Veritas Access Administrator's Guide

To extend the Active Directory schema with the necessary CIFS-schema extensions

1. Login with Schema Admins privileges on the Active Directory Forest Schema Master domain controller.
2. Download ADCIFSSchema.zip from the Veritas Access server (/opt/VRTSnas/tools/cifs/ADCIFSSchema.zip) with software such as WinSCP.exe.
3. Unzip the file and open each .ldf file to perform a search and replace of the string dc=example,dc=com, replacing the string with the top-level domain component (that is, dc=yourdomain,dc=com) values for the AD forest.
4. Install the schema extensions by executing the schemaupdate.bat file from the command prompt.

To validate the schema extensions

1. Execute regsvr32 schmmgmt.dll in a command prompt window to install the Active Directory Schema Snap-In on the AD server.
2. Enter mmc in Run.
3. On the File menu, click Add/Remove Snapin.
4. In Available snap-ins, click Active Directory Schema, and then click Add.
5. Click OK.
6. Click Attributes in the left frame, and try to find uidNumber and gidNumber in the right frame.

   Validate that the uidNumber and gidNumber attributes have no minimum or maximum value setting by viewing the properties of the attribute objects.

To create an application partition

1. Open a command prompt window on the domain controller that will hold the first replica of the application partition.
2. Enter ntdsutil in the command prompt window.
3. At the ntdsutil command prompt, enter the following:

   domain management

   If you are using Windows 2008, change this command to the following:

   partition management

4. At the domain management command prompt, enter the following:

   connection

5. At the connection command prompt, enter the following:

   connect to server adserver.example.com

6. At the connection command prompt, enter the following:

   quit

7. At the domain management command prompt, enter the following such as:

   create nc dc=idmap,dc=example,dc=com null

   Example settings:

   C:\>ntdsutil
   ntdsutil: domain management
   domain management: connection
   server connections: connect to server adserver.example.com
   Binding to adserver.example.com ...
   Connected to adserver.si2m.com using credentials of locally logged 
   on user.
   server connections: quit
   domain management: create nc dc=idmap,dc=example,dc=com NULL
   adding object dc=idmap,dc=example,dc=com
   domain management: quit
   ntdsutil: quit
   Disconnecting from adserver.example.com...

8. Once the application partition has been created, open ADSIedit.msc fromRun, then right-click on ADSI Edit in the left frame, and click connect to ... to connect to the application partition using the settings as indicated:

   Name	Enter Domain.
   Connection Point	Select or enter a Distinguished Name or Naming Context, as in: dc=idmap,dc=example,dc=com
   Computer	Select or enter a domain or server, as in: adserver.example.com

   
9. Once connected, select the top-level application partition (for example, dc=idmap,dc=example,dc=com) node in the left panel, and right-click to select New then Object from the list, and then select SambaUnixIdPool.
   

   When prompted, enter the following values:

   OU attribute	cifsidmap
   uidNumber	10000
   gidNumber	10000

10. Click Finish to complete the configuration.
11. Once the ou=cifsidmap,dc=idmap,dc=example,dc=com container has been created, right-click the object, and select properties.
12. On the Security tab, click Add, and proceed to add the cifsuser user account, and grant the account Read, Write, Create All Child Objects, and Delete All Child Objects permissions.