Synchronization mode - Active Directory / Open Directory / LDAP

To create a new Server Task, click Tasks > New > add_new_defaultServer Task or select the desired task type on the left and click New > add_new_defaultServer Task.

Basic

In the Basic section, enter basic information about the task, such as a Name and Description (optional). Click Select tags to assign tags.
In the Task drop-down menu, select the task type you want to create and configure. If you have selected a specific task type before creating a new task, Task is pre-selected based on your previous choice. Task (see the list of all Tasks) defines the settings and the behavior for the task.

You can also select from the following task trigger settings:

Run task immediately after finish - Select this option to have the task run automatically after you click Finish.

Configure trigger - Select this option to enable the Trigger section, where you can configure trigger settings.

To set the trigger later, leave the check boxes deselected.

Settings

Common Settings

Click Select under Static Group Name - by default, the executing user's home group will be used for synchronized computers. Alternatively you can create a New Static Group.

Object to synchronize - Either Computers and Groups, or Only Computers.

Computer creation collision handling - If the synchronization adds computers that are already members of the Static Group, you can select a conflict resolution method:

oSkip (synchronized computers will not be added)

oMove (new computers will be moved to a subgroup)

oDuplicate (new computer is created with modified name)

Computer extinction handling - If a computer no longer exists, you can either Remove this computer or Skip it.

Group extinction handling - If a group no longer exists, you can either Remove this group or Skip it.

Synchronization mode - Active Directory / Open Directory / LDAP

Read our Knowledgebase article on managing computers using Active Directory synchronization in ESMC 7.

Server connection settings

Server - Type the Server name or IP address of your domain controller.

Login - Type the Username for your domain controller in the following format:

oDOMAIN\username (ESMC Server running on Windows)

ousername@FULL.DOMAIN.NAME or username (ESMC Server running on Linux).

important

Important

Be sure to type the domain in capital letters, as this formatting is required in order to properly authenticate queries to an Active Directory server.

Password - Type the password used to log on to your domain controller.

important

Important

ESMC Server 7.2 on Windows uses the encrypted LDAPS (LDAP over SSL) protocol by default for all Active Directory (AD) connections. You can also configure LDAPS on ESMC Virtual Appliance.

If you upgrade an earlier ESMC version on Windows to ESMC 7.2 and you were using the Active Directory synchronization, synchronization tasks will fails in ESMC 7.2.

For a successful AD connection over LDAPS, configure the following:

1.The domain controller must have installed a machine certificate. To issue a certificate for your domain controller, follow the steps below:

a)Open the Server Manager, click Manage > Add Roles and Features and install the Active Directory Certificate Services > Certification Authority. A new Certification Authority will be created in Trusted Root Certification Authorities.

b)Navigate to Start > certmgr > Certificates - Local Computer > Personal > right click the empty pane > All Tasks > Request New Certificate > Enroll Domain Controller role.

c)Verify that the issued certificate contains the FQDN of the domain controller.

 

2.When providing connection settings to the AD server, type the FQDN of the domain controller (as provided in the domain controller certificate) in the Server or Host field. IP address is no longer sufficient for LDAPS.

To enable fallback to LDAP protocol, select the check box Use LDAP instead of Active Directory and enter the specific attributes to match your server. Alternatively, you can select Presets by clicking Select and the attributes will be populated automatically:

Active Directory

Mac OS X Server Open Directory (Computer Host Names)

Mac OS X Server Open Directory (Computer IP Addresses)

OpenLDAP with Samba computer records - For setting up the parameters DNS name in Active Directory.

When using the LDAP and Active Directory preset, you can populate computer details with attributes from your Active Directory structure. Only attributes of the type DirectoryString can be used. You can use a tool (for example, ADExplorer) to inspect the attributes on your Domain Controller. See the corresponding fields in the table below:

Computer details fields

Synchronization task fields

Name

Computer Hostname Attribute

Description

Computer Description Attribute

Synchronization Settings

Distinguished Name - Path (Distinguished Name) to the node in the Active Directory tree. Leaving this option empty will synchronize the entire AD tree. Click Browse next to Distinguished Name. Your Active Directory tree will be displayed. Select the top entry to synchronize all groups with ESMC, or select only the specific groups that you want to add. Only computers and Organizational Units are synchronized. Click OK when you are finished.

Excluded distinguished name(s) - You can choose to exclude (ignore) specific nodes in the Active Directory tree.

Ignore disabled computers (only in Active Directory) - You can choose to ignore computers disabled in Active Directory (the task will skip these computers).

important

Important

If you get the error: Server not find in Kerberos database after clicking Browse, use the server's AD FQDN instead of the IP address.

hmtoggle_plus0Synchronization from Linux server

Trigger

The Trigger section contains information about the trigger(s) which would run a task. Each Server Task can have up to one trigger. Each trigger can run only one Server Task. If Configure trigger is not selected in the Basic section, a trigger is not created. A task can be created without trigger. Such a task can be run afterward manually or a trigger can be added later.

Advanced Settings - Throttling

By setting Throttling, you can set advanced rules for the created trigger. Setting throttling is optional.

Summary

All configured options are displayed here. Review the settings and click Finish.

In Tasks you can see the progress indicator bar, status icon, and details for each created task.