Password Reset Server Installation

Transcription

1 Password Reset Server Installation Vista/Server 08 and Windows 7/Server 2008 R2 Table of Contents I. Requirements... 4 A. System Requirements... 4 B. Domain Account Requirements... 5 C. Recommendations... 5 II. Before You Begin... 6 A. Administrative Access... 6 B. Installation Process... 6 C. Installing IIS Windows Vista / Windows Windows Server 2008 / Windows Server 2008 R D. Installing ASP.NET before IIS E. Installing ASP.NET 2.0 and the.net Framework 3.5 SP F. Installing SQL Server G. Creating a SQL Server Database Creating the Database Creating the SQL Server User... 23

2 III. Password Reset Server MSI...24 A. Download the latest version of Password Reset Server B. Running the MSI Standard Option Advanced Option File Destination Application Name Completing Installation from Password Reset Server IV. Completing Password Reset Server installation from website...26 V. Manual Installation Creating website (No MSI)...28 A. Installing as a Virtual Directory B. Installing as part of a Website C. Configuring the Pipeline Changing the Pipeline Mode Creating a New Application Pool VI. Appendix...35 A. SQL Server 2008 Express Prerequisites B. Installing PowerShell Windows Vista Windows Windows Server 2008 / Windows Server 2008 R C. Virtual Accounts... 36

3 D. Creating a Domain Account to Reset Passwords E. SSL Certificate What is an SSL Certificate? Where can I obtain an SSL Certificate? F. Installing an SSL Certificate Installing certificate from a 3rd Party Creating and installing your own

4 I. Requirements NOTE: This is the installation guide for Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2. If you are looking for the installation guide for Windows XP and Windows Server 2003, please click here. A. System Requirements 1. Microsoft SQL Server 2005 or Microsoft SQL Server One of the following operating systems: Windows Server Windows Server 2008 R2 Microsoft Windows Vista Ultimate, or Windows Vista Business 2. Microsoft Windows 7 Ultimate, or Windows 7 Professional2. 3. Microsoft Internet Information Services (IIS) (Internal Part of Operating System) 4. Microsoft.NET Framework 3.5 with Service Pack 1. Both 32-bit and 64-bit editions are supported. 4 NOTE: Windows 7 and Windows Server 2008 R2 come with the.net Framework 3.5 SP1 already installed. You do not need to install the.net Framework if you are using one of these operating systems. NOTE: An important security update has been released for the Microsoft.NET Framework. Please ensure that this update is installed on your server to ensure maximum security. For further detail and how to obtain the patch, please click here. 1 Both 32-bit and 64-bit Editions of Windows are supported. You must install the proper version of the.net Framework to support 64-bit. 2 Windows Vista/7 is only supported for testing environments. Microsoft does not support this operating system as a production environment.

5 B. Domain Account Requirements 1. Each Domain will need a Domain Account to synchronize the Users and Reset Passwords. See the section CREATING A DOMAIN ACCOUNT TO RESET PASSWORDS for instructions for setting up the domain account. C. Recommendations 1. Use a SSL Certificate for Password Reset Server. 2. Run Microsoft Update on your server to make sure all components are up to date. 5

6 II. Before You Begin A. Administrative Access Throughout most of this installation, you will be required to be an administrator to perform most of these actions. Please ensure that you are logged on to your system with an account that has Administrative permissions. B. Installation Process Components should be installed in this order. 1. Internet Information Services (IIS) 2. ASP.NET 2.0 /.NET Framework 3.5 SP1 (Windows Vista / Server 2008 Only) 3. SQL Server Password Reset Server 6

7 C. Installing IIS IIS is an internal part of the Microsoft Windows Operating System. Installing it will vary depending on which version of the Operating System you are using. 1. Windows Vista / Windows 7 Please ensure you have your Windows installation disk available if the system asks for it. This disk should have been included with the System Manufacturer or the Administrator that installed Windows on that machine. 1. Start by clicking the Start Menu, then Control Panel. 2. Open the Programs and Features Control Panel item. 3. On the left pane, click Turn Windows Features on or off. 4. A dialog like this should appear. It may take a moment or two for the system to load. 7

8 8 Expanding Internet Information Services > World Wide Web Services > Application Development Features and checking ASP.NET will also check other needed dependencies. 5. Expand Common Http Features and check the following: a. Static Content b. Default Document

9 6. Click OK. At this point, Windows will now install IIS. It may ask you for your operating system s disk. 7. At this point, IIS is now installed. Depending on your operating system, Windows may ask you to restart your computer. You can verify the installation of IIS by opening the Control Panel, clicking Administrative Tools, and an icon in there should now appear called Internet Information Services. We recommend you run Windows Update to get the latest security patches for IIS once you have IIS installed. 9

10 2. Windows Server 2008 / Windows Server 2008 R2 To install Internet Information Services on Windows Server 2008 or Server 2008 R2, you will give your server the Web Server (IIS) role. 1. Begin by opening the Server Manager and selecting Roles Click Add Roles. 3. Select the Web Server (IIS) role.

