Automated Computer Account Management in Active Directory June 2 nd, 2009 Bill Claycomb Systems Analyst Sandia National Laboratories Sandia is a multiprogram laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the United States Department of Energy’s National Nuclear Security Administration under contract DE-AC04-94AL85000.

Agenda Background Motivation Design and Implementation Performance Discussion Future Directions

Active Directory Localized data store containing information about objects –Users –Computers –Contacts, etc. Provides information to applications –Authentication and access control –Contact information –Group membership Uses LDAP Communication Protocol –Lightweight Directory Access Protocol

Active Directory at SNL User account objects: –12651 user accounts –2023 service accounts Group objects –14024 group objects Contact objects: –21543 contact objects Computer objects: –24989 computer objects

The Problem Authoritative data source for computer account information is not Active Directory (AD) –SQL Database: Network Information System (NWIS) Policy requires any object in Active Directory to be in authoritative data source –Policy was not enforced Administrative duplication of efforts –Machine records manually entered into database –Computer accounts manually entered in AD –Computer accounts manually managed in AD once populated

Solution Automate computer account population and management in Active Directory

Benefits Automated population and standardization of account data –Ownership –Support notes Reduced administrative overhead –Eliminate need for manual account creation Enable registration policy enforcement Accurate reflection of actual computer usage –Large impact to billing calculations –Removal of inactive accounts from AD

Implementation - Platform Application developed using.NET Framework –Allows easy interoperability with Active Directory –Simple interface with SQL database as well –Service easily integrates with existing Windows platform

Implementation - Provisioning  Database UniqueID  Name  Owner  Management Info  OS  Machine roles  Etc.  AD UniqueID  Name  Owner Info  OU Location  Provisioning Tags

Implementation - Management  Authorized Accounts  Existing Accounts  New Accounts  Account Changes  Expired Accounts

Implementation Concerns How to handle machines no longer authorized to be in Active Directory? Handle workstations differently than servers? How to handle machine renames? How to handle movement of computers between management unit OU’s? –Machine owner changes locations, and thus changes management unit

Future Directions Automated management of object location –Requires consistent OU structure within management units Feed Active Directory information back to authoritative data source –Usage information –Logging information

Design and Implementation Team Database –Miriam Maldonado –Stan Hall –Andrew Steele –Robbie Evanoff –Jim House Active Directory –Bob D’Spain –Jason Crenshaw –Bill Claycomb

Questions