Active Roles 7.3.1 - Skype for Business Server User Management Administrator Guide

Register domains with Active Roles

Register domains with Active Roles

Skype for Business Server User Management requires the following domains to be registered with Active Roles:

  • At least one domain that holds computers running the Front End Server or Standard Edition Server role in your Skype for Business Server deployment
  • Domains that hold logon-enabled users you are going to administer with Skype for Business Server User Management
  • In case of multi-forest topology, the domain in the Skype for Business Server forest that holds shadow accounts for Skype for Business Server users

When registering a domain, you are prompted to choose which account you want the Administration Service to use to access the domain. You can either specify a so-called override account or let the Administration Service use its service account. With either option, the account must have sufficient rights in the domain you are registering. At a minimum, the account must have the following rights:

  • In the domain that holds Skype for Business Server computers, a member of the RTCUniversalUserAdmins group
  • In the user domains, a member of the Account Operators group
  • In the shadow accounts domain, a member of the Account Operators group

    For a central forest deployment, the account must also have the rights to create, view, modify and delete contact objects in the shadow accounts domain. It will suffice to make the account a member of the Domain Admins group.

    For instructions on how to register domains with Active Roles, see “Adding and removing managed domains” in the Active Roles Administrator Guide.

Deployment in a single-forest environment

Deployment in a single-forest environment

In a single-forest environment, you only need to link the Built-in Policy - Skype for Business - User Management Policy Object to the Active Directory domains or containers that hold user accounts for which you want Active Roles to perform Skype for Business Server user management tasks.

To link the Policy Object to an organizational unit or domain

  1. In the Active Roles console tree, select Configuration | Policies | Administration | Builtin.
  2. In the details pane, right-click the Built-in Policy - Skype for Business - User Management Policy Object, and then click Policy Scope.
  3. In the dialog box that appears, click Add, and then select the desired organizational unit or domain.

Out of the box, the Policy Object has all policy settings configured. You can use the Active Roles console to view or change policy settings as needed.

To view or change policy settings

  1. In the Active Roles console tree, select Configuration | Policies | Administration | Builtin.
  2. In the details pane, double-click the Built-in Policy - Skype for Business - User Management Policy Object.
  3. In the Properties dialog box that appears, go to the Policies tab, and double-click the entry in the list of policies.
  4. In the Properties dialog box that appears, do any of the following:
    • On the Server tab, specify how you want Active Roles to select a computer running Skype for Business Server.
    • On the SIP User Name tab, configure a rule for generating the SIP user name in the user SIP address.
    • On the SIP Domain tab, configure a rule to restrict selection of a SIP domain for the user SIP address.
    • On the Pool tab, configure a rule to restrict selection of an Enterprise Edition Front End pool or Standard Edition server to which Skype for Business Server users can be assigned.
    • On the Telephony tab, configure a rule to restrict selection of a Telephony option for Skype for Business Server users.

For detailed description of the policy settings, see User Management policy settings earlier in this document.

Deployment in a multi-forest environment

Deployment in a multi-forest environment

In a multi-forest environment, you need to perform the following deployment tasks:

  • Apply the Master Account Management policy  Adjust the Forest Mode policy setting in the Built-in Policy - Skype for Business - Master Account Management Policy Object and then link that Policy Object to Active Directory domains or containers that hold logon-enabled user accounts in user forests (master accounts) for which you want Active Roles to perform Skype for Business Server user management tasks.
  • Apply the User Management policy  Link the Built-in Policy - Skype for Business - User Management Policy Object to Active Directory domains or containers in the Skype for Business Server forest that hold shadow accounts.

    In case of central forest, you also need to link the Built-in Policy - Skype for Business - User Management Policy Object to Active Directory domains or containers in the Skype for Business Server forest that hold logon-enabled user accounts for which you want Active Roles to perform Skype for Business Server user management tasks.

Apply the Master Account Management policy

Apply the Master Account Management policy

The Built-in Policy - Skype for Business - Master Account Management Policy Object enables Active Roles to perform Skype for Business Server user management tasks on user accounts in Active Directory forests that are external to the Skype for Business Server forest. It needs to be configured as appropriate to your Skype for Business Server forest mode (resource forest or central forest) and then linked to domains or containers in external user forests.

To configure the Policy Object

  1. In the Active Roles console tree, select Configuration | Policies | Administration | Builtin.
  2. In the details pane, double-click the Built-in Policy - Skype for Business - Master Account Management Policy Object.
  3. In the Properties dialog box that appears, go to the Policies tab, and double-click the entry in the list of policies.
  4. In the Properties dialog box that appears, go to the Forest Mode tab and select the option that matches the Skype for Business Server forest mode in your Skype for Business Server deployment (see Skype for Business Server forest mode).
  5. Review other policy settings:
    • On the Shadow Account tab, view or change the container and default description for new shadow accounts.
    • On the Master Account tab, view or change the attribute to store a reference to shadow account.
    • On the Synced tab, view or change the list of synchronized properties.
    • On the Substituted tab, configure your custom list of substituted properties in addition to the default list.
    • On the Back-synced tab, view or change the list of back-synchronized properties.

For detailed description of the policy settings, see Master Account Management policy settings earlier in this document.

To link the Policy Object to an organizational unit or domain

  1. In the Active Roles console tree, select Configuration | Policies | Administration | Builtin.
  2. In the details pane, right-click the Built-in Policy - Skype for Business - Master Account Management Policy Object, and then click Policy Scope.
  3. In the dialog box that appears, click Add, and then select the desired organizational unit or domain.
Related Documents