HP Ilo 3 User Guide

4.Manage
a.Createamanagementdeviceobjectandaroleobjectbyusingthesnap-in.
b.Assignrightstotheroleobject,asnecessary,andassociatetherolewiththemanagement
deviceobject.
c.Adduserstotheroleobject.
Formoreinformationaboutmanagingthedirectoryservice,see“Directory-enabledremote
management”(page190).Examplesareavailablein“DirectoryservicesforActiveDirectory”
(page174)and“DirectoryservicesforeDirectory”(page182).
5.Handleexceptions
iLOmigrationutilitiesareeasiertousewithasinglerole.Ifyouplantocreatemultipleroles...

Figure85InstallerforSchemaExtenderandsnap-ins
YoucannotruntheschemainstalleronadomaincontrollerthathostsWindowsServer2008Core.
Forsecurityandperformancereasons,WindowsServer2008CoredoesnotuseaGUI.Touse
theschemainstaller,youmustinstallaGUIonthedomaincontrolleroruseadomaincontroller
thathostsanearlierversionofWindows.
SchemaExtender
Several.xmlfilesarebundledwiththeSchemaExtender.Thesefilescontaintheschemasthat
areaddedtothedirectory.Typically,oneofthesefilescontainsacoreschemathatiscommonto...

Setupwindow
YouusetheSetupwindow(Figure87)toentertheappropriateinformationbeforeextendingthe
schema.
TheDirectoryServersectionoftheSetupwindowenablesyoutospecifywhetheryouwilluse
ActiveDirectoryoreDirectory,andtosetthecomputernameandtheporttobeusedforLDAP
communications.
NOTE:WhenyouarerunningtheSchemaExtendertool,youmustusetheAdministrator
loginalongwiththedomainname,forexample,[email protected]\
Administrator....

Figure88Resultswindow
Managementsnap-ininstaller
Themanagementsnap-ininstallerinstallsthesnap-insrequiredtomanageiLOobjectsinaMicrosoft
ActiveDirectoryUsersandComputersdirectoryorNovellConsoleOnedirectory.
iLOsnap-insareusedtoperformthefollowingtasksincreatinganiLOdirectory:
•CreatingandmanagingtheiLOobjectsandroleobjects
•MakingtheassociationsbetweentheiLOobjectsandtheroleobjects
DirectoryservicesforActiveDirectory
Thefollowingsectionsprovideinstallationprerequisites,preparationinstructions,andaworking...

•InstallingdirectoryservicesforiLOrequiresextendingtheActiveDirectoryschema.AnActive
Directoryschemaadministratormustextendtheschema.
•directoryservicesforiLOusesLDAPoverSSLtocommunicatewiththedirectoryservers.Before
youinstallsnap-insandschemaforActiveDirectory,readandhaveavailablethefollowing
documentation:
◦MicrosoftKnowledgeBaseArticles
Thesearticlesareavailableathttp://support.microsoft.com/.
–321051EnablingLDAPoverSSLwithaThird-PartyCertificateAuthority...

8.NavigatetotheiLODedicatedNetworkPortorSharedNetworkPortGeneralSettingspage,
andthenentertheenvironmentsettingsintheDomainNameandPrimaryDNSserverboxes.
Formoreinformation,see“ConfiguringiLOnetworksettings”(page69).
NOTE:TheLDAPcomponentdoesnotworkwithaWindowsServer2008Coreinstallation.
Snap-ininstallationandinitializationforActiveDirectory
1.Runthesnap-ininstallationapplicationtoinstallthesnap-ins.
2.ConfigurethedirectoryservicetohavetheappropriateobjectsandrelationshipsforiLO
management....

d.ClickOK.
e.Repeattheprocess,creatingaroleforremoteservermonitorscalledremoteMonitors.
3.UsetheHP-providedActiveDirectoryUsersandComputerssnap-instoassignrightstothe
rolesandassociatetheroleswithusersanddevices.
a.Right-clicktheremoteAdminsroleintheRolesorganizationalunitinthe
testdomain.localdomain,andthenselectProperties.
TheremoteAdminsPropertiesdialogboxopens.
b.ClicktheHPDevicestab,andthenclickAdd.
TheSelectUsersdialogboxopens....

Afterthesnap-insareinstalled,iLOobjectsandiLOrolescanbecreatedinthedirectory.Byusing
theActiveDirectoryUsersandComputerstool,theusercompletesthefollowingtasks:
•CreatesiLOandroleobjects
•Addsuserstotheroleobjects
•Setstherightsandrestrictionsoftheroleobjects
NOTE:Afterthesnap-insareinstalled,ConsoleOneandMMCmustberestartedtoshowthe
newentries.
ActiveDirectorysnap-ins
ThefollowingsectionsdiscusstheadditionalmanagementoptionsavailableinActiveDirectory
UsersandComputersaftertheHPsnap-inshavebeeninstalled....

Figure90Memberstab
RoleRestrictionstab
TheRoleRestrictionstab(Figure91)enablesyoutosetthefollowingrestrictionsfortherole:
•Timerestrictions
•IPnetworkaddressrestrictions:
IP/mask◦
◦IPrange
◦DNSname
Figure91RoleRestrictionstab
Timerestrictions
YoucanmanagethehoursavailableforlogonbymembersoftherolebyclickingEffectiveHours
ontheRoleRestrictionstab.IntheLogonHoursdialogbox(Figure92),youcanselectthetimes
availableforlogonforeachdayoftheweek,inhalf-hourincrements.Youcanchangeasingle...

squarebyclickingit,oryoucanchangeasectionofsquaresbyclickingandholdingthemouse
button,draggingthecursoracrossthesquarestobechanged,andreleasingthemousebutton.
Thedefaultsettingistoallowaccessatalltimes.
Figure92LogonHoursdialogbox
EnforcedclientIPaddressorDNSnameaccess
AccesscanbegrantedordeniedtoanIPaddress,IPaddressrange,orDNSname.
1.FromtheByDefaultlist,selectwhethertoGrantorDenyaccessfromalladdressesexceptthe
specifiedIPaddresses,IPaddressranges,andDNSnames....