48 lines
3.1 KiB
Markdown
48 lines
3.1 KiB
Markdown
**SAT User Provisioning and Server Access**
|
||
**STOP: SAT Accounts should not be manually created**
|
||
SAT user accounts should be provisioned through the ADEX Tool [HERE](https://adex.cbp.dhs.gov/WSG-Forms/SAT/SAT_Account_Provisioning.cfm)
|
||
SAT Server access is granted to user accounts through Security Groups and enforced by Group Policy
|
||
IT IS NOT granted by adding users to the Local Admin groups of servers. If added directly to These Local groups, the accounts will get removed during the next GPO processing.
|
||
|
||
SAT Provisioning tool
|
||
You Use this tool to Both Create and ADD users to Security groups
|
||
|
||
1. Enter the HASH ID of the USER
|
||
2. Click "Lookup User Info" This gathers User Info in AD
|
||
3. Select a Program Office from the drop down. This is the location the account(s) will go into
|
||
4. Place a check in the Accounts to be created . Regular account always created, you need to place check in the Admin (default is blank). If the Accounts already exist, creation options will not be presented
|
||
5. Click "LookUp Security Groups"
|
||
|
||
- Based on the Program Office chosen, a listing of available Security groups will be presented
|
||
|
||
- SAT\SG-*****-Server-AdminsSAT\SG-*****-Server-Users
|
||
6. Place a check mark in the groups to be added
|
||
|
||
- "What Groups do I add them too".. See below in "Security Groups and GPOs"
|
||
7. Click "Process" Allow 5 Minutes to take affect
|
||
|
||
|
||
|
||
|
||
Security Groups and GPOs
|
||
When adding a user to security groups, you first need to know what servers the Security Groups grant access to. A future version of the App tool may enumerate those servers, but for now, the process is two-fold
|
||
|
||
1. Look up the Server object in the SAT Domain in ADUC, identify its OU location
|
||
2. Open Group Policy manager, look at that OU, and inspect the GPO that is being used for Server Access, and that will show you the Security groups.
|
||
|
||
|
||
|
||
|
||
The Security groups are created in the "Program Office" sub OU under "AccessControl\Groups Security\"
|
||
These are the Groups that are presented during the use of the SAT Provisioning tool, by the program office selected.
|
||
|
||
|
||
|
||
**My server isn't inheriting a "Server Access :****" GPO**
|
||
Security groups will need to be created in the Correct program Office OU location and named following the naming standards
|
||
SAT\SG-*****-Server-Admins
|
||
SAT\SG-*****-Server-Users
|
||
A GPO must be Created and linked to the OU the server resides in
|
||
**STOP..** GPO's are inherited by all member Servers in that OU
|
||
If you are not 100% confident on the proper way to create a GPO or understand its effect on the servers that will inherit, contact a senior member of the WSG Staff to instruct or assist.
|
||
\> From \<[https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Adding%20SAT%20Users%20SAT%20Server%20ADMIN%20and%20Remote%20User%20Roles.aspx](https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Adding%20SAT%20Users%20SAT%20Server%20ADMIN%20and%20Remote%20User%20Roles.aspx)\> |