11 4. Click Next >. 5. Selecting the Web Server (IIS) role will automatically select all of the features needed to run this role. When the dialog appears, select Add Required Features When asked for the services of the Role you want to enable, select ASP.NET under Application Development.

12 12

13 7. Checking ASP.NET will prompt you to automatically check other role services needed to run ASP.NET. Select Add Required Role Services to continue. 8. Also ensure that Static Content, Default Document, and HTTP Errors are selected under Common HTTP Features. 9. Click Next >. 10. After confirming your installation, the installation will begin 13

14 11. Finally once the installation is complete, a summary dialog will appear. 14

15 12. Click Close. 15 Your server is now configured to run Password Reset Server.

16 D. Installing ASP.NET before IIS NOTE: This is only applicable to Windows 7 and Windows Server We recommend installing IIS before you install ASP.NET. However, if the.net Framework 3.5 was already installed before IIS was, there are some additional steps required to configure ASP.NET in IIS. You must register ASP.NET in IIS. This step is only necessary if you installed the.net Framework 3.5 before IIS. 1. Begin by clicking Start > Run, then type in cmd.exe and click OK At the command prompt, type cd %WINDIR%\Microsoft.NET\Framework\v and press enter. TIP: If you are using the x64 Edition of Windows and the.net Framework, you should use: cd %WINDIR%\Microsoft.NET\Framework64\v Then at the command prompt, type aspnet_regiis.exe /i" and press enter. The ASP.NET registration into IIS will then begin. After a few moments, ASP.NET will be registered in IIS.

17 Warning: This command requires elevated privileges in Vista if UAC (User Account Control) is enabled. You can do this by opening the start menu, find the Command Prompt, right-click, and select Run as Administrator. Running it without Administrative Privileges will result in the error An error has occurred: 0x Unspecified error ASP.NET is now correctly registered.

18 E. Installing ASP.NET 2.0 and the.net Framework 3.5 SP1 TIP: We recommend installing IIS before you complete this process. TIP: This is only applicable to Windows 7 and Windows Server Begin by downloading the.net Framework 3.5 SP1. 2. Execute the download to begin the installation process. 3. Once setup is complete, ASP.NET and the.net Framework are now properly installed on your system. WARNING: Microsoft has released an update for the.net Framework 3.5 SP1 which contains compatibility fixes for applications running on previous versions of the.net Framework. It is recommended that this update is installed after the.net Framework 3.5 SP1 has been installed. It can be downloaded here: 18 WARNING: An important security update has been released for the Microsoft.NET Framework. Please ensure that this update is installed on your server to ensure maximum security. For further detail and how to obtain the patch, please click here.

19 F. Installing SQL Server 2008 We recommend using SQL Server A free edition called SQL Server 2008 Express is available to download for free. WARNING: SQL Server 2008 SP1 must be installed immediately after the installation is complete to resolve compatibility issues with Windows 7 and Windows Server 2008 R2. WARNING: SQL Server 2008 Express has some prerequisites that must be installed first. Please see our appendix for required software for SQL Server 2008 Express. The instructions given below are for the SQL 2008 Express Edition with Tools. The installation processes for other editions such as Enterprise or Standard may be similar, but not the same. TIP: There are several editions of SQL Server 2008 Express. We recommend downloading SQL Server 2008 Express with Tools. This KB article has the link on Microsoft s site Download the installation package, right-click it and select Run as Administrator if you have UAC enabled. 2. From the welcome screen, select Installation from the left menu.

20 20 3. Select New SQL Server installation stand-alone installation or add features to an existing installation. 4. SQL Server will then initialize your installation. 5. SQL Server may ask you to install some preparation files first. Select Install

21 21 6. Continue to click next until the Feature Selection screen is next 7. Select Database Engine Services and Management Tools Basic and select Next.

22 22 8. Under Instance Configuration click Next. 9. Ensure your environment meets all of your Disk Space requirements. 10. For Server Configuration click Use the same account for all SQL Server services. a. Under the Account Name drop down list select NT AUTHORITY\NETWORK SERVICE b. Do not enter anything into the password field. c. Click OK. d. Click Next 11. For Database Engine Configuration, the installer will then ask you if you want to enable Mixed Mode or Windows only mode. a. Mixed Mode (Recommended)

23 Mixed Mode is required if you intend on using a SQL Server account to authenticate Password Reset Server to your SQL Server. If you are doing an evaluation and using the Password Reset Server MSI, we recommend Mixed Mode with a SQL Authentication account. See Creating the SQL Server User for instructions. b. Windows Mode This will prevent SQL Server account authentication and require a Windows Service account to run the Password Reset Server website. This will also require additional configuration in IIS once Password Reset Server is installed. There is a KB article that walks through the advanced setup at support.thycotic.com. Click the Add Current User for the SQL Server Administrators. 12. Continue to click next until the Ready to Install step is reached. Ensure all of the configuration options look correct. 13. SQL Server 2008 Express is now installed. TIP: We recommend running Microsoft Update to get all of the latest service packs and fixes for SQL G. Creating a SQL Server Database Creating the Database 1. Open Management Studio Express. 2. Connect to your SQL Server database. 3. Right click the Databases folder and select New Database " 4. Enter a database name and click OK 2. Creating the SQL Server User 1. Open Management Studio Express. 2. Connect to your SQL Server Database. 3. Expand the Security folder.

24 4. Right click Logins and select New Login Enter a new username and password. 6. Select the User Mappings from the left menu. 7. Check the checkbox next to your Password Reset Server database. 8. Give the user db_owner permission. 9. Click OK. III. Password Reset Server MSI TIP: Make sure you have the prerequisites installed before attempting to setup Password Reset Server.

25 A. Download the latest version of Password Reset Server The latest version of Password Reset Server is available for Download. Once clicking the Download button, the setup.exe file will be downloaded to your machine. B. Running the MSI When running the setup.exe file, your first option will be to choose Standard or Advanced. 1. Standard Option Installs Password Reset Server as a Virtual Directory under the Default Website. This is recommended if you have existing sites using the Default Website and it is also the fastest way to get up and running. 2. Advanced Option Installs Password Reset Server as a new Website without using the Default Website. This option allows you to specify a port number that the website will run under. Using this option assumes some knowledge of IIS and is often followed up by adding a DNS entry on the domain controller. This option must be used if there is no Default Website File Destination This is the location where the application files will exists. The folder is typically C:\inetpub\wwwroot\ PasswordResetServer but can be customized to follow your convention. 4. Application Name Application name will be used when creating the Application Pool and either the website or the virtual directory depending on the selected option above.

26 5. Completing Installation from Password Reset Server Once the MSI completes, the website will be setup with the correct permissions. The browser will open to allow you to complete the Password Reset Server installation from the webpage. The following section will guide you through this process. IV. Completing Password Reset Server installation from website Password Reset Server is now ready to begin installation through its installer. Open a browser and browse to where your Password Reset Server is located, for example: Password Reset Server has a 5 step installation process: 1. This step ensures that Password Reset Server has write access to its location. You must give the correct account write and modify permissions. Once the permissions are set, click Next. Please see the MANUAL INSTALLATION CREATING WEBSITE section for more information about account permissions. 26 TIP: If you don t want to change the permissions of a folder, you can give Password Reset Server a Windows Username and Password that does, and Password Reset Server will impersonate as that user during the installation process. TIP: Password Reset Server only needs write permission during installation and upgrade. You can remove the write and modify permissions once the installation process is complete. 2. Step 2 is where you specify the database. If Password Reset Server is installed on the same machine as SQL Server, you can specify (local). If you are using a named instance of SQL, specify a slash then the instance name, for instance: (local)\instancename.

27 NOTE: Password Reset Server can create the database for you. See CREATING THE DATABASE. TIP: If you are having trouble getting the Instance name, a quick tip would be to open SQL Studio Management Studio and select connect. The full instance name used here is the same one that will be used by Password Reset Server, for example THYCO1\SQLEXPRESS. Enter the SQL Username and Password if using SQL Server Authentication, or select Windows Authentication. To create a SQL Server user, see CREATING THE SQL SERVER USER. 3. Review the EULA and check I Agree and click Continue to accept the agreement. Otherwise, Password Reset Server cannot be installed. 4. Password Reset Server will now ask you to create your first user. This user will be a local Administrator that will be used to configure your Password Reset Server. We recommend choosing a strong password. 5. Step 5 will prompt you for your first domain. Enter a domain and account credentials that have the required permissions to reset passwords on the domain. See Creating a Domain Account to Reset Passwords. 27 NOTE: The Domain Name needs to be the Full Qualified Domain Name (FQDN), for example domain.thycotic.com instead of domain. Password Reset Server has now successfully been installed. For more information about configuring and maintaining your Password Reset Server, please see our User Guide.

28 V. Manual Installation Creating website (No MSI) TIP: Make sure you have the required software installed before attempting to setup Password Reset Server. Download the latest version of Password Reset Server. After clicking the download button you will be taken to a page where you can choose to download a ZIP file that contains the Password Reset Server files. Use this ZIP file for the instructions below. Password Reset Server can be installed in a few different ways: As a Virtual Directory As a Website Part of a Website A. Installing as a Virtual Directory 1. Extract the contents of the ZIP file where you would like Password Reset Server to be located on your system. 2. a. Windows Vista / Server 2008: Ensure that the folder has the proper permissions on it for IIS. Ensure that the NETWORK SERVICE Windows Account has Read, Write, and Modify permissions on the folder where Password Reset Server is installed. The same permissions should be applied to the IIS anonymous account, called IUSR. b. Windows 7 / Server 2008 R2: Ensure that the folder has the proper permissions on it for IIS. Ensure that the <AppPoolName> virtual account has Read, Write, and Modify permissions on the folder where Password Reset Server is installed. For more information on Virtual Accounts, please see the section VIRTUAL ACCOUNTS in the Appendix. 3. Open the IIS Control Panel by going into the Control Panel, then Administrative Tools > Internet Information Services (IIS) Manager. 4. Select Default Web Site, right-click it, select Add Virtual Directory. 28

29 29 5. Select an alias for your Password Reset Server. The alias is what will be appended to the website. For instance, 6. Select the physical directory for where you unzipped Password Reset Server.

30 7. In the tree, right click the new virtual directory and select Convert to Application In the new dialog, click OK. 9. See our section on CONFIGURING THE PIPELINE. 10. Password Reset Server is now ready to be installed.

31 B. Installing as part of a Website 1. Extract Password Reset Server to the path where your website is (Commonly C:\Inetpub\wwwroot). For example, C:\Inetpub\wwwroot\PasswordResetServer 2. a. Windows Vista / Server 2008: Ensure that the folder has the proper permissions on it for IIS. Ensure that the NETWORK SERVICE Windows Account has Read, Write, and Modify permissions on the folder where Password Reset Server is installed. The same permissions should be applied to the IIS anonymous account, called IUSR_machinename Where machinename is the name of the computer. b. Windows 7 / Server 2008 R2: Ensure that the folder has the proper permissions on it for IIS. Ensure that the <AppPoolName> virtual account has Read, Write, and Modify permissions on the folder where Password Reset Server is installed. For more information on Virtual Accounts, please see the section VIRTUAL ACCOUNTS in the Appendix. 3. Open the IIS Control Panel by going into the Control Panel, then Administrative Tools > Internet Information Services (IIS) Manager. 4. Expand the Default Website and locate the Password Reset Server folder. Right-click it, and select Convert to Application. 5. Select OK in the new dialog. 6. See our section on CONFIGURING THE PIPELINE. 7. Password Reset Server is now ready to be installed. 31

32 C. Configuring the Pipeline Password Reset Server requires that the application pool s managed pipeline mode be set to Classic. This can be done by changing the Application Pool s mode or creating a new one. Tip: It is recommended that you create a new Application Pool if you have other web applications running on the server. This will help avoid changing the configuration for another application. 1. Changing the Pipeline Mode Password Reset Server is by default placed in the DefaultAppPool application pool. You can modify the pipeline mode. 1. In the Internet Information Services (IIS) Manager, select the Application Pools node. 2. Double-click the DefaultAppPool. 3. For the Managed Pipeline Mode select Classic Click OK.

33 2. Creating a New Application Pool 1. In the Internet Information Services (IIS) Manager, right-click the Application Pools node and select Add Application Pool 2. Select a name for your application pool. It does not have to be anything specific. 3. Ensure that the.net Framework Version is set to.net Framework v For the Managed Pipeline Mode select Classic Click OK. 6. Right click the Virtual Directory in Internet Information Services (IIS) Manager, select Manage Application -> Advanced Settings 7. In the new Window, change the Application Pool to the one we just created.

