Stages Documentation

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
Next revisionBoth sides next revision
72:setup_directory [2018/07/06 18:03] – [Setup Active Directory] bkkr72:setup_directory [2018/11/30 12:18] – [Setup Active Directory] evt
Line 7: Line 7:
 To set up the Active Directory, start the Active Directory Users and Groups from the administrative tools menu and open the context menu of the Users tree node. Select New User from the menu. Next, enter the server's hostname in the first name field. Then type a password and check the "Password never expires" selection. Click next and confirm the summary dialog window. Export Kerberos key of the new account to a 'Keytab' file. Finally, open a command window on the Active Directory server and execute the following command: To set up the Active Directory, start the Active Directory Users and Groups from the administrative tools menu and open the context menu of the Users tree node. Select New User from the menu. Next, enter the server's hostname in the first name field. Then type a password and check the "Password never expires" selection. Click next and confirm the summary dialog window. Export Kerberos key of the new account to a 'Keytab' file. Finally, open a command window on the Active Directory server and execute the following command:
  
-<code>ktpass –princ HTTP/<fqdn>@<KERBEROS-REALM>+<code> 
 +ktpass –princ HTTP/<fqdn>@<KERBEROS-REALM>
  -mapuser <trust-account-name>  -mapuser <trust-account-name>
  -pass <trust-account-password>  -pass <trust-account-password>
  -out <output-file>  -out <output-file>
  -crypto rc4-hmac-nt  -crypto rc4-hmac-nt
-</file>+</code> 
 + 
 +Now you have to securely transfer the keytab file to the Stages server.\\ 
 +After exporting the keytab file, delegation has to be enabled on the trust account. Be aware that this can only be done after exporting the Kerberos key! Windows will not display this option, unless you have exported the key first. Select your trust account with the right mouse button and choose “Properties” from the context menu, click on the “Delegation” tab and check “Trust this user for delegation to any\\ 
 +service (Kerberos only)”.