Active Administrator 8.7 - User Guide

Defining role-based access

Defining role-based access

Set up permissions to restrict access to the various modules in Active Administrator. Permissions are evaluated when a user starts Active Administrator. If the user does not have permission to an Active Administrator module, that module does not display. If the user does not have permission to any modules, Active Administrator Console shuts down. All modifications to the permissions are audited by the Active Administrator audit agent.

IMPORTANT: If Active Administrator cannot access the Active Administrator database to validate permissions, the user will have access to all modules in the console.

Topics 

•	Adding a new user or group to Active Administrator

Refer to the following table to determine the access to give to users.

 

Table 110. Role-based access

Role	Area
Full Control	Full access to all modules in Active Administrator. Clear the check box to configure individual roles.
Active Templates	Dashboard Search (Search only) Delegation Status Active Templates Tasks Search quick task
Alert Editor	Dashboard Search (Search only) Alerts Tasks Search quick task
Alert Viewer	Dashboard Search (Search only) Alerts (Read only) Tasks Search quick task
Audit Report Management	Dashboard Search (Search only) Audit Reports Archives Tasks Search quick task
Audit Report Viewer	Dashboard Search (Search only) Audit Reports (Read only but can add tags and comments) Archives (Read only but can add tags and comments) Tasks Search quick task
Domain Controller Management	Dashboard Search (Search only) DC Status Services Performance Event Logs Tasks Search quick task
Group Policy History	Dashboard Search (Search only) Group Policy History Task Search quick task
Group Policy Object Management	Dashboard Search (Search only) Group Policy Objects GPO By Container GPO Modeling GPO Backup Troubleshooting Tasks Search quick task
Group Policy Repository	Dashboard Search (Search only) GPO Repository Tasks Search quick task
Password Policy	Dashboard Search (Search only) Password Policies Tasks Search quick task
Recovery	Dashboard Search (Search only) Object Recovery Tasks Search quick task
Security	Dashboard Search (Search and Edit) User Logon Activity Delegation Status Tasks All quick tasks items
Site Management	Dashboard Search (Search only) Active Directory Sites Replication Monitoring Replication Analyzer Tasks Search quick task
Trusts Management	Dashboard Search (Search only) Active Directory Trusts Tasks Search quick task
DNS Management	Full access to the DNS module.
Certificate Management	Full access to the Certificate module. NOTE: If the Certificate Management role is selected, the Certificate Manager Viewer role is also selected and the check box is disabled. Clear the Certificate Management check box to limit the user to read-only access.
Certificate Management Viewer	Read-only access to the Certificate module.
Active Directory Health Alert Viewer	Read-only access to Active Directory Health Analyzer alerts.
Active Directory Health Analyzer	Read-only access to the Active Directory Health Analyzer module. NOTE: Must be selected to configure other Active Directory Health Analyzer roles.
Azure Active Directory Connect	Full access to Active Directory Health | Active Directory Connect.
Active Directory Health Agent Management	Access to Active Directory Health Analyzer | Agents to install, remove, edit, and start/stop/restart agents. If disabled, user can view agent properties and workload details.
Active Directory Health Alert Management	Full access to Active Directory Health Analyzer | Agents | Alert Settings to edit settings for alerts. If disabled, user can view, but not edit alert settings.
Active Directory Health Data Collector Management	Full access to Active Directory Health Analyzer | Agents | Data Collectors to edit settings for data collectors. If disabled, user can view, but not edit data collector settings.
Active Directory Health Notification Management	Full access to managing Active Directory Health Analyzer notifications.
Active Directory Health Troubleshooter	Full access to Active Directory Health | Troubleshooter. If disabled, user cannot run reports, run jobs, delete reports and jobs results, clear history or replicate connections between domain controllers in replication view. User can open existing reports from history, view previous job results, and view generated replication views.
Active Directory Health Check Management	Full access to the Active Directory Health Check module.
Active Directory Health Check Viewer	Read-only access to the Active Directory Health Check module.
User Provisioning	Full access to user provisioning actions. NOTE: By default, users who hold the Full Access role are automatically granted the User Provisioning role.
User Provisioning read-only access	Read-only access to user provisioning. NOTE: By default, all users are granted the User Provisioning read-only access role.

To manage role-based access

1	Select Configuration | Role Based Access.

NOTE: To configure individual roles, you must clear the Full Control check box. To configure individual Active Directory Health Analyzer roles, you must select the Active Directory Health Analyzer check box.

2	Use the tool bar to manage role-based access.

 

Table 111. Role-based access tool bar

Option	Description
Refresh	Refresh the list.
New	Click to add users and groups to the list. See Adding a new user or group to Active Administrator.
Save	Save any changes.
Delete	Click to remove selected users and groups from the list.
Select All Permissions	Select all modules for the selected user or group.
Clear All Permissions	Clear all modules for the selected user.

Adding a new user or group to Active Administrator

Adding a new user or group to Active Administrator

To add a new user or group to Active Administrator

1	Select Configuration | Role Based Access.

2	Click New.

3	Search for users or groups.

4	Add optional comments.

5	By default, users and groups have access to the listed permissions in Active Administrator®. To deny access, clear the check box.

▪	To select all, click Select All Permissions.

▪	To clear all, click Clear All Permissions.

6	Click Save.

Setting email server options

Setting email server options

To set email server options

1	Select Configuration | Email Settings.

2	Select to use either SMTP or Exchange Online.

Email Option	Procedure
SMTP	1 Type the name of the SMTP server that sends the alert emails. 2 Type the number of the TCP/IP port on which the SMTP server is listening. 3 Type the User name and password required to authenticate the SMTP server. 4 Type the email address that to appear in the From box of the alert email. By entering something meaningful, you can use the From box to filter your email. By default, the email of the current user displays.
Exchange Online	1 Type the Exchange service URL, the tenant ID, and the Application ID. 2 Type the mailbox name and select the required certificate for authentication. NOTE:   • The certificate must be previously uploaded to Azure Active Directory App certificates & secrets. • The application ID, tenant ID, tenant name, certificate, and certificate password are set when you register Active Administrator to use Office 365 Exchange Online through Azure Active Directory. See Appendix: Registering Active Administrator for Office 365 Exchange Online.

3	Choose a format for the email.

4	Click Test Settings to verify the values.

5	Click Save.

Configuring SCOM and SNMP Settings

Configuring SCOM and SNMP Settings

If you have a license for the Active Directory Health module and are using Microsoft® System Center Operations Manager (SCOM), you can deploy the Quest® Active Administrator® management pack, which establishes a connection to SCOM. If you are using an SNMP manager, you can configure the integration from the Active Administrator console. Once an alert manager has been configured, Active Directory Health alerts from the Active Directory Health Analyzer agent are displayed in the Operations Manager Monitoring pane under the Quest Active Administrator folder and in the SNMP Manager.

 

NOTE: Only System Center 2016 Operations Manager is supported. NOTE: Only SNMP management software capable of TRAP v2 notifications processing is supported. NOTE: After you complete the configuration, you can edit the System Center Operations Manager Notification to configure which Active Directory Health Analyzer alerts to push to SCOM or an SNMP manager. See Pushing alerts to System Center Operations Manager and SNMP managers.

To configure Systems Center Operations Manager and SNMP integration

1	Select Configuration | SCOM and SNMP Settings.

2	Optionally, select Forward alert events to SCOM server to forward alert events and to deploy the Quest Active Administrator management pack to the specified SCOM management server.

Type the name of the SCOM management server.

Type or browse for an account with SCOM administrator rights, and type the password.

 

NOTE: The account must be a member of the SCOM Administrator group and a member of the local Administrators group on the computer where Active Administrator Server is installed.

To test the SCOM connection, click Test Settings.

3	Optionally, select Enable SNMP notification and enter the IP address of the SNMP notification target computer.

To test the SNMP connection, click Test Settings.

NOTE: The SNMP notification target computer must be equipped with SNMP management software capable of TRAP v2 notifications processing.

4	Click Save.