EMC® VNX® Series Security Configuration Guide for VNX

Active Directory Users & Computers

Active Directory user and group accounts can be managed with the Active Directory Users & Computers (ADUC) MMC Snap-in. This snap-in is installed automatically on every Windows domain controller. You access this tool from Control Panel > Administrative Tools > Active Directory Users & Computers.

1. Open ADUC and (if necessary) connect to the domain. Right-click the domain name, and then select Find from the menu.
2. Identify a domain user who will be a VNX for file user. To locate the user profile, type the user's name in the Find field and click Find Now.
3. Add the X.500 path to the displayed user information by selecting View > Choose Columns.
4. Select X500 Distinguished Name from the Columns available field and click Add.
5. The Find window now displays the X.500 distinguished name of this user. The X.500 distinguished name contains the user’s name (CN=Joe Muggs) and the path to the container in the directory structure where this user is located: CN=Users,DC=derbycity,DC=local. Record the path.
6. Verify that all other VNX for file users use the same path by either:
   • Repeating the Find for all VNX for file user accounts

     or

   • Navigating to that area of the directory in ADUC, and locating all VNX for file user accounts
7. Repeat steps 1 through 6 to find the path to the container in the directory structure where the groups are located.
   If the user and group paths are both CN=Users,DC=<domain component>,DC=<domain component>[, DC=<domain component>…] (for example CN=Users,DC=derbycity,DC=local), you can use the Default Active Directory option in the Unisphere Manage LDAP Domain view. This option assumes that the users and groups are located in the default container (CN=Users), so you do not have to specify the user or group search path.
8. Users might not be in the default container (CN=Users). They may instead be located in other containers or organizational units within the directory, for example VNX for File Users. In this case, you need to use the Custom Active Directory option in the Unisphere Manage LDAP Domain view and manually enter the search paths.
9. Groups might not be in the default container (CN=Users), and they do not have to be located with the users. They may instead be located within other containers or organizational units within the directory.
10. The LDAP user and group search begins with the path specified, and searches that container and all containers below it. If VNX for file users and groups are not located within the same container or organizational unit, you must use the intersection (common parts) of their collective paths when you specify the user and group search paths. In some cases, this may need to be the root of the domain. For example, assume that VNX for file users are stored in the following two Active Directory locations:
    • Path 1: CN=Users,DC=derbycity,DC=local
    • Path 2: OU=VNX Users,OU=EMC VNX,DC=derbycity,DC=local

    In order for VNX for file to find all users, you need to use the intersection of the two paths as your search path, that is, the domain root DC=derbycity,DC=local. Type this value in the User Search Path field in the Unisphere Manage LDAP Domain view.

11. Use the Find window again to determine the full X.500 path of the account you will use to connect the VNX for file Control Station to the directory. In this case you should not remove the username from the path because you are specifying the path to an individual account.
    • If you are using the Default Active Directory option in the Unisphere Manage LDAP Domain view, type only the account name, for example VNX LDAP Binding, in the Account Name field. You do not need to provide the X.500 syntax because the VNX for file software constructs the full X.500 path.
    • If you are using the Custom Active Directory option in Manage LDAP Domain, then type the full X.500 path in the Distinguished Name field.