Installing the Cerebrum ADserver

Note: This service is deprecated!

Follow the general instructions in the code README.

This documentation is written for and tested with revision 12264 of the code. ADserver was tested on Windows Server 2008 x64, Windows Server 2008 R2 x64 and Windows Server 2003 x86.

A problem with x64 and python means there is currently no x64 support for Python for Windows Extensions (PyWin32), therefore all binaries must use 32bit versions.

Install the following components on a domain member machine:

• ActivePython-2.7
• pywin32 for Python 2.7
• pyOpenSSL for Python 2.7
• Win32 OpenSSL

If OpenSSL is complaining about missing DLL, try to install Visual C++ 2008 Redistributables from http://www.slproweb.com/products/Win32OpenSSL.html

Configure

Edit the Constants in the file ADconstants.py. See the README for details on each setting.

Recomended settings on the Domain Controller

• Create an user in AD, place the user in an OU Cerebrum is configured not to touch. Give this user the necessary rights to perform actions in Active Directory. Run the service in the context of this user. Remember to change password on the service if password is changed on the user AD. For security reasons This user should not be the user specified in the AUTH variable in the constants file. For test purposes it is advised that the user is a member of Domain Admins.
• Domain Functional level must be above 2000mixed mode to allow groups as groupmembers.
• The Group Policy Setting in Default Domain Policy: Computer Configuration -> Windows Settings Security Settings -> Account Policy -> Password Policy -> Password must meet complexity requirements should be disabled, else changing of password might fail. Password complexity requirements should be handled by Cerebrum.
• The Group Policy Setting in Default Domain Policy: User Configuration -> Windows Settings -> Administrative Template -> System -> Ctrl+Alt+Del Options -> Remove Change Password should be disabled.
• Create OUs matching the AD_OU values in cerebrum for deleted objects, groups, user and so on.
• Remember to configure the firewall and accept communication through port 8000, or the port specified by the PORT variable.
• The Machine must be member of the domain. The changes is done in the Active Directory domain through the Windows COM interface. The machine do not need to be a domain controller for the server work.

Running the ADserver

See README