Active Administrator 8.6.3 - Installation Guide

Chat now with support

Applying a license file Creating a passphrase Setting the Active Administrator database Setting the Active Administrator archive database Configuring purge and archive settings Storing Active Administrator data Setting up the email server Setting up features and the owner Configuring active template delegation enforcement Configuring group policy history Configuring Active Directory backups Configuring Active Administrator users Configuring service accounts Connecting to System Center Operations Manager and Enabling SNMP Notifications Reviewing selections

Installing Active Administrator console Setting up the console

Setting up auditing on domain controllers Installing audit agents Creating alerts

Setting up workstation logon auditing

Deploying the workstation logon audit agent Enabling the default port

Using Active Administrator

Appendix: Active Administrator Server Manager

Starting the Active Administrator Server Manager Active Administrator Foundation and Data Services

SQL Full-Text Search

Web Server Configuration Managing Security

Managing the passphrase Managing file security Managing database security Recovering from a lost passphrase

Active Directory Health

For all Active Administrator® modules to operate properly, the Active Administrator Foundation service (AFS) requires an account that is a member of the Domain Admins group. However, you may want to customize access to each module for console users or the AFS account.

NOTE:

•

To assign roles in Active Administrator, select Configuration | Role Based Access | New.

•

For details on the minimum permissions required for the Active Directory Health module, see Active Directory Health minimum permissions.

•

The Active Directory Health Analyzer agent must be upgraded to the current version.

Topics:

•

Required permissions for Active Directory Health

•

Active Administrator Data Services (ADS) requirements

•

Data collectors requirements

Required permissions for Active Directory Health

The following table lists the specific permission requirements for the Active Directory Health module.

Table 12. Required permissions for the Active Directory Health module
Submodule	Console user account	AFS account
Active Directory Health Landing Page	Must have the Active Administrator Active Directory Health Analyzer role.	Must be a member of the AA_Users group.
Analyzer	Must have the Active Administrator Active Directory Health Analyzer role.	N/A
Alerts	Must have the Active Administrator Active Directory Health Analyzer role. To manage notifications, must have the Active Administrator Active Directory Health Notification Management role.	Must be a member of the AA_Users group. Must have read/write access to the DACache folder in the Active Administrator share.
Agents	To manage agents, must have the Active Administrator Active Directory Health Agent Management role. To manage notifications, must have the Active Administrator Active Directory Health Notification Management role. to manage data collectors, must have the Active Administrator Active Directory Health Data Collector Management role. To manage alerts, must have the Active Administrator Active Directory Health Alert Management role. To manage agents, must have the Active Administrator Active Directory Health Agent Management role.	To install, edit, and remove agents, must be a member of the AA_Admins group and have full control access to the target server. To update alerts and collectors, and to manage notifications, must have read/write access to the DACache folder in the Active Administrator share. NOTE: For the specific permissions required for each data collector, see Appendix A in the Quest® Active Administrator® User Guide or online help.
Troubleshooter	Must have the Active Administrator Active Directory Health Troubleshooter role. To view reports or perform troubleshooting operations, must have WMI remote access enabled and be a member of the Distributed COM users group. To run jobs, must have full control access to the target server.	N/A
Diagnostic Console	To collect performance counter values, must be a member of the local administrator group on the target domain controller.	N/A

Active Administrator Data Services (ADS) requirements

Table 13. Required permissions for Active Administrator Data Services (ADS)
Subsystem	ADS account
Loader	Must be a member of the AA_Users group and have read access to the enterprise.
Data Collectors	See the data collector permissions for forests, domains, and sites in Appendix A of the Quest® Active Administrator® User Guide or online help.
Agent Monitor and Recovery	Must have full access on the server where the Active Directory Health Analyzer agent is installed.