Install the Management Console

This section provides information on management console requirements and installing the console.

Requirements to Use AD Bridge with Active Directory

This section lists the requirements to use AD Bridge Enterprise with Active Directory.

You must have at least the following components:

  • An Active Directory domain controller.
  • A Windows administrative workstation that is running ADUC and is connected to your Active Directory domain controller.
  • One or more Unix or Linux computers running an operating system that AD Bridge Enterprise supports, such as versions of macOS, Red Hat, SUSE Linux, Fedora, CentOS, Debian, Sun Solaris, IBM AIX, HP-UX, and Ubuntu.

For agent requirements (the software that runs on the Linux, Unix, and macOS computers that you want to connect to AD), please see Install the AD Bridge Enterprise Agent.

Microsoft Management Tools

AD Bridge Enterprise works with ADUC, GPME, and GPMC. Ensure that the Microsoft management tools are installed before you install AD Bridge Enterprise.

The Microsoft management tools vary by Windows version, but include the Remote Server Administration Tools (RSAT) for Windows.

Turn Windows features on or off

Turn on the following RSAT features. Go to Control Panel, select Programs, and then select Turn Windows features on or off:

  • Group Policy Management Tools
  • Active Directory Module for Windows PowerShell
  • Active Directory Administrative Center
  • AD DS Snap-ins and Command-Line Tools

 

For more information, please see Remote Server Administration Tools for Windows.

Administrator Privileges

  • Root access or sudo permission on the Unix, Linux, and macOS computers that you want to join to the domain.
  • Active Directory credentials that allow you to add computers to an Active Directory domain. For example, membership in the Domain Administrators security group or the Enterprise Administrators security group.

Active Directory Requirements

  • Windows Server 2008 R2 or higher

Windows Requirements for the Console

  • One of the following operating systems:
    • Windows Professional 7 or higher with RSAT
    • Windows Server 2008 R2 or higher
    • 64-bit versions only
  • Microsoft .NET Framework 4.5
  • 50 MB of free space

Requirements to Run AD Bridge Enterprise in Directory Integrated Mode

  • Active Directory installations that comply with RFC 2307
  • Domain and forest functional levels have been raised to Windows Server 2003 or later.

For more information, please see Storage Modes in Active Directory.

Networking

The subnets with your Linux, Unix, and macOS computers must be added to Active Directory sites before joining the computers to Active Directory so that the AD Bridge Enterprise agent can detect the optimal domain controller and global catalog.

Replication

Make sure your AD replication system is up to date and functioning properly by using the following diagnostic tools from www.microsoft.com/download to test replication.

For instructions, see the Microsoft documentation for each tool.

  • DCDiag: Part of Microsoft's support tools for Windows Server 2003, dcdiag.exe should be run with the /v /c /e switches to test the domain controllers in all your sites.
  • FRSDiag: Use frsdiag.exe tool, available from the Microsoft Resource Kit tools, to check the File Replication Service (FRS).

In addition, the following tools can help you review and troubleshoot FRS problems.

  • Sonar: Use it to perform a quick review of FRS status.
  • Ultrasound: Use it to monitor and troubleshoot FRS.
  • ReplMon: Included in the Microsoft Resource Kit Tools. Use it to investigate replication problems across links where DCDiag showed failures.

Supported Platforms and Applications

Platforms

AD Bridge Enterprise supports many Unix, Linux, macOS, and virtualization platforms.

Applications

You can use the Advanced Group Policy Management (AGPM) tool to manage your GPOs. Any AD Bridge Enterprise settings applied to your GPOs will be maintained.

Install the Console

Install the BeyondTrust Management Console on a Windows administrative workstation that can connect to your Active Directory domain controller.

We recommend that you do not install the console on a domain controller.

  • Review the requirements before proceeding with the installation.

For more information, please see Requirements to Use AD Bridge with Active Directory.

  • Ensure the account you are using to run the install is a member of the Domain Admins group or Enterprise Admins group. The account needs privileges to change objects and child objects in Active Directory.
  • Ensure the Microsoft management tools for Active Directory are installed before you install the console.

For more information about Microsoft management tools, please see Requirements to Use AD Bridge with Active Directory.

During the installation, checks are in place to ensure that your environment meets successful installation requirements. If you need more information, a log file is created here during the install: %UserProfile%AppData\Local\PBIS.Logs.

  1. Locate and copy the SetupPBIS64-*.exe install file to your Windows workstation. The installer file includes the version and build number.
  2. Run SetupPBIS64-*.exe.
  3. On the License Agreement page, click Accept to go through the installation.
  4. Click Install.
  5. On the Directory Integrated Mode Configuration page, click Configure to set up Directory Integrated mode. Otherwise, click Skip.
  6. On the Default Cell Creation page, click Create Cell to build the default cell. Otherwise, click Skip.
  7. On the Reporting Options page, configure the following:
    • Report Viewer: Click Install to install the Report viewer.
    • SQL Server database instance: Click Search Server to create the AD Bridge database.
    • Event Collector services: Click Install to go through the wizard to configure the AD Bridge Database utilities.
  8. Click Finish.

Use msiexec.exe

Silent Install

Run a silent install or uninstall of the console using msiexec.exe. To see a complete list of options, run msiexec.exe.

Examples

  • msiexec.exe /i PBISEnterprise64-x.x.x.xxx.msi /quiet /qn
  • msiexec.exe /x PBISEnterprise64-x.x.x.xxx.msi /quiet /qn

Install Individual Modules

Install individual AD Bridge modules using msiexec.exe. The following module options are available:

  • BaseInstall
  • ConsoleInstall
  • ReportingToolsInstall
  • OperationsDashboard
  • DBUpdateTool
  • MigrationToolsInstall
  • MMCExtensions
  • MigrationToolsInstall
  • GPMC
  • ADUC

Example

msiexec /i PBISEnterprise64-x.x.x.xxx.msi ADDLOCAL=BaseInstall /qn

Install Active Directory and GPMC Extensions

You can run an installer that only installs the Active Directory Users and Computers and Group Policy Management Console (GPMC) extensions. The BeyondTrust Management Console and reporting components will not be installed. Run the installer: SetupExtensions64-x.x.x.xxx.exe.

Upgrade the Console

To upgrade to the latest version of AD Bridge Enterprise, first uninstall the existing version. Then, before installing the latest version of AD Bridge Enterprise, install the latest version of Group Policy Management Console (GPMC) and run Windows update to make sure your workstation has the latest XML patches.

Upgrade AD Bridge 7.5 to AD Bridge 8.1

If you were using Directory Integrated mode in AD Bridge Enterprise 7.5, updates to the schema need to be applied when you upgrade to AD Bridge Enterprise 8.1. Ensure that the user installing AD Bridge is a member in the Schema Admins group. The install must be run on the forest root since the Schema Admins group only exists on the domain controller for the forest.

For more information on the Schema Admins group, please refer to Microsoft documentation.

When Schema Admins permissions are in place, you can upgrade AD Bridge without removing your existing AD Bridge Cells.

The Schema Admins permissions only apply to an upgrade.

  1. Locate and copy the SetupPBIS64-*.exe install file to your Windows workstation. The installer file includes the version and build number.
  2. Run SetupPBIS64-*.exe.
  3. Accept the license agreement, and then click Next.
  4. To change settings for the AD Bridge Enterprise install, click Modify. The installation wizard starts. This is where you select the components to install.
    • set the user name and organization
    • set the installation directory
    • select the AD Bridge components to install:
      • BT Management Console
      • Reporting
      • Operations Dashboard
      • Database Update and Management tools
      • Migration tools
      • GPMC support.
    • click Finish

Directory Integrated Mode Configuration Page

  1. If you plan to use Directory Integrated mode, there is no configuration required here. Click Skip.

 

  1. Click Skip on the Default Cell Create Page.
  2. On the Advanced Options page, you can:
    • Remove the report viewer.
    • Create or remove database instances.
    • Run the AD Bridge Enterprise Database Utilities wizard.
  3. Click Finish.

Upgrade from 8.1 - Directory Integrated Mode

This section applies to upgrades from AD Bridge version 8.1 and later if you have met one or more of the following criteria:

  • Using Directory Integrated mode in AD Bridge versions 7.5 and earlier, and installing the Management Console.
  • In your forest schema, UidNumber, GidNumber and Uid are all indexed and promoted to the Global Catalog.

The installer detects the old Directory Integration mode and updates to the schema needed to be applied to prevent potential issues. Ensure that the user installing AD Bridge is a member in the Schema Admins group.

Run the installer on the forest root.

For more information on the Schema Admins group, please refer to Microsoft documentation.

When Schema Admins permissions are in place, you can upgrade AD Bridge Directory Integration mode without removing your existing AD Bridge Cells.

For changes to the schema, please see Changes Applied by the Directory Integrated Mode Configuration.

Change to Directory Integrated Mode

Running the wizard indexes frequently searched attributes in the Active Directory global catalog.

  1. Run the AD Bridge installer, and skip to the Directory Integrated Mode Configuration page.
  2. Click the Configure button.

The necessary attributes are updated.

Changes Applied by the Directory Integrated Mode Configuration

The Active Directory schema changes are applied from a set of LDAP Data Interchange Format (LDIF) files. The standard installation places these files in the following directory: \Program Files\BeyondTrust\PBIS\Enterprise\Resources\LDF.

After you raise the domain and forest to 2003 functional levels, the AD Bridge Enterprise domain configuration wizard changes the following attributes, which are required for AD Bridge Enterprise to run in Directory Integrated mode.

Promotes and indexes the following attributes to the global catalog:

  • displayName
  • gidNumber
  • uid
  • uidNumber

Promotes (but does not index) the following attributes to the global catalog:

  • gecos
  • loginShell
  • unixHomeDirectory