GPOADmin Upgrade to 5.1 Guide. Authors: Version : 1.0 Antonio Pollan Anthony Okinedo

Size: px

Start display at page:

Download "GPOADmin Upgrade to 5.1 Guide. Authors: Version : 1.0 Antonio Pollan Anthony Okinedo"

Byron Nelson
5 years ago
Views:

1 GPOADmin Upgrade to 5.1 Guide. Authors: Version : 1.0 Antonio Pollan Anthony Okinedo

2 Table of Contents Quest GPOADmin Architecture... 4 System Requirements... 5 GPOADmin Service... 5 Backup Repository (Storage Method)... 6 GPOADmin Client... 6 GPOADmin Watcher Service... 6 Installing Quest GPOADmin Configuring GPOADmin Migrating GPOs using the Migration Wizard Configuring GPOAdmin

3 Quest GPOADmin Architecture Quest GPOADmin is a directory-enabled application and all of its application information is stored in the configuration container of either Active Directory (AD) or Active Directory Application Mode (ADAM/AD LDS) in Windows 2003 environments; in Windows 2008 environments, the application information is stored in Active Directory Domain Services (ADDS) or Active Directory Lightweight Directory Services (AD/LDS). For all Active Directory deployments, the application information along with the GPOADmin Version Control System is stored in the configuration container of Active Directory in the following location: CN=QGPM,CN=Quest,CN=Services,CN=Configuration,DC=Domain,DC=com Where if you drilled down on the GPOADmin container you will find the following directories: - CN=QGPM - CN=Wentworth hierarchy) + CN=Roles (Custom Roles location) + CN=Users (Where users' preferences are stored) + CN=VCRoot (The root of the version control container + CN=Version Control (Pointers to backups' locations (perhaps also backups themselves if 'Directory' is selected as the backup storage location) and controlled object history) + CN=Scheduled Actions + CN=Templates Since this information is stored in the configuration container of Active Directory, it is replicated to all other DCs within your forest. However, the Master Version Control is unique and the authoritative source for all version control actions. The Master Version Control role is normally held by the DC specified during Quest GPOADmin 8.

4 System Requirements Before installing Quest GPOADmin, ensure your system meets the following minimum hardware and software requirements. Quest GPOADmin Minimum Requirements (server install) 1 + GHz processor 2 GB RAM or greater 200 MB hard disk space Video Card w/ 1024x768 resolution monitor Windows Server 2008 or Windows Server 2008 R2 MMC 3.0 GPOADmin Service.NET Framework 3.5 Service Pack 1 Remote Server Administration Tools Must be able to connect to an Active Directory forest The GPOADmin Service can be hosted on a shared application server. Its purpose is to communicate with the Version Control system and implement change requests initiated by the authorized users of the GPOADmin application. These requests would normally include: Check out of an object for editing Check in of an object after editing and request for approval Approval of the changes Implementation of the updated object into the production Active Directory

5 Backup Repository (Storage Method) You have the option of choosing one of the following for the location of the physical backup copy of the object versions: Active Directory (although not recommended for production deployments due to the volume of replication data) Active Directory Application Mode (ADAM) for Windows Server 2003 OR Active Directory Lightweight Directory Services (AD LDS ) for Windows Server 2008 Microsoft SQL Server 2005 or 2008 A network share For the majority of deployments, network share is the recommended approach as it provides a high performance backup store with a minimum of configuration and maintenance overhead. GPOADmin Client The GPOADmin client application is an MMC Snap-in that can be installed on the workstations of all administrators responsible for the management of GPOs. Through the client, administrators and users will connect to the appropriate GPOADmin server to perform the tasks described under GPOADmin Service. GPOADmin Watcher Service The Watcher service protects an organization from unauthorized changes by automatically detecting changes to GPOs made outside of the GPOADmin console. An optional component of GPOADmin, the Watcher service will automatically version a registered GPO outside of the GPOADmin console and display it as noncompliant (indicated by an icon change). If the change is valid, an administrator can either incorporate the change into the version control system or roll back the change to the previous deployed version of the GPO. The GPOADmin Watcher Service must be run using credentials with sufficient network permissions. For example, if you have a GPO checked out and it is flagged as noncompliant by the Watcher Service, this indicates that the GPO settings in the live environment have changed since you checked out and started working on that GPO. Once you have selected GPOs for check-in, the Noncompliant Objects Detected dialog box shows you a list of the non-compliant objects, alerting you of any GPOs that have

