Chat now with support
Chat with Support

GPOADmin 5.20 - Quick Start Guide

Using the database upgrade script

GPOADmin upgrade scripts are located in the Database Scripts sub-directory in the install directory. The database upgrade script for each GPOADmin version is in a sub-directory for that version.

The upgrade scripts are run based on the following:

•
GPOADmin determines if an upgrade is required by checking the internal database version to that of the current database in use.
•
If an upgrade is required, GPOADmin searches for all upgrade scripts with a version greater than the current database version using the pattern "GPOADmin_*_Upgrade.sql".
•
For every upgrade script found, the upgrade process executes the script and then requests the value of the property "GPOADmin Version" from the current database.
•
This process is repeated until the database version currently in use, matches the internal data version of the product. The scripts are processed sequentially from oldest to newest.

If required, you can manually upgrade the GPOADmin database.

To manually upgrade the GPOADmin database
1
Determine the version of the database currently in use by looking at the extended properties of the database in SQL Management Studio.
2
Expand the Database Scripts sub directory in the install directory.
3
Open the directory of the next higher version.
4
Change all instances of [GPOADmin] to the name of the existing database.
5
Execute the upgrade script in the directory.
6
Repeat steps 1 to 4 until the database is fully upgraded.
For example:
To upgrade from GPOADmin 5.19 RTM to 5.20
1
After installing GPOADmin 5.20, expand the “Database Scripts” sub directory in the install directory.
2
Open the 5.20.0.0 directory and run the script.
To upgrade from GPOADmin 5.18 RTM to 5.20
1
After installing GPOADmin 5.20, expand the “Database Scripts” sub directory in the install directory.
2
Open the 5.18.1.0 directory and run the script.
3
Open the 5.18.2.0 directory and run the script.
4
Open the 5.19.0.0 directory and run the script.
5
Open the 5.20.0.0 directory and run the script.
To upgrade from GPOADmin 5.18 Update 1 to 5.20
1
After installing GPOADmin 5.20, expand the “Database Scripts” sub directory in the install directory.
2
Open the 5.18.2.0 directory and run the script.
3
Open the 5.19.0.0 directory and run the script.
4
Open the 5.20.0.0 directory and run the script.
To upgrade from GPOADmin 5.18 Update 2 to 5.20
1
After installing GPOADmin 5.20, expand the “Database Scripts” sub directory in the install directory.
2
Open the 5.19.0.0 directory and run the script.
3
Open the 5.20.0.0 directory and run the script.

Configuring the GPOADmin Server

* 
NOTE: To run the Server Configuration Wizard, you must logon with an account that is a member of the Enterprise Administrators group or the GPOADmin Service Account.

The Version Control server must be configured before users can connect to the Version Control system.

To configure the GPOADmin Server
1
Run All Programs | Quest | GPOADmin from the Start menu.
2
In the GPOADmin console, right-click the GPOADmin node and select Connect.
3
In the Connect to Server dialog box click Connect to connect with the current logged on user credentials or select the down arrow in the Connect button and select Connect As to enter new credentials (domain\user and password).
4
To save the credentials, select the Remember my password check box and click OK.
5
In the Select a Configuration Store dialog, select Active Directory, AD LDS, or SQL Server for your configuration storage location.
* 
NOTE: Configuration Store Selection

The best practice is to use AD LDS as the configuration store. However, in large environments, SQL server is the recommended option. Quest uses the following criteria to define large environments:

•
Domains with more than 500 registered objects that run searches on a regular basis.
•
More than 500 registered containers.
•
Containers with objects nested more than 3 levels deep.

These are guidelines and should not be considered as an exhaustive list.

* 
IMPORTANT: Ensure that you are following the minimum permissions. The listed permissions help to secure the database by limiting the access to only the required accounts.
a
If you select Active Directory, select the Domain Controller (DC) to be the Version Control server, and click Next.
Any DC in any domain of the selected forest can be specified as the primary version control server. This server can be thought of as another FSMO role in the Microsoft sense (such as Schema master, PDC Emulator, and RID master).
GPOADmin is a directory-enabled application and all its application information is stored in the configuration container of Active Directory. Because of how the information is stored, all information is automatically replicated to all other DCs. However, the primary version control server is the authoritative source for all version control actions. If it goes offline, users cannot perform actions such as check-in a desired group policy object change until the problem has been rectified.
b
If you select AD LDS, enter the NetBIOS name of the computer you are installing to and the port number in the format: server_name:port, and click Next.
For example, gpoadmin_svr: 389.
* 
NOTE: The username/port/server (but not password) will be cached, so the next time you open the console you will not need to enter this information.
c
If you select SQL Server, choose the required SQL server, enter a name for the database, select the authentication method to access the server.
To connect as the current user, select NT Authentication.
Select the level of encryption for the connection. When enabled, SQL Server uses TLS encryption for data sent between the client and server.
* 
NOTE: When using SQL as the Configuration or Backup store with GPOADmin, TLS 1.2 remains a requirement since SQL Server satellite services require TLS 1.2 to be enabled. For more information on TLS support, see Microsoft documentation.
Choose between:
•
Strict (SQL Server 2022 and Azure SQL): Select this option for Azure SQL Database and Azure SQL Managed Instance or when the instance has Force Strict Encryption enabled.
•
Mandatory (Default in GPOADmin): Select this option when the instance has Force Encryption enabled. It can also be used when no encryption is configured for the instance, but Trust server certificate is enabled. While this method is less secure than installing a trusted certificate, it does support an encrypted connection.
•
Optional
Enabling Trust Server Certificate, when 'Optional' or 'Mandatory' encryption is selected, or if the server enforces encryption, means that SQL Server will not validate the server certificate on the client computer when encryption is enabled for network communication between the client and server.
Under Host name in the certificate, you can provide an alternate, yet expected, Common Name (CN) or Subject Alternative Name (SAN) in the server certificate for the connection to SSMS. You would use this option when the server name does not match the CN or SAN, for example, when using DNS aliases.
Leaving this option blank allows certificate validation to confirm that the CN or SAN matches the server name.
To connect using SQL credentials, select SQL Authentication and enter the username and password.
Click Next to continue.
* 
NOTE: When configuring GPOADmin to use an Azure SQL managed instance, you must specify the public endpoint including the port number, in the Server Name field in GPOADmin. For details on configuring a public endpoint, see Microsoft documentation.
6
In the Select Storage Options dialog box, the Network Share is pre-selected (this is the best practice for backup storage). Select the backup storage destination that was created in the prerequisites procedure (Installing Quest GPOADmin ) and click Next.
* 
NOTE: To create the GPOADmin_Backups database during the Server Configuration Wizard setup, the Service account must have Database Creator role for the specific SQL Server.
7
In the Configure Server Access dialog box, add the accounts that will be Administrators and Users.
To add an Administrator, select the icon with the Plus sign (the icon with the arrowhead will expand or collapse the list). After the account is selected, it will appear in the Administrators list. The account can be removed by selecting the red X icon.
By default the Enterprise Admins and the Service Account are added to the trustees permitted to connect to the system and change server properties. We recommend that you create a Global Group for GPOADmin Admins (<Domain>-GPOADmin Admins), add it, and click Next.
8
In the Configure Server Access dialog box, after you have added all the accounts, click Finish to commit the changes.

Updating your license

If you want to upgrade your license (for example from a trial license) or you want to change your license for any reason, you can access the license information through the server properties.

* 
NOTE: If your license expires, you will be prompted to update it the next time you attempt to connect to the service.
To update the GPOADmin license through the Server Properties
1
Select the GPOADmin node, right-click and select Connect To, and connect to the console.
2
Right-click the forest for that connection and select Options.
3
In the Options dialog expand License | Current License.
4
Check the Update License check box and browse to and select your updated license.
5
Click OK.
* 
NOTE: If your license expires, you will be prompted for the DLV file when you try to connect to the Version Control System.

Setting Permissions on AD LDS

To use GPOADmin with an AD LDS deployment, users must be assigned the Administrator role.

To set permissions on AD LDS
1
Open AD LDS ADSI-Edit (ADSI-Edit is installed as part of the AD LDS tools).
2
In the Select a well known Naming Context, select Configuration, then enter the console and port number in the Computer box, and click OK.
For example, GPOconsole:389.
3
Double-click Configuration to expand the configuration and browse to and select the Roles container.
4
To grant the users rights, right-click the Administrators role, and select Properties.
5
Browse to the member attribute and click Edit.
6
Add the service account and other accounts that will be administering GPOADmin to the selected role.
* 
NOTE: If required, you can use the AD LDS support tool dsacls to fine-tune the rights given by these roles or to grant specific rights to users.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating