-
标题
Defender menu does not populate in Active Directory to manage Defender objects -
说明
After installing Defender without error, when attempting to create defender objects in AD, the Defender menu along with the right-click options are missing which prevent creation of necessary objects.
-
原因
It is possible the Defender Administration Console was not installed. It will need to be installed on every workstation or server that will administrate Defender objects within AD.
-
解决办法
Confirm that the Defender Administration Console is installed:
- Select the Defender OU in ADUC, a Defender menu option should appear above
- Files should be located here C:\Program Files\One Identity\Defender\Administration Console
Confirm the account being used to access ADUC and the Defender Administration Console is a member of the Domain Admins or Administrators group.
When first installing Defender, delegation of privileges may have been skipped in which case they will need to be delegated.
Confirm that it is a permissions issue by checking the effective access the account has over the Access Nodes OU.
Here are the steps to check it:
- Open ADUC, expand Defender OU and right-click the Access Nodes OU and select Properties.
- Select the Security tab and select Advanced.
- Select the Effective Access tab and choose the account where it states 'Select a user'.
- Select View effective access.
- Does the account have access to Create Defender objects such as policies, licenses, access nodes, etc.?
If access is denied then the 'Full Control' options will need to be delegated to the account or security group in order to have the options to add/edit access nodes and policies.
The DefenderRightsUI.exe tool can be used. It is found here: C:\Program Files\One Identity\Defender\Administration Console\DelegatedAdmin