than Z: or the Home Directory property is assigned a network path other than \\Server\Share\LogonName where LogonName stands for the pre-Windows 2000 logon name of the user account.
When this option is turned off, the policy allows a home folder path and name that differs from the path and name prescribed by this policy. A Property Generation and Validation policy can be configured to generate the Home Drive and Home Directory properties on user accounts, or those properties can be specified manually. In either case, Active Roles updates the user account so that the folder with the specified path and name is set as the user home folder. If necessary, Active Roles creates the folder.
When this option is turned on, the policy behaves as follows:
By selecting the Enforce this home folder setting in Active Directory check box, you ensure that the home folders on user accounts are set in compliance with this policy.
By clearing the check box, you get the option of applying a Property Generation and Validation policy in order to generate and validate the Home Drive and Home Directory properties, and thus have Active Roles create and assign home folders in accordance with the flexible, highly customizable rules provided by a Property Generation and Validation policy.
|
IMPORTANT: When setting the Home Drive and Home Directory properties, Active Roles does not create the home folder if the network path of the folder to hold the home folder is not listed in the Home Folder Location Restriction policy. The policy defines a list of the folders on network file shares in which creation of home folders is allowed, and prevents Active Roles from creating home folders in other network locations. For instructions on how to view or modify the policy settings, see Configuring the Home Folder Location Restriction policy later in this section. |
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy