migrate

2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
@@ -0,0 +1,48 @@
+**SAT User Provisioning and Server Access**  
+**STOP: SAT Accounts should not be manually created**  
+SAT user accounts should be provisioned through the ADEX Tool [HERE](https://adex.cbp.dhs.gov/WSG-Forms/SAT/SAT_Account_Provisioning.cfm)  
+SAT Server access is granted to user accounts through Security Groups and enforced by Group Policy  
+IT IS NOT granted by adding users to the Local Admin groups of servers. If added directly to These Local groups, the accounts will get removed during the next GPO processing.  
+   
+SAT Provisioning tool  
+You Use this tool to Both Create and ADD users to Security groups
+
+1. Enter the HASH ID of the USER
+2. Click "Lookup User Info" This gathers User Info in AD 
+3. Select a Program Office from the drop down. This is the location the account(s) will go into
+4. Place a check in the Accounts to be created . Regular account always created, you need to place check in the Admin (default is blank). If the Accounts already exist, creation options will not be presented
+5. Click "LookUp Security Groups"
+    
+    - Based on the Program Office chosen, a listing of available Security groups will be presented
+        
+        - SAT\SG-*****-Server-AdminsSAT\SG-*****-Server-Users
+6. Place a check mark in the groups to be added
+    
+    - "What Groups do I add them too".. See below in "Security Groups and GPOs"
+7. Click "Process" Allow 5 Minutes to take affect
+
+![SPT2jpg](Exported%20image%2020250808202223-0.jpeg)
+
+   
+Security Groups and GPOs  
+When adding a user to security groups, you first need to know what servers the Security Groups grant access to. A future version of the App tool may enumerate those servers, but for now, the process is two-fold
+
+1. Look up the Server object in the SAT Domain in ADUC, identify its OU location
+2. Open Group Policy manager, look at that OU, and inspect the GPO that is being used for Server Access, and that will show you the Security groups.
+
+![GPOexampljpg](Exported%20image%2020250808202224-1.jpeg)
+
+   
+The Security groups are created in the "Program Office" sub OU under "AccessControl\Groups Security\"  
+These are the Groups that are presented during the use of the SAT Provisioning tool, by the program office selected.
+
+![SGsjpg](Exported%20image%2020250808202224-2.jpeg)
+
+**My server isn't inheriting a "Server Access :****" GPO**  
+Security groups will need to be created in the Correct program Office OU location and named following the naming standards  
+SAT\SG-*****-Server-Admins  
+SAT\SG-*****-Server-Users  
+A GPO must be Created and linked to the OU the server resides in   
+**STOP..** GPO's are inherited by all member Servers in that OU  
+If you are not 100% confident on the proper way to create a GPO or understand its effect on the servers that will inherit, contact a senior member of the WSG Staff to instruct or assist.
+ \> From \<[https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Adding%20SAT%20Users%20SAT%20Server%20ADMIN%20and%20Remote%20User%20Roles.aspx](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Adding%20SAT%20Users%20SAT%20Server%20ADMIN%20and%20Remote%20User%20Roles.aspx)\>