Dell NetWorker 19.9 Administration Guide

File-level restore as an Active Directory user

In order to perform a file-level restore as an Active Directory (AD) user in the NMC NetWorker Administration window's Recovery wizard or the Dell Data Protection Restore Client, you need to register a tenant user and provide the FLR AD user required permissions.

1. Log in to your AD server, and make note of objects related to this user (such as the Organizational Units (OU) and Groups in the Active Directory server) that will be added as a tenant user of NetWorker. You can use any third party AD viewer/browser to obtain the required objects and their properties.
   For example,
   1. Create an OU proxy inside the domain.
   2. Inside the OU proxy, create a group named vmware and another OU user.
   3. Inside the OU user, create a user named ADuser and make this user a member of the group vmware.
   4. If you plan to use the command line to register the AD user to NetWorker, as described in step two below, make note of the values for the following variables as you will require these values for the registration commands:
      • config-name
      • config-server-address
      • config-domain
      • config-user-dn
      • config-user-dn-password
      • config-user-object-class
      • config-user-search-path
      • config-user-id-attr
      • config-group-search-path
      • config-group-name-attr
      • config-group-object-class
      • config-group-member-attr
      • config-active-directory
   5. If you plan to use the NetWorker Management Console to register the AD user to NetWorker, also described in step two below, make note of the following values as you will require these values for the registration:
      • Domain
      • Port number
      • Provider Server name
      • User DN
      • Group Object Class
      • Group Search Path
      • Group Name Attribute
      • Group Member Attribute
      • User Object Class
      • User Search Path
      • User ID Attribute
2. Register the AD domain user to NetWorker either using the command line or the NetWorker Management Console user interface.
   If using the command line:
   1. Create a tenant user on NetWorker by running the authc_config command, as in the following:
      authc_config -u administrator -e add-tenant -D tenant-name=your tenant name -D tenant-alias your selected aliases -p password
      For example, to create a tenant user ADuser with the alias FLR, run authc_config -u administrator -e add-tenant -D tenant-name=ADuser -D tenant-alias FLR -p password
   2. Obtain the tenant ID by running the authc_config command using the find-tenant parameter. For example:
      authc_config -u administrator -e find-tenant -D tenantname=ADuser -p password
   3. Register the AD domain user to NetWorker by running the authc_config command using the add-config parameter and using the values obtained in Step1d, as in the following:
      authc_config -u administrator -e add-config -D config-tenant-id=tenant ID number -D config-name=your tenant name -D config-server-address=ldap IPv4/IPv6 address OU=proxy,DC=domain name,DC=com -D config-domain=domain name -D config-user-dn=CN=Aduser,OU=user,OU=proxy,DC=domain name,DC=com -D config-user-dn-password=password -D config-user-objectclass= inetOrgPerson -D config-user-search-path=OU=user -D config-userid- attr=cn -D config-group-search-path=OU=user -D config-group-nameattr= cn -D config-group-object-class=group -D config-group-memberattr= member -D config-active-directory=y -p password
   If using the NetWorker Management Console:
   1. Click the Setup tab.
   2. On the left pane of the Setup window, expand Users and Roles, right-click External Authority and select New from the drop-down. The Add External Authentication Authority dialog displays.
   3. Provide a name for the external authority (for example, Aduser), select Active Directory from the Server Type drop-down, and then fill in the required details with the values obtained from Step1e.
   4. Click OK.
3. In the NetWorker Management Console, click the Server tab.
4. On the Server window, select User Groups.
5. Add a user group (for example, ADuser group) with the following permissions:
   • View Security Settings
   • View Application Settings
   • Remote Access All Clients
   • Operate NetWorker
   • Monitor NetWorker
   • Operate Devices and Jukeboxes
   • Recover Local Data
   • Recover Remote Data
   • Backup Local Data
6. Edit the new user to add the required AD user and AD group in the External Roles field. For example, for a user named ADuser with the domain rideblr, add the following in the External Roles field:
   CN=Aduser,OU=user,OU=proxy,DC=rideblr,DC=com CN=vmware,OU=proxy,DC=rideblr,DC=com
7. Log in to the Dell Data Protection Restore Client as the AD user, in the format <tenant>\<domain>\<userid>. For example, default\rideblr.com\ADuser.