1. Automated Computer Account Management in Active Directory June 2 nd, 2009 Bill Claycomb Systems Analyst Sandia National Laboratories Sandia is a multiprogram laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the United States Department of Energy’s National Nuclear Security Administration under contract DE-AC04-94AL85000.

2. Agenda Background Motivation Design and Implementation Performance Discussion Future Directions

3. Active Directory Localized data store containing information about objects –Users –Computers –Contacts, etc. Provides information to applications –Authentication and access control –Contact information –Group membership Uses LDAP Communication Protocol –Lightweight Directory Access Protocol

4. Active Directory at SNL User account objects: –12651 user accounts –2023 service accounts Group objects –14024 group objects Contact objects: –21543 contact objects Computer objects: –24989 computer objects

5. The Problem Authoritative data source for computer account information is not Active Directory (AD) –SQL Database: Network Information System (NWIS) Policy requires any object in Active Directory to be in authoritative data source –Policy was not enforced Administrative duplication of efforts –Machine records manually entered into database –Computer accounts manually entered in AD –Computer accounts manually managed in AD once populated

6. Solution Automate computer account population and management in Active Directory

7. Benefits Automated population and standardization of account data –Ownership –Support notes Reduced administrative overhead –Eliminate need for manual account creation Enable registration policy enforcement Accurate reflection of actual computer usage –Large impact to billing calculations –Removal of inactive accounts from AD

8. Implementation - Platform Application developed using.NET Framework –Allows easy interoperability with Active Directory –Simple interface with SQL database as well –Service easily integrates with existing Windows platform

9. Implementation - Provisioning  Database UniqueID  Name  Owner  Management Info  OS  Machine roles  Etc.  AD UniqueID  Name  Owner Info  OU Location  Provisioning Tags

10. Implementation - Management  Authorized Accounts  Existing Accounts  New Accounts  Account Changes  Expired Accounts

11. Implementation Concerns How to handle machines no longer authorized to be in Active Directory? Handle workstations differently than servers? How to handle machine renames? How to handle movement of computers between management unit OU’s? –Machine owner changes locations, and thus changes management unit

12. Future Directions Automated management of object location –Requires consistent OU structure within management units Feed Active Directory information back to authoritative data source –Usage information –Logging information

13. Design and Implementation Team Database –Miriam Maldonado –Stan Hall –Andrew Steele –Robbie Evanoff –Jim House Active Directory –Bob D’Spain –Jason Crenshaw –Bill Claycomb

14. Questions http://www.sandia.gov wrclayc@sandia.gov