Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

FAQs about the OfficeScan (OSCE) Active Directory (AD) integration

    • Updated:
    • 21 Apr 2016
    • Product/Version:
    • OfficeScan 10.6
    • Platform:
    • Windows 2003 Enterprise Server
    • Windows 2003 Standard Server Edition
    • Windows 2003 Standard Server Edition 64-bit
    • Windows 2008 Enterprise Server
    • Windows 2008 Enterprise Server Edition 64-bit
    • Windows 2008 Standard Server Edition
    • Windows 2008 Standard Server Edition 64-bit
Summary

This article provides information and answers to the common questions about OSCEintegration with Microsoft Active Directory.

Details
Public
Active Directory permissions
  1. What are the permissions needed by OfficeScan to log in to the Active Directory?
  2. Will the OfficeScan server change the scheme of the Active Directory?
  3. What user rights in Group Policies are additionally needed by the account used in OfficeScan?
  4. What Security Options in Group Policies are additionally needed by the OfficeScan server?
  5. Which authentication levels are supported?

Querying the Active Directory servers
  1. Is it possible to configure the query time of the OfficeScan server to the Domain Controllers?
  2. What is the amount of traffic for each query in the Domain Controller?
  3. How does OfficeScan query the Domain Controllers?
  4. Should we rely on the DNS for name resolution of Domain Controllers?
  5. Is it possible to specify multiple servers as reference for one forest?
  6. What properties are queried on the Active Directory?
  7. What encryption keys can be used to encrypt Active Directory credentials?

Initial setup and maintenance of the Active Directory groups in OfficeScan
  1. What happens when OfficeScan is unable to query a Domain Controller during the initial configuration?
  2. What happens when OfficeScan is unable to query a Domain Controller after the tree is built?
  3. How do you rebuild the tree if the OfficeScan server is lost?
  4. Are the Domain Controllers specified in the UI and in the file?
  5. How does OfficeScan deal with a client that has been installed and reinstalled?
  6. What happens to the settings of a domain group that I created if I reorder it?


Active Directory permissions
What are the permissions needed by OfficeScan to log in to the Active Directory?
OfficeScan only needs the Read access to the entire tree because it only queries data from the Active Directory.
Will the OfficeScan server change the scheme of the Active Directory?
No, OfficeScan will not change anything in Active Directory. It will only import the user or query tree structure.
What user rights in Group Policies are additionally needed by the account used in OfficeScan?
The permission of a server does not relate to a user. All the Active Directory queries in OfficeScan are performed by the OfficeScan Active Directory Integration Service and it logs on as a "Network Service" account.
What Security Options in Group Policies are additionally needed by the OfficeScan server?
If your OfficeScan servers are integrated with the Active Directory, the users in AD can be imported and can log in to the OfficeScan server console.
Which authentication levels are supported?
Only the users in the OfficeScan database can access the server console. Therefore, the NTLM and/or Kerberos authentication are not supported in OfficeScan 10.5.


Querying the Active Directory servers
Is it possible to configure the query time of the OfficeScan server to the Domain Controllers?
Yes, OfficeScan allows users to configure the scheduled Active Directory synchronization. You can perform AD synchronization manually or via a scheduled task.
What is the amount of traffic for each query in the Domain Controller?
The traffic depends on the size of your Active Directory; large Active Directory domain will cause larger amount of traffic. However, as of this writing, there is no base line for the precise traffic amount.
How does OfficeScan query the Domain Controllers?
OfficeScan uses the Active Directory Service Interface (ADSI) to implement the Active Directory Integration feature. It uses LDAP to query the Active Directory.
Should we rely on the DNS for name resolution of Domain Controllers?
Yes, you should rely on DNS for the name resolution of the Domain Controllers as you cannot specify a Domain Controller.
Is it possible to specify multiple servers as reference for one forest?
Yes, you can decide which domain will be imported to the OfficeScan server. Therefore, multiple servers can import the same domain. However, it means that all the servers will maintain their own Active Directory domain. The related settings on the Active Directory-related feature, such as sorting rule and outside server management, will be different on these servers. Nevertheless, the tree structure will remain the same.
What properties are queried on the Active Directory?
The following properties are queried for domain structure:
  • Common Name
  • AD path
  • Class
  • GUID
  • Distinguished Name
The following properties are queried for domain user for RBA:
  • Account Name
  • Display Name
  • Class
  • GUID
  • Distinguished Name
What encryption keys can be used to encrypt Active Directory credentials?
The encryption key is powerful. Trend Micro suggests that you use a strong password level to protect the Active Directory credentials.
However, if your environment has already been set up, then you do not need to use specific credential and encryption key. The privilege of the system account is enough to query the Active Directory directly.


Initial setup and maintenance of the Active Directory groups in OfficeScan
What happens when OfficeScan is unable to query a Domain Controller during the initial configuration?
When the OfficeScan server is unable to query the Domain Controller and synchronize the AD, the web console will display the "Failed" status for AD synchronization. The detailed information will be logged in the OfficeScan system event log.
What happens when OfficeScan is unable to query a Domain Controller after the tree is built?
When the OfficeScan server is unable to query the Domain Controller and synchronize the AD, the web console will display the "Failed" status for AD synchronization. The detailed information will be logged in the OfficeScan system event log.
 
The only difference is that the previous tree will be kept. OfficeScan will not remove the tree under some error situations.
How do you rebuild the tree if the OfficeScan server is lost?
The steps to rebuild the AD tree are the same as when you initiate an AD tree. You only need to trigger Active Directory synchronization again.
Are the Domain Controllers specified in the UI and in the file?
No, OfficeScan 10.5 does not allow you to specify a Domain Controller.
How does OfficeScan deal with a client that has been installed and reinstalled?
OfficeScan will duplicate the client that has been reinstalled because the client GUID is different. The offline client will be automatically removed every seven (7) days. This is done in the OfficeScan management console > Administration > Inactive clients.
What happens to the settings of a domain group that I created if I reorder it?
The custom client groups will move the clients from domain A to domain B. Therefore, if the client move to domain B, it will get the settings from the new domain and will lose the settings from domain A. On the other hand, custom client groups will not remove the domain. Therefore, domain A will still keep the client tree even if there is no client belonging to it.
Premium
Internal
Rating