Active Administrator 8.6.2 - Installation Guide

Chat now with support

Applying a license file Creating a passphrase Setting the Active Administrator database Setting the Active Administrator archive database Configuring purge and archive settings Storing Active Administrator data Setting up the email server Setting up features and the owner Configuring active template delegation enforcement Configuring group policy history Configuring Active Directory backups Configuring Active Administrator users Configuring service accounts Connecting to System Center Operations Manager and Enabling SNMP Notifications Reviewing selections

Installing Active Administrator console Setting up the console

Setting up auditing on domain controllers Installing audit agents Creating alerts

Setting up workstation logon auditing

Deploying the workstation logon audit agent Enabling the default port

Using Active Administrator

Appendix: Active Administrator Server Manager

Starting the Active Administrator Server Manager Active Administrator Foundation and Data Services

SQL Full-Text Search

Web Server Configuration Managing Security

Managing the passphrase Managing file security Managing database security Recovering from a lost passphrase

Configuring Active Directory backups

Administrators can select a domain that contains Windows Server domain controllers and back up Active Directory user and group objects in that domain. When a situation occurs that requires a user or group object to be restored, administrators can select the object from a list and restore either the object with all the attributes it possessed when it was backed up, or only attributes the administrator selects. In the case of an organizational unit object, administrators have the option of either restoring all objects it contains or all objects it contains of a particular type.


	IMPORTANT: Active Administrator® restores only selected user, group, and organizational unit (OU) objects, and their attributes from the backup file. If you require a backup file that restores Active Directory in its entirety, we recommend that you use an Active Directory disaster recovery product.

The Active Administrator AD Object Backup Service backs up the listed domains based on the settings in the Run backup boxes. If you are using Windows Server, Yes displays in the Supports Password Recovery column.


	IMPORTANT: If you choose to disable Password Recovery, passwords are not backed up. If you restore a backup that does not contain passwords, you must unjoin, and then rejoin computer accounts.

By default, an Active Directory backup creates temporary files during processing and stores the backup files when the backup is complete under the folder C:\ActiveAdministrator\ADBackups\DOMAIN_domainname (where domainname is the fully qualified name of the domain being backed up). You can specify the folder where the temporary files are processed and where the backup files are stored.


	NOTE: After you complete the configuration wizard, you can use the Active Administrator Console to manage Active Directory backups by selecting Configuration \| Recovery Settings.

To configure Active Directory backups

Add any additional domains.

To add domains

Click Add Domain.

In the Domain box, type a domain name, or browse to locate a domain.

Specify the domain controller to perform the backup. By default, Active Administrator uses a domain controller automatically selected by Active Directory. You can browse to choose a different domain controller.

Click OK.

Password recovery is enabled by default. If you disable password recovery, passwords will not be backed up. When you restore the backup, you will need to unjoin, and then rejoin the computer accounts.

To disable password recovery

Select the domain controller.

Click Password Recovery.

Click Yes.

By default, backups occur twice a day at 6:00 A.M. and 6:00 P.M.

To change the frequency

Select to run the backup Every Day, Twice a Day, or Weekly in the Run backup box.

Select the day of the week or time(s) from the lists.

Change the folder where temporary backup files are processed, if desired.

To change the folder where temporary backup files are processed

Select the Override the default temporary folder check box.

Browse to locate or create a folder.

Click OK.

Change the folder where backup files are stored, if desired.


	NOTE: If there are existing backup files in the existing share, you must move them manually. Only newly created backup files are stored to the new share path.

To change the folder where backup files are stored

Select the Override AD Backup share path check box.

Browse to locate or create a folder.

Click OK.

Click Next. See Configuring Active Administrator users.

Configuring Active Administrator users

Active Administrator® users have unrestricted access to the Active Administrator Console. By default, the user installing and running the configuration wizard is automatically considered an Active Administrator user.


	NOTE: Upon initial installation, the Domain Admins group is added automatically to the list. If you remove the Domain Admins group from the list and do not add any groups or users, the Domain Admins group is added automatically the next time you start the configuration wizard. After you complete the configuration wizard, you can use the Active Administrator Console to manage users by selecting Configuration \| Role Based Access.

To configure Active Administrator users

To add additional users, click Add, find and select users, click OK.

Click Next. See Configuring service accounts.

Configuring service accounts

The Domain Administrator account provides the necessary permissions for the Active Administrator® foundation and notification services to operate properly.


	NOTE: After you complete the configuration wizard, use the AA Server Manager to manage service account logons.

To configure service accounts

Type a name for a group/user with domain administrator rights, or browse to locate a group/user.

Type the account password.

The default service port number is 15600. To change the port number, type a value.

To use the same account for the notification service, select the check box. Otherwise, type or browse for an account with domain administrator rights, and type the password.

Click Next.

If you have a license for the Active Directory Health module, see Connecting to System Center Operations Manager and Enabling SNMP Notifications. Otherwise, see Reviewing selections.

Connecting to System Center Operations Manager and Enabling SNMP Notifications

If you have a license for the Active Directory Health module and are using Microsoft® System Center Operations Manager (SCOM), you can choose to deploy the Quest® Active Administrator® management pack, which establishes a connection to SCOM and enables Active Directory Health alerts from the Active Directory Health Analyzer agent to appear in the Operations Manager Monitoring pane under the Quest Active Administrator folder. You can also enable SNMP alert notifications.


	NOTE: Only System Center 2016 Operations Manager is supported. NOTE: After you complete the configuration wizard, if you need to make any changes or if you skip this page, you can configure the SCOM connection and SNMP alert notifications in the Active Administrator console (Configuration \| SCOM and SNMP Settings). You also can restart the configuration wizard (Start \| AA Configuration Wizard). Page through the wizard until you reach the System Center Operations Manager and SNMP Notification page. NOTE: After you complete the configuration wizard, you can edit the System Center Operations Manager and SNMP Notification to configure which Active Directory Health Analyzer alerts to push to SCOM and SNMP.