Compose-Files/Backups/Miker/.trash/Configuration Add SAT user.md

SAT User Provisioning and Server Access
STOP: SAT Accounts should not be manually created
SAT user accounts should be provisioned through the ADEX Tool HERE
SAT Server access is granted to user accounts through Security Groups and enforced by Group Policy
IT IS NOT granted by adding users to the Local Admin groups of servers. If added directly to These Local groups, the accounts will get removed during the next GPO processing.
 
SAT Provisioning tool
You Use this tool to Both Create and ADD users to Security groups

1. Enter the HASH ID of the USER

2. Click "Lookup User Info" This gathers User Info in AD 

3. Select a Program Office from the drop down. This is the location the account(s) will go into

4. Place a check in the Accounts to be created . Regular account always created, you need to place check in the Admin (default is blank). If the Accounts already exist, creation options will not be presented

5. Click "LookUp Security Groups"

   • Based on the Program Office chosen, a listing of available Security groups will be presented

     • SAT\SG--Server-AdminsSAT\SG--Server-Users

6. Place a check mark in the groups to be added

   • "What Groups do I add them too".. See below in "Security Groups and GPOs"

7. Click "Process" Allow 5 Minutes to take affect

 
Security Groups and GPOs
When adding a user to security groups, you first need to know what servers the Security Groups grant access to. A future version of the App tool may enumerate those servers, but for now, the process is two-fold

1. Look up the Server object in the SAT Domain in ADUC, identify its OU location
2. Open Group Policy manager, look at that OU, and inspect the GPO that is being used for Server Access, and that will show you the Security groups.

 
The Security groups are created in the "Program Office" sub OU under "AccessControl\Groups Security"
These are the Groups that are presented during the use of the SAT Provisioning tool, by the program office selected.

My server isn't inheriting a "Server Access :****" GPO
Security groups will need to be created in the Correct program Office OU location and named following the naming standards
SAT\SG--Server-Admins
SAT\SG--Server-Users
A GPO must be Created and linked to the OU the server resides in 
STOP.. GPO's are inherited by all member Servers in that OU
If you are not 100% confident on the proper way to create a GPO or understand its effect on the servers that will inherit, contact a senior member of the WSG Staff to instruct or assist. > From <https://uconnect.cbpnet.cbp.dhs.gov/sites/OIT/edme/edco/dco/osg/WSG%20Wiki/Adding%20SAT%20Users%20SAT%20Server%20ADMIN%20and%20Remote%20User%20Roles.aspx>