Test Scenario - Active Directory Computer ManagedBy Attributes

 We are no longer updating this content regularly. Please visit our knowledge base for most current version.

Overview

The feature enables the administrators to maintain the managedBy attribute of the Active Directory domain computer objects.  

 When the policy is enabled, the software sets the managedBy attribute to the user distinguishedName attribute value.This will help to system admin to know which computer is managed by which user

 Purpose

This article provides instructions on testing the SYNERGIX AD Client Extensions software Account Attributes \ Computer Account Attributes \ Computer ManagedBy Attribute feature.   The software requires the security principal Domain Computers or the security group 'SYNERGIX ADCE Managed Computers' is granted permission to update the managedBy attribute value of the computer objects in the selected OU or the top level domain object. 

Prerequisites

• Supported Microsoft Windows Operating System
• Microsoft Windows XP or 
• Microsoft Windows Vista or 
• Microsoft Windows 7.0 or 
• Microsoft Windows 8.0
• .NET Framework 4.0
• Active Domain Membership in Microsoft Active Directory domain
• Microsoft Outlook or other EMail client 
• EMail client is required to submit log files to [e-mail] or [e-mail]
• SYNERGIX AD Client Extensions 2013

Active Directory Domain Environment

• Single Active Directory Domain environment i.e. Single Forest with Forest Root Domain only example. F10.LOCAL
• You can setup a more complex Active Directory Domain environment, if needed.  For example, one forest F10.LOCAL with child domains D10.F10.LOCAL, D11.F10.LOCAL and D12.F10.LOCAL and a trusted forest F20.LOCAL with child domains D20.F20.LOCAL, D21.F20.LOCAL and D22.F20.LOCAL
• Security Group(s)
• Create a security group called "SYNERGIX ADCE Managed Computers".  The group type may be Domain Global Group or Domain Local Group.
• Add the test domain computer(s) into the security group "SYNERGIX ADCE Managed Computers"
• Delegate Control

 You must ensure that the security principal Domain Computers or the security group 'SYNERGIX ADCE Managed Computers' is granted READ managedBy attribute and WRITE managedBy attribute value of the computer objects in the selected OU or the top level domain object.

      .

• The test domain computer must be member of "SYNERGIX ADCE Managed Computers" security group.
• Configure domain Group Policy Object
• Copy SYNERGIX AD Client Extensions Administrative Template file SYNERGIX-ADCE.ADMX to %SystemRoot%\PolicyDefinitions on admin workstation ( must be Windows 7.0 ) 
• Copy SYNERGIX AD Client Extensions Administrative Template Language file SYNERGIX-ADCE.ADML to %SystemRoot%\PolicyDefinitions\en-US on same admin workstation ( must be Windows 7.0 ) 
• Using GPMC.MSC, edit existing or new Group Policy Object.  
• In Group Policy Editor, expand COMPUTER CONFIGURATION
• Expand Administrative Templates
• Expand SYNERGIX AD Client Extensions
• Expand Account Attributes
• Expand Computer Account Attributes
• Select Computer ManagedBy attribute
• Enable policy setting
• The value determines the time interval before next update occurs.  By default, it is 1,440 minutes.

More Information

• Visit Synergix website or contact vendor support

Procedure

• Log into a domain computer with local administrative privileges
• Install SYNERGIX AD Client Extensions software
• Ensure the SYNERGIX AD Client Extensions specific Grou Policy settings were applied
• Launch RSOP.MSC or run GPRESULT.EXE /v to confirm
• Logout
• Log into the same domain computer with a domain user account.  This domain account represents a business user who does not have elevated privileges on his / her computer.
• Launch Active Directory Users and Computers ( dsa.msc ) Management Console
• If DSA.MSC is not installed, log into another workstation with Administrative Tools installed and then, launch DSA.MSC on it
• Search for domain computer object
• Bring up domain computer properties windows
• Review Computer ManageBy attribute value.  By default, it updates once every 24 hours.
• If Yes, Test Results are successful.  In the Test Result, write down PASS
• If No, re-run test

1. Remove lastUpdate registry entry from HKEY_LOCAL_MACHINE\SOFTWARE\Synergix\ADCE\Account Attributes\Computer Account Attributes\Computer ManagedBy Attribute.   Did it work this time?
2. Try on another computer. Did it work this time?
3. Review ServiceLogFile.txt. Do you see "Access Denied" exception? If yes, verify that the he security principal Domain Computers or the security group 'SYNERGIX ADCE Managed Computers' is granted permission to update the managedBy attribute value of the computer objects? Did it work this time?

Test Results

• Pass or
• Fail

Test Result Submission

1. Complete the Test Environment worksheet
2. Upload test results document file to software test repository
3. Upload log files
4. ServiceLogfile.txt
5. ClientLogfile.txt
6. Output of GPRESULTS.EXE /V command

Note: You must use ADCE \ Help \ Submit Log Files button to zip up above 3 files and submit

References

N/A