Setup Service Account in AD

Transcription

1 Table of contents Setup Service Account in AD... 2 Security setup on Service Account in AD... 2 Create Organization Units (OU) in AD... 4 Security setup on OUs in AD... 5

2 Setup Service Account in AD 1. Create service account user in AD e.g, domain\crm.serviceuser Note: remember password, as password required to be mentioned in the scripts for installation and configuration. 2. Set the user created in step 1 as local administrator on both Application Server machine and Database Server. 3. Add the user created in step 1 as sysadmin in the SQL Server 2008 Database instance which will be used for installation of CRM Security setup on Service Account in AD The objective for this setup is that the service account should be able to dynamically create Service Principal Name (SPN) for the services it is set to run. Typically SQL Service requires that for named instances where port could be dynamically allocated to service each time service is restarted. So it becomes difficult to change the SPN every time the port is changed. Note: If network service is configured as the running user of SQL Server than you do not need to give SPN permissions to this user To add the permissions, follow these steps: 1. Click Start, click Run, type Adsiedit.msc, and then click OK. 2. In the ADSI Edit snap-in, expand Domain [DomainName], expand DC= RootDomainName, expand CN=Users, right-click CN= AccountName, and then click Properties. 3. In the CN= AccountName Properties dialog box, click the Security tab. 4. On the Security tab, click Advanced 5. In the Advanced Security Settings dialog box, make sure that SELF is listed under Permission entries. If SELF is not listed, click Add, and then add SELF. 6. Under Permission entries, click SELF, and then click Edit. 7. In the Permission Entry dialog box, click the Properties tab. 8. On the Properties tab, click This object only in the Apply onto list, and then make sure that the check boxes for the following permissions are selected under Permissions: Read serviceprincipalname Write serviceprincipalname 9. Click OK three times, and then exit the ADSI Edit snap-in. Following picture illustrates the permissions

3

4 Create Organization Units (OU) in AD 1. Create Organizational Units in AD, these OUs will be used by CRM installation for giving proper access to SQL, reporting and application services. Each installation of CRM will create 5 security groups under this OU. So create these OUs in such a way that they individually represent the environment they are supposed to be used for. For example there will be an installation of CRM for each of Test, PreProd & Prod. An example structure could be as following: rootdom.abc.xyz Users Computers CRM (OU) Test_env (OU) PreProd_env (OU) Prod_env (OU) 2. After creating the OU, take some time to get the Distinguished name of the OU. This OU will be required for usage in CRM installation script, for example following table illustrates OU Path in AD rootdom.abc.xyz/crm/test_env rootdom.abc.xyz/crm/preprod_env rootdom.abc.xyz/crm/prod_env Distinguished name OU=TEST_env,OU=CRM,DC=rootdom,DC=abc,DC=xyz OU=PreProd_env,OU= CRM,DC=rootdom,DC=abc,DC=xyz OU=Prod_env,OU=CRM, DC=rootdom,DC=abc,DC=xyz To get the distinguished name for above mentioned, use the following ldap query as a domain administrator on command prompt, results will be written out to c:\temp\output.txt: ldifde -d "OU=CRM,DC=rootdom,DC=abc,DC=xyz" -f c:\temp\output.txt -l "dn" -r "(&(objectclass=organizationalunit)(name=*_env))

5 Security setup on OUs in AD For the user account of the user who is installing CRM, add the following permissions to the organizational unit (OU) in the AD. Perform this step for the OU which you select for installation of CRM. For example, in test it is at following path in AD: rootdom.abc.xyz/crm/test_env Permissions o Full control Advanced permissions o Read Permissions o Modify Permissions o Read Members o Write Members To add the permissions, follow these steps: 1. Log on to the domain controller server as a user who has domain administrator permissions. 2. Click Start, click Administrative Tools, and then click Active Directory Users and Computers. 3. On the View menu, click Advanced Features. 4. In the navigation pane, find the OU that you want to use for the Microsoft Dynamics CRM installation. To do this, expand the tree to the node that contains the security group. 5. Right-click the security group, click Properties, and then click the Security tab. 6. In the Group or user names list, click the user account of the user who is installing Microsoft Dynamics CRM if the account is listed. If the account is not listed, click Add to add the user account. 7. In the Allow column, click to select the check box for the Full control permission. Note By default, the Allow check box is selected for the Read permission. 8. Click Advanced. 9. In the Permission entries list, click Add, select the user account of the user who is installing Microsoft Dynamics CRM, and then click OK. 10. In the Apply onto list, click Descendant Group objects. 11. In the Allow column, click to select the following check boxes: o Read Permissions o Modify Permissions 12. Click the Properties tab. 13. In the Apply onto list, click Descendant Group objects. 14. In the Allow column, click to select the following check boxes: o Read Members o Write Members 15. Click OK three times.