Chat now with support
Chat with Support

Identity Manager 8.1.4 - Administration Guide for Connecting to Active Directory

Managing Active Directory environments Setting up Active Directory synchronization Basic data for managing an Active Directory environment
Account definitions for Active Directory user accounts Password policies for Active Directory user accounts Initial password for new Active Directory user accounts Email notifications about login data User account names Target system managers Editing a server
Active Directory domains Active Directory user accounts
Linking user accounts to employees Supported user account types Entering master data for Active Directory user accounts Additional tasks for managing Active Directory user accounts Automatic assignment of employees to Active Directory user accounts Updating employees when Active Directory user account are modified Automatic creation of departments and locations based on user account information Disabling Active Directory user accounts Deleting and restoring Active Directory user accounts
Active Directory contacts Active Directory groups
Entering master data for Active Directory groups Validity of group memberships Assigning Active Directory groups to Active Directory user accounts, Active Directory contacts, and Active Directory computers Additional tasks for managing Active Directory groups Deleting Active Directory groups Default solutions for requesting Active Directory groups and group memberships
Active Directory security IDs Active Directory container structures Active Directory computers Active Directory printers Active Directory locations Reports about Active Directory objects Configuration parameters for managing an Active Directory environment Default project template for Active Directory

Active Directory specific master data for Active Directory domains

Enter the following data on the Active Directory tab:

Table 28: Active Directory data
Property Description

Domain name (pre Win2000)

Pre-Windows 2000 computer name.

Full domain name

Name of the domain confirming to DNS syntax.

Name of this domain.name of parent domain.name of default domain

Example

Docu.Testlab.dd

Account manager

Manager responsible for the domain.

To specify an account manager

  1. Click next to the field.
  2. In the Table menu, select the table that maps the account manager.
  3. In the Account manager menu, select the manager.
  4. Click OK.

Distinguished name

Distinguished name of the domain. The distinguished name is determined using a template from the full domain name and cannot be edited.

Forest

The name of the forest to which the domain belongs. This name should be given if group memberships are mapped cross-domain.

Enable recycling bin

Specifies whether the recycling bin is enabled (from functional level Windows Server 2008 R2). The property is imported by the synchronization and should not be edited in One Identity Manager.

Retention period

Retention period of objects in the recycling bin (from functional level Windows Server 2008 R2). The property is imported by the synchronization and should not be edited in One Identity Manager.

Complex passwords

Specifies whether complex passwords are implemented in the domain. Complex passwords must fulfill certain minimum prerequisites. For more information, see the documentation for implementing Windows Server.

For domains from the functional levels Windows Server 2008 R2 and above, it is possible to define this setting using account policies.

Default home drive

Default home drive to be connected when a user logs in.

Structural object class

Structural object class representing the object type. By default, the domains in One Identity Manager are created using the object class DOMAINDNS.

Object class List of classes defining the attributes for this object. The object classes listed are read in from the database during synchronization with the Active Directory environment. You can also enter object classes in to the input field.
Related topics

Specifying categories for inheriting Active Directory groups

Groups and be selectively inherited by user accounts and contacts in One Identity Manager. The groups and user accounts (contacts) are divided into categories in the process. The categories can be freely selected and are specified using a mapping rule. Each category is given a specific position within the template. The mapping rule contains tables that map the user accounts (contact) and the groups. Specify your categories for user account (contacts) in the table for user accounts (contacts). Enter your categories fro groups in the group table. Each table contains the Position 1 to Position 31 category positions.

To define a category

  1. Select the Active Directory | Domains category.
  2. Select the domain in the result list.
  3. Select the Change master data task.
  4. Select the Categories tab.
  5. Expand the root in the respective table.
  6. To enable the category, double-click .
  7. Enter a category name for user accounts, contacts, and groups in your login language.
  8. Save the changes.
Detailed information about this topic

Information about the Active Directory forest

The information about the forest is required in One Identity Manager to map trusted domains and group memberships across domains.

The information about the Active Directory forest is loaded into One Identity Manager during synchronization.

To display information about a forest

  1. Select the Active Directory | Forests category.
  2. Select a forest in the result list.
  3. To display a domain's forest, select the Forest overview task.
  4. To display a forest's master data, select the Change master data task.
Related topics

Trusted Active Directory domains

For an explanation of the concept of trusts in Active Directory, refer to your Windows Server documentation. Users can access resources in other domains depending on the domain trusts.

  • Explicit trusts are loaded into Active Directory by synchronizing with One Identity Manager. Domains which are trusted by the currently synchronized domains are found.
  • To declare implicit two-way trusts between domains within an Active Directory forest in One Identity Manager, ensure that the parent domain is entered in all child domains.

To enter the parent domain

  1. In the Manager, select the Active Directory | Domains category.
  2. Select the domain in the result list.
  3. Select the Change master data task.
  4. Enter the parent domain.
  5. Save the changes.

    Implicit trusts are created automatically.

To test trusted domains

  1. In the Manager, select the Active Directory | Domains category.
  2. Select the domain in the result list.
  3. Select Specify trust relationships.

    This shows domains which trust the selected domain.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating