Data Domain: Active Directory Guide

The Data Domain and PowerProtect operating environment provides secure administration through either the DD System Manager by HTTPS or SSH for CLI. Either method enables locally defined users, Network Information Service (NIS) users, Lightweight Directory Access Protocol (LDAP), Microsoft Active Directory (AD) domain users, and Single Sign-on (SSO).

Data Domain and PowerProtect systems can use Microsoft Active Directory pass-through authentication for the users or servers. Administrators can enable certain domains and groups of users to access files that are stored on the system. It is recommended to have Kerberos configured. Also, systems support Microsoft Windows NT LAN Managers NTLMv1 and NTLMv2. However, NTLMv2 is more secure and is intended to replace NTLMv1.

Viewing Active Directory and Kerberos Information

The Active Directory/Kerberos configuration determines the methods CIFS and NFS clients use to authenticate.
The Active Directory/Kerberos Authentication panel displays this configuration.

Steps:

1. Select Administration > Access > Authentication.
2. Expand the Active Directory/Kerberos Authentication panel.

Configuring Active Directory and Kerberos Authentication

Configuring Active Directory authentication makes the protection system part of a Windows Active Directory realm.
CIFS clients and NFS clients use Kerberos authentication.

Steps:

1. Select Administration > Access > Authentication. The Authentication view appears.
2. Expand the Active Directory/Kerberos Authentication panel.
3. Click Configure next to Mode to start the configuration wizard. The Active Directory/Kerberos Authentication dialog appears.
4. Select Windows/Active Directory and click Next.
5. Enter the Full Realm Name for the system (example; domain1.local), the username, and password for the system.
6. Click Next.

7. Select the default CIFS Server Name, or select Manual and enter a CIFS server name.
8. To select Domain Controllers, select Automatically Assign, or select Manual and enter up to three domain controller names. Enter fully qualified domain names, hostnames, or IP addresses (IPv4 or IPv6).
9. To select an organizational unit, select Use Default Computers, or select Manual and enter an organization unit name.

10. Click Next. The Summary page for the configuration appears.
11. Click Finish. The system displays the configuration information in the Authentication view.
12. Click Enable to the right of Active Directory Administrative Access to enable administrative access.

Authentication Mode Selections

The authentication mode selection determines how CIFS and NFS clients authenticate using supported combinations of Active Directory, Workgroup, and Kerberos authentication.
About this task, DDOS supports the following authentication options.

• Disabled: Kerberos authentication is disabled for CIFS and NFS clients. CIFS clients use Workgroup authentication.
• Windows/Active Directory: Kerberos authentication is enabled for CIFS and NFS clients. CIFS clients use Active Directory authentication.
• UNIX: Kerberos authentication is enabled for only NFS clients. CIFS clients use Workgroup authentication.

Managing Administrative Groups for Active Directory

Use the Active Directory/Kerberos Authentication panel to create, modify, and delete Active Directory (Windows) groups and assign management roles (admin, backup-operator, so on) to those groups.

To prepare for managing groups, select Administration > Access > Authentication, expand the Active Directory/Kerberos Authentication panel, and click the Active Directory Administrative Access Enable button.

Creating Administrative Groups for Active Directory

Create an administrative group to assign a management role to all the users configured in an Active Directory group.
Prerequisites: Enable Active Directory Administrative Access on the Active Directory/Kerberos Authentication panel in the Administration > Access > Authentication page.

Steps:

1. Click Create
2. Enter the domain and group name separated by a backslash.

3. Select the Management Role for the group from the drop-down menu.
4. Click OK.

Modifying Administrative Groups for Active Directory

Modify an administrative group when you want to change the administrative domain name or group name configured for an Active Directory group.
Prerequisites: Enable Active Directory Administrative Access on the Active Directory/Kerberos Authentication panel in the Administration > Access > Authentication page.

Steps:

1. Select a Group to modify under the Active Directory Administrative Access heading.
2. Click Modify
3. Modify the domain and group name, and use a backslash "\" to separate them. For example: domainname\groupname

Deleting Administrative Groups for Active Directory

Delete an administrative group to terminate system access for all the users configured in an Active Directory group.
Prerequisites: Enable Active Directory Administrative Access on the Active Directory/Kerberos Authentication panel in the Administration > Access > Authentication page.

Steps:

1. Select a Group to delete under the Active Directory Administrative Access heading.
2. Click Delete.

System clock

When using active directory mode for CIFS access, the system clock time can differ by no more than five minutes from that of the domain controller.
When configured for Active Directory authentication, the system regularly syncs time with the Windows domain controller. 
Therefore for the domain controller to obtain the time from a reliable time source, see the Microsoft documentation for your Windows operating system version to configure the domain controller with a time source.

Ports for Active Directory 

Active Directory

Active Directory is not FIPS-compliant.
Active Directory continues to work when it is configured and when FIPS is enabled.

Authentication Configuration

The information in the Authentication panel changes, depending on the type of authentication that is configured.
Click the Configure link in to the left of the Authentication label in the Configuration tab. The system goes to the Administration > Access > Authentication page where to configure authentication for Active Directory, Kerberos, Workgroups, and NIS.

Active directory configuration information 

Workgroup Configuration 

Related Articles:

• Data Domain - Joining a Data Domain System to a Windows Domain
• Unable to join a Data Domain to a Specific Organizational Unit (OU) of Active Directory

The Following Related Articles can only be Viewed By Logging In to Dell Support as a Registered User:

• PowerProtect DD System Manager (DDSM) and Data Domain Management Server (DDMC) access fails with AD Authentication
• Active Directory Authentication not working as GC is disabled in Data Domain
• Data Domain: Unable to Access the Data Domain System with CIFS in Active Directory Mode
• Data Domain: Using CIFS "Set Authentication Active-Directory" Command
• Join Data Domain to Active Directory to a specific Organizational Unit (OU)
• Data Domain: Windows Authentication Issues with the Data Domain System Configured for Active Directory
• Data Domain: Unable to Join Active Directory Due to Server Policies