KACE Systems Management Appliance 13.2 Common Documents

Option	Description
Domain	The host name of the domain of your Active Directory® server, such as example.com.
Username	The user name of the administrator account on the Active Directory server. For example, username@example.com.
Password	The password of the administrator account on the Active Directory server.
Computer Object Container	The name of the computer object container of the administrator account on the Active Directory server.
Computer Object Name	The name of the computer object container of the administrator account on the Active Directory server.
Service Account Container	The name of the service account container of the administrator account on the Active Directory server.

Click Join.

The appliance performs the following tests, which require read-only permission, to determine whether the domain is configured correctly to allow the appliance to join the domain:

◦

Check for supported operating system and correct operating system patches

◦

Check for sufficient disk space to install QAS

◦

Check that the hostname of the system is not 'localhost'

◦

Check if the name service is configured to use DNS

◦

Check resolv.conf for proper formatting of name service entries and that the host can be resolved

◦

Check for a name server that has the appropriate DNS SRV records for Active Directory

◦

Detect a writable domain controller with UDP port 389 open

◦

Detect Active Directory site if available

◦

Check if TCP port 464 is open for Kerberos kpasswd

◦

Check if UDP port 88 and TCP port 88 are open for Kerberos traffic

◦

Check if TCP port 389 is open for LDAP

◦

Check for a global catalog server and if TCP port 3268 is open for communication with global catalog servers

◦

Check for a valid time skew against Active Directory

◦

Check for the QAS application configuration in Active Directory

◦

Check if TCP port 445 is open for Microsoft CIFS traffic

These tests do not need write access and they do not check for permission to write to any directory. In addition, these tests do not verify username and password credentials. If the credentials are incorrect, the appliance might not be able to join the domain even if the tests are successful.

A message appears stating the results of the test. To view errors, if any, click Logs, then in the Log drop-down list, select Server Errors.

Optional: Select Force Join to join the server to ignore errors and join the domain.

Click Save and Restart Services.

When users are logged in to devices that are joined to the Active Directory domain, they can access the appliance User Console without having to re-enter their credentials. If users are on devices that are not joined to the Active Directory domain, the login window appears and they can log in using a local appliance user account. See Add or edit System-level user accounts.

NOTE: To use single sign on with Microsoft Edge and Firefox browsers, users must configure their browser settings to use the appropriate authentication. See Configuring browser settings for single sign on.

Generate an SSL certificate

You can generate a self-signed SSL certificate, or generate a certificate signing request for third-party certificates, using the Administrator Console.

Go to the appliance Control Panel:

◦

If the Organization component is not enabled on the appliance, log in to the appliance Administrator Console, https://appliance_hostname/admin, then select Settings > Control Panel.

◦

Click Security Settings to display the Security Settings page.

In the SSL section, click Enable SSL.

Additional SSL options are displayed.

Click Generate CSR (Certificate Signing Request) or Self-Signed SSL Certificate, then click SSL Certificate Form to display the SSL Certificate Form page.

NOTE: If a certificate signing request has previously been generated, it appears on the page. To generate a new request, you need to update the information in the Configure section, then click Save before you click Generate Self-Signed Certificate.

In the Configure section, provide the following information:

Option	Description
Company Name	The name of your company.
Organization Name	The name of your organizational unit or business group.
Common Name	The common name of the appliance you are creating the SSL certificate for.
Email	Your email address.
City Name	The name of your locality.
State or Province Name	The name of your state or province.
Country Name	The name of your country.

Click Save.

If this is the first time the SSL Certificate Form has been saved, the Certificate Signing Request section appears. If the form has previously been saved, the Certificate Signing Request section is updated.

Do one of the following:

◦

To generate a certificate using a third-party certificate issuer:

Copy all of the text in the Certificate Signing Request section, including the lines "-----BEGIN CERTIFICATE REQUEST-----" and "-----END CERTIFICATE REQUEST-----" and everything in between, then send it to the certificate issuer or the person who provides your company with web server certificates.

When you receive a certificate from the third party, return to the Security Settings page and upload the certificate. See Configure security settings for the appliance.

◦

To generate a self-signed certificate:

Click Generate Self-Signed Certificate to generate and display the certificate below the Certificate Signing Request section.

Click Deploy Self-Signed Certificate, then click Yes.

On the Security Settings page, click Save and Restart Services.

Self-signed certificates are converted to PEM files, named kbox.pem, and the files are placed in KACE Agent data folders.

NOTE: Your private key appears in the Private Key field. It is deployed to the appliance when you deploy a valid certificate. Do not send the private key to anyone. It is displayed here in case you want to deploy this certificate to another web server.

NOTE: The certificate and private key for SSL are not included in the appliance’s daily backups for security reasons. Retain these two files for your own records.