Quantum Corporation · NASDAQ:QMCO
Quantum — Technical Presentation (2011)
48 slides from Quantum's technical presentation, 2011
Slide 1: DXi and Active Directory
DXi and Active Directory Presented by: Craig McBride on 11/08/26 © 2011 Quantum Corporation. Company Confidential. Forward-looking information is based upon multiple assumptions and uncertainties, does not necessarily represent the company’s outlook and is for planning purposes only.
Slide 2: What We’re Going to Cover
What We’re Going to Cover Scenarios •What should I do if I cannot connect to Active Directory? •How do I check the group policy? •When should I use LDAP signing? •How do I administer access to NAS shares? Q&A Session *Please us the chat window for questions or comments. 2
Slide 3: Workgroup and Active Directory
Workgroup and Active Directory 3
Slide 4: NAS and Active Directory Domain
NAS and Active Directory Domain Scenario: •NAS shares on DXi need to be available for use on Windows network •Customer is using Active Directory as Domain Type •Need to join DXi to Active Directory domain using SMB Can’t join domain. What do you do? 4
Slide 5: Join an Active Directory Domain
Join an Active Directory Domain Select Configuration > NAS > Windows Authentication 5
Slide 6: Clock Skew Problem…
Clock Skew Problem… Select Configuration > System > Date & Time to synchronize clock 6
Slide 7: Still Fails to Join an AD Domain
Still Fails to Join an AD Domain 7
Slide 8: Check Network Configuration
Check Network Configuration Ensure DNS entries reflect Active Directory domain 8
Slide 9: Still Fails to Join an AD Domain
Still Fails to Join an AD Domain 9
Slide 10: Review Thus Far…
Review Thus Far… NAS shares created on DXi Customer has Active Directory Domain Need to join DXi to Windows AD domain using SMB to access shares 3 problems encountered when attempting to join DXI to AD domain: • Clock skew - resolved • DNS resolution - resolved • Stronger authentication required – u
Slide 11: Domain Security Policy Problem?
Domain Security Policy Problem? Quick Overview •Active Directory •Organizational Units •Group Policy Overview •Security Options Settings •Local Security Policy 11
Slide 12: Active Directory Review
Active Directory Review Active Directory Domain Services (AD DS) defines the data structure and services that provide organization, management, and security of accounts and resources in a Microsoft network. An AD forest contains all the domains, sites, and trusts that are part of AD DS. A domain is
Slide 13: Group Policy Overview
Group Policy Overview • Policy-based management has been a goal for the Windows operating systems for a long time. • Organizational units, domains, and sites are linked to Group Policy objects. • The Security Settings tool allows a security administrator to modify security settings assigned to a Gro
Slide 14: Modify the Security Policy
Modify the Security Policy Select Administrative Tools > Active Directory Users and Computers Right-click <Domain_Name>, select Properties, click Group Policy tab Click Open to display Group Policy Management console 14
Slide 15: Adding Group Policy Management Console
Adding Group Policy Management Console Following will appear if management console is not installed Click on Upgrade link will take you to Server 2008. Google 2003 Group Policy Management Console for download link 15
Slide 16: Group Policy Management Console
Group Policy Management Console Expand <Domain_Name>, right-click Default Domain Policy Select Edit… to open Group Policy Object Editor 16
Slide 17: Group Policy Object Editor
Group Policy Object Editor • Expand Windows Settings, expand Security Settings • Expand Local Policies, select Security Options • Notice: LDAP server requires signing 17
Slide 18: Explain This (Security Option) Setting
Explain This (Security Option) Setting Double-click any option (LDAP for example), select Explain This Setting tab See Caution Statement 18
Slide 19: LDAP Server Signing is Required
LDAP Server Signing is Required Click Security Policy Setting tab Define this policy setting is checked, Require signing is selected 19
Slide 20: View Security Options Settings
View Security Options Settings From a command window, enter the command gpresult /v 20
Slide 21: Note About Local Security Policy…
Note About Local Security Policy… Local Security Policy and Group Domain Policy Which settings take precedence? 21
Slide 22: Local Security Policy Settings
Local Security Policy Settings Local Security Policy is a subset of the Group Policy structure for a system. To view (or modify) the security settings on your local computer (Local Security Policy), run secpol.msc 22
Slide 23: How to Enforce Group Domain Policy
How to Enforce Group Domain Policy Checking Enforce (right-click Default Domain Policy from Group Policy Management window) – Group Domain Policy overrides Local Policy Uncheck Enforce – Local Security Policy overrides Group Domain Policy 23
Slide 24: Time For Another Quick Review…
Time For Another Quick Review… • Windows AD uses Policy-based management • Security settings in Policy-based management could prevent DXi from successfully joining the AD Domain • In our scenario, LDAP server signing was required on the AD Domain Controller (which is preventing DXi from joining doma
Slide 25: Review Continued…
Review Continued… View/Modify the Security Policy settings from Group Policy Management console (perform following steps to access console): 1. Select Administrative Tools > Active Directory Users and Computers 2. Right-click <Domain_Name>, select Properties, click Group Policy tab 3. Click Open to
Slide 26: Now What?
