立即与支持人员聊天
与支持团队交流

GPOADmin 5.17 - Quick Start Guide

Editing connection options

Editing connection options

An environment has multiple GPOADmin servers and one remote GPOADmin server called GPOADmin.Remote.MyDomain.com. The remote server is on the other side of a slow WAN link and users frequently receive connection timeout messages while connected. To solve this issue, the administrator can make a copy of the Default.Client.Connection.config file to target just the remote server and adjust the connection timeout parameters using the following process:

1
Copy the Default.Client.Connection.config and rename the copy to GPOADmin.Remote.MyDomain.com.config.
2
Edit this file and adjust the connection timeout parameters.
This file will only be used when connecting to the GPOADmin.Remote.MyDomain.com server. All other connections will use the Default.Client.Connection.config file unless there is a specific file matching the FQDN of the target server.

Connecting to GPOADmin using NTLM authentication

To override the default settings and use NTLM authentication, you can edit the configuration file by navigating to configuration/Settings/ForceNTLM and setting the value to “true”.

Installing GPOADmin in a disjointed domain

When GPOADmin is installed in a disjointed domain environment, you may encounter errors with configuring, connecting, and in general usage. This is most likely due to the DNS name of the domain not matching the Active Directory name.

To resolve this, edit the Default.Client.Connection.config file in the Connections directory located in the install directory. Add the following to the <Settings> section below the <ForceNTLM value="false" /> entry: <DomainName value=”ACTIVE_DIRECTORY_FULLY_QUALIFIED_DOMAIN_NAME” />

Deploying with Multiple service accounts

By default, GPOADmin uses a domain unique SPN for connections which requires the use of a single service account in the domain, reducing the number of elevated accounts.

However, you can configure GPOADmin to use multiple service accounts in your domain.

To configure GPOADmin to use multiple service accounts:
1
On each GPOADmin service host, browse to HKEY_LOCAL_MACHINE\SOFTWARE\Quest\GPOADmin\ServerConfig and set the registry value UseServerAndPortSPN to 1.
2
On each GPOADmin service host and client, browse to the UseServerAndPortSPN in the Default.Client.Connection.config file in the Connections subdirectory of the install directory, and set the configuration value to true.
3
Restart all GPOADmin services on each modified host.
The SPN format will change to GPOADmin/SERVICE_HOST_FQDN:PORT allowing for a separate service account per service host.

Restricting search scope

If required, you can restrict which global catalogs are used within the forest to search for the GPOADmin server during connection.

To restrict the search scope:
1
Create a file called PreferredGCs.txt.
2
List the fully qualified domain name of each Global Catalog server to include in the search on their own row in the file.
3
Save the file to the installation directory.
When you connect to GPOADmin, only the global catalog servers listed in the file will be searched as possible connection points. If this file is not included, GPOADmin will search all global catalog servers in the forest.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级