34 34

35 VI. Appendix A. SQL Server 2008 Express Prerequisites SQL Server 2008 Express requires some software to be installed before it can be installed. TIP: Only the Express Edition requires these components to be installed separately. If you are installing another edition of SQL such as Standard or Enterprise, these components will be installed for you. 1. Windows PowerShell Microsoft.NET Framework 3.5 SP1. See our System Requirements for information about the.net Framework 3.5 SP1. 3. Windows Installer 4.5. Get Windows Installer 4.5. TIP: Windows 7 and Windows Server 2008 R2 ship with Windows Installer 5.0. There is no need to install a new version of Windows Installer if you are using one of these operating systems. 35 B. Installing PowerShell 1. Windows Vista Simply download and run the installer that you can download here: Get PowerShell Windows 7 Windows 7 includes PowerShell 2.0. There is no need to install anything. 3. Windows Server 2008 / Windows Server 2008 R2 1. Open the Server Manager 2. Select Features on the left. 3. Select Add Features

36 4. Check Windows PowerShell 5. Click Next 6. Click Install PowerShell is now comes installed for Windows Server 2008 / Server 2008 R2. C. Virtual Accounts Virtual Accounts, or Managed Service Accounts, is a new feature in Windows 7 and Windows Server 2008 R2. Windows will create a virtual account for the name of the Application Pool. Thus, if the name of your Application Pool is DefaultAppPool, you would assign permissions to the account DefaultAppPool if your ApplicationPool is set to use ApplicationPoolIdentity as its identity. You can re-assign the identity to NETWORK SERVICE if the virtual account functionality is causing issues. 36

37 D. Creating a Domain Account to Reset Passwords In order for Password Reset Server to reset passwords, it must be given access to an account that is able to reset passwords on the domain users. Setting up the exact permissions is detailed below. We recommend creating a new account that will only be used by Password Reset Server. NOTE: You must be a member of the Domain Admins to perform these steps. 1. Open the Active Directory Users and Computers MMC snap-in and connect to your domain. 2. Right click on Users under your domain and select New > User. 3. Choose a user name that will be unique however memorable. 37 Click Next >.

38 4. Choose a password that is strong and unique. 38 NOTE: You will want to choose Password never expires. If the password expires and it is not changed, Password Reset Server will not be able to change passwords on users using this account. 5. Click Next and Finish to complete changing the user. NOTE: The Domain account used to synchronize and reset passwords for the domain must have the following permissions to reset a user's account: Change Password, Reset Password, Write lockouttime, Write pwdlastset 6. Set the Active Directory Users and Computers to display Advanced Features. Click View in the Menu and select Advanced Features to enable it.

39 7. Select the top level domain node, right click, and select properties to assign the correct permissions 39

40 TIP: If desired, you may apply the permissions to specific Organizational Units instead of the entire domain. These actions must be repeated for each Organizational Unit. 8. Select the Security tab and click Advanced 40

41 9. On the Advanced Properties screen Click Add Select the user created above

42 11. On the Object tab select Apply to as Descendant User Objects, then locate and check Allow for both Change password and Reset password 42

43 12. On the Properties tab select Apply to as Descendant User Objects, then locate and check Allow for both Write lockouttime and Write pwdlastset 43

44 Press OK on each Dialog to apply the settings to the Domain account You can now use this account to reset passwords using Password Reset Server. TIP: You may want to modify your domain s Group Policy to deny local login for this account under User Rights Assignment. Note: The dssec.dat file located in %WINDIR%\SYSTEM32 contains a list of filtered properties. A property listed here may not be visible under the Properties tab as indicated in 9 above. In order to make a filtered property visible, delete the line under the appropriate object (e.g. [User]) or change the value to 0. For further information, see:

45 E. SSL Certificate 1. What is an SSL Certificate? An SSL (Secure Socket Layer) Certificate greatly enhances the security between the user s browser and the server Password Reset Server is installed on. It encrypts all data between the server and the client s browser so if an attacker were to look at the data being transmitted between the two, they would not be able to decipher it. 2. Where can I obtain an SSL Certificate? A certificate can be obtained from various companies such as Thawte or VeriSign. It is also possible to create your own, see Creating and installing your own. F. Installing an SSL Certificate 1. Installing certificate from a 3rd Party If you obtained a certificate from a 3 rd Party provider such as Thawte or VeriSign, please follow their instructions for installing their certificates. 2. Creating and installing your own 45 You will need to download and install the IIS Resource Toolkit. This toolkit will work on IIS 5.1 and up. 1. Once installed, a new menu in the Start Menu s Program Files called IIS Resource Toolkit will appear. Click the item called selfssl.

46 2. Type the following at the command line: selfssl.exe /N:YOURSERVERNAME /K:1024 /V:XXXX Where YOURSERVERNAME is the name of the server IIS is installed on. Where XXXX is the number of days you would like your certificate to be valid for. 3. Press enter. You should now be able to access Password Reset Server with the HTTPS protocol. 46 Note: A self created SSL Certificate is not a trusted certificate because it was not issued by a trusted root publisher. If you wish to use a selfssl certificate, you will need to install it on all of your client s computers. We recommend only using a self created SSL for a testing environment.