Chat now with support
Chat with Support

Binary Tree Power365 Current - Help Center

Help Center Home Power365 Platform Tenant-to-Tenant Directory Sync Migration for Active Directory Release Notes Known Limitations Support

File Shares and Network Storage

What is the File Shares + Network Storage page used for?  

The File Shares + Network Storage screen allows you to ReACL File Share and Network Storage devices via a network share.

 

How is a File Share or Network Storage device added?  

To add a File Share or a Network Storage device:

  1. Select the Add icon. The File Share window appears.

  2. Enter values in the following fields:

    • UNC Path - the UNC path that will be the starting location for ReACL on the File Share computer
    • Device - The name of the Computer used to access the File Share computer. This computer must be local (same network, region, and so on) to the File Share device. This is a sAMAccountName, not an FQDN.
    • Username - The username to access the File Share device. UserPrincipalName values (user@domain.dom) or domain\username format are supported.
    • Password - the Password to credential access the File Share computer
  3. Click OK. The File Share device is added to the list.

 

What actions can be performed on File Shares and Network Storage devices?  

The following actions can be performed on File Shares and Network Storage devices by selecting the devices in the list, selecting an action from the drop-down list, and then clicking the Apply Action button.

  • ReACL

    The ReACL process updates the File Share’s domain user profiles for use by the matching target user after cutover.

    In the Job Options window, click Apply to begin the ReACL process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the ReACL Status will be displayed as Queued in the File Share table and the "Do Not Start Before" column in the File Share Computer Jobs table will be populated with the selected date.

  • Cleanup

    The Cleanup process removes the Source SIDs after the Cutover process completes.

    In the Job Options window, click Apply to begin the Cleanup process as soon as possible. To select when the process will begin check Do not start before and then enter or select a date and time. If using the Do not start before option, the Cleanup Status will be displayed as Queued in the File Share table and the "Do Not Start Before" column in the File Share Computer Jobs table will be populated with the selected date.

  • ReACL Rollback

    The ReACL Rollback process rolls back all changes made by the ReACL process. ReACL Rollback can be performed on File Share computers that have completed the ReACL process.

    In Job Options window, click Apply to begin the ReACL Rollback process as soon as possible. Check Do not start before and then enter or select a date and time when the process will begin. If using the Do not start before option, the Do Not Start Before column in the File Share Computer Jobs table will be populated with the selected date.

  • Set Share ReACL Profile

    Use the Set Share ReACL Profile action to assign a File Share ReACL profile to the selected devices.

  • View Jobs

    Use the View Jobs action to view the device jobs of the selected devices.

  • Custom Actions

    If any Custom Actions have been created for File Share, they will appear in the Actions menu.

How-To

Offline Domain Join (ODJ)

Normally, right after a Device is Cutover to a new domain VPN users can’t log in to their workstation because Windows must be able to contact the target domain to authenticate against a domain controller for that very first login. Typically, a remote user not on the VPN would need to log in to their machine first and then establish a VPN connection.

Power365 Migration for Active Directory answers this problem by building on Microsoft’s Offline Domain Join (ODJ) process to allow a workstation to join a domain without contacting a Domain Controller. This solution is achieved by first creating an ODJ file for each workstation and then taking advantage of Windows’ ability to cache credentials. If users have logged in to the target domain previously, Windows can log them in again even if they can no longer reach a domain controller by using cached credentials.

Power365 Migration for Active Directory’s ODJ process has users pre-login to the new domain before the computer needs to be Cutover so the target credentials can be cached and used for the first post-Cutover login without the need to contact a domain controller first. Then when the administrator is ready to Cutover workstations using the ODJ Action, Power365 Migration for Active Directory allows the workstation to join the new domain without having the user connect to the corporate VPN and manually join their workstation to the new domain.

The computers that the Power365 ODJ process is being run on must have network connectivity to BOTH the source and target environments at the same time sometime pre-cutover in order to have the Cache Credentials function work properly.

 

1. CREATING ODJ FILES FOR EACH WORKSTATION  

The first step in the ODJ process is for an administrator to use Microsoft’s DJOIN utility to create a provisioning file. Only the provisioning part of the DJOIN process is needed. Complete information on DJOIN can be found here.

The Provision, Domain, Machine, and Savefile parameters are required at a minimum. There is the option to control where the target machine will be created using the MachineOU parameter as in the sample shown here.

