automated computer account management in active directory june 2 nd, 2009 bill claycomb systems...
TRANSCRIPT
Automated Computer Account Management
in Active Directory
June 2nd, 2009
Bill ClaycombSystems Analyst
Sandia National Laboratories
Sandia is a multiprogram laboratory operated by Sandia Corporation, a Lockheed Martin Company,for the United States Department of Energy’s National Nuclear Security Administration
under contract DE-AC04-94AL85000.
Agenda
•Background•Motivation•Design and Implementation•Performance•Discussion•Future Directions
Active Directory
• Localized data store containing information about objects– Users– Computers– Contacts, etc.
• Provides information to applications– Authentication and access control – Contact information– Group membership
• Uses LDAP Communication Protocol– Lightweight Directory Access Protocol
Active Directory at SNL
•User account objects:– 12651 user accounts– 2023 service accounts
•Group objects– 14024 group objects
•Contact objects:– 21543 contact objects
•Computer objects:– 24989 computer objects
The Problem
• Authoritative data source for computer account information is not Active Directory (AD)– SQL Database: Network Information System (NWIS)
• Policy requires any object in Active Directory to be in authoritative data source– Policy was not enforced
• Administrative duplication of efforts– Machine records manually entered into database– Computer accounts manually entered in AD– Computer accounts manually managed in AD once
populated
Solution
•Automate computer account population and management in Active Directory
Benefits
• Automated population and standardization of account data– Ownership– Support notes
• Reduced administrative overhead– Eliminate need for manual account creation
• Enable registration policy enforcement• Accurate reflection of actual computer usage
– Large impact to billing calculations– Removal of inactive accounts from AD
Implementation - Platform
•Application developed using .NET Framework– Allows easy interoperability with Active
Directory– Simple interface with SQL database as well– Service easily integrates with existing
Windows platform
Implementation - Provisioning Database
UniqueID Name Owner Management Info OS Machine roles Etc.
AD UniqueID Name Owner Info OU Location Provisioning Tags
Implementation - Management
Authorized Accounts
Existing Accounts
New Accounts Account Changes Expired Accounts
Implementation Concerns
•How to handle machines no longer authorized to be in Active Directory?
•Handle workstations differently than servers?
•How to handle machine renames?•How to handle movement of computers between management unit OU’s?– Machine owner changes locations, and thus
changes management unit
Future Directions
•Automated management of object location– Requires consistent OU structure within
management units
•Feed Active Directory information back to authoritative data source– Usage information– Logging information
Design and Implementation Team
• Database– Miriam Maldonado– Stan Hall– Andrew Steele– Robbie Evanoff– Jim House
• Active Directory– Bob D’Spain– Jason Crenshaw– Bill Claycomb
