Chat now with support
Chat with Support

Identity Manager 8.1.4 - Administration Guide for Connecting to Active Directory

Managing Active Directory environments Setting up Active Directory synchronization Basic data for managing an Active Directory environment
Account definitions for Active Directory user accounts Password policies for Active Directory user accounts Initial password for new Active Directory user accounts Email notifications about login data User account names Target system managers Editing a server
Active Directory domains Active Directory user accounts
Linking user accounts to employees Supported user account types Entering master data for Active Directory user accounts Additional tasks for managing Active Directory user accounts Automatic assignment of employees to Active Directory user accounts Updating employees when Active Directory user account are modified Automatic creation of departments and locations based on user account information Disabling Active Directory user accounts Deleting and restoring Active Directory user accounts
Active Directory contacts Active Directory groups
Entering master data for Active Directory groups Validity of group memberships Assigning Active Directory groups to Active Directory user accounts, Active Directory contacts, and Active Directory computers Additional tasks for managing Active Directory groups Deleting Active Directory groups Default solutions for requesting Active Directory groups and group memberships
Active Directory security IDs Active Directory container structures Active Directory computers Active Directory printers Active Directory locations Reports about Active Directory objects Configuration parameters for managing an Active Directory environment Default project template for Active Directory

Active Directory group inheritance based on categories

Groups and be selectively inherited by user accounts and contacts in One Identity Manager. The groups and user accounts (contacts) are divided into categories in the process. The categories can be freely selected and are specified using a mapping rule. Each category is given a specific position within the template. The mapping rule contains tables that map the user accounts (contact) and the groups. Specify your categories for user account (contacts) in the table for user accounts (contacts). Enter your categories for groups in the group table. Each table contains the Position 1 to Position 31 category positions.

Every user account (contact) can be assigned to one or more categories. Each group can also be assigned to one or more categories. If at least one user account (contact) category position matches an assigned structural profile, the structural profile is inherited by the user account (contact). If the group or user account (contact) is not in classified into categories, the group is also inherited by the user account (contact).

NOTE: Inheritance through categories is only taken into account when groups are assigned indirectly through hierarchical roles. Categories are not taken into account when assigning groups to user accounts and contacts.

Table 65: Category examples
Category position Categories for user accounts Categories for groups
1 Default user Default entitlements
2 System users System user entitlements
3 System administrator System administrator entitlements

Figure 2: Example of inheriting through categories.

To use inheritance through categories

  • Define categories in the domain.
  • Assign categories to user accounts and contacts through their master data.
  • Assign categories to groups through their master data.
Related topics

Assigning Active Directory account policies directly to an Active Directory group

For domains from the functional level Windows Server 2008 R2 and above, it is possible to define additional password policies in addition to the default password policies. This allows individual users and groups to be subjected to stricter account policies as intended for global groups.

To specify account policies for a group

  1. Select Active Directory | Groups.
  2. Select the group in the result list.
  3. Select the Assign account policies task.
  4. In the Add assignments pane, assign the account policies.

    - OR -

    In the Remove assignments pane, remove the account policies.

  5. Save the changes.
Related topics

Assigning secretaries to an Active Directory group

Assign a secretary to the group. The secretary is displayed in the email recipient’s properties in Microsoft Outlook.

To assign a secretary to a group

  1. Select the Active Directory | Groups category.
  2. Select the group in the result list.
  3. Select the Assign secretaries task.
  4. Select the table which contains the user from the menu Table at the top of the form. You have the following options:
    • Active Directory user accounts
    • Active Directory contacts
    • Active Directory groups

  5. In the Add assignments pane, assign secretaries.

    - OR -

    In the Remove assignments pane, remove secretaries.

  6. Save the changes.

Moving an Active Directory group

NOTE: You can only move groups within a domain.

To move a group

  1. Select the Active Directory | Groups category.
  2. Select the group in the result list.

  1. Select the Change master data task.

  2. Select the Change Active Directory container task.
  3. Confirm the security prompt with Yes.
  4. Select the new container from the Containers menu on the General tab.
  5. Save the changes.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating