Tchater maintenant avec le support
Tchattez avec un ingénieur du support

GPOADmin 5.16 - Quick Start Guide

AD LDS storage method

Using AD LDS as the backup repository (storage method) the service account will need the following minimum requirements:

Member of the Administrator Role in the AD LDS instance. If using the command line tool or the GUI (ldp.exe), the service account will require the same permissions in AD LDS that it would require in Active Directory.

For more information, see Setting Permissions on AD LDS .

Network share storage method

Using Network Share as the backup repository (storage method) the service account will need the following minimum requirements:

•
At the Share level, Change & Read permissions.
•
At the Directory level, all permissions except “Change Permissions" and "Take Ownership.”

Authentication

GPOADmin supports both NTLM and Kerberos authentication by using Windows Communication Foundation (WCF) configuration elements. By default, GPOADmin will use Kerberos.

* 
NOTE: If your environment is not configured to use Kerberos, GPOADmin will authenticate using NTLM.

Managing client connections

Managing client connections

GPOADmin uses the Default.Client.Connection.config file when connecting to a GPOADmin service. This file is located in the Connections sub-directory of the install directory. It contains the basic parameters that you can manipulate along with a link to Microsoft’s complete list of adjustable settings.

To change settings on a global scale, you simply edit this file. However, to adjust only a specific server connection, you need to copy the file, and rename it to the FQDN of the target server ensuring that you retain the .config file extension.

Editing connection options

An environment has multiple GPOADmin servers and one remote GPOADmin server called GPOADmin.Remote.MyDomain.com. The remote server is on the other side of a slow WAN link and users frequently receive connection timeout messages while connected. To solve this issue, the administrator can make a copy of the Default.Client.Connection.config file to target just the remote server and adjust the connection timeout parameters using the following process:

1
Copy the Default.Client.Connection.config and rename the copy to GPOADmin.Remote.MyDomain.com.config.
2
Edit this file and adjust the connection timeout parameters.
This file will only be used when connecting to the GPOADmin.Remote.MyDomain.com server. All other connections will use the Default.Client.Connection.config file unless there is a specific file matching the FQDN of the target server.

Connecting to GPOADmin using NTLM authentication

To override the default settings and use NTLM authentication, you can edit the configuration file by navigating to configuration/Settings/ForceNTLM and setting the value to “true”.

Installing GPOADmin in a disjointed domain

When GPOADmin is installed in a disjointed domain environment, you may encounter errors with configuring, connecting, and in general usage. This is most likely due to the DNS name of the domain not matching the Active Directory name.

To resolve this, edit the Default.Client.Connection.config file in the Connections directory located in the install directory. Add the following to the <Settings> section below the <ForceNTLM value="false" /> entry: <DomainName value=”ACTIVE_DIRECTORY_FULLY_QUALIFIED_DOMAIN_NAME” />

Deploying with Multiple service accounts

By default, GPOADmin uses a domain unique SPN for connections which requires the use of a single service account in the domain, reducing the number of elevated accounts.

However, you can configure GPOADmin to use multiple service accounts in your domain.

To configure GPOADmin to use multiple service accounts:
1
On each GPOADmin service host, browse to HKEY_LOCAL_MACHINE\SOFTWARE\Quest\GPOADmin\ServerConfig and set the registry value UseServerAndPortSPN to 1.
2
On each GPOADmin service host and client, browse to the UseServerAndPortSPN in the Default.Client.Connection.config file in the Connections subdirectory of the install directory, and set the configuration value to true.
3
Restart all GPOADmin services on each modified host.
The SPN format will change to GPOADmin/SERVICE_HOST_FQDN:PORT allowing for a separate service account per service host.
Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation