iDRAC 8/7 v2.40.40.40 User’s Guide

Configuring Active Directory with Extended schema using RACADM

1. Use the following commands:

   racadm set iDRAC.ActiveDirectory.Enable 1
   racadm set iDRAC.ActiveDirectory.Schema 2
   racadm set iDRAC.ActiveDirectory.RacName <RAC common name>
   racadm set iDRAC.ActiveDirectory.RacDomain <fully qualified rac domain name>
   racadm set iDRAC.ActiveDirectory.DomainController1 <fully qualified domain name or IP address of the domain controller>
   racadm set iDRAC.ActiveDirectory.DomainController2 <fully qualified domain name or IP address of the domain controller>
   racadm set iDRAC.ActiveDirectory.DomainController3 <fully qualified domain name or IP address of the domain controller>

   • Enter the Fully Qualified Domain Name (FQDN) of the domain controller, not the FQDN of the domain. For example, enter servername.dell.com instead of dell.com.
   • You must provide at least one of the three addresses. iDRAC attempts to connect to each of the configured addresses one-by-one until it makes a successful connection. With Extended Schema, these are the FQDN or IP addresses of the domain controllers where this iDRAC device is located.
   • To disable the certificate validation during SSL handshake, use the following command:

     racadm set iDRAC.ActiveDirectory.CertValidationEnable 0

     In this case, you do not have to upload a CA certificate.
   • To enforce the certificate validation during SSL handshake (optional):

     racadm set iDRAC.ActiveDirectory.CertValidationEnable 1

     In this case, you must upload a CA certificate using the following command:

     racadm sslcertupload -t 0x2 -f <ADS root CA certificate>

     NOTE: If certificate validation is enabled, specify the Domain Controller Server addresses and the FQDN. Ensure that DNS is configured correctly under Overview > iDRAC Settings > Network.
     Using the following RACADM command may be optional:

     racadm sslcertdownload -t 0x1 -f <RAC SSL certificate>

2. If DHCP is enabled on iDRAC and you want to use the DNS provided by the DHCP server, enter the following command:

   racadm set iDRAC.IPv4.DNSFromDHCP 1

3. If DHCP is disabled in iDRAC or you want to manually input your DNS IP address, enter the following command:

   racadm set iDRAC.IPv4.DNSFromDHCP 0
   racadm set iDRAC.IPv4.DNSFromDHCP.DNS1 <primary DNS IP address>
   racadm set iDRAC.IPv4.DNSFromDHCP.DNS2 <secondary DNS IP address>

4. If you want to configure a list of user domains so that you only need to enter the user name during log in to iDRAC web interface, use the following command:

   racadm set iDRAC.UserDomain.<index>.Name <fully qualified domain name or IP Address of the domain controller>

   You can configure up to 40 user domains with index numbers between 1 and 40.