Custom Active Directory Groups and User Names Setup
- Anand Rajaraman
- Del Gonzalez
Overview:
Velocity by default uses specific Windows Groups and User names for application and SQL authentication. The two Active Directory Group names it uses are: “Velocity Users” and “Velocity Services”. There is also one Active Directory User: “VelocityServices”. Depending on the installation, these groups and user will either be in Active Directory, or they will be local to the Velocity server. Where the groups and user reside depends on whether:
Velocity and SQL are installed on the same computer, or
Velocity and SQL are installed on separate computers
When Velocity and SQL are installed on the same computer, the only group that is created on the domain controller is the Velocity Users group. The Velocity Services group and the VelocityServices user are local to the Velocity server.
When Velocity and SQL are installed on separate computers, both groups and the user are all located on the Active Directory Domain Controller.
There are instances when you will not want to use the default Velocity Users group, Velocity Services group, or VelocityServices user names. Government or other large organizations in particular often require the assignment of unique naming conventions for every unit or department within the organization.
To do this, you need to choose the Advanced Authentication option on the Application Network and Security screen while performing a Server installation.
The purpose of custom user and groups is to replace the defaults. Making sure the new names work before deleting the defaults is strongly recommended. Because every installation is different, make sure you review your existing default accounts to guarantee that the new accounts have equivalent rights and permissions.
This procedure should be performed by an IT professional thoroughly familiar with the intricacies of SQL Server database management and Windows Active Directory.
Based on your requirement follow the steps mentioned in either of the sections
Configuration Details:
This section explains how to create a new users group, service group, service user, and assigning members on the domain.
To create custom users and service groups for managing users and services
Need to create two different groups, one for managing the custom users & another one for managing the custom services.
Open Active Directory Users and Computers. Expand your local domain
The Active Directory Users and Computers window appears:Right-click the Users folder (in the left pane) and select New ►Group.
The New Object - Group dialog box appears:Enter the name of the group you want to use (instead of the Velocity Users Group), then click:
Group scope: Global
Group type: Security
The dialog box now resembles this example:
Click OK.
The new users group appears in the Users folder.Follow steps 3 to 5 for creating another group for managing services (CustomVelServicesGrp).
Right-click the new users group and select Properties, then click the Members tab.
The Members tab is displayed. Add the Domain Administrator, Users who have access to Velocity, as a member by following the steps below.Click the Add button.
The Select Users, Contacts, Computers, Service Accounts, or Groups dialog box appears:Click Locations and select this domain server’s location.
Do one of these:
Enter the name of the object you are seeking and click Check Names. If the name is correctly entered, the name is underlined.
Click Advanced and in the Common Queues section, select a text string to find the required members. Click Find Now. All relevant users appear in the search results. Select one or more users.
Click OK twice.
The new users group with associated users appears in the Users folder.
To create a non-Velocity named user account for managing Velocity services:
Open Active Directory Users and Computers. Expand your local domain
The Active Directory Users and Computers window appears:Right-click the Users folder (in the left pane) and select New ►Users.
The New Object - User dialog box appears:Enter the first name and last name and then a user logon name for the User and click next
Type Password and Confirm Password, click Next.
Click Finish.
The new user appears in the Users folder.Right-click the new user services and select Properties, then click the Members tab
The Members tab is displayed. Add the Domain Users and newly created service group (CustomVelServicesGrp) as members by following the steps below.Click the Add button.
The Select Users, Contacts, Computers, Service Accounts, or Groups dialog box appears:Click Locations and select this domain server’s location.
Do one of these:
Enter the name of the object you are seeking and click Check Names. If the name is correctly entered, the name is underlined.
Click Advanced and in the Common Queues section, select a text string to find the required members. Click Find Now. All relevant users appear in the search results. Select one or more users.
Click OK twice.
The new user services with associated users appear in the Users folder.