6 been modified outside of the version control system of GPOADmin, and providing you with the following options: Cancel pending check in for all object(s). Cancel pending check in for noncompliant object(s) and proceed with check in for compliant object(s). Accept unauthorized modifications and discard local changes.(checks in the unauthorized and discards the local changes made within GPOADmin.) Accept local changes and discard unauthorized modifications.(checks in only the local changes made within GPOADmin.)

7 Installing Quest GPOADmin Logon to the newly installed Windows server 2008 as an administrator. Open server manager

8 2. Navigate to features click on add features 3. Select.Net Framework and Group Policy Management click next

9 4. Verify the features to be installed click Install

10 5. Click close.

$appropriate directory (c:\temp, for$

11 6. Once you have downloaded Quest GPOADmin, use a software compression tool to decompress the file to an appropriate directory (c:\temp, for example).

12 7. After extraction is complete, double click on autorun 8. Double-click Quest GPOADmin x64.msi file. 9. Click Next.

13 10. Read the licensing information, select I accept the terms in the License Agreement, and click Next.

14 11. Select complete type of installation. 12. In the Destination folder option - Click Next.

15 13.Enter the user account to be used by the Quest GPOADmin Service and click Next. 14. Click Install.

17 Configuring GPOADmin Open the newly installed GPOADmin - connect 2. Select localhost and click connect

18 3. Browse to the location of the licensing file

19 4. Click OK 5. Select the PDCE to store the AD information

20 6. Select SQL server as the GPO backup location Enter the SQL server information click next.

21 7. Add GPOADmin_Administrators as Administrators

22 8. Add GPOADmin_reviewers as Users Click Finish

23 9. Review the GPOAdmin 5.1 Console

24 Migrating GPOs using the Migration Wizard 1. Stop the Watcher service for the duration of the migration 2. Make sure users do not access either product during the migration 3. In NetPro GPOADmin 2.1, make sure all GPOs are in an available state to ensure access. If any GPOs are locked, unlock them.

$.\ [Program Files]\Quest Software\Quest GPOADmin 5.$

25 4. Start the wizard by running MigrationWizard.exe. folder. The default is..\ [Program Files]\Quest Software\Quest GPOADmin 5. Enter the database server information

26 6. Wait for the calculation to complete. 7. Allow the migration to progress

27 8. Click finish upon completion

28 9. Review migrated GPO s

$T:\PROJECTS \Novell_to_Windows_Migration\GPOAdmin \GPOADmin_5.1_User_Guide.pdf 2. Logon to the GPOADmin 5.1 server 3.$

29 Configuring GPOAdmin Review the Quest GPOAdmin 5.1 users guide. T:\PROJECTS \Novell_to_Windows_Migration\GPOAdmin \GPOADmin_5.1_User_Guide.pdf 2. Logon to the GPOADmin 5.1 server 3. Open GPOADmin 5.1 from the start menu 4. Open the properties of the domain

30 5. Open the SMTP tab and enable SMTP

31 6. Enter pasmsrv.panynj.gov as the SMTP server and as from address. Click OK

32 7. Right click on the version control root select propoerties

33 8. Grant the Active Directory group GPOADmin_reviews the user role

34 9. Grant the Active Directory group GPOADmin_Administrators the systems administrator role

35 10.Grant the Active Directory group GPOADmin_Approvers the approver role

36 11.Grant the Active Directory group GPOADmin_Opperators the moderator and user roles

37 12.Configure approvals as shown below. Click OK

Quest GPOADmin 5.6. User Guide

Quest GPOADmin 5.6. User Guide Quest GPOADmin 5.6 User Guide 2012 Quest Software, Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under