Users Guide

Configuring Active Directory with Extended schema using RACADM
To configure Active Directory with Extended Schema using the RACADM:
1. Use the following commands:
racadm set iDRAC.ActiveDirectory.Enable 1
racadm set iDRAC.ActiveDirectory.Schema 2
racadm set iDRAC.ActiveDirectory.RacName <RAC common name>
racadm set iDRAC.ActiveDirectory.RacDomain <fully qualified rac domain name>
racadm set iDRAC.ActiveDirectory.DomainController1 <fully qualified domain name or IP
address of the domain controller>
racadm set iDRAC.ActiveDirectory.DomainController2 <fully qualified domain name or IP
address of the domain controller>
racadm set iDRAC.ActiveDirectory.DomainController3 <fully qualified domain name or IP
address of the domain controller>
• Enter the Fully Qualified Domain Name (FQDN) of the domain controller, not the FQDN of the domain. For example, enter
servername.dell.com instead of dell.com.
• You must provide at least one of the three addresses. iDRAC attempts to connect to each of the configured addresses
one-by-one until it makes a successful connection. With Extended Schema, these are the FQDN or IP addresses of the
domain controllers where this iDRAC device is located.
• To disable the certificate validation during SSL handshake, use the following command:
racadm set iDRAC.ActiveDirectory.CertValidationEnable 0
In this case, you do not have to upload a CA certificate.
• To enforce the certificate validation during SSL handshake (optional):
racadm set iDRAC.ActiveDirectory.CertValidationEnable 1
In this case, you must upload a CA certificate using the following command:
racadm sslcertupload -t 0x2 -f <ADS root CA certificate>
NOTE: If certificate validation is enabled, specify the Domain Controller Server addresses and the FQDN. Ensure
that DNS is configured correctly under Overview → iDRAC Settings → Network.
Using the following RACADM command may be optional:
racadm sslcertdownload -t 0x1 -f <RAC SSL certificate>
2. If DHCP is enabled on iDRAC and you want to use the DNS provided by the DHCP server, enter the following command:
racadm set iDRAC.IPv4.DNSFromDHCP 1
3. If DHCP is disabled in iDRAC or you want to manually input your DNS IP address, enter the following command:
racadm set iDRAC.IPv4.DNSFromDHCP 0
racadm set iDRAC.IPv4.DNSFromDHCP.DNS1 <primary DNS IP address>
racadm set iDRAC.IPv4.DNSFromDHCP.DNS2 <secondary DNS IP address>
4. If you want to configure a list of user domains so that you only need to enter the user name during log in to iDRAC web
interface, use the following command:
racadm set iDRAC.UserDomain.<index>.Name <fully qualified domain name or IP Address of
the domain controller>
You can configure up to 40 user domains with index numbers between 1 and 40.
Testing Active Directory settings
You can test the Active Directory settings to verify whether your configuration is correct, or to diagnose the problem with a failed
Active Directory log in.
Testing Active Directory settings using iDRAC web interface
To test the Active Directory settings:
1. In iDRAC Web Interface, go to Overview → iDRAC Settings → User Authentication → Directory Services → Microsoft
Active Directory.
The Active Directory summary page is displayed.
2. Click Test Settings.
136