Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Active Administrator 8.6 - Installation Guide

Table of Contents

Installation Considerations for Active Administrator

System requirements Server hardware requirements

Server software requirements SQL Server requirements Console requirements

Console hardware requirements Console software requirements

Audit agents requirements Workstation logon audit agents requirements Web Console requirements System Center requirements Port requirements Additional requirements User privilege requirements

Password recovery Services Audit database

Active Administrator module requirements

Home Search Certificates Security and Delegation Active Directory Health

Required permissions for Active Directory Health Active Administrator Data Services (ADS) requirements Data collectors requirements

Auditing & Alerts Group Policy Active Directory Recovery DC Management DNS Management Active Administrator Module Configuration

Active Directory Health minimum permissions

Active Directory Health module Active Directory Health Module Configuration Agents Notifications Troubleshooter

AFS service account minimum permissions Diagnostic Console minimum permissions Upgrade and compatibility Product licensing

Installing and configuring Active Administrator

Backing up your data Installing Active Administrator server Configuring the server

Applying a license file Creating a passphrase Setting the Active Administrator database Setting the Active Administrator archive database Configuring purge and archive settings Storing Active Administrator data Setting up the email server Setting up features and the owner Configuring active template delegation enforcement Configuring group policy history Configuring Active Directory backups Configuring Active Administrator users Configuring service accounts Connecting to System Center Operations Manager and Enabling SNMP Notifications Reviewing selections

Installing Active Administrator console Setting up the console

Setting up auditing on domain controllers Installing audit agents Creating alerts

Setting up workstation logon auditing

Deploying the workstation logon audit agent Enabling the default port

Using Active Administrator

Appendix: Active Administrator Server Manager

Starting the Active Administrator Server Manager Active Administrator Foundation and Data Services

SQL Full-Text Search

Web Server Configuration Managing Security

Managing the passphrase Managing file security Managing database security Recovering from a lost passphrase

Services

The Domain Administrator account provides the necessary permissions for the various Active Administrator services to operate properly.

When choosing an account, keep these requirements in mind:

•

Active Administrator Foundation service (AFS) requires an account that is a member of the Domain Admins group. For more detailed permission requirements, see Active Administrator module requirements.

•

Active Administrator Data Services (ADS) requires an account that is a member of the AA_Users group, has read access to the enterprise, and has full access on the server where the Active Directory Health Analyzer agent is installed. For more detailed permission requirements, see Active Administrator Data Services (ADS) requirements.

•

Active Administrator Advanced Auditing runs as the Local System account, regardless of the user account configured for the Active Administrator Agent service.

•

Active Administrator Agent can run under a Domain User account provided it is a local administrator account, which gives it the rights to log on as a service, log on locally and manage auditing and security log. The user account should also be a member of the AA_Admin group, which by default is located in the Local groups of the server where the ActiveAdministrator database is located. If the group is not found in this location, the settings during the initial database creation were modified and it can be found under the Users container object of Active Directory.

•

Active Administrator Agent can run under a non-domain admin user account if the following permissions are set.

To set up a non-domain admin user account

1

Create a Domain User account within Active Directory Users and Computers.

2

Use Group Policy Management console (GPMC) to edit the Default Domain Controller Group Policy Object. Give the user account User Rights to Manage auditing and security log.

3

On the target domain controllers, give the user account Read permission to the registry key: HKLM\System\CurrentControlSet\Services\Eventlog\Security.

4

After the agent is installed, verify the user account has Write permission on the folder: C:\Windows\SLAgent.


	NOTE: For more detailed instructions, see https://support.quest.com/active-administrator/kb/209446/how-to-configure-a-non-domain-admin-audit-agent-service-account.

•

Active Administrator Notification service needs to have access to the database.

Audit database

On the database server, the database installation creates two local groups that control access to the audit database.

•

AA_Admin group = users that need to be able to update the database

•

AA_User group = users that only need to run reports from the database

Active Administrator module requirements

For all Active Administrator® modules to operate properly, the Active Administrator Foundation service (AFS) requires an account that is a member of the Domain Admins group. However, you may want to customize access to each module for console users or the AFS account. This section details the permissions required for operation of each module and submodule.

•

•

•

•

Security and Delegation

•

Active Directory Health

•

Auditing & Alerts

•

•

Active Directory Recovery

•

•

•

Active Administrator Module Configuration

Home

For all Active Administrator® modules to operate properly, the Active Administrator Foundation service (AFS) requires an account that is a member of the Domain Admins group. However, you may want to customize access to each module for console users or the AFS account. The following table lists the specific permission requirements for the Home module.

Table 8. Required permissions for the Home module

Console user account

Open to all users, but some items may not be available if the user does not have the required permission.

Must have read access to the entire domain:

•

Active Directory Search

Must have the appropriate permissions on the target user account:

•

•

Unlock User Account

•

Enable/Disable User Account

Must have the appropriate permissions on the target group:

•

Add a user to a group

•

Remove a user from a group

Must have the appropriate permissions on the target computer:

•

Reset Computer Account

Open to all users.

Must be a member of the AA_User group and have read access to the domains being managed.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center