Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I work with an MSP and we would like to implement something to the effect that every user within our organization can easily be added across multiple different domains that aren't nessasarily in the same forest.

Let me give you an example

Say a new user, John Doe joins our company, Obviously we don't want everyone knowing the domain administrator password so we create him a username, say, adminjd, with a company he is to work with, XYZ, however, we manage MANY customers, so not only must he have an account with XYZ, but also ABC, 123, ACME, so on and so forth - so adding him service accounts could consume a technician for several days. No good. The issue is compounded even further if, say we have a not-so-amicable break with Mr. Doe and we want to remove his accounts. We can do this easily and quickly with Solarwinds NCM for Cisco/Juniper/Etc. devices, but we don't have a great solution for Active Directories/LDAP, paid or otherwise.

It would also be nice to monitor events and other relevent Active Directory info, but the primary function is stated above.

Does anyone have any experience with such software? Can someone make a recommendation?

share|improve this question
    
your title doesn't seem to match the question, also scom's ACS is a good choice for monitoring –  tony roth Sep 16 '10 at 15:50
    
Agreed. Please change the title. –  gWaldo Sep 16 '10 at 16:08
    
I'm trying to retag you, but I can't make sense of it. –  DanBig Sep 16 '10 at 19:14

4 Answers 4

up vote 1 down vote accepted

I recommend a scripting solution. (It's my best hammer, so everything looks like a nail...) In this case of Active Directory Scripting, Perl makes this much easier than it is in VBScript (my two strongest languages), because you have to explicitly bind to each domain in Perl (where in VBScript it uses the account context of that the script is run as). I typically use the NET::LDAP module.

I would either set the script to accept command line arguments, or present a question-and-answer list (full name, username, password, domain admin?, etc). You'll also ask for your own username and password for the domains as well. (This is easier if you use the (insecure) practice of having all passwords match across domains, but you can set it to ask for each run.)

Then define an array of your client's domains. In a for loop, bind to each domain, create the account in each (setting groups and passwords) and then move on to the next domain. Rinse. Repeat.

share|improve this answer
    
Normally, I'd be right behind you on the scripting bandwagon, but unfortunately, in an environment like this, people REALLY want to have a web solution or a enterprise 'active directory monitor'. I don't have enough experience to say if something like Microsoft's System Center Operations Manageer would work, but its unfortunate that seeing or hearing the word 'command-line' runs shivers down the less technically inclined's (Read 'business types') back. –  zv_ Sep 16 '10 at 16:13
1  
You could always write it up, and set up a web front-end using CGI or the like... Sadly I don't know of another product that would do something like this out-of-the-box all pretty-like... –  gWaldo Sep 16 '10 at 16:25
    
I voted you up for a good answer, regardless of if it solves my problem. –  zv_ Sep 16 '10 at 16:27
    
Thanks for the upvote. You could use this "problem" as an "opportunity" (sorry, I just threw up a little from the corpspeak...) to weasel some training dollars from the company. Don't forget about things like PerlTK which allow you to do GUIs! –  gWaldo Sep 16 '10 at 16:29
    
A scripting solution or a basic ASP.NET website should be approx. the same development effort... you can even call into powershell cmdlets within .NET if that is to your fancy/reuse/DRY religion ^^ –  Oskar Duveborn Sep 17 '10 at 10:37

We have been using Novell Identity Manager in our environment for many years and are extremely pleased with the results. It provisions an arbitrary number of Active Directory domains as well as eDirectory, various e-mail solutions, databases, etc. and is very flexible in how it is deployed. Because of the scope of the product, it can be quite complex but it will essentially handle any and all user and resource provisioning tasks you throw at it (and you can limit its scope for simple out-of-the-box deployments). The stability and scalability after initial setup are excellent.

http://www.novell.com/products/identitymanager/

share|improve this answer
    
Does it require that we run Novell? –  zv_ Sep 16 '10 at 19:17
    
It requires a server running the Identity Manager (IDM) product, and one instance of eDirectory (included with the product, probably running on the same server) for the central Identity Vault. You can run IDM on a number of different Linux, Unix and Windows platforms but we are running it on a SUSE Linux 10 server at present. Since Novell owns SUSE, I would go with that as the IDM server base. If by "Novell" you mean the Netware OS then no, it does not. Novell as a company has been migrating its offerings to SUSE Linux as its server OS for the past few years. –  Johnnie Odom Sep 16 '10 at 19:22
1  
@Zephyr Novell is a company, not a product. –  Chris Thorpe Sep 17 '10 at 10:52

Try ManageEngine ADManager Plus to provision user accounts in Active Directory across multiple domains. To monitor the user actions deploy ManageEngine ADAudit Plus.

share|improve this answer

AuthAnvil, does what you want. I don't use it but I've heard great things about it. You don't need to even create accounts on each system.

Ian

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.