Now What? You’ve determined the Domain Controller requires LDAP signing Can you enable LDAP signing on the DXi? Yes! In Galaxy 2.0 26
Slide 27: Enable LDAP Signing
Enable LDAP Signing Select Configuration > NAS > Advanced Setting 27
Slide 28: Samba Configuration File
Samba Configuration File /etc/samba/smb.conf 28
Slide 29: snfs/common/galaxy-config/nas/smb.conf.extra
snfs/common/galaxy-config/nas/smb.conf.extra Entry in /snfs/common/galaxy-config/nas/smb.conf.extra is: client ldap sasl wrapping = plain (disabled) client ldap sasl wrapping = sign (enabled) 29
Slide 30: Enable LDAP Signing
Enable LDAP Signing Admin Low Capacity Logout Administrator Help Replication OST PTT System Notifications _Contacts to true. panic nd run 't in nel oploc true 30
Slide 31: Successfully Joined!
Successfully Joined! Quantum. Dx;4510 Thu Feb 10 2011 - 12:58:45 PM MST Low Capacity Logout Administrator Help Replication OST PTT System Notifications Contacts ting Configuration 31 Topic
Slide 32: Verify DXi Joined Active Directory Domain
Verify DXi Joined Active Directory Domain Select Administrative Tools > Active Directory Users and Computers Select Computers to view DXi joined to AD Domain “Verify from DXI” net ads commands also available (as shown) 32
Slide 33: May Need to “Find” Objects
May Need to “Find” Objects Right-click <Domain_Name>, select Find 33
Slide 34: Another Quick Review
Another Quick Review • Select Configuration > NAS > Advanced Setting to enable LDAP signing on DXi • LDAP setting is stored in: • /snfs/common/galaxy-config/nas/smb.conf.extra • smb.conf.extra file is “included” in main Samba configuration file: • /etc/samba/smb.conf • To verify DXi joined AD Domain
Slide 35: NAS Share Access
NAS Share Access • The Share Access page (select Configuration > NAS > Share Access) provides a different function depending if DXI is joined to a workgroup or a domain. • When DXI is joined to a Workgroup: • Page is used to manage Workgroup Users • Workgroup Users can be granted access to NAS share
Slide 36: NAS Share Administrators
NAS Share Administrators • The Domain Admins group is created as a Share Administrator by default. • Any Windows user who is a member of the Domain Admins group can administrator share access from the MMC. • Additional Share Administrators (users or groups) can also be created. 36
Slide 37: View Domain Admin Group Membership
View Domain Admin Group Membership Select Administrative Tools > Active Directory Users and Computers Select Users to view AD Users and Groups Right-click Domain Admins, select Properties, click Members tab 37
Slide 38: View User’s Group Membership
View User’s Group Membership Select Administrative Tools > Active Directory Users and Computers Select Users to view AD Users and Groups Right-click Username, select Properties, click Member of tab 38
Slide 39: Manage NAS Shares on DXi From MMC
Manage NAS Shares on DXi From MMC Select Administrative Tools > Active Directory Users and Computers Select Computers to view DXi joined to AD Domain Right-click DXi, select Manage > Shared Folders > Shares 39
Slide 40: Manage Share Access From MMC
Manage Share Access From MMC Only DXi Share Administrators can manage share access Right-click share name, select Properties 40
Slide 41: Grant Share Access To Specific User
Grant Share Access To Specific User Click Share Permissions tab, Remove Everyone, Add user “Jim” Everyone has access by default 41
Slide 42: User Name and Password Required (1 of 2)
User Name and Password Required (1 of 2) Right-click My Computer, select Map Network Drive Now, prompted for User name and Password (unless logged on as Jim) 42
Slide 43: User Name and Password Required (2 of 2)
User Name and Password Required (2 of 2) Provide User name and Password (for Jim), share is mapped 43
Slide 44: Final Review (Share Administration)
Final Review (Share Administration) • NAS Share Administrators are configured from the DXi GUI: • Select Configuration > NAS > Share Access • The Domain Admins group is configured by default • Members of this group can perform Share Access from the MMC • To View/Modify Domain Admin group membership:
Slide 45: Get Some Hands-On Practice!
Get Some Hands-On Practice! • DXi-Series 2.0 Hands-on GUI Practice (3-2432 virtual classroom) • Opportunities to practice basic configuration tasks • Access to two virtual DXi systems and a virtual active directory domain controller • Course # is 3-2432 45
Slide 46: Q&A and After-Class Discussion
Q&A and After-Class Discussion 46
Slide 47: Questions?
47 Questions? ot Yet
Slide 48: Thanks for Attending!
Thanks for Attending! Presented by: Craig McBride © 2011 Quantum Corporation. Company Confidential. Forward-looking information is based upon multiple assumptions and uncertainties, does not necessarily represent the company’s outlook and is for planning purposes only. 48