Tchater maintenant avec le support
Tchattez avec un ingénieur du support

Active Administrator 8.6.3 - Release Notes

Additional requirements

•
Remote Procedure Call (RPC) must be open between the AFS Server and the target.
•
When installing the audit agent on a member server instead of a domain controller, the following inbound firewall exceptions for Windows Management Instrumentation must be enabled:
•
ASync-In
•
DCOM-In
•
WMI-In
•
If you are using the Certificate Management feature, Remote Registry Service must be enabled on all Windows computers on which certificates are managed.
•
If you want to access the DNS event logs in Active Administrator, the following inbound firewall exceptions are required on each DNS server:
•
COM+ Network Access (DCOM-In)
•
Remote Event Log Management (NP-In)
•
Remote Event Log Management (RPC)
•
Remote Event Log Management (RPC-EPMAP)
•
HTTP Port 8080 must be open on the computer running the Web Server.
 
* 
IMPORTANT: It is recommended that you only use the Web Console internal to the network. If you want to use the Web Console externally, use HyperText Transfer Protocol Secure (HTTPS) by enabling Secure Sockets Layer (SSL). You need to select a certificate, which must be installed in the Personal or My store on the local computer. The default port is 9443. See the Web Console User Guide for more instructions on configuring the Web Server.

User privilege requirements

•
To install Active Administrator, a user must hold administrative rights on the local system and the SQL instance that will host the Active Administrator database.
•
To use Active Administrator, a user must hold administrative rights on both the local system and the domain, and be a member of the AA_Admin database access group, which is created during the installation process.
Password recovery

Active Administrator can restore passwords when you restore accounts that were deleted. To enable password recovery, a minor modification is made to the Schema. To be able to modify the Schema, you must use an account that is a member of the Schema Admins group.

Services

The Domain Administrator account provides the necessary permissions for the various Active Administrator services to operate properly.

When choosing an account, keep these requirements in mind:

•
Active Administrator Foundation service (AFS) requires an account that is a member of the Domain Admins group. For more detailed permission requirements, see Active Administrator module requirements.
•
Active Administrator Data Services (ADS) requires an account that is a member of the AA_Users group, has read access to the enterprise, and has full access on the server where the Active Directory Health Analyzer agent is installed. For more detailed permission requirements, see Active Administrator Data Services (ADS) requirements.
•
Active Administrator Advanced Auditing runs as the Local System account, regardless of the user account configured for the Active Administrator Agent service.
•
Active Administrator Agent can run under a Domain User account provided it is a local administrator account, which gives it the rights to log on as a service, log on locally and manage auditing and security log. The user account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and it can be found under the Users container object of Active Directory.
•
Active Administrator Agent can run under a non-domain admin user account if the following permissions are set.
To set up a non-domain admin user account
1
Create a Domain User account within Active Directory Users and Computers.
2
Use Group Policy Management console (GPMC) to edit the Default Domain Controller Group Policy Object. Give the user account User Rights to Manage auditing and security log.
3
On the target domain controllers, give the user account Read permission to the registry key: HKLM\System\CurrentControlSet\Services\Eventlog\Security.
4
After the agent is installed, verify the user account has Write permission on the folder: C:\Windows\SLAgent.
* 
NOTE: For more detailed instructions, see https://support.quest.com/active-administrator/kb/209446/how-to-configure-a-non-domain-admin-audit-agent-service-account.
•
Active Administrator Notification service needs to have access to the database.
Audit database

On the database server, the database installation creates two local groups that control access to the audit database.

•
AA_Admin group = users that need to be able to update the database
•
AA_User group = users that only need to run reports from the database

 

Active Administrator module requirements

For all Active Administrator® modules to operate properly, the Active Administrator Foundation service (AFS) requires an account that is a member of the Domain Admins group. However, you may want to customize access to each module for console users or the AFS account. See the Quest® Active Administrator® 8.6.3 Install Guide for the specific permissions required for operation of each module and submodule.

Upgrade and compatibility

Note the following when upgrading Active Administrator.

•
The GPO repository cannot include GPOs with unpublished changes. To ensure no edits are lost, you must publish the changes or check out the GPOs prior to installing Active Administrator.
•
Active Administrator 8.6.3 supports in-place upgrades from Active Administrator versions 8.4,8.5 and 8.6. To perform an in-place upgrade to Active Administrator 8.6.3 from a version of Active Administrator that is earlier than 8.4, you must first upgrade to Active Administrator 8.4.
•
Installing Active Administrator 8.6.3 onto an existing Active Administrator installation will result in the removal of the earlier version. Active Administrator databases, both live and archive databases, will be upgraded automatically to version 8.6.3.
•
A database upgraded by Active Administrator 8.6.3 cannot be used by previous versions and the database upgrade cannot be rolled back.
•
Data within the Active Administrator share can be used by Active Administrator 8.6.3.
•
If you use group policy to deploy the Workstation Logon Auditing Agents (WLAA), the 8.6.3 installation process will not update the agent on the user workstations. You must replace the install package at the software distribution share with the 8.6.3 version. Computers will upgrade to the Active Administrator 8.6.3 WLAA the next time they are started.
•
The Active Directory Health features available in Active Administrator 8.6.3 each require a separate license. If you do not have a license file to apply, the module does not appear in Active Administrator. You will see the Certificate Management feature listed under the Configuration module, but when you select the feature, a warning displays that a license is required.
•
The Active Directory Health Analyzer agent must be upgraded to the current version.
Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation