DirectoryAnalyzer 4.12

Transcription

1 DirectoryAnalyzer 4.12 Installation Guide

2 2011 Quest Software, Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's personal use without the written permission of Quest Software, Inc. The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA USA legal@quest.com Refer to our Web site for regional and international office information. Trademarks Quest, Quest Software, the Quest Software logo, NetPro, DirectoryAnalyzer and ChangeAuditor are trademarks and registered trademarks of Quest Software, Inc in the United States of America and other countries. For a complete list of Quest Software s trademarks, please see Other trademarks and registered trademarks are property of their respective owners. Third Party Contributions DirectoryAnalyzer contains some third party components. For a complete list, see the Third Party Components page in DirectoryAnalyzer online help. DirectoryAnalyzer Installation Guide March 2011 Version 4.12

3 Table of Contents TABLE OF CONTENTS About This Guide Overview About Quest Software Chapter 1 Installation Overview Introduction Before You Begin System Requirements System Overview Installation Overview Chapter 2 Installing the Enterprise Agent Introduction Installing the Enterprise Agent Enterprise Agent Installation Wizard Chapter 3 Installing the Client and Deployment Wizard Introduction Installing the Client and Deployment Wizard DirectoryAnalyzer Client Setup Wizard Chapter 4 Deploying Site and DC Agents Introduction Deploying Agents Agent Deployment Wizard Chapter 5 DirectoryAnalyzer Web Portal Introduction Installing the Web Portal Removing the Web Portal

4 DirectoryAnalyzer Chapter 6 MOM Integration Introduction Installing the MOM Connector Framework and Product Connector Installing the DirectoryAnalyzer MOM Product Connector and Configuration Tool Configuring and Registering the DirectoryAnalyzer MOM Product Connector Using the MOM/DirectoryAnalyzer Product Connector Service Unregistering the Quest MOM Product Connector Uninstalling the MOM Product Connector Uninstalling the DirectoryAnalyzer MOM Product Connector Chapter 7 Removing DirectoryAnalyzer Introduction Removing Site and DC Agents Removing the DirectoryAnalyzer Client Removing the Enterprise Agent APPENDIX A DirectoryAnalyzer and SNMP Appendix B Importing and Configuring the DirectoryAnalyzer MOM Appendix CManagement Pack Microsoft Operations Manager (MOM) Integration APPENDIX D DirectoryAnalyzer Database Access & Event Log Database Access Database Credentials Requisite Privileges Event Log Index

5 About This Guide Overview Conventions About Quest Software Contacting Quest Software Contacting Quest Support

6 DirectoryAnalyzer Overview This document has been prepared to assist you in becoming familiar with DirectoryAnalyzer, a solution which is available in the Quest Spotlight on Active Directory Pack. The Installation Guide contains the information required to install, upgrade or remove DirectoryAnalyzer. It is intended for network administrators, consultants, analysts, and any other IT professionals responsible for installing and maintaining the product. Conventions In order to help you get the most out of this guide, we have used specific formatting conventions. These conventions apply to procedures, icons, keystrokes and cross-references. ELEMENT Select Bolded text Italic text Bold Italic text CONVENTION This word refers to actions such as choosing or highlighting various interface elements, such as files and radio buttons. Interface elements that appear in Quest products, such as menus and commands. Used for comments. Used for emphasis. Blue text Indicates a cross-reference. When viewed in Adobe Reader, this format can be used as a hyperlink. Used to highlight additional information pertinent to the process being described. Used to provide Best Practice information. A best practice details the recommended course of action for the best result. Used to highlight processes that should be performed with care. Used to highlight a troubleshooting tip pertaining to the topic being described. 4

7 About This Guide ELEMENT CONVENTION Used to highlight permissions required to perform the action being described. + A plus sign between two keystrokes means that you must press them at the same time. A pipe sign between elements means that you must select the elements in that particular sequence. About Quest Software Quest Software simplifies and reduces the cost of managing IT for more than 100,000 customers worldwide. Our innovative solutions make solving the toughest IT management problems easier, enabling customers to save time and money across physical, virtual and cloud environments. For more information about Quest go to Contacting Quest Software Phone Mail Web site (United States and Canada) info@quest.com Quest Software, Inc. World Headquarters 5 Polaris Way Aliso Viejo, CA USA Please refer to our Web site for regional and international office information. Contacting Quest Support Quest Support is available to customers who have a trial version of a Quest product or who have purchased a Quest product and have a valid maintenance contract. Quest Support provides unlimited 24x7 access to SupportLink, our self-service portal. Visit SupportLink at 5

8 DirectoryAnalyzer From SupportLink, you can do the following: Review thousands of solutions from our online Knowledgebase Download the latest releases and service packs Create, update and review Support cases View the Global Support Guide for a detailed explanation of support programs, online services, contact information, and policy and procedures. The guide is available at: Support Guide.pdf. 6

9 1 Installation Overview Introduction Before You Begin System Requirements System Overview Installation Overview

10 DirectoryAnalyzer Introduction DirectoryAnalyzer, a Quest Spotlight on Active Directory Pack solution, proactively monitors and diagnoses critical, directory-wide infrastructure issues from replication latency to Domain Name System (DNS) inconsistencies. Using a graphical interface, DirectoryAnalyzer provides a holistic view showing directory status. When a problem occurs, an instant alert notifies you of its exact nature and location. This chapter defines the system requirements for DirectoryAnalyzer, provides an overview of the installation steps, and describes a sample DirectoryAnalyzer installation. Before You Begin It is recommended that you perform the following steps before you begin the installation procedure: Review the System Requirements section Review the complete installation process Read the Release Notes for updated information Ensure you have a valid license file to enable the DirectoryAnalyzer software. DirectoryAnalyzer will prompt you for a valid license during the Enterprise Agent Installation. If you are upgrading from DirectoryAnalyzer 4.10 or 4.11, you will not require a new license. However, pre-4.10 DirectoryAnalyzer licenses will NOT work with the 4.12 version. 8

11 Installation Overview System Requirements The DirectoryAnalyzer components execute on the following operating systems: Client Windows 2000 Professional, Windows Server 2000, Windows Server 2003, Windows XP, Windows Vista or Windows Server 2008 Microsoft Data Access Components (MDAC) version 2.6 or higher is required for generating reports. MDAC is included in the Windows 2000/2003 installations. For more information or to download the latest version of MDAC refer to Microsoft s web site at DC Agent Servers Windows Server 2000, Windows Server 2003 or Windows Server 2008 domain controller Site Agent Servers Windows Server 2000, Windows Server 2003 or Windows Server 2008 domain controller Enterprise Agent Server Windows Server 2000, Windows Server 2003 or Windows Server 2008 Member Server (it is required that you place the Enterprise Agent on a member server, not a domain controller). SQL Server 2000 SP3a, Microsoft SQL Server Desktop Engine (MSDE) (minimum), SQL Server 2005, or SQL Server 2005 Express. If you intend to use the DirectoryAnalyzer MOM integration components, it is strongly recommended that the Enterprise Agent NOT be installed onto a MOM Management Server. WMI must be installed and running if a consolidator connection is desired Web Portal PIII 450 MHz or better 256 MB RAM or better Windows 2000 Server SP2 or Windows Server 2003 Microsoft.NET Framework components V2.0 or newer Microsoft IIS 9

12 DirectoryAnalyzer To monitor Exchange through the Exchange View, Exchange 2000 SP2 or higher or Exchange 2003 is required. For integration with MOM, MOM 2005 is required. At a minimum, DirectoryAnalyzer requires one Site Agent and one Enterprise Agent to run (the DA client may optionally be installed on any server running a DA service agent). DirectoryTroubleshooter If you plan on launching DirectoryTroubleshooter or using the integrated features, DirectoryTroubleshooter v or higher must be installed on the DirectoryAnalyzer Client machine. ChangeAuditor If you plan on launching ChangeAuditor or using the integrated features, ChangeAuditor v or newer must be installed, with the ChangeAuditor Client installed on the DirectoryAnalyzer Client machine. DNSAnalyzer In order to launch DNSAnalyzer from within the DirectoryAnalyzer Client, DNSAnalyzer must be installed on the DirectoryAnalyzer Client machine. DirectoryAnalyzer will launch Quest s DNSAnalyzer QuickAnalyzer if version 4.0 is installed or the DNSAnalyzer Admin Console, or if an earlier version of DNSAnalyzer is installed. Spotlight on Active Directory If you plan to launch Spotlight for Active Directory from the DirectoryAnalyzer Client, Spotlight on Active Directory v. 6.8 must be installed on the DirectoryAnalyzer Client machine. Communications Protocol and Ports If your network uses any kind of internal firewalling, certain ports must be opened for inbound/outbound access. Failure to open the following port will impact the functionality of DirectoryAnalyzer up to and including failure: TCP/IP Port 2650 (0xA5A) - as assigned by IANA 5/98 10

13 Installation Overview This port has been dedicated to Quest applications by its respective governing board and should not be used by any other company or application. Note that this port does not need to be externally accessible unless specifically requested by Quest Technical Support -- this only applies to wide area networks with internal filtering or firewalling. If you install the DirectoryAnalyzer Agent on a Windows 2008 server, the Windows firewall may prevent inter-agent communication. That is, data and alerts from remote agents will not be viewable from the DirectoryAnalyzer client. If you encounter this issue, please create a firewall exception for port TCP/IP 2650 on every DC Agent and Enterprise Agent installation. System Overview DirectoryAnalyzer is made up of four primary components: Client - the graphical user interface that manages all aspects of DirectoryAnalyzer. The client allows administrators to view current alerts, set thresholds, display or print alert history and run interactive tools to assist in troubleshooting Active Directory. Enterprise Agent - a service that resides on a Windows 2000/2003/2008 member server in the enterprise. It is responsible for monitoring forest-wide conditions and collecting alert conditions and information from Site Agent(s) in order to generate notifications to administrators and display status to the client. Site Agent - a service that resides on a single domain controller within a site. In addition to performing all the actions of a standard DC Agent, it is responsible for monitoring site-level conditions and collecting alert conditions and information from all DC Agents in the same site to pass on to the Enterprise Agent. DC Agent - a service that resides on each domain controller in the enterprise, except the one hosting the Site Agent at each site. The DC Agent is charged with monitoring that domain controller for alert conditions and passing them on to the Site Agent. 11

14 DirectoryAnalyzer Installation Overview You will first install the DirectoryAnalyzer Enterprise Agent, followed by the DirectoryAnalyzer Client and Deployment Wizard. You will then run the Deployment Wizard to deploy DirectoryAnalyzer agents (Site Agents and DC Agents) to the network. DirectoryAnalyzer uses Microsoft s Windows Installer technology to install the DirectoryAnalyzer Enterprise Agent, client and deployment wizard. Running the Setup.exe file will launch the DirectoryAnalyzer Setup Wizard, allowing you to install these components. The first page of the wizard contains links to perform the following installation steps: SQL Server 2005 Express Download DirectoryAnalyzer requires access to an installation of SQL Server 2000 SP3a, Microsoft SQL Server Desktop Engine (MSDE), SQL Server 2005 or SQL Server 2005 Express. A typical installation requires a locally installed instance of SQL Server Express. Select this option if SQL is not already installed or if you wish to create a new SQL Server Express instance for DirectoryAnalyzer. Selecting this option, will launch your internal browser allowing you to download the SQL Server 2005 Express Edition from the Microsoft web site. After you have downloaded and installed the SQL Server Express Edition, proceed to the second step: Enterprise Agent Installation. 12

15 Installation Overview Enterprise Agent Installation Select this option to install or upgrade the DirectoryAnalyzer Enterprise Agent. This installation must be performed locally on a Windows 2000/2003/2008 member server. It is strongly recommended that the Enterprise Agent not be installed on a MOM Management Server; the MOM connector may fail to automatically start during a reboot if the Enterprise Agent, MOM connector and MOM are installed on the same server. Client and Deployment Wizard Installation Select this option to install the DirectoryAnalyzer Client and Deployment Wizard. The client provides the graphical interface to DirectoryAnalyzer and the deployment wizard allows the administrator to deploy and configure DirectoryAnalyzer agents. Administrators may wish to make only the DirectoryAnalyzer Client available to the first line help desk administrators. The Deployment Wizard installation is part of the client installation process. If installed, it can be launched at any time after the installation. Once these components are successfully installed, launch the Deployment Wizard to deploy DirectoryAnalyzer Site and DC agents to the desired servers. If no DirectoryAnalyzer Site or DC agents are deployed, the Information tabs and Summary Graphs in the DirectoryAnalyzer Client will not contain any information. MOM Integration DirectoryAnalyzer can be installed and configured for tight integration with Microsoft Operations Manager (MOM) 2005 by leveraging the MOM Connector Framework and the DirectoryAnalyzer MOM Product Connector. This configuration does not require DirectoryAnalyzer Site or DC agents to be deployed in the environment. However, both the DirectoryAnalyzer Site and DC agents can coexist with the DirectoryAnalyzer MOM Product Connector. DirectoryAnalyzer MOM Product Connector - a service that connects DirectoryAnalyzer to the MOM Connector Framework, enabling bidirectional alert forwarding and synchronization. This service allows for alerts generated by MOM ADMP to be sent to the DirectoryAnalyzer Enterprise Agent and makes them available as MOM alerts in the client, then updates back to MOM when an alert s status or history changes. The MOM alerts in the DirectoryAnalyzer health console are also mapped with smartlink integration to DirectoryTroubleshooter tests and ChangeAuditor queries. 13

16 DirectoryAnalyzer DirectoryAnalyzer MOM Management pack - allows for alerts generated by the DirectoryAnalyzer agents to be forwarded to the MOM Operators console. The alerts processed through the management pack in the MOM operators console do not update in the DirectoryAnalyzer console. The DirectoryAnalyzer alerts will automatically drop from the health console if the condition is rectified in the environment since the alerts are self acknowledging. Sample Installation Scenario Following is a sample scenario of how the different DirectoryAnalyzer components can be installed. Active Directory Structure Summary LOGICAL 15 Windows 2000 Domain Controllers in 3 Active Directory Domains domain1.com DC1 DC2 DC3 DC4 DC5 domain2.domain1.com DC6 DC7 DC8 DC9 DC10 domain3.domain1.com DC11 DC12 DC13 DC14 DC15 PHYSICAL 3 Active Directory Sites ADSite1 DC1 DC2 DC4 DC6 DC14 ADSite2 DC7 DC8 DC9 DC11 DC13 ADSite3 DC3 DC5 DC10 DC12 DC15 14

17 Installation Overview The deployment of DirectoryAnalyzer components is based on the physical design of Active Directory, namely the Active Directory sites that exist and the domain controllers that exist in each site. So the deployment of DirectoryAnalyzer for this sample Active Directory environment could look like this: The DA Client is installed on a Windows 2000 Professional administrator s workstation called WKSTN1. The Enterprise Agent is deployed on a Windows 2000 member server called SERVER1. DA Client: WKSTN1.domain1.com Enterprise Agent: MEMBERSERVER1.domain1.com Site Agents: DC1.domain1.com DC5.domain1.com DC9.domain2.domain1.com 15

18 DirectoryAnalyzer DC Agents: DC2.domain1.com DC3.domain1.com DC4.domain1.com DC6.domain2.domain1.com DC7.domain2.domain1.com DC8.domain2.domain1.com DC10.domain2.domain1.com DC11.domain3.domain1.com DC12.domain3.domain1.com DC13.domain3.domain1.com DC14.domain3.domain1.com DC15.domain3.domain1.com 16

19 2 Installing the Enterprise Agent Introduction Installing the Enterprise Agent Enterprise Agent Installation Wizard

20 DirectoryAnalyzer Introduction The DirectoryAnalyzer Enterprise Agent is responsible for monitoring forest-wide conditions and collecting alert conditions and information from Site Agent(s) in order to generate notifications to administrators and display status to the client. This service must be installed locally on a Windows 2000/2003/2008 member server in the enterprise. A single Enterprise Agent is required for the entire enterprise (forest). You can, however, define a primary and alternate Enterprise Agent for fault tolerance. Installing the Enterprise Agent Prerequisite to installing the DirectoryAnalyzer: DirectoryAnalyzer requires access to an installation of SQL Server 2000 SP3a, Microsoft SQL Server Desktop Engine (MSDE), SQL Server 2005 or SQL Server 2005 Express. A typical installation requires a locally installed instance of SQL Server Express. 1. If SQL is not already installed or if you wish to create a new MSDE instance for DirectoryAnalyzer, run the Setup.exe file to launch the DirectoryAnalyzer Setup Program. 2. On the first page of the wizard, select SQL Server/MSDE Installation. Selecting this option, will launch your internal browser allowing you to download the SQL Server 2005 Express Edition from the Microsoft web site. 3. After you have downloaded and installed the SQL Server Express Edition, proceed to the second step: Enterprise Agent Installation To install the DirectoryAnalyzer Enterprise Agent: 1. From the desired member server, run the Setup.exe file to launch the DirectoryAnalyzer Setup program. 2. On the first page of the wizard, select Enterprise Agent Installation to launch the Enterprise Agent Installation wizard. 3. Follow the instructions provided in the installation wizard. Here are some points to keep in mind during this installation process: If the Microsoft SNMP service is installed, select the Yes, Enable SNMP Integration option if you want to use the SNMP service to send SNMP traps as alerts. At least one Enterprise Agent is required for the entire enterprise (forest). You can however, define a primary and an alternate Enterprise Agent to provide fault tolerance. 18

21 Installing the Enterprise Agent DirectoryAnalyzer s security mechanism enables an organization to delegate monitoring responsibility as appropriate. It is recommended to use the Yes, create the DA Admins security group option. Specify the SQL instance to be used and the authentication method to be used to access this database. When prompted for the license file, select the Licenses button. Selecting this button will display the License Status dialog. On this dialog, select the Browse License button to locate the license file you previously copied to your local hard drive and then select the Close button to return to the Product Licensing screen. 4. After entering all of the requested information, select the Finish button on the final wizard screen to return to the DirectoryAnalyzer Installation Options screen. Enterprise Agent Installation Wizard Selecting the Enterprise Agent Installation option from the DirectoryAnalyzer Installation Options screen will launch the Enterprise Agent Installation wizard which will walk you through the installation process. This installation must be performed locally on a member server running Windows Server 2000, Windows Server 2003 or Windows Server The Enterprise Agent Installation wizard consists of the following screens: Select Database Name Welcome Software License Agreement Product Licensing Customer Information SNMP Configuration Enterprise Agent Configuration Access Control and Security Group Configuration SQL Server Desktop Engine Database Authentication Ready to Install the Program InstallShield Wizard Complete 19

22 DirectoryAnalyzer The remainder of this chapter provides a detailed description of each of the wizard pages and the required input. Select Database Name Once you select the Enterprise Agent Installation option, the Select Database Name window will display. You ll be prompted to type in or select from the drop-down menu a database name. Enter a name, then select OK to load the installation program. Welcome After the installation program finishes loading, the DirectoryAnalyzer Enterprise Agent Welcome screen will be displayed. Select Next to continue. Software License Agreement The Software License Agreement will then be displayed. By selecting the I Accept the terms of the license agreement option, you acknowledge that you have read and agree to all of the terms of the agreement. If you do not accept the terms of the agreement, the installation program will not continue. Select Next to continue. 20

23 Installing the Enterprise Agent Product Licensing You should have received a license file from Quest to enable the DirectoryAnalyzer software; it will not run without a valid license. If you do not have a valid license file or need an updated license file, contact Quest to get your license file and copy it to your local hard drive. Copy this license file to your local hard drive. Licenses Use the Licenses button to open the License Status dialog to verify your license information, apply a new license or update an existing license. License Status Dialog The License Status dialog is displayed when the Licenses button is selected on the Product Licensing screen of the Enterprise Agent Installation wizard. From this dialog, you can locate and apply a new license and update an existing license. 21

24 DirectoryAnalyzer Feature This column displays the product or feature that requires a valid license. License Status This column displays the status of the feature s license: Installed, Not Installed or Trial. If the License Status column indicates that the DirectoryAnalyzer product is Not Installed, select the Browse license button to locate the DirectoryAnalyzer product license file. License Expires This column display the date the license expires (if applicable to the selected feature). Maintenance Expires This column displays the date the maintenance contract expires (if applicable to the selected feature). Browse license Use the Browse license button to locate the license file you previously copied to your local hard drive. Once you have applied the license file, use the Close button to return to the Product Licensing screen. Select Next to continue installing the Enterprise Agent. 22

25 Installing the Enterprise Agent Customer Information After accepting the terms of the license agreement, the setup wizard proceeds to the Customer Information screen. This screen will display the following information about the user currently logged in. User Name This field displays the name of the user currently logged in. Organization This field displays the name of this user s company/organization. Select Next to continue. 23

26 DirectoryAnalyzer SNMP Configuration If the Microsoft SNMP service is installed, DirectoryAnalyzer allows you to use the SNMP service to send SNMP traps as alerts. The options on this screen will be disabled if SNMP is not installed on the installation machine. Select the appropriate option: Yes, Enable SNMP Integration No, Do NOT enable SNMP Integration After selecting the appropriate option, select Next to continue. 24

27 Installing the Enterprise Agent Enterprise Agent Configuration At least one Enterprise Agent is required for the entire enterprise (forest). You can, however, define a primary and an alternate Enterprise Agent to provide fault tolerance. If there is only one Enterprise Agent implemented in an environment and that Enterprise Agent fails for any reason, the environment will be unable to detect directory problems that might be happening. To avoid this situation, DirectoryAnalyzer allows for an alternate Enterprise Agent to operate simultaneously. With this type of implementation, even if one Enterprise Agent fails, the other will continue to receive alert information and will notify administrators. Enterprise Agent redundancy is fully meshed, meaning that all Site Agents communicate with both Enterprise Agents. That way there is no opportunity for alert information to slip through the cracks. It is recommended that the Enterprise Agent(s) be installed on a Windows Server 2000, Windows Server 2003 or Windows Server 2008 member server that resides in the same physical location as the Active Directory administrator(s). This screen allows you to define whether you are installing a single Enterprise Agent and/or an alternate Enterprise Agent on your network. Select the appropriate option: This will be the Primary Enterprise Agent on this network. This server will be the Alternate Enterprise Agent. 25

28 DirectoryAnalyzer If the second option is selected, a text box will be displayed allowing you to specify the Primary Enterprise Agent. In this text box, enter the fully qualified name of the member server to be used as your Primary Enterprise Agent. Or you can use the browse button to the right of this text box to search for available member servers. When this browse button is selected, the Select Primary Enterprise Agent screen will be displayed. Use the Discover button at the bottom of this screen to search your system for available member servers. Then from the list displayed, select the member server to be used as your Primary Enterprise Agent. Select the OK button to close this screen and return to the previous installation wizard screen. Select Next to continue. 26

29 Installing the Enterprise Agent Access Control and Security Group Configuration DirectoryAnalyzer s security mechanism enables an organization to delegate monitoring responsibility as appropriate by: controlling access to DirectoryAnalyzer facilities, specifically agent distribution, alert history reporting and object configuration restricting the scope of what DirectoryAnalyzer presents based on the user s administrative responsibility In order to ease DirectoryAnalyzer security administration, this screen allows you to create a dedicated security group, as well as automatically add access control entries to each domain in the forest. Select the appropriate option as described below: Yes, create the DA Admins security group and add appropriate access control entries. (Recommended) Select this option to create a security group named DA Admins and set access control entries allowing members of the DA Admins group to monitor the forest. No, I will set DirectoryAnalyzer access control manually. If you select this option, DirectoryAnalyzer will not function until you add the appropriate access control entries manually. 27

30 DirectoryAnalyzer Use the Tell Me More button to view additional details on DirectoryAnalyzer security group creation. Refer to the DirectoryAnalyzer Security Administrator s Guide for a detailed explanation of DirectoryAnalyzer s security feature. Once you have selected the appropriate option, select Next to continue. This will initiate a search for SQL servers and instances on the member server. SQL Server Desktop Engine A SQL Server instance is required. This screen displays the results of the search for SQL servers and instances. If you choose a Remote SQL server and you will be using Windows Integrated security, please ensure that the domain user is granted access to the SQL server. This account must be assigned the System Administrator role to create the Enterprise Agent database. Use the browse button to the right of the Installing to Selected SQL Server\Instance field to select the SQL instance to be used. When you select the browse button, the Select SQL Server screen will be displayed. 28

31 Installing the Enterprise Agent Use the Discover button at the bottom of this screen to search your system for instances of SQL. Then from the list displayed, select the instance to be used for DirectoryAnalyzer. After selecting the SQL instance to be used, select the OK button to close this screen and return to the previous installation wizard screen. Select Next to continue. Database Authentication The Database Authentication screen allows you to select the type of credentials to be used to access the database. 29

32 DirectoryAnalyzer For more information on database access, please refer to DirectoryAnalyzer Database Access & Event Log. SQL Authentication Screen If you selected to use SQL credentials, the following screen will be displayed. On this screen, enter the appropriate SQL credentials: Username for SQL Account Enter the username of the user account to be used to access the designated SQL server/instance. Password / Confirm Password Enter the password associated with the SQL account entered above. After entering the proper credentials, select Next to continue. 30

33 Installing the Enterprise Agent Windows Integrated Authentication Screen If you selected to use Windows credentials, the following screen will be displayed. On this screen, select the appropriate option: I will supply credentials for SQL Server access. (Default) Use LocalSystem Account for SQL Server access. When the first option is selected, the following fields will be activated allowing you to enter the Windows credentials to be used to access the designated SQL server/instance. Domain/Username for Windows Account Enter the domain/username for the Windows account to be used to access the SQL server/instance. Password / Confirm Password Enter the password associated with the user account entered above. After entering the proper credentials, select Next to continue. 31

34 DirectoryAnalyzer Ready to Install the Program The Ready to Install the Program screen will then be displayed. It displays a summary of what is being installed: Enable/disable SNMP support Primary/Alternate EA information Enable/disable DirectoryAnalyzer Security Destination SQL server name Database Authentication information If you want to review or change the installation settings, use the Back button to return to the appropriate screen(s). Select the Install button to begin the Enterprise Agent installation. The Installing Quest DirectoryAnalyzer Enterprise Agent screen will display the progress of the files being copied. 32

35 Installing the Enterprise Agent InstallShield Wizard Complete Once the installation program has successfully copied all the necessary files and built the database, the InstallShield Wizard Complete screen will be displayed. Select the Finish button. This will return you to the DirectoryAnalyzer Installation Options screen, where you can select to install the Client and Deployment Wizard or exit the setup wizard. The DirectoryAnalyzer Enterprise Agent is now installed. However, in order to use DirectoryAnalyzer, the Client must be installed and Site and DC Agents must be deployed to machines in your enterprise. Install the Client and launch the Deployment Wizard to install and distribute the Site and DC Agents to their host machines. See Installing the Client and Deployment Wizard and Deploying Site and DC Agents for more information on installing the Client and on deploying the necessary agents. 33

36

37 3 Installing the Client and Deployment Wizard Introduction Installing the Client and Deployment Wizard DirectoryAnalyzer Client Setup Wizard

38 DirectoryAnalyzer Introduction The DirectoryAnalyzer Client provides you with an interface for monitoring and troubleshooting Active Directory. The client can be installed on Windows 2000 Professional, Windows Server 2000, Windows Server 2003, Windows XP, Windows Vista or Windows Server The DirectoryAnalyzer Deployment Wizard provides you with an interface to install and distribute the DirectoryAnalyzer agents on your network, modify your DirectoryAnalyzer installation or remove DirectoryAnalyzer agents from your network. This wizard is installed on the same machine as the DirectoryAnalyzer Client by default. Installing the Client and Deployment Wizard To install the client and deployment wizard: 1. On the desired server, run the Setup.exe file to launch the DirectoryAnalyzer Setup wizard. 2. On the Installation Options page of the wizard, select the Client and Deployment Wizard Installation option, which will then launch the DirectoryAnalyzer Client Setup wizard. 3. Enter the requested information on the client setup wizard as described in the following sections. DirectoryAnalyzer Client Setup Wizard Selecting the Client and Deployment Wizard Installation option will launch the DirectoryAnalyzer Client Setup wizard which will step you through the installation process for the DirectoryAnalyzer Client and Deployment Wizard. The DirectoryAnalyzer Client Setup wizard consists of the following screens: Welcome Customer Information Setup Type 36

39 Installing the Client and Deployment Wizard Ready to Install the Program Completing the DirectoryAnalyzer Setup Wizard The remainder of this chapter provides a detailed description of each of the wizard screens and the required input. Welcome After selecting the Client and Deployment Wizard Installation option and the installation program finishes loading, the DirectoryAnalyzer Client Setup Wizard Welcome screen will be displayed. Select Next to continue. Software License Agreement The Software License Agreement will then be displayed. By selecting the I Accept the terms of the license agreement option, you acknowledge that you have read and agree to all of the terms of the agreement. If you do not accept the terms of the agreement, the installation program will not continue. After selecting the 'I Accept' option, select Next to continue. 37

40 DirectoryAnalyzer Customer Information After accepting the terms of the license agreement, the setup wizard proceeds to the Customer Information screen. This screen will display the following information about the user currently logged in (which can be changed). User Name This field displays the name of the user currently logged in. Organization This field displays the name of this user s company/organization. Install this application for From this screen, you can also specify who can run DirectoryAnalyzer. Select the appropriate option: Anyone who uses this computer (all users). This option is selected by default. Only for me (<user_name>) Select Next to continue. 38

41 Installing the Client and Deployment Wizard Setup Type The Setup Type screen will be displayed allowing you to specify the type of setup. Select the appropriate setup option: Complete By default this option is selected. The Complete setup will install both the DirectoryAnalyzer Client and Deployment Wizard. It will install these programs in the following folder: C:\Program Files\Quest Software\DirectoryAnalyzer\Client\. Custom Select this option if you would like to change the installation options of a component or specify a different installation folder. Selecting this option will display the Custom Setup screen, allowing you to customize your installation. 39

42 DirectoryAnalyzer By default, the DirectoryAnalyzer Client and DirectoryAnalyzer Deployment Wizard will be installed. To change the installation option for either of these components, click on the icon to the left of the component and select a different option from the drop-down list. Valid options are: Install to This feature will be installed on local hard drive. (Default) This feature, and all subfeatures, will be installed on local hard drive. (For DirectoryAnalyzer, this option has the same effect as the first option.) This feature will not be available. That is, the selected component will not be installed. Use the Change button to locate a new installation folder. Locate the folder and select OK to close the Change Current Destination Folder screen and return to the Custom Setup screen. To review the available disk space on each of the drives to which you are currently connected, use the Space button at the bottom of the Custom Setup screen. Select the Next button to continue. 40

43 Installing the Client and Deployment Wizard Ready to Install the Program The Ready to Install the Program screen will then be displayed. If you want to review or change the installation settings, use the Back button to return to the appropriate wizard screen(s). When you are ready to install, select the Install button to begin the installation. The Installing DirectoryAnalyzer screen will display the progress of the files being copied. Completing the DirectoryAnalyzer Setup Wizard Once the installation program has successfully copied all the necessary files, the Completing the DirectoryAnalyzer Client Setup Wizard screen will be displayed. In order to use DirectoryAnalyzer, agents must first be installed on machines in your enterprise. Use the Deployment Wizard to install and distribute the Site and DC Agents to their host machine. The installed components (DirectoryAnalyzer Client and/or Deployment Wizard) can now be started. To launch the Deployment Wizard, you can either select (check) the Start the Deployment Wizard option on this screen or use the shortcuts on the Start Menu. Select the Finish button to return to the DirectoryAnalyzer Installation Option dialog. From this dialog, select Close to exit the Setup Wizard. 41

44

45 4 Deploying Site and DC Agents Introduction Deploying Agents Agent Deployment Wizard

46 DirectoryAnalyzer Introduction The DirectoryAnalyzer Deployment Wizard allows you to deploy and configure the following DirectoryAnalyzer agents from a single location: DC Agent(s) - one DC Agent is required for each domain controller that you want to monitor using DirectoryAnalyzer. Site Agent(s) - one Site Agent is required for each Active Directory site to be monitored. Select one domain controller at each site to host the Site Agent. In addition to monitoring the site for which it is responsible, the Site Agent also monitors the local domain controller it resides on. Therefore, a DC Agent will not be installed on the domain controller where you are installing a Site Agent. We recommend that a maximum of 150 agents (combination of DC and Site Agents) be under the control of a single Enterprise Agent. Deploying Agents To deploy DirectoryAnalyzer agents: 1. Select Start All Programs Quest Software DirectoryAnalyzer DirectoryAnalyzer Deployment Wizard to launch the Agent Deployment wizard. 2. On the Select an LDAP Server screen, select the server to be used for LDAP queries. 3. On the Specify the Enterprise Agent screen, enter the fully qualified DNS name of the member server currently hosting your Enterprise Agent. 4. Once the wizard has obtained the necessary configuration information and established your default configuration, the Agent Configuration screen will be displayed. From this screen, expand each domain structure and select the desired action for each domain controller within the domain. The following actions are available depending on the node selected: Install/Upgrade Agents Demote to a DC Agent (available for Site Agents) Promote to a Site Agent (available for DC Agents) Remove Agents No Action 44

47 Deploying Site and DC Agents After making your selections, select Next to continue. 5. Confirm your selections on the Deployment Action Summary screen and select the Execute button to start the distribution process. 6. Once the distribution process is completed, select OK to close the status pop-up that is displayed. 7. Back on the Deployment Action Summary screen, select Finish to continue. 8. On the Deployment Wizard Completed screen, select the View Logs button to view the agent deployment logs or the OK button to exit the deployment wizard. Agent Deployment Wizard The Agent Deployment Wizard can be launched at any time after the installation (if it was installed) by selecting Start Programs Quest Software DirectoryAnalyzer DirectoryAnalyzer Deployment Wizard. The Agent Deployment wizard consists of the following screens: Welcome to the DirectoryAnalyzer Deployment Wizard Select an LDAP Server Specify the Enterprise Agent Determine Configuration Agent Configuration Deployment Action Summary Deployment Wizard Complete The following sections provide a description of the Deployment Wizard screens and the information that is to be provided. 45

48 DirectoryAnalyzer Welcome to the DirectoryAnalyzer Deployment Wizard The first screen displayed is the Welcome screen for the Deployment Wizard. Select Next. Select an LDAP Server The Select an LDAP Server screen allows you to specify a Windows Server 2000/2003/2008 server to be used to determine the site layout of your network. This screen also allows you to specify alternate LDAP credentials to be used for read and write access to Active Directory. The Deployment Wizard will use the current user s credentials to check the Agent Topology facility for permission to continue. Please see the DirectoryAnalyzer Security Administrator s Guide for details. 46

49 Deploying Site and DC Agents Enter the following information on this screen: Domain Controller Name Enter the fully qualified DNS name of a Windows 2000, Windows Server 2003 or Windows Server 2008 domain controller. Use Windows credentials as LDAP credentials Select/check this check box to use the current Windows credentials as the LDAP credentials. Uncheck this check box to specify alternate credentials. Domain Name Enter the name of the domain to be used by the Deployment Wizard to access Active Directory. User ID Enter the name of the user to be used to access Active Directory. Password Enter the password associated with the user ID entered above. Use the Tell Me More button for further explanation concerning credentials. After entering this information, select Next to continue. Once the site layout has been determined with the specified rights, the remaining steps of the wizard will use the credentials of the logged in user. The currently logged in user must have sufficient rights to: Copy files to the servers. Create, remove, stop and start services. Read and write the registry on the remote machines (including HKLM\SOFTWARE and HKLM\SYSTEM\CurrentControlSet). 47

50 DirectoryAnalyzer Specify the Enterprise Agent The wizard will then display the name of the member server currently hosting your Enterprise Agent. If the name of your Enterprise Agent is not being displayed, use the arrow and select it from the drop-down list or enter the name of the member server that is hosting your Enterprise Agent. Select Next to continue. Determine Configuration The wizard will then ask you to wait while it queries the Enterprise Agent to obtain the necessary configuration information needed to proceed. Once the wizard has obtained the necessary configuration information and established your default configuration, select Next. 48

51 Deploying Site and DC Agents Agent Configuration The Agent Configuration screen allows you to define the domain controllers that will host DC Agents or the Site Agent for an Active Directory Site. The DC Agent is responsible for monitoring a single domain controller for alert conditions and passing them on to the Site Agent. One DC Agent is required for each domain controller that you want to monitor using DirectoryAnalyzer. It is highly recommended that a DC Agent be installed on every domain controller in your enterprise, except on the domain controller(s) hosting a Site Agent. The Site Agent is responsible for monitoring site-level conditions and collecting alert conditions and information from the DC Agents at that site. It then passes this information on to the Enterprise Agent. One Site Agent is required for each Active Directory site to be monitored. Select one domain controller at each site, onto which you want to install a Site Agent. In addition to monitoring the site for which it is responsible, the Site Agent also monitors the local domain controller on which it resides. Therefore, a DC Agent will not be installed on the domain controller where you are installing a Site Agent. We recommend that a maximum of 150 agents (combination of DC and Site Agents) be under the control of a single Enterprise Agent. From this screen you can perform the following tasks: install or upgrade agents demote a Site Agent to a DC Agent promote a DC Agent to a Site Agent remove DC and Site Agents take no action 49

52 DirectoryAnalyzer This screen contains the following information/controls to help you define your DC and Site Agents: Version To Deploy This is a read-only field that displays the current version of DirectoryAnalyzer that is being deployed. Directory This column displays all of the sites and domain controllers found on your network. This graphic display uses the following icons to represent the different types of objects: Enterprise Site Domain Controller Site Agent 50

53 Deploying Site and DC Agents To expand a site to view the resident domain controllers, select the + sign to the left of the site s name or right-click on an object and select the appropriate menu command: Expand, Expand All, Collapse, or Collapse All. Action This column displays the actions to be taken against each of the domain controllers listed. Click the action and use the drop-down arrow to select the action to be taken against the selected site or domain controller. The following actions are available for the Enterprise or a Site: Install/Upgrade Agents Remove All Agents Take No Action The following actions are available for Site Agents: Install/Upgrade Site Agent Demote to a DC Agent Remove Site Agent Take No Action By default, the first server listed in a site will be selected to host a Site Agent. The following actions are available for domain controllers hosting DC Agents: Version Install/Upgrade Agent Promote to a Site Agent Remove DC Agent Take No Action This column displays the current version already installed on each of the domain controllers, if applicable. This column will be blank for the initial installation. 51

54 DirectoryAnalyzer Installing/Upgrading Agents From this screen, you can install/upgrade agents to individual DCs, all DCs in a site or all DCs in the enterprise. To install/upgrade agents to individual domains controllers: 1. Select the domain controller(s) where agents are to be installed/upgraded. 2. Click on the Action and select the appropriate action: Install/Upgrade Agent, Demote to a DC Agent, or Promote to a Site Agent. To install/upgrade all of the agents in a site: 1. Select the site(s) where agents are to be installed/upgraded. 2. Click on the Action and select Install/Upgrade All Agents. To install/upgrade all of the agents in the enterprise: 1. Select the enterprise node. 2. Click on the Action and select Install/Upgrade All Agents. Once you have made your selections, select Next to continue. Deployment Action Summary A screen similar to the Agent Configuration screen will be displayed that summarizes the configuration changes you are about to apply to your enterprise. Review your selections to ensure they are correct and select Execute to start the distribution process. After selecting the Execute button, the Status column will detail the status of the deployment process. If errors were encountered, a red X will mark the objects (Directory column) that generated the error(s). In addition, if you click on a server, real-time status will be displayed in the text box at the bottom of the screen. 52

55 Deploying Site and DC Agents To view a text file that contains a detailed log of the steps taken during the deployment process and any errors that occurred, select the View Log button. Once the distribution process is completed, a pop-up will be displayed that states that the installation was successful or warning you that errors were encountered. Select OK to close this pop-up. Select the Finish button to continue. Deployment Wizard Complete The Deployment Wizard Complete screen will then be displayed. This screen displays whether there were any errors encountered during the deployment process as well as Quest contact information. To view the errors or logs for the deployment process, select the View Log button. Select OK to exit the Deployment Wizard. 53

56

57 5 DirectoryAnalyzer Web Portal Introduction Installing the Web Portal Removing the Web Portal

58 DirectoryAnalyzer Introduction The DirectoryAnalyzer Web Portal (DAWeb) allows administrators and operations personnel to connect to an alerting console using Internet Explorer 5.01 or higher. DAWeb is a technology that was first released with DirectoryAnalyzer 3.1. In version 3.5, DirectoryAnalyzer introduced two new significant functions: multi-forest view and ChangeAuditor integration. DAWeb Internals The Web Portal communicates with a consolidator via TCP port This port is used by the Remoting classes of the.net framework. The consolidator uses the credentials for each forest to connect to the Quest DirectoryAnalyzer WMI provider running on the DirectoryAnalyzer Enterprise Agent. A forest s credentials can either be a domain account within the forest or a local machine account on the Enterprise Agent. These credentials must have permission to access the Enterprise Agent machine s WMI provider. Similarly, credentials must be provided for the ChangeAuditor Repository WMI provider. With these credentials, the consolidator is able to access each Enterprise Agent and ChangeAuditor Repository to retrieve topology information, current alerts, alert details, ChangeAuditor events and event details. The DAWebAdmins group is optionally created by the installer as a local group account on the IIS server running the web portal. If you do not allow the installer to create this group, it MUST be created by an administrator if you want anyone to have administrative access to the web portal/consolidator. The web portal may not be run on a domain controller. To grant users access to the administrative functions of the web portal, local/domain users or groups must be members of this group. Users accessing the portal who are not members of this group will not see the Admin tab in the web portal. 56

59 DirectoryAnalyzer Web Portal Requirements It is strongly recommended that you remove a previously installed 3.1 DA web portal before installing the 4.x version. Prior to installing the DirectoryAnalyzer Web Portal, you must first have the following applications installed: DirectoryAnalyzer version 4.5 or higher DirectoryAnalyzer WMI Provider (installed as part of the 4.0 Enterprise Agent) Microsoft IIS must be configured to run ASP.NET applications. If problems exist running ASP.NET applications, see the Microsoft Knowledge Base Article for a possible solution. Secure Sockets Layer (SSL) is required to use the Admin tab (See SSL Encryption, below, for more details) For the ChangeAuditor integration, the following applications must first be installed: ChangeAuditor version 2.6 or higher ChangeAuditor WMI Provider SSL Encryption Secure Sockets Layer (SSL) must be enabled on the DA Web Portal server to ensure that forest credentials are encrypted between the client web browser and the web server itself. To enable SSL on the IIS server, you must obtain a server certificate from a certificate authority (CA). Upon receipt and installation of the server certificate, the administration portions of the web portal (Admin tab) will become available. If a server certificate has not been previously registered with the IIS server, it may be necessary to restart IIS once the certificate has been installed before any secure pages can be viewed via an SSL connection. For information on how to obtain and install a server certificate and SSL on an IIS server, please refer to the following sources: 57

60 DirectoryAnalyzer IIS 6.0 Administration Guide -> Certificates: ocs/en-us/sec_auth_certificate.mspx Installing Server Certificates: ocs/en-us/sec_auth_certinstallsrv.mspx IIS FAQs: Once SSL is enabled, the IIS administrator can chose to encrypt the entire web portal folder. If the administrator chooses to force SSL for the entire DA Web portal, then access to the portal can only be accomplished by specifying in the address (e.g., If enabling SSL is NOT an option in your environment, a consolidator configuration tool is provided as part of the web portal/consolidator installation which can be used to duplicate the contents of the Admin page as a workaround to getting the Admin page running on the DA Web Portal. This tool is located in the Consolidator folder where the web portal was installed (e.g., c:\inetpub\wwwroot\daportal\consolidator\configmanager). Version Compatibility DirectoryAnalyzer only supports top-down, backward compatibility. That is, the Enterprise Agent must be of equal or a higher version than the Site Agents and the Site Agents must be of equal of higher version than the DC Agents. DirectoryAnalyzer Version 3.1 The new DirectoryAnalyzer web portal can be used in a DirectoryAnalyzer version 3.1 installation; however, the following limitations exist with this configuration: The topology displayed in the web portal is restricted to servers that have or have had alerts. That is, if a server has never had an alert, it will not appear in the topology. The server icons will not indicate the roles that server performs, i.e., there is no indication whether the server is DNS, Global Catalog or Bridgehead server. 58

61 DirectoryAnalyzer Web Portal DirectoryAnalyzer Version 3.5 Enterprise Agent with DirectoryAnalyzer 3.1 (or lesser) Site/DC Agents The new DirectoryAnalyzer web portal will function normally if you have upgraded your Enterprise Agent to 3.5 but left your Site and DC Agents at an earlier version. However, the following limitations exist with this configuration: The new alerts for version 3.5 will not be evaluated. The version 3.5 client will not display the new statistics on the DC Information page. These fields will display N/A. Installing the Web Portal To ensure a successful installation of the DAWebPortal, please use the following procedure: 1. Download (or copy from the distribution media) the DirectoryAnalyzer Web Portal Installation msi file to a secure location on your network. 2. Double-click the Quest DirectoryAnalyzer Web Portal.msi file to install and configure the DirectoryAnalyzer Web Portal. This will launch the DAWebPortal Installation Wizard. 3. On the Welcome screen, select Next to proceed with the installation. 4. You will then be asked to read and agree to the terms in the license agreement. Click on the I accept the terms of the license agreement option and select Next to continue. 5. The DAWebPortal and Consolidator Setup page will appear if the proper versions of Microsoft IIS,.NET Framework and ASP.NET are not installed on the machine. If multiple versions of.net Framework are detected, or if an incompatible version is found, a warning will display stating any installation issues and how to address them. Refer to System Requirements on page 9 to see system requirements for installation. Since these applications must be installed BEFORE the DAWebPortal can be installed, use the Cancel button to exit the installation wizard. Install the required applications and then restart the DAWebPortal Installation Wizard. 6. On the Customer Information page, enter your user name and organization. Select Next to continue. 59

62 DirectoryAnalyzer 7. The Select Installation Folder will then prompt you to select the installation folder for the web portal. A virtual directory created in IIS will point to this folder. The default directory is located at C:\Inetpub\wwwroot\DAPortal, which will create the DAPortal directory under the wwwroot folder. You can select another directory by navigating to it using the drop down box in the Look in field. You can also create a new folder at any location, by clicking on the Create new folder button. Once you have selected the installation folder to be used, select Next. 8. The Set Consolidator Default Port and Name page will then be displayed, prompting you to enter your consolidator port (8085) and name. The port is required to allow communication between the web clients. Once you have entered the port number and consolidator name, select the Next button. 9. The DAWebPortal Group Creation page will be displayed allowing you to create the DAWebAdmins group, which is used by the web portal and multi-forest consolidator to allow administrative access. Users must be a member of this group to access the Administrator functions of the web portal. On this page, select one of the following options: Yes, please create the necessary group for me (default) No, I ll create the necessary group myself 10. On the Ready to Install the Program page, select the Install button to begin the installation. 11. After the installation is complete, select the Finish button to close the DAWebPortal Installation Wizard. Removing the Web Portal When removing DirectoryAnalyzer, use Add/Remove Programs to remove the following applications in the designated order: DirectoryAnalyzer Web Portal, DirectoryAnalyzer WMI Provider, and DirectoryAnalyzer Enterprise Agent. 60

63 6 MOM Integration Introduction Installing the MOM Connector Framework and Product Connector Installing the DirectoryAnalyzer MOM Product Connector and Configuration Tool Configuring and Registering the DirectoryAnalyzer MOM Product Connector Using the MOM/DirectoryAnalyzer Product Connector Service Unregistering the Quest MOM Product Connector Uninstalling the MOM Product Connector Uninstalling the DirectoryAnalyzer MOM Product Connector

64 DirectoryAnalyzer Introduction The MOM Connector Framework provides a service that connects MOM to the Quest DirectoryAnalyzer MOM Product Connector service, enabling bidirectional alert forwarding and synchronization. Alerts generated by MOM are sent to the DirectoryAnalyzer Enterprise Agent and made available as MOM alerts in the client, then update back to MOM when an alert s status or history changes. This version of DirectoryAnalyzer utilizes the MOM Connector Framework to provide more integrated capability with MOM 2005, and can be installed on a computer in the network with a MOM Administrator Console. MOM 2005 is required to run the framework and connector and must be installed from the MOM 2005 installation CD. It is strongly recommended that MOM be installed on a separate machine from where the DirectoryAnalyzer components are installed. In addition, you must have the Microsoft Active Directory Management Pack to monitor the performance and availability of Active Directory. To install the framework and connector, you will run SETUP.EXE from the MOM product CD. This chapter explains how to install, configure, use, unregister and uninstall the MOM Product Connector. 62

65 MOM Integration Installing the MOM Connector Framework and Product Connector To begin installing the MOM Connector Framework and Product Connector, you must be logged on to a computer with a MOM Administrator Console. To install the framework and connector: 1. Once logged on to a local computer with a MOM Administrator Console, double-click SETUP.EXE on the MOM product CD. 2. In the Microsoft Operations Manager 2005 Setup Resources dialog box, select Install Microsoft Operations Manager 2005 to start the MOM 2005 Setup Wizard. 63

66 DirectoryAnalyzer 3. On the Program Maintenance page, verify that Modify is selected, then select Next. 4. On the Custom Setup page, expand MOM 2005 Server Components. 5. Select the down arrow next to Connector Framework, then select This component will be installed on local hard disk. 64

67 MOM Integration 6. Select the down arrow next to MOM Product Connector, then select This component will be installed on local hard disk, and select Next. 7. The Prerequisite Check page indicates whether you have met the requirements for installing the MOM Database components. To see details, select the View Log button. 8. On the Data Access Server Account page, enter the Data Access Server (DAS) account that you used to install MOM. Setup uses this account to communicate with the database only during installation. You must use the same DAS account that you used for the MOM Database setup. 9. On the Ready to Modify the Program page, select the Install button to begin installation. Verify that the Disable Execution check box is de-selected (unchecked). If checked, de-select (uncheck) the box then select Apply, then OK, and close the dialog. Next you will assign an alert to DirectoryAnalyzer. Validating MOM Connector Service Availability and Credentials: You will need to validate the credentials that you intend to use to connect to the MOM server and ensure that the MOM Connector Service is running. 1. Open an Internet Explorer window and enter the following address in the browser: where: <yourmomserver> will be the FQDN 2. When prompted for credentials, use an account that is listed in the MOM Administrators group. The recommended account is the one used as the Management Action Account. 3. The following screen should appear. 65

68 DirectoryAnalyzer Installing the DirectoryAnalyzer MOM Product Connector and Configuration Tool 1. The MOM Connector Service used by DirectoryAnalyzer should now be installed onto the Enterprise Agent server. 2. Next, locate the Quest DirectoryAnalyzer Product Connector.msi in the MOM2005 folder to install the DirectoryAnalyzer Product Connector and Quest MOM Product Connector Configuration tool. 3. Double-click this file to launch the DirectoryAnalyzer MOM Product Connector InstallShield wizard. 4. Enter the requested information on the wizard screens as described below. If you are installing the DirectoryAnalyzer MOM Product Connector on a running Enterprise Agent, you will need to disconnect then reconnect the Enterprise Agent to display MOM-applicable controls within the DirectoryAnalyzer client. 66

69 MOM Integration DirectoryAnalyzer MOM Product Connector InstallShield Wizard Double-clicking the Quest DirectoryAnalyzer Product Connector.msi file will launch the DirectoryAnalyzer MOM Product Connector InstallShield wizard. The DirectoryAnalyzer MOM Product Connector InstallSheild wizard consists of the following screens: Welcome License Agreement Customer Information Setup Type Ready to Install the Program InstallShield Wizard Complete The following sections provide a description of the wizard screens and the information that is to be provided. Welcome Double-click the file to launch the Welcome screen of the DirectoryAnalyzer MOM Product Connector InstallShield Wizard. Select Next to continue to the License Agreement screen. License Agreement By selecting the I accept the terms in the license agreement option, you acknowledge that you have read and agree to the terms of the agreement. If you do not accept the terms of the agreement, the installation program will not continue. After selecting the I Accept option, select Next to continue. 67

70 DirectoryAnalyzer Customer Information After licensing the product, the setup wizard will prompt you for user information on the Customer Information screen. This screen allows you to enter the following information about the user currently logged in. User Name Enter the name of the user currently logged in. Organization Enter the name of this user s company/organization. Install this application for Select one of the two options to specify whether the application is to be added to a user profile for all users or a specific user: Anyone who uses this computer (all users) (default) Only for me (current user) Select Next to continue. 68

71 MOM Integration Setup Type The wizard will then ask which setup type you prefer. The Setup Type screen allows you to choose from the following options: Complete Select this option to install all product features. Custom Select this option to choose which features to install and the location where you want to install them. Recommended for advanced users. Once you have chosen an option, select Next. Ready to Install the Program The wizard is now ready to install the program. Select the Install button to begin installing the Quest MOM Product Connector Configuration tool. 69

72 DirectoryAnalyzer InstallShield Wizard Complete The final screen will display when the installation has completed. The DirectoryAnalyzer Product Connector is now installed. By default, the Launch the Configuration Tool box is checked. Uncheck this box if you wish to configure the DirectoryAnalyzer MOM Product Connector at a later time, otherwise select the Finish button to launch the configuration tool immediately. Configuring and Registering the DirectoryAnalyzer MOM Product Connector The Configuration Tool registers the DirectoryAnalyzer MOM Product Connector with MOM and starts the connector service. It launches immediately once the DirectoryAnalyzer Product Connector wizard completes installation of the connector and tool (if the Launch the Configuration Tool box was checked). Otherwise, you can launch the Configuration tool by running the ConfigurationTool.exe file that was previously installed by the.msi. You can locate the file at Start Quest Software DirectoryAnalyzer Quest MOM Product Connector Configuration, or C:\Program Files\Quest Software\DirectoryAnalyzer\MOMConnector. The DirectoryAnalyzer to MOM Product Connector Configuration Wizard will launch. You are able to select Finish at any time from the following screens, as most of the fields in the Configuration tool will already contain information previously entered when the Enterprise Agent was installed. See Installing the Enterprise Agent for more details. 70

73 MOM Integration DirectoryAnalyzer to MOM Product Connector Configuration Wizard The DirectoryAnalyzer to MOM Product Connector Configuration wizard consists of the following screens: Select Operation Configure the Connector Credentials for the EA Server s SQL Database Configuration for Connection to the MOM Server Credentials Required to Access MOM Connector Service Register the Product Connector with MOM Configuration Wizard Complete The following sections provide a description of the wizard screens and the information that is to be provided. Select Operation At startup, verify that the Register DirectoryAnalyzer Product Connector radio button is selected. Select Next. 71

74 DirectoryAnalyzer Configure the Connector On the Enterprise Agent Configuration screen, verify that the Enterprise Agent server and the database instance name are correct. Enterprise Agent DNS Name Specifies the server where the Enterprise Agent is located. Enterprise Agent Database Instance Specifies the name of the Enterprise Agent database. Select Next. 72

75 MOM Integration Credentials for the EA Server s SQL Database Verify the settings to use to connect the Enterprise Agent to the database. Use Windows Integrated Authentication (default) Specifies that Integrated Windows Authentication will be used to authenticate the following credentials. Select from the following options: Use LocalSystem to Access EA Database Supply Windows Credentials (default) Account Domain Specifies the domain for the Windows account to be used to access the SQL server/instance. Username for Windows Account Specifies the username for the Windows account to be used to access the SQL server/instance. Password / Confirm Password Select Next. Specifies the password associated with the user account entered above. 73

76 DirectoryAnalyzer Configuration for Connection to the MOM Server This screen prompts you to configure the MOM service connection. Enter information as explained below: MOM Server URI Type the URI you used to validate MOM service. Product Connector Resolution State Name Specifies the name of the product connector as you want it to appear in the MOM system. Product Connector Resolution ID Specifies the resolution state value that MOM will use when an alert status is assigned to DirectoryAnalyzer. Assigned to DirectoryAnalyzer Resolution ID Specifies the value that was assigned from the MOM Administrator console. This value should be one more than the Product Connector Resolution ID specified above. 74

77 MOM Integration Update Interval (in seconds) Specifies the frequency that the Quest MOM connector service polls the MOM Management server for New/Updated Alerts. Default: 20 seconds. Maintenance Interval (in seconds) Select Next. Specifies the frequency with which the Quest MOM Connector service will clean resolved alerts from the Enterprise Agent database. Default: 3600 seconds. Credentials Required to Access MOM Connector Service This screen prompts you to enter credentials to access MOM Connector Service. This account must be a local admin to the machine from which the MOM Connector Service is run. Select from the following options: Use LocalSystem credentials for MOM Access (not recommended) Supply Windows Credentials (default) 75

78 DirectoryAnalyzer Account Domain Specifies the domain for the Windows account to be used to access the SQL server/instance. Windows Username Specifies the username for the Windows account to be used to access the SQL server/instance. Password Specifies the password associated with the user account entered above. It is recommended that you use the same credentials used in prior steps to verify access to the connector service, then select Next to continue to the Register the Product Connector with MOM screen. Register the Product Connector with MOM The registration page displays a summary of the configurations up to this point. Select the Register button to add the product connector to MOM. If this is the first time creating the connector, or if the service has not yet been registered, the Next button will be disabled. Only after the register process has completed is the button enabled, then you MUST select the Next button to continue to the following screen. 76

79 MOM Integration Configuration Wizard Complete When registration is complete, select the Start Service button starts/restarts the connector service. Upon successful startup of the service, a message will display notifying you that the service has or has not been started. Select OK, then select the Finish button on the wizard screen to exit. Once the Enterprise Agent communicates to the DirectoryAnalyzer Client that a MOM Connector is available and running, the client will display a message indicating that the MOM connector is now available, and will enable the appropriate tabs, pages and controls. When the DA Client is informed that the MOM Connector is not available, the client will display a message indicating the loss of the connector, then disable MOM tabs and hide/remove related pages and controls. The control switches to the Current Alerts tab when the MOM tab becomes disabled. A message displays to inform you once the connector becomes available again, and the MOM tabs and pages are re-enabled. 77

80 DirectoryAnalyzer Using the MOM/DirectoryAnalyzer Product Connector Service This section explains how to use the DirectoryAnalyzer MOM Product Connector Service to perform the following tasks: Assign alerts from MOM to DirectoryAnalyzer Respond to assigned alerts within the DirectoryAnalyzer console Use ChangeAuditor integration Use DirectoryTroubleshooter integration Assigning Alerts from MOM to DirectoryAnalyzer Once the product connector service is running, you will need to assign an alert to DirectoryAnalyzer from MOM. To assign alerts: 1. Open the MOM Operations Console on your MOM server and go to the Alert View. 2. Set the resolution state of the alert to DirectoryAnalyzer Product Connector. 3. When the alert returns as Assigned to DirectoryAnalyzer, the Enterprise Agent has received the alert information from MOM and has placed the information into the agent s SQL store and acknowledged receipt to MOM. Responding to Assigned Alerts within the DirectoryAnalyzer Console From the DirectoryAnalyzer console you can: change the alert resolution state view alert product knowledge (via the More Info button) view and add alert history. 78

81 MOM Integration To respond to alerts: 1. Launch the DirectoryAnalyzer Console and connect to the Enterprise Agent that is also running the DirectoryAnalyzer/MOM Product Connector Service. 2. To view MOM alerts, select the Windows menu and MOM Alerts. Using ChangeAuditor and DirectoryTroubleshooter Integration You can use ChangeAuditor and DirectoryTroubleshooter integration in the same way as with Enterprise Agent generated alerts. Within the MOM console, you can assign alerts from the Microsoft Active Directory Management Pack to the DirectoryAnalyzer Product connector. 1. In the DirectoryAnalyzer console, select the MOM alert from the MOM Alerts tab grid. 2. Select the ChangeAuditor or DirectoryTroubleshooter tab from the lower pane. Pre-selected facilities related to the selected MOM alert will display. Unregistering the Quest MOM Product Connector To uninstall the connector service, you must unregister the DirectoryAnalyzer Product Connector with MOM using the Quest MOM Product Connector Configuration Wizard. It is recommended that you first manually stop the MOM Connector Service using Services from Administrative Tools in the Start menu. To unregister the MOM Product Connector: 1. Run the ConfigurationTool.exe file that was installed by the DirectoryAnalyzer Product Connector.MSI file. The file can be found at: Start Programs Quest Software DirectoryAnalyzer Quest MOM Product Connector Configuration or C:\Program Files\Quest Software\DirectoryAnalyzer\MOMConnector. 79

82 DirectoryAnalyzer 2. Once the configuration tool launches, select Unregister DirectoryAnalyzer Product Connector, then select the Next button. 3. The connector location will show in the display window. Select the Unregister button to begin unregistering the product connector. The following screen will display its progress. 4. When the screen states that the connector is unregistered, you will continue to the last screen. The Configuration Wizard has completed the unregistration, and you can now uninstall the MOM Product Connector and the DirectoryAnalyzer Connector. Uninstalling the MOM Product Connector To uninstall the MOM Product Connector: 1. From the Control Panel, open Add/Remove Programs on the computer with MOM locally installed. 2. Select Microsoft Operations Manager, then select the Change button. The MOM Setup Wizard will launch. 80

83 MOM Integration Select Next. 3. By default, the Modify button is selected. Select Next. 4. On the Custom Setup page, expand MOM 2005 Management Server. 5. Select the down arrow next to the MOM Connector Framework, then select This component will not be available. 6. Select the down arrow next to the MOM Product Connector, then select This component will not be available. Select Next. The Setup Wizard will complete the uninstallation or provide you with details of a failed uninstall. 81

84 DirectoryAnalyzer Uninstalling the DirectoryAnalyzer MOM Product Connector If you uninstall the connector while it is running, it may not uninstall completely. Ensure that you have unregistered the connector using the Quest MOM Product Configuration tool. To uninstall the product connector: 1. From the Control Panel, open Add/Remove Programs on the computer where the DirectoryAnalyzer Product Connector is installed. 2. Select Remove. A dialog will display prompting you to verify whether you want to remove the product connector. Select Yes to confirm the uninstall operation. 82

85 7 Removing DirectoryAnalyzer Introduction Removing Site and DC Agents Removing the DirectoryAnalyzer Client Removing the Enterprise Agent

86 DirectoryAnalyzer Introduction This chapter explains how to remove DirectoryAnalyzer from your Active Directory network. DirectoryAnalyzer components should be removed in the following order: Site and DC Agents (using the Deployment Wizard) Client (using Add/Remove Programs) Enterprise Agent (using Add/Remove Programs) Removing Site and DC Agents You will use the Deployment Wizard to remove Site and DC Agents. 1. Select Start Programs Quest Software DirectoryAnalyzer DirectoryAnalyzer Deployment Wizard to launch the Deployment Wizard. The Deployment Wizard screens are the same as the initial installation screens, except that you now have additional actions that can be taken against a domain controller. 2. On the Agent Configuration screen, select/highlight the Site or Enterprise. Click on the action and select Remove All Agents. 3. On the Deployment Action Summary screen, review your selections to ensure they are correct and select Execute to start the removal process. Agent Deployment Wizard The Agent Deployment wizard consists of the following pages: Welcome to the DirectoryAnalyzer Deployment Wizard Select an LDAP Server Specify Enterprise Agent Determine Configuration Agent Configuration Deployment Action Summary Deployment Wizard Complete 84

87 Removing DirectoryAnalyzer The following sections walk through the Deployment Wizard screens and provide information that applies to removing Site and DC Agents. Welcome to the DirectoryAnalyzer Deployment Wizard The first screen displayed is the Welcome screen for the Deployment Wizard. Select Next. Select an LDAP Server The Select an LDAP Server screen allows you to specify a Windows Server 2000/2003/2008 server to be used to determine the site layout of your network. This screen also allows you to specify alternate LDAP credentials to be used for read and write access to Active Directory. Enter the following information on this screen: Domain Controller Enter the fully qualified DNS name of a Windows Server 2000/2003/2008 domain controller. Use Windows credentials as LDAP credentials Select/check this check box to use the current Windows credentials as the LDAP credentials. Uncheck this check box to specify alternate credentials. Domain Name Enter the name of the domain to be used by the Deployment Wizard to access Active Directory. User ID Enter the name of the user to be used to access Active Directory. Password Enter the password associated with the user ID entered above. 85

88 DirectoryAnalyzer Tell Me More Select the Tell Me More button for a thorough explanation of the credentials the wizard uses. If you have DirectoryAnalyzer version 1.6 or greater installed, then the Deployment Wizard uses the credentials of the user it is running as to check the Agent Topology facility for permission to continue. It does not use the LDAP credentials. Please see the DirectoryAnalyzer Security Administrator's Guide for details. For access to Active Directory, the Deployment Wizard can use the credentials of the user it is running as, or you can provide different credentials by unchecking the Use Windows credentials as LDAP credentials check box. The credentials from this screen are used for all reads and writes to Active Directory. The Deployment Wizard writes to Active Directory for the following: Installation of DirectoryAnalyzer base security. Extended rights are added to the Extended-Rights container of the Configuration NC, and a container called Quest is added to the Services container in the Configuration NC. This is required and is not optional, but is only done once. If base security has not been installed, then the credentials provided here will need permission to do this, which typically means Enterprise Admin level access. Optional installation of a security group and DACL attribution. This feature is explained in detail later in the deployment process. If you choose to install this optional feature, then the credentials provided here will need permissions equivalent to Enterprise Admin and Schema Admin level access. After entering the server and credential information, select Next to continue. Once the site layout has been determined with the specified rights, the remaining steps of the wizard will use the credentials of the logged in user. The currently logged in user must have sufficient rights to: Copy files to the servers. Create, remove, stop and start services. Read and write the registry on the remote machines (including HKLM\SOFTWARE and HKLM\SYSTEM\CurrentControlSet). 86

89 Removing DirectoryAnalyzer Specify Enterprise Agent The wizard will then display the name of the member server (or domain controller) currently hosting your Enterprise Agent. If the name of your Enterprise Agent is not being displayed, use the arrow and select it from the drop-down list or enter the name of the member server (or domain controller) that is hosting your Enterprise Agent. Select Next to continue. Determine Configuration The wizard will then ask you to wait while it queries the Enterprise Agent to obtain the necessary configuration information needed to proceed. Once the wizard has obtained the necessary configuration information and established your default configuration, select Next. Agent Configuration The Agent Configuration screen will allow you to remove individual agents or all DirectoryAnalyzer agents from a site or from the entire enterprise. 87

