McAfee EPOCDE-AA-BA Product Guide - Page 57

Configuring advanced server settings Configuring Active Directory user login 7 • Do you want to use multiple domain controllers? • Do you have users spread across multiple domains? • Do you want to use a WINS server to look up which domain your users are authenticating against? Without any special configuration, users can authenticate using Windows credentials for the domain that the McAfee ePO server is joined to, or any domain that has a two-way trust relationship with the McAfee ePO server's domain. If you have users in domains that don't meet that criteria, you must configure Windows authentication. For option definitions, click ? in the interface. Task 1 Click Menu | Configuration | Server Settings, then select Windows Authentication from the Settings Categories list. 2 Click Edit. 3 Specify whether you want to use one or more Domains, one or more Domain controllers, or a WINS server. Domains must be provided in DNS format. (e.g. internaldomain.com) Domain controllers and WINS servers must have fully-qualified domain names. (e.g. dc.internaldomain.com) You can specify multiple domains or domain controllers, but only one WINS server. Click + to add additional domains or domain controllers to the list. 4 Click Save when you are finished adding servers. If you specify domains or domain controllers, the McAfee ePO server will attempt to authenticate users with servers in the order they are listed. It starts at the first server in the list and continues down the list until the user authenticates successfully. Configuring Windows authorization Users attempting to log on to an ePolicy Orchestrator server using Windows authentication need a permission set assigned to one of their Active Directory groups to log on successfully. Task For option definitions, click ? in the interface. 1 Click Menu | User Management | Permission Sets. 2 Either choose an existing permission set from the Permission Sets list and click Edit in the Name and users section, or click Actions | New. 3 Select any individual users the permission set should apply to. 4 Select a Server name from the list and click Add. 5 In the LDAP browser, navigate through the groups and select the groups to which this permission set should apply. Selecting an item in the Browse pane will display the members of that item in the Groups pane. You can select any number of those groups to receive the permission set dynamically. Only members from one item at a time may be added. If you need to add more, repeat steps 4 and 5 until you are finished. 6 Click Save. The permission set will now be applied to all users from the groups you specified logging on to the server using Windows authentication. McAfee® ePolicy Orchestrator® 4.6.0 Software Product Guide 57