DJOIN.EXE /Provision /Domain BTADLAB.com /Machine Sales220 /Savefile “C:\Program Files\Binary Tree\Power365\Downloads\ODJ\Sales220.txt” /MACHINEOU OU=SalesComputers,OU=Sales,DC=BTADLAB,DC=COM

The file must be saved in the ODJ folder in the Repositories path that was configured in the UI.

Generating these files can be completed for all in scope workstations early in the migration process.

WARNING: Be sure to name each text file with the exact matching machine name.

 

2. CONFIGURING THE CREDENTIAL CACHE PROFILE  

The next step is to configure the existing Default Credential Cache profile with the IP address of a Target domain controller, or to create a new profile for this setting.

From the Profiles page select Credential Cache Profiles. Click on Add to create a new profile, or Edit to modify an existing profile. If you choose to use the Default profile, you must edit it to include a Target DC IP address.

  • The Target Domain Controller Ping Interval setting determines how long the script will sleep before pinging the DC again.
  • The Timeout Before Job Failure setting determines the Credential Cache app timeout value that will be used for the job once downloaded to the agent managed machine.
  • The Timeout For User Credential setting determines how long the user is presented with a dialog box to enter their target domain credentials.

 

3. CACHE CREDENTIALS JOBS  

Now that a profile has been configured with a target DC IP address, we can assign a Cache Credentials job to each in scope workstation.

In the Devices list, select one or more Computers. Select Cache Credentials from the Actions dropdown menu and click the Apply Action button. The Credential Cache Options box appears.

Select a Credential Cache Profile.

A date and time for the Cache Credentials job can be chosen to run the job at a later time. This date/time combination represents the earliest time that this job could run.

If a date/time is not chosen, this job will run on the workstation the next time the agent checks for jobs.

The Devices list will reflect a status of "Queued". When the job is collected by the agent the status will change to "In Progress", and then finally it will transition to a status of "Completed" or "Failed".

On the workstation side, when the Cache Credentials Job is received, the user will be prompted to enter their target credentials. Below is an example of what the user will see when the Cache Credential job runs:

Figure 1: Enter Cutover Credentials

 

4. REACL  

Following Cache Credentials the next recommended step is the ReACL process. The ReACL process can be run repeatedly as needed before ODJ, but it is suggested to be run at least once right after the Cache Credentials process is run.

In the Devices list, select one or more Computers. Select ReACL from the Actions dropdown menu and click the Apply Action button.

The Job Options box appears. A specific date/time combination can be chosen for when to run the job, or just click Apply Action to have this job received by the workstations during their next check for jobs.

 

5. OFFLINE DOMAIN JOIN JOB  

The final step is the actual Offline Domain Join job itself. This is similar to the Cutover process used for machines that are directly connected to the network.

WARNING: Do not perform the Cutover process on Offline Domain Join workstations. The Offline Domain Join process takes the place of Cutover for workstations connecting via VPN.

In the Devices list, select one or more Computers. Select Offline Domain Join from the Actions dropdown menu and click the Apply Action button.

The Job Options box appears. A specific date/time combination can be chosen for when to run the job, or just click Apply Action to have this job received by the workstations during their next check for jobs.

WARNING: The Offline Domain Join (Job Scheduling Options dialog box) start date and time must be set AFTER the Cache Credentials job (Cache Credential Options dialog box) start date and time.

The Offline Domain Join process does not support rollback.

Custom Action Example

Scenario: The administrator wants to download the Get-DiskSpace.ps1 file on selected workstations.

Steps:

  1. Copy the Get-DiskSpace.ps1 file into the file location of the configured Custom Downloads Repository.
  2. On the Actions screen, click the New button under the Actions table.
  3. Add a Custom Action named "Get-Diskspace". The Action Display Name is how the option will appear in the Actions menu. Select the "Computer" Action Target so the menu option will appear in the Actions menu on the Computer Actions screen.

    Add a Custom Action screen

  4. Click the New button under the Tasks table.
  5. Select the "Download File" Task Type and enter the File Name. The full path to the file should not be entered.

    Add a Custom Task screen

    File Download screen

  6. Select the task, select "Get-Diskspace" from the Select Action drop-down menu and click the Add To button.

    Ensure the Action is active. The action can be expanded to view the associated Task.

    Expanded Action displaying Task

  7. On the Devices + Servers screen, select the devices and then select the new "Get Disk Space" option from the Actions menu. When the new download job is run successfully against a machine, the Get-DiskSpace.ps1 file will reside locally on disk at c:\Program Files (x86)\Binary Tree\P365ActiveDirectoryAgent\Downloads\.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating