Chat now with support
Chat with Support

Active Administrator 8.7 - Installation Guide

Installation Considerations for Active Administrator Installing and configuring Active Administrator Appendix: Active Administrator Server Manager

AFS service account minimum permissions

The following table details the minimum permissions required for proper functionality of the Active Administrator Foundation Service (AFS) service account.

 
Table 29. Minimum permissions for the AFS service account submodules
AFS submodule
Minimum permissions

Account Expiration
•
Read/Write database permission
•
Read Active Directory permission

Active Templates
•
Read/Write Active Directory permission
•
Read/Write access to the Active Administrator share

Active Directory Health Reports
•
Read Active Directory permission
•
Read registry permission
•
WMI execute permission
•
Read/Write database permission
•
Read/Write access to the Active Administrator share

Active Directory Infrastructure Reports
•
Read Active Directory permission
•
Read/Write database permission
•
Read/Write access to the Active Administrator share

Alert History Report
•
Read/Write database permission
•
Read/Write access to the Active Administrator share

Alerts
•
Read/Write database permission

Archiving and Purging
•
Read/Write database permission
•
Read/Write access to the Active Administrator share

Assessment Report
•
Read Active Directory permission
•
Read/Write database permission

Audit Agent
•
Read Active Directory permission
•
Read/Write database permission
•
WMI execute permission

Audit Reports
•
Read/Write database permission
•
Read Active Directory permission

Auditing
•
Read/Write access to the Active Administrator database
•
Read/Write access to the server working directory

Cache
•
Read/Write access to the server working directory
•
Read/Write access to the Active Administrator registry key

Certificate Management
•
Read Active Directory permission
•
Read/Write database permission
•
Read/Write Active Administrator registry permission
•
Read access to SOFTWARE\Microsoft\SystemCertificates\{StoreName}\Certificates

Certificate Repository
•
Read/Write Certificate repository folder permission
•
Read database permission
•
Read registry permission

Certificate Search
•
Read Certificate repository folder permission
•
Read/Write database permission
•
Read Active Administrator registry permission

Certification report
•
Read Active Administrator registry permission
•
Read/Write database permission
•
Read access to the Active Administrator share

Conductors
•
Read/Write access to the server working directory
•
Read access to the Active Administrator registry key
•
Windows Event Log Write access

Configuration
•
Read/Write access to the server working directory
•
Read/Write access to the credentials directory
•
Read/Write access to the Active Administrator database
•
Permission to send emails
•
Read access to Active Directory domains

Configuration report
•
Read Active Administrator registry permission
•
Read/Write database permission
•
WMI execute permission

Dashboard
•
Read access to the Active Administrator database
•
Windows Event Log Write access
•
Read access to the Active Administrator registry key
•
Read access to Active Directory domains
•
Read/Write access to the server working directory

DC consistency report
•
Active Directory health reports permission
•
Remote registry access to SYSTEM\CurrentControlSet\Control\FileSystem
•
Remote registry access to SYSTEM\CurrentControlSet\Control\Lsa
•
Remote registry access to Software\Microsoft\Windows\NT\CurrentVersion\Winlogon

DCRIDInfoReport
•
Active Directory Health reports permission
•
Remote registry access to SYSTEM\CurrentControlSet\Services\NTDS\RID Values

DFSR report
•
Active Directory Health reports permission
•
Remote registry access to SYSTEM\CurrentControlSet\Services\lanmanserver\Shares

DNS Management

DNS Analyzer

DNS Event log
•
Read Active Directory permission
•
Read\Write database permission
•
WMI execute permission

DNS report
•
WMI execute permission

DNSConfiguration report
•
Active Directory Health reports permission
•
Remote registry access to SYSTEM\CurrentControlSet\Services\DNS\Parameters

DSParameters report
•
Active Directory Health reports permission
•
Remote registry access to SYSTEM\CurrentControlSet\Services\NTDS\Parameters

Event definition
•
Read/Write database permission

Group Policy
•
Read/Write Active Directory permission
•
Read/Write access to the Active Administrator share

Helpers
•
Read access to Active Directory domains
•
Read access to the Active Administrator database
•
Windows Event Log Write access
•
Read/Write access to the server working directory
•
Permission to send emails
•
Tasks permission

Inactive Accounts
•
Read/Write database permission
•
Read/Write Active Administrator registry permission
•
Read/Write Active Directory permission

Licensing
•
Read/Write access to the Active Administrator database
•
Read access to the Active Administrator registry key
•
Windows Event Log Write access

LockedOutAccounts
•
Read/Write database permission
•
Read/Write Active Directory permission
•
Read/Write Active Administrator registry permission

LogLevels report

WhiteSpace report
•
Active Directory Health reports permissions
•
Remote registry access to SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Password Reminder
•
Read Active Directory permission
•
Read/Write database permission

Recovery
•
Read/Write database permission
•
Read Active Directory permission
•
Read/Write access to the Active Administrator share

Replication Monitoring
•
Read Active Directory permission
•
Read/Write database permission

SecConfig Report

DiscSpace Report
•
Active Directory Health reports permissions
•
Remote registry access to SYSTEM\CurrentControlSet\Services\NTDS\Parameters
•
Remote registry access to SOFTWARE\Microsoft\Windows NT\CurrentVersion
•
Remote registry access to SYSTEM\CurrentControlSet\Services\lanmanserver\Shares

Security (All objects) reports
•
Read Active Directory permission
•
Read/Write database permission

Service Monitoring
•
Read/Write database permission

Site coverage report
•
Active Directory Health reports permissions
•
Remote registry access to SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Tasks
•
Read/Write access to the server working directory
•
Read/Write access to the Active Administrator database
•
Read access to the Active Administrator registry key
•
Windows Event Log Write access

TimeSync report
•
Active Directory Health reports permissions
•
Remote registry access to System\CurrentControlSet\Services\W32Time\Parameters

Trustees
•
Read access to Active Directory domains
•
Read/Write access to the Active Administrator database
•
Read/Write access to the server working directory
•
Cache permissions

User Settings
•
Read/Write access to the Active Administrator database
•
Read access to Active Directory domains
•
Read/Write access to the server working directory

Workstation Logon
•
Read access to the Active Administrator registry key
•
Read/Write access to the server working directory
•
Read/Write access to the Active Administrator database

Diagnostic Console minimum permissions

To run the Diagnostic Console, the Domain Administrator permission is recommended.

The Performance Monitor Users and Performance Log Users permissions are the minimum permissions required to collect most, but not all, Active Directory performance data on the target domain controller.

The Domain Administrator permission is needed for the Diagnostic Console to collect data and display the following critical alarms on target domain controllers:

•
Records and registration status for DNS entries
•
Percentage of disk space consumed on the system disk
•
Active Directory store database size, the amount of free space remaining, and the total size of the drive
•
Physical RAM
•
Domain controller configuration, such as Installed Software, Installed Hotfixes, and Network Adapters, on the target domain controller

 

Installing and configuring Active Administrator

Installing and configuring Active Administrator

Active Administrator has two main components: Server and Console. Install the Console component on any computer that requires it. The Server component needs to be installed on only one computer. Both the Console and Server components can be installed on the same server.

To install and configure Active Administrator, follow the steps in these sections:

•
Backing up your data
•
Installing Active Administrator server
•
Configuring the server
•
Installing Active Administrator console
•
Setting up the console
•
Setting up workstation logon auditing
•
Using Active Administrator

Backing up your data

 
* 
IMPORTANT: Prior to upgrading Active Administrator, it is highly recommended that you back up your Active Administrator database files and the folders in the Active Administrator share to avoid any loss of data. Quest Software will not be able to recover your data.

 

* 
CAUTION: It is very important to record the passphrase related to the backup files in a secure location where it can be retrieved when required. If the passphrase is lost, it will be impossible to restore and use Active Administrator backups.

Prior to upgrading Active Administrator ensure you back up the Active Administrator share, any data files, ActiveAdministratror.xml, and export the HKEY_LOCAL_MACHINE\SOFTWARE\Quest\Active Administrator registry key.

•
The Active Administrator share is located at the root on the computer where Active Administrator is installed (C:\ActiveAdministrator). The Active Administrator share contains several folders that contain information, such as settings, templates, repositories, backup files, and log files. Back up the entire Active Administrator share.
•
The Active Administrator data files are located on the named data server. To identify the data server and database file, run the Active Administrator Server Configuration report from the Active Administrator Console (Settings | Configuration Report).
•
The ActiveAdministrator.xml file is in the folder where Active Administrator server is installed. The default location is C:\Program Files\Quest\Active Administrator\Server.
•
The registry key is located at HKEY_LOCAL_MACHINE\SOFTWARE\Quest\Active Administrator.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating