Migrator Pro for Active Directory 20.11.1 - Requirements and Installation Guide

Section 2. Directory Sync Pro Prerequisites

2.1 Supported Environments

The following is a list of supported and unsupported environments. If implementing directory synchronization between two Active Directory environments, you will need a Binary Tree Windows Server and an SQL Server database server.

NTLM Authentication is required for the product to function. NTLM Authentication options are typically controlled via Group Policy. These three settings should be verified:

• Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers

  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers

  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  • The RestrictSendingNTLMTraffic key, with DWORD value will be present.  If the key is missing, then this setting is not being leveraged.  If the key is set to 2, the “deny all” option has been set to restrict all out going NTLM Traffic.  If the key is set to 1, the “audit all” option has been set, which will only log when outgoing NTLM traffic is detected.  If the key is set to 0, then “allow all” is configured and there are not restrictions on sending NTLM traffic in place.

• Network security: Restrict NTLM: Incoming NTLM traffic

  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic

  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  • The RestrictReceivingNTLMTraffic key, with a DWORD value will be present.  If the key is missing, then this setting is not being leveraged.  If the key is set to 2, the “deny all” option has been set to restrict all incoming NTLM Traffic.  If the key is set to 1, the “audit all” option has been set, which will only log when Incoming NTLM traffic is detected.  If the key is set to 0, then “allow all” is configured and there are not restrictions on receiving NTLM traffic in place.

• Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication
  This allows for exclusions from the two policies below for a computer

  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication

  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  • The ClientAllowedNTLMServers key, with REG_MULTI_SZ values will be present.  If the key present, but is empty, there are no allowed exceptions.  If they key is present, and lists servers, these are the servers that allow NTLM communication to.  If the key is missing, then this setting is not being leveraged.

2.1 Supported Environments

The following is a list of supported and unsupported environments. If implementing directory synchronization between two Active Directory environments, you will need a Binary Tree Windows Server and an SQL Server database server.

NTLM Authentication is required for the product to function. NTLM Authentication options are typically controlled via Group Policy. These three settings should be verified:

• Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers

  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers

  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  • The RestrictSendingNTLMTraffic key, with DWORD value will be present.  If the key is missing, then this setting is not being leveraged.  If the key is set to 2, the “deny all” option has been set to restrict all out going NTLM Traffic.  If the key is set to 1, the “audit all” option has been set, which will only log when outgoing NTLM traffic is detected.  If the key is set to 0, then “allow all” is configured and there are not restrictions on sending NTLM traffic in place.

• Network security: Restrict NTLM: Incoming NTLM traffic

  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic

  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  • The RestrictReceivingNTLMTraffic key, with a DWORD value will be present.  If the key is missing, then this setting is not being leveraged.  If the key is set to 2, the “deny all” option has been set to restrict all incoming NTLM Traffic.  If the key is set to 1, the “audit all” option has been set, which will only log when Incoming NTLM traffic is detected.  If the key is set to 0, then “allow all” is configured and there are not restrictions on receiving NTLM traffic in place.

• Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication
  This allows for exclusions from the two policies below for a computer

  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication

  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  • The ClientAllowedNTLMServers key, with REG_MULTI_SZ values will be present.  If the key present, but is empty, there are no allowed exceptions.  If they key is present, and lists servers, these are the servers that allow NTLM communication to.  If the key is missing, then this setting is not being leveraged.

2.2 Binary Tree Windows Server Requirements

2.1 Supported Environments

The following is a list of supported and unsupported environments. If implementing directory synchronization between two Active Directory environments, you will need a Binary Tree Windows Server and an SQL Server database server.

NTLM Authentication is required for the product to function. NTLM Authentication options are typically controlled via Group Policy. These three settings should be verified:

• Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers

  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers

  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  • The RestrictSendingNTLMTraffic key, with DWORD value will be present.  If the key is missing, then this setting is not being leveraged.  If the key is set to 2, the “deny all” option has been set to restrict all out going NTLM Traffic.  If the key is set to 1, the “audit all” option has been set, which will only log when outgoing NTLM traffic is detected.  If the key is set to 0, then “allow all” is configured and there are not restrictions on sending NTLM traffic in place.

• Network security: Restrict NTLM: Incoming NTLM traffic

  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic

  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  • The RestrictReceivingNTLMTraffic key, with a DWORD value will be present.  If the key is missing, then this setting is not being leveraged.  If the key is set to 2, the “deny all” option has been set to restrict all incoming NTLM Traffic.  If the key is set to 1, the “audit all” option has been set, which will only log when Incoming NTLM traffic is detected.  If the key is set to 0, then “allow all” is configured and there are not restrictions on receiving NTLM traffic in place.

• Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication
  This allows for exclusions from the two policies below for a computer

  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication

  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  • The ClientAllowedNTLMServers key, with REG_MULTI_SZ values will be present.  If the key present, but is empty, there are no allowed exceptions.  If they key is present, and lists servers, these are the servers that allow NTLM communication to.  If the key is missing, then this setting is not being leveraged.

2.3 SQL Server Database Requirements

• The IP address and either the default SQL port (1433) or an alternate port must be open to all Binary Tree servers.

• The ability to create and modify tables in the Dirsync database on the SQL Server database server.

• It is strongly recommended that the SQL Server database server is dedicated to SQL Server. This server can host other SQL databases, but should serve no other purpose than being a SQL Server database server.

• SQL Server must be configured using Mixed Mode authentication.

• Using the default system administrator SQL Server login account is not recommended. A Directory Sync SQL Server login account should be created. This account must have sysadmin and database owner rights to create the Dirsync database. The sysadmin right can be removed from this account once the install is complete.

• If using a Remote Named Instance of SQL Server:

The incoming firewall rules on the machine that hosts the SQL Server instance must be modified.

Using the SQL default of dynamic ports for named instances:

1. Create an inbound firewall “Program” rule whose program path is the named SQL database engine (ex: %ProgramFiles%\Microsoft SQL Server\MSSQL14.<INSTANCE-NAME>\MSSQL\Binn\sqlservr.exe)

2. Create an inbound firewall “Port” rule for UDP port 1434.

3. The “SQL Server Browser” must be running.

Alternatively, you can setup a fixed port for the SQL instance following these instructions.