返回
-
标题
Installing Defender - will it install on parent or child domain, or both? -
说明
Question 1. As Defender Management Console installation causes Defender OU creation & Schema Extensions on the Domain of the logged in system, suppose Defender Management Console is installed on a system which is a computer in child domain; while installing Defender Console, will it allow Defender OU creation on the Parent Domain?
Question 2. When Schema Extension added on Parent Domain Controller, is it required for its Child Domain controller?
Question 3. If integrating DSS with a Parent Domain controller, will two-factor authentication work for all the users who are in its child domain? -
解决办法
Answer 1. The Defender MMC Console can be installed anywhere. That is, it is independent of where the OU exists in Active Directory (AD). The console allows you to manage Defender objects wherever they exist in AD, provided that the correct delegation is in place. If you would like the the Defender OU to exist in in the parent domain then run the installation on a DC for the parent so that it is placed there.
Note: Only one Defender installation per forest is required.Answer 2. This depends on where your users exists and where the Defender objects exist. When you extend the schema on the schema master for a forest, the changes are propagated to all other domain controllers in the forest. This is an AD concept, so you'll need to confirm how you would like this implemented in your environment.
Answer 3. The answer to this depends on the above two answers. This should work, but will depend on how you choose to implement in your environment. -
其他信息
Support cannot assist with implementation, and cannot make any recommendations for your AD environment. In general, Defender can be used in an AD forest as long as permissions are adequate for user/object management.For more on delegation please refer to the Defender Delegated Administration User Guide.