Log on as Active Roles Admin
Log on as Active Roles Admin
To configure Skype for Business Server User Management, log on as Active Roles Admin. This ensures that you have sufficient rights to make the necessary configuration changes. Assuming the default configuration of the Active Roles Administration Service, you should log on with a domain user account that is a member of the Administrators group on the computer running the Administration Service.
Register domains with Active Roles
Skype for Business Server User Management requires the following domains to be registered with Active Roles:
- At least one domain that holds computers running the Front End Server or Standard Edition Server role in your Skype for Business Server deployment
- Domains that hold logon-enabled users you are going to administer with Skype for Business Server User Management
- In case of multi-forest topology, the domain in the Skype for Business Server forest that holds shadow accounts for Skype for Business Server users
When registering a domain, you are prompted to choose which account you want the Administration Service to use to access the domain. You can either specify a so-called override account or let the Administration Service use its service account. With either option, the account must have sufficient rights in the domain you are registering. At a minimum, the account must have the following rights:
- In the domain that holds Skype for Business Server computers, a member of the RTCUniversalUserAdmins group
- In the user domains, a member of the Account Operators group
- In the shadow accounts domain, a member of the Account Operators group
For a central forest deployment, the account must also have the rights to create, view, modify and delete contact objects in the shadow accounts domain. It will suffice to make the account a member of the Domain Admins group.
For instructions on how to register domains with Active Roles, see “Adding and removing managed domains” in the Active Roles Administrator Guide.
Deployment in a single-forest environment
In a single-forest environment, you only need to link the Built-in Policy - Skype for Business - User Management Policy Object to the Active Directory domains or containers that hold user accounts for which you want Active Roles to perform Skype for Business Server user management tasks.
To link the Policy Object to an organizational unit or domain
- In the Active Roles console tree, select Configuration | Policies | Administration | Builtin.
- In the details pane, right-click the Built-in Policy - Skype for Business - User Management Policy Object, and then click Policy Scope.
- In the dialog box that appears, click Add, and then select the desired organizational unit or domain.
Out of the box, the Policy Object has all policy settings configured. You can use the Active Roles console to view or change policy settings as needed.
To view or change policy settings
- In the Active Roles console tree, select Configuration | Policies | Administration | Builtin.
- In the details pane, double-click the Built-in Policy - Skype for Business - User Management Policy Object.
- In the Properties dialog box that appears, go to the Policies tab, and double-click the entry in the list of policies.
- In the Properties dialog box that appears, do any of the following:
- On the Server tab, specify how you want Active Roles to select a computer running Skype for Business Server.
- On the SIP User Name tab, configure a rule for generating the SIP user name in the user SIP address.
- On the SIP Domain tab, configure a rule to restrict selection of a SIP domain for the user SIP address.
- On the Pool tab, configure a rule to restrict selection of an Enterprise Edition Front End pool or Standard Edition server to which Skype for Business Server users can be assigned.
- On the Telephony tab, configure a rule to restrict selection of a Telephony option for Skype for Business Server users.
For detailed description of the policy settings, see User Management policy settings earlier in this document.
Deployment in a multi-forest environment
In a multi-forest environment, you need to perform the following deployment tasks:
- Apply the Master Account Management policy Adjust the Forest Mode policy setting in the Built-in Policy - Skype for Business - Master Account Management Policy Object and then link that Policy Object to Active Directory domains or containers that hold logon-enabled user accounts in user forests (master accounts) for which you want Active Roles to perform Skype for Business Server user management tasks.
- Apply the User Management policy Link the Built-in Policy - Skype for Business - User Management Policy Object to Active Directory domains or containers in the Skype for Business Server forest that hold shadow accounts.
In case of central forest, you also need to link the Built-in Policy - Skype for Business - User Management Policy Object to Active Directory domains or containers in the Skype for Business Server forest that hold logon-enabled user accounts for which you want Active Roles to perform Skype for Business Server user management tasks.
