Chat now with support
Chat with Support

Identity Manager 8.1.4 - Administration Guide for Connecting to Active Directory

Managing Active Directory environments Setting up Active Directory synchronization Basic data for managing an Active Directory environment
Account definitions for Active Directory user accounts Password policies for Active Directory user accounts Initial password for new Active Directory user accounts Email notifications about login data User account names Target system managers Editing a server
Active Directory domains Active Directory user accounts
Linking user accounts to employees Supported user account types Entering master data for Active Directory user accounts Additional tasks for managing Active Directory user accounts Automatic assignment of employees to Active Directory user accounts Updating employees when Active Directory user account are modified Automatic creation of departments and locations based on user account information Disabling Active Directory user accounts Deleting and restoring Active Directory user accounts
Active Directory contacts Active Directory groups
Entering master data for Active Directory groups Validity of group memberships Assigning Active Directory groups to Active Directory user accounts, Active Directory contacts, and Active Directory computers Additional tasks for managing Active Directory groups Deleting Active Directory groups Default solutions for requesting Active Directory groups and group memberships
Active Directory security IDs Active Directory container structures Active Directory computers Active Directory printers Active Directory locations Reports about Active Directory objects Configuration parameters for managing an Active Directory environment Default project template for Active Directory

Specifying server functions

NOTE: All editing options are also available in the Designer under Base Data | Installation | Job server.

The server function defines the functionality of a server in One Identity Manager. One Identity Manager processes are handled with respect to the server function.

NOTE: More server functions may be available depending on which modules are installed.
Table 19: Permitted server functions

Server function

Remark

Active Directory connector

Server on which the Active Directory connector is installed. This server synchronizes the Active Directory target system.

CSV connector Server on which the CSV connector for synchronization is installed.

Domain controller

The Active Directory domain controller. Servers that are not labeled as domain controllers are considered to be member servers.

Printer server

Server that acts as a print server.

Generic server

Server for generic synchronization with a custom target system.

Home server

Server for adding home directories for user accounts.

Update server

This server automatically updates the software on all the other servers. The server requires a direct connection to the database server that One Identity Manager database is installed on. It can run SQL tasks.

The server with the One Identity Manager database installed on it is labeled with this functionality during initial installation of the schema.

SQL processing server

It can run SQL tasks. The server requires a direct connection to the database server that One Identity Manager database is installed on.

Several SQL processing servers can be set up to spread the load of SQL processes. The system distributes the generated SQL processes throughout all the Job servers with this server function.

CSV script server

This server can process CSV files using the ScriptComponent process component.

Native database connector

This server can connect to an ADO.Net database.

One Identity Manager database connector

Server on which the One Identity Manager connector is installed. This server synchronizes the One Identity Manager target system.

One Identity Manager Service installed

Server on which a One Identity Manager Service is installed.

Primary domain controller

Primary domain controller.

Profile server

Server for setting up profile directories for user accounts.

SAM synchronization Server

Server for running synchronization with an SMB-based target system.

SMTP host

Server from which One Identity Manager Service sends email notifications. Prerequisite for sending mails using One Identity Manager Service is SMTP host configuration.

Default report server

Server on which reports are generated.

Windows PowerShell connector

The server can run Windows PowerShell version 3.0 or later.

Related topics

Preparing a home server and profile server for creating user directories

Home and profile servers are expected when user account home and profile directories are added.

To declare home and profile servers

  • In the Designer, set the TargetSystem | ADS | AutoCreateServers and TargetSystem | ADS | AutoCreateServers | PreferredLanguage configuration parameters.

    If these configuration parameters are set, entries for missing home servers and profile servers are created automatically when user accounts are synchronized.

- OR -

  1. Select the Active Directory | Basic configuration data | Servers category.
  2. Select the Job server entry in the result list.
  3. Select the Change master data task.
  4. Edit the Job server's master data.
  5. Select the Assign server functions task and specify the Home server and Profile server server functions.
  6. Save the changes.

You may use other settings for create home and profile directories.

  • If you want a user’s home directory to be linked at the time of login, in the Designer, set the QER | Person | User | ConnectHomeDir configuration parameter.
  • To create the user profile in the user’s home directory, in the Designer, set the QER | Person | User | PropertyMapping | ProfileFromHome configuration parameter.
  • You can use a batch file for creating the home directory, the result of which determines whether the home directory is enabled.
  • You can create a template structure on the profile server that is used in the process of creating the profile directory.
  • Home and profile directory permissions can be granted through the One Identity Manager Service.
Related topics

Creating home directories using batch files

To satisfy specific demands of individual network environments, you can use a batch file, which is executed when you create a home directory with One Identity Manager Service. Whether the home directory is ultimately enabled depends on the result of executing the batch file.

To use this function, a Netlogon share must exist on all home servers. Subdirectories are added in the Netlogon share, which correspond to the NetBIOS names of the domain. If there is a batch file in this directory with the name HomePre.CMD, it is executed before the home directory is added. If the batch file ends in failure (that means Errorlevel <> 0), the home directory is not added.

Pass the following command line parameters to the batch file HomePre.CMD to be used during executed (in the given order; database column names are used):

SAMAccountName (from table ADSAccount)

Ident_Domain (from table ADSAccount)

Ident_Server (from table QBMServer)

SharedAs (from table ADSAccount)

HomeDirPath (from table ADSAccount)

HomeShare (from table ADSAccount)

You can run another batch file again after adding a home directory. This must be kept in the same place as before and have the name HomePost,CMD. You pass the parameters in the same way as HomePre.CMD. Merely, the exit code (Errorlevel) is not handled.

Example

A user account Test1 is created in the domain Dom2. Its home directory should be created on the server Serv3 in the shared drive Share7 with the name TestHome6 and be released as TestShare5. On the executing home server ServHome the files HomePre.CMD and HomePost.CMD are found in the \\ServHome\Netlogon\Dom2 directory.

Batch call before creating the home directory:

\\ServHome\Netlogon\Dom2\HomePre.CMD Test1 Dom2 Serv3 TestShare5 TestHome6 Share7

If the batch execution returns an exit code 0, the home directory is created. Otherwise, the process is aborted with a log message.

Batch call after creating the home directory:

\\ServHome\Netlogon\Dom2\HomePost.CMD Test1 Dom2 Serv3 TestShare5 TestHome6 Share7

Supporting multiple profile directories

The different Windows operating system versions use different repositories for roaming user profiles. For exact information about storing roaming profile, see the MicrosoftTechNet Library.

To map the roaming user profile in One Identity Manager.

  • Provide a template structure for the user profile on the profile server.

    Example of a template structure for user profiles on a profile server

    PROFILE

    UserProfile

    All required folders/files

    UserProfile.V2

    All required folders/files

    UserProfile.V3

    All required folders/files

    UserProfile.V4

    All required folders/files

  • In the Designer, set the TargetSystem | ADS | Accounts | ProfileFixedString configuration parameter and define the part of the user profile directory that you want to attach to the default profile path. The default value is UserProfile.

As a result, the directory paths for the user profiles are mapped as follows in the default installation.

  • If the profile directory is created in the home directory:

    \\Servername\HOMES\Username$\PROFILES\UserProfile

  • If the profile directory is not created in the home directory:

    \\Servername\PROFILES\Username\UserProfile

The following directories exist after handling the processes.

  • If the profile directory is created in the home directory:

    \\Servername\HOMES\Username$\PROFILES\UserProfile

    \\Servername\HOMES\Username$\PROFILES\UserProfile.v2

    \\Servername\HOMES\Username$\PROFILES\UserProfile.v3

    \\Servername\HOMES\Username$\PROFILES\UserProfile.v4

  • If the profile directory is not created in the home directory:

    \\Servername\PROFILES\Username\UserProfile

    \\Servername\PROFILES\Username\UserProfile.v2

    \\Servername\PROFILES\Username\UserProfile.v3

    \\Servername\PROFILES\Username\UserProfile.v4

The directory paths for the repository on the terminal server are mapped in the same way. In this case, in the Designer, change the TargetSystem | ADS | Accounts | TProfileFixedString configuration parameter accordingly. Specify in this configuration parameter the part of the user profile directory path which is appended to the default profile path on a terminal server. The default value is UserProfile.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating