Active Administrator 8.6.3 - Installation Guide

Configuring Active Directory backups

Administrators can select a domain that contains Windows Server domain controllers and back up Active Directory user and group objects in that domain. When a situation occurs that requires a user or group object to be restored, administrators can select the object from a list and restore either the object with all the attributes it possessed when it was backed up, or only attributes the administrator selects. In the case of an organizational unit object, administrators have the option of either restoring all objects it contains or all objects it contains of a particular type.

IMPORTANT: Active Administrator® restores only selected user, group, and organizational unit (OU) objects, and their attributes from the backup file. If you require a backup file that restores Active Directory in its entirety, we recommend that you use an Active Directory disaster recovery product.

The Active Administrator AD Object Backup Service backs up the listed domains based on the settings in the Run backup boxes. If you are using Windows Server, Yes displays in the Supports Password Recovery column.

IMPORTANT: If you choose to disable Password Recovery, passwords are not backed up. If you restore a backup that does not contain passwords, you must unjoin, and then rejoin computer accounts.

By default, an Active Directory backup creates temporary files during processing and stores the backup files when the backup is complete under the folder C:\ActiveAdministrator\ADBackups\DOMAIN_domainname (where domainname is the fully qualified name of the domain being backed up). You can specify the folder where the temporary files are processed and where the backup files are stored.

NOTE: After you complete the configuration wizard, you can use the Active Administrator Console to manage Active Directory backups by selecting Configuration | Recovery Settings.

NOTE: If there are existing backup files in the existing share, you must move them manually. Only newly created backup files are stored to the new share path.

Configuring Active Administrator users

Active Administrator® users have unrestricted access to the Active Administrator Console. By default, the user installing and running the configuration wizard is automatically considered an Active Administrator user.

NOTE: Upon initial installation, the Domain Admins group is added automatically to the list. If you remove the Domain Admins group from the list and do not add any groups or users, the Domain Admins group is added automatically the next time you start the configuration wizard. After you complete the configuration wizard, you can use the Active Administrator Console to manage users by selecting Configuration | Role Based Access.

Configuring service accounts

The Domain Administrator account provides the necessary permissions for the Active Administrator® foundation and notification services to operate properly.

NOTE: After you complete the configuration wizard, use the AA Server Manager to manage service account logons.

Connecting to System Center Operations Manager and Enabling SNMP Notifications

If you have a license for the Active Directory Health module and are using Microsoft® System Center Operations Manager (SCOM), you can choose to deploy the Quest® Active Administrator® management pack, which establishes a connection to SCOM and enables Active Directory Health alerts from the Active Directory Health Analyzer agent to appear in the Operations Manager Monitoring pane under the Quest Active Administrator folder. You can also enable SNMP alert notifications.

NOTE: Only System Center 2016 Operations Manager is supported. NOTE: After you complete the configuration wizard, if you need to make any changes or if you skip this page, you can configure the SCOM connection and SNMP alert notifications in the Active Administrator console (Configuration | SCOM and SNMP Settings). You also can restart the configuration wizard (Start | AA Configuration Wizard). Page through the wizard until you reach the System Center Operations Manager and SNMP Notification page. NOTE: After you complete the configuration wizard, you can edit the System Center Operations Manager and SNMP Notification to configure which Active Directory Health Analyzer alerts to push to SCOM and SNMP.

NOTE: If the check box is not selected, the Remove management pack check box is visible. Use this check box to remove the management pack.

NOTE: The account must be a member of the SCOM Administrator group.

NOTE: The SNMP notification target computer must be equipped with SNMP management software capable of TRAP v2 notifications processing.