Administrator Guide

6. Repeat steps 3 to 5 to add up to three IP addresses.
NOTE: Adding multiple Active Directory servers ensures continued authentication of Active Directory accounts even
in the event of a resource outage. The group uses the rst Active Directory server in the list for authenticating
accounts; if the group cannot establish contact with the rst server, it uses the other Active Directory servers to
authenticate administrator logins.
7. Select the Active Directory server that you want to congure.
8. In the AD server settings section, select Secure protocol: and choose TLS or none.
9. Select whether to use the default port for the selected protocol, or specify a dierent port.
10. Type the Base DN for the Active Directory server, or select Get Default to use the default value. The Base DN can be up to
254 ASCII characters.
11. Type the path in which you want to search for users in the User_Search Path eld.
12. Type the path in which you want to search for groups in the Group_Search Path eld.
13. Select whether to use anonymous connections to the server or type a Bind DN.
14. If a Bind DN is specied, type the Bind password. Passwords can be up to 63 ASCII characters.
15. To test the new Active Directory settings, click the Test AD settings button. Group Manager tests the Active Directory settings
for all servers. If authentication fails, a dialog box opens, listing the Active Directory servers with which connections could not
be established. If no connections can be established, you can accept the conguration as is or click Cancel and check the
Active Directory settings again.
16. Click OK.
Modify Active Directory Accounts and Groups
When you modify Active Directory accounts and groups, the following restrictions apply:
• You cannot change the account name. Instead, you must delete the account and then add it back with the updated name in
Active Directory.
• You cannot modify cached accounts. You can only view their conguration details.
• You cannot change the account type. Instead, you must delete the account and recreate it with the desired account type.
When you modify Active Directory groups, the following considerations apply:
• An Active Directory security/distribution group is added to the PS Series group with the attribute that all members of the AD
group now have access. If changes are made to any members of the group, the changes are automatically integrated the next
time the members log in to the group.
– When a new user is added to the Active Directory group, the user automatically has access to the group.
– When an Active Directory user is removed from the AD group, the user no longer has access to the group.
– When the user name of a current member of the AD group is modied in Active Directory, no changes need to be made for
that user on the PS Series group.
• When you change the name of the Active Directory group, the group must be deleted from the PS Series group and then re-
added with the new name.
To change an Active Directory account or group:
1. Click Group → Group Conguration.
2. Click the Administration tab.
3. In the Accounts and Groups panel, select either:
• All accounts and groups to view both local and remote accounts.
• Local accounts to view local accounts only.
• Remotely authenticated users to view users that have been remotely authenticated.
• Active Directory users to view only Active Directory user accounts.
• Active Directory groups to view only Active Directory group accounts.
4. Select the account and click Modify. The Modify Administration Account dialog box opens.
In the dialog box, use the Account type section to change attributes of the account type:
74
About Group-Level Security