Directory Sync Pro for Active Directory 20.11.4 - Installation Guide

The following is a list of supported and unsupported environments. If implementing directory synchronization between two Active Directory environments, you will need a Quest Windows Server and an SQL Server database server.

NTLM Authentication is required for the product to function. NTLM Authentication options are typically controlled via Group Policy. These three settings should be verified:

• Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers
  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
  • The RestrictSendingNTLMTraffic key, with DWORD value will be present.  If the key is missing, then this setting is not being leveraged.  If the key is set to 2, the “deny all” option has been set to restrict all out going NTLM Traffic.  If the key is set to 1, the “audit all” option has been set, which will only log when outgoing NTLM traffic is detected.  If the key is set to 0, then “allow all” is configured and there are not restrictions on sending NTLM traffic in place.
• Network security: Restrict NTLM: Incoming NTLM traffic
  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic
  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
  • The RestrictReceivingNTLMTraffic key, with a DWORD value will be present.  If the key is missing, then this setting is not being leveraged.  If the key is set to 2, the “deny all” option has been set to restrict all incoming NTLM Traffic.  If the key is set to 1, the “audit all” option has been set, which will only log when Incoming NTLM traffic is detected.  If the key is set to 0, then “allow all” is configured and there are not restrictions on receiving NTLM traffic in place.
• Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication
  This allows for exclusions from the two policies below for a computer
  • Microsoft Outlines this setting here: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication
  • The registry key for this setting is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
  • The ClientAllowedNTLMServers key, with REG_MULTI_SZ values will be present.  If the key present, but is empty, there are no allowed exceptions.  If they key is present, and lists servers, these are the servers that allow NTLM communication to.  If the key is missing, then this setting is not being leveraged.

• .NET 4.8 or greater. The installer will install .NET 4.8 if the target machine does not already have it. All system patches, service packs, and security updates should be applied to you operating system to ensure compatibility with .NET 4.8.
• IPv4 Only
• The user running the Directory Sync service (full name BinaryTree.DirSync.Exchange.exe) must have the following rights:
  1. Administrator rights to SQL Server with sysadmin role (during installation).
  2. Local administrative rights to the Quest Windows server (during installation).
• Exchange cannot be installed on an Exchange Server.
• The Quest Windows Server must be a dedicated server for the Quest solutions.
• The Quest Windows Server can be a workgroup (non-domain joined) server.  Note, in order to use Migrator Pro's Role Based Access Control functionality, product must be installed and configured on a Domain Joined server.

• The IP address and either the default SQL port (1433) or an alternate port must be open to all Quest servers.
• The ability to create and modify tables in the Dirsync database on the SQL Server database server.
• It is strongly recommended that the SQL Server database server is dedicated to SQL Server. This server can host other SQL databases, but should serve no other purpose than being a SQL Server database server.
• SQL Server must be configured using Mixed Mode authentication.
• Using the default system administrator SQL Server login account is not recommended. A Directory Sync SQL Server login account should be created. This account must have sysadmin and database owner rights to create the Dirsync database. The sysadmin right can be removed from this account once the install is complete.
• If using a Remote Named Instance of SQL Server:

The incoming firewall rules on the machine that hosts the SQL Server instance must be modified.

Using the SQL default of dynamic ports for named instances:

1. Create an inbound firewall “Program” rule whose program path is the named SQL database engine (ex: %ProgramFiles%\Microsoft SQL Server\MSSQL14.<INSTANCE-NAME>\MSSQL\Binn\sqlservr.exe)
2. Create an inbound firewall “Port” rule for UDP port 1434.
3. The “SQL Server Browser” must be running.

Alternatively, you can setup a fixed port for the SQL instance following these instructions.