90 DirectoryAnalyzer To remove move individual agents: 1. Select/highlight the domain controller(s) that contain an agent that is to be removed. 2. Click on the action and select the appropriate action: Remove Site Agent or Remove DC Agent. To remove all agents from a Site or the entire Enterprise: 1. Select/highlight the Site or Enterprise. 2. Click on the action and select Remove All Agents. Once you have made your selections, select Next to continue. Deployment Action Summary A screen similar to the Agent Configuration screen will be displayed that summarizes the configuration changes you are about to apply to your enterprise. Review your selections to ensure they are correct and select Execute to start the removal process. After selecting the Execute button, the Status column will detail the status of the removal process. If errors were encountered, a red X will mark the objects (Directory column) that generated the error(s). In addition, if you click on a server, real-time status will be displayed in the text box at the bottom of the screen. The View Log button will become available, which you can select if you want to view the text file containing a detailed log of the steps taken during the process and any errors that occurred. Once the removal process is completed, a pop-up will display stating that the process was successful or warning you that errors were encountered. Select the Finish button to continue. Deployment Wizard Complete The Deployment Wizard Complete screen will then be displayed. This screen displays whether there were any errors encountered during the removal process as well as Quest contact information. To view the errors or logs for the removal process, select the View Log button. Select OK to exist the Deployment Wizard. 88

91 Removing DirectoryAnalyzer Removing the DirectoryAnalyzer Client Once you have removed the Site and DC agents, you can then remove the DirectoryAnalyzer Client. To remove the DirectoryAnalyzer Client, use the Windows Add/Remove Programs facility, as described below. 1. From the Start menu, select Settings Control Panel Add/Remove Programs. 2. Select/highlight Quest DirectoryAnalyzer Client and select the Remove button. Removing the Enterprise Agent Once you have removed the DC and Site agents and the Client, you can then remove the Enterprise Agent. To remove the DirectoryAnalyzer Enterprise Agent, use the Windows Add/Remove Programs facility, as described below. 1. From the Start menu, select Settings Control Panel Add/Remove Programs. 2. Select/highlight Quest DirectoryAnalyzer Enterprise Agent and select the Change button. 3. The Enterprise Agent Wizard will run. Select Remove from the options presented. 89

92

93 Appendix A DirectoryAnalyzer and SNMP DirectoryAnalyzer uses the Windows 2000 SNMP service to send alert messages via SNMP traps. To generate SNMP traps, the Windows 2000 SNMP service must be installed and properly configured on the machine(s) that hosts a DirectoryAnalyzer Enterprise Agent. The Enterprise Agent can then communicate the alert information to the Windows 2000 SNMP service. In the SNMP Trap message, the first variable of each trap refers to the following severity levels: 0 = Disabled 1 = Clear 2 = Warning 3 = Critical To enable SNMP alert capability in DirectoryAnalyzer: 1. Install the SNMP service (if it is not already installed) on the machine that will host the DirectoryAnalyzer Enterprise Agent: Select Start Settings Control Panel Add/Remove Programs. Select Add/Remove Windows Components. Select Management and Monitoring Tools and click on Details. Check the box for Simple Network Management Protocol and click OK. Click on Next and follow the instructions until the installation process is complete. 2. Configure the SNMP service: Select Start Settings Control Panel Administrative Tools. Select Services. Scroll down and find SNMP Service. Right click on SNMP Service and select Properties. Select the Traps tab and add a Community name of Public and Trap destinations that contain the IP Addresses of the machines that will receive the SNMP traps, then select OK. 91

94 DirectoryAnalyzer 3. Stop and restart the SNMP Service. 4. Compile the DirectoryAnalyzer MIB into the SNMP management console(s) on the machine specified to receive SNMP traps in Step 2. Copy the DirectoryAnalyzer MIB (C:\Program Files\Quest Software\DirectoryAnalyzer\Enterprise Agent\DA.MIB) to the appropriate computer(s). Use the compile or load utility that is associated with the management console you are using. (Consult your management console documentation for detailed instructions.) 5. Install DirectoryAnalyzer, making sure to specify, Yes, I have the Windows SNMP service installed, configure DA to use it on the SNMP Configuration screen when running the Enterprise Agent MSI package. 6. Confirm that the DirectoryAnalyzer Client has SNMP Alerts enabled. Launch the DirectoryAnalyzer Client (Start Programs Quest Software DirectoryAnalyzer DirectoryAnalyzer Client). Select Options and verify that SNMP Alerts has a check mark next to it. 92

95 Appendix B Importing and Configuring the DirectoryAnalyzer MOM Management Pack DirectoryAnalyzer alert information can be accessed via the DirectoryAnalyzer MOM Management Pack. This appendix explains the requirements and procedures for installing the DirectoryAnalyzer MOM Management Pack, which is located in the \Install\MOM2005 directory on the DirectoryAnalyzer Product DVD. Microsoft Operations Manager (MOM) Integration DirectoryAnalyzer extends its Active Directory monitoring and alerting coverage to one of the leading network management consoles: Microsoft Operations Manager (MOM). The Microsoft Operations Manager console interface can be configured to receive all DirectoryAnalyzer alerts and view the DirectoryAnalyzer knowledge base entries for alerts (vendor information placed into MOM as Product/Company Knowledge ). DirectoryAnalyzer utilizes MOM s Management Pack technology for the integration path between the two products enabling administrators who use the Microsoft Operations Manager console to obtain the most detailed view and analysis of Active Directory issues. Requirements MOM must be installed before the DirectoryAnalyzer MOM Management Pack can be used. For more information about MOM, go to the Microsoft Operations Manager Web site ( A MOM agent must reside on the DirectoryAnalyzer Enterprise Agent in order to enable the DirectoryAnalyzer MOM Management Pack. For more information about installing MOM, see Microsoft Operations Manager Help. DirectoryAnalyzer must be installed, as described earlier in this document. 93

96 DirectoryAnalyzer Importing/Updating the DirectoryAnalyzer Management Pack To monitor an Active Directory Enterprise, the DirectoryAnalyzer Management Pack must be imported into Microsoft Operations Manager (MOM). This can be done by performing the following actions: 1. On the Start menu, point to Programs > Microsoft Operations Manager, and then click MOM Administrator Console. 2. In the left pane, highlight Microsoft Operations Manager (default), then from the right pane, select option 2, Import Management Pack. The Management Pack Import/Export Wizard launches. 3. Select Next to display the following screen, select the Import Management Packs and/or reports option (default), then select Next again. 4. The screen will prompt you to select a folder where the management pack is located. Select the Browse button to search for the DirectoryAnalyzer Product DVD. Locate the MOM2005 directory. In the Type of Import box, Import Management Packs only is selected by default. Select Next. 5. The Select Management Packs screen will display a list of packs located in the MOM 2005 folder. Highlight DirectoryAnalyzer Management Pack.akm 6. You can select from further import options to update (default) or replace an existing pack. Select the Backup existing Management Pack (default) check box to save a backup of a current pack and use the Browse button to locate the specific pack. Once your option preferences have been selected, select Next to continue. 7. The final wizard screen allows you to review your selections. Select Finish to close the wizard and begin importing the DirectoryAnalyzer Management Pack. A dialog will display the status of the import operation. 8. After importing, the following should be present and displayed within the MOM Administrator Console: A Quest DirectoryAnalyzer rule group. Under that will be rule groups for DC Alerts, NC Alerts, and Site Alerts. Quest DirectoryAnalyzer Alerts view under "All: Alert Views" Quest DirectoryAnalyzer TopLevelComponent Computer Attribute (determines what servers are DirectoryAnalyzer Enterprise Agents) Quest DirectoryAnalyzer Enterprise Agent Computer Group Next, you will need to verify that the MOM server is configured properly. 94

97 Importing and Configuring the DirectoryAnalyzer MOM Management Pack Configuring the MOM Server After importing the management pack into MOM, you will need to make sure that the MOM server is configured in order to verify that the changes to the configuration will be committed. If the changes aren t committed, the rules are not sent until the Agent Request configuration interval completes. If the imported management pack appears to function incorrectly, verify that the MOM Agent Action Account has enough privileges. 1. From the MOM 2005 Administrator Console, select Global Settings in the Administration folder from the explorer. 2. Double-click Security from the settings which display in the right pane. The Security tab will display. 95

98 DirectoryAnalyzer 3. Verify that the Disable Execution check box is de-selected (unchecked). If checked, de-select (uncheck) the box then select Apply, then OK, and close the dialog. 96

99 Appendix C DirectoryAnalyzer Database Access & Event Log Database Access Directory Analyzer supports both SQL Server authentication modes: Windows SQL Server Refer to the Microsoft SQL Server documentation for a detailed description of supported authentication modes. Windows (Integrated) This is the recommended authentication mode. SQL Server (Mixed Mode) In order to utilize SQL Server authentication, the server instance must be configured to support both SQL Server and Windows authentication. In SQL Server Enterprise Manager, this appears on the Security property page of the database instance. 97

100 DirectoryAnalyzer When attempting to connect to a database instance using SQL Server credentials, the following error message generally indicates that the database instance has not been configured to support SQL Server authentication: Login failed for user user-name. Reason: Not associated with a trusted SQL Server connection. Database Credentials Server Requirements With the typical DirectoryAnalyzer installation, the Enterprise Agent service does not require dedicated database credentials to access the database. In a typical installation, SQL Server 2005 Express Edition is installed on the Enterprise Agent host. Consequently, the Enterprise Agent service utilizes the authority of the Local System Account to access the database. No additional intervention is required. 98

101 DirectoryAnalyzer Database Access & Event Log If, however, you wish to use a pre-existing SQL Server instance, you must select a SQL Server authentication mode and supply the appropriate credentials during the installation process. The credentials are encrypted and submitted to the Local System Authority of the Enterprise Agent host for safe keeping. After installation, the DAConfigureDatabase utility can be used to modify the credentials used to access the database. The path to this executable is found at: C:\Program Files\Quest Software\ DirectoryAnalyzer\Enterprise Agent\ To modify existing credentials: 1. Prior to running the DAConfigureDatabase command, stop the Enterprise Agent service. 2. Type DAConfigureDatabase at the command prompt. The following screen will be displayed. DirectoryAnalyzer does not cache credentials. The credentials are managed by the LSA (Local System Authority) of the host computer. Consequently, the installer package and the database configuration utility (DAConfigureDatabase) must be executed on the host computer. 99