Active Administrator 8.7 - Installation Guide

Setting up features and the owner

On many tasks, an email is sent automatically to the Administrator’s email address. You also have the opportunity to enable or disable key features of Active Administrator. If you disable a feature, you can enable it within the Active Administrator console.

NOTE: The first time you run the configuration wizard, the check boxes are enabled. The next time you run the configuration wizard, the check boxes are disabled, so you need to use Active Administrator console to enable/disable the features. • Inactive Users and Computers To modify the feature, finish the wizard, start Active Administrator Console, and select Security & Delegation | Inactive Accounts. • Change Your Password Reminder Policy To modify the feature, finish the wizard, start Active Administrator Console, and select Security & Delegation | Password Policy. • Enable Account Expiration Notification To modify the feature, finish the wizard, start Active Administrator Console, and select Security & Delegation | Account Expiration. • Active Directory Replication Monitoring To modify the feature, finish the wizard, start Active Administrator Console, and select AD Infrastructure | Replication Monitoring. • Active Directory Health Assessment Reports To modify the feature, finish the wizard, start Active Administrator Console, and select Settings | Assessment Report.

Configuring active template delegation enforcement

Active Templates, which are used to grant specific sets of Active Directory® rights to an object, can be configured so that they are automatically reapplied if any of their permissions within the template are accidentally removed. Additionally, you can alert administrators automatically by email when an Active Template is repaired.

NOTE: After you complete the configuration wizard, you can use the Active Administrator Console to manage active template delegation enforcement by selecting Configuration | Active Template Settings.

NOTE: You must have configured the Email server to continue. See Setting email server options in the

Configuring group policy history

You can set how often selected domain controllers are polled for Group Policy Object (GPO) changes. The polling interval is set to 60 seconds by default. We recommend a polling interval of 60 seconds as this gives administrators enough time to make a few changes to the GPO without creating new versions for every change.

NOTE: After you complete the configuration wizard, you can use the Active Administrator Console to manage group policy history by selecting Configuration | GPO History Settings.

Configuring Active Directory backups

Administrators can select a domain that contains Windows Server domain controllers and back up Active Directory user and group objects in that domain. When a situation occurs that requires a user or group object to be restored, administrators can select the object from a list and restore either the object with all the attributes it possessed when it was backed up, or only attributes the administrator selects. In the case of an organizational unit object, administrators have the option of either restoring all objects it contains or all objects it contains of a particular type.

IMPORTANT: Active Administrator restores only selected user, group, and organizational unit (OU) objects, and their attributes from the backup file. If you require a backup file that restores Active Directory in its entirety, we recommend that you use an Active Directory disaster recovery product.

The Active Administrator AD Object Backup Service backs up the listed domains based on the settings in the Run backup boxes. If you are using Windows Server, Yes displays in the Supports Password Recovery column.

IMPORTANT: If you choose to disable Password Recovery, passwords are not backed up. If you restore a backup that does not contain passwords, you must unjoin, and then rejoin computer accounts.

By default, an Active Directory backup creates temporary files during processing and stores the backup files when the backup is complete under the folder C:\ActiveAdministrator\ADBackups\DOMAIN_domainname (where domainname is the fully qualified name of the domain being backed up). You can specify the folder where the temporary files are processed and where the backup files are stored.

NOTE: After you complete the configuration wizard, you can use the Active Administrator Console to manage Active Directory backups by selecting Configuration | Recovery Settings.

NOTE: If there are existing backup files in the existing share, you must move them manually. Only newly created backup files are stored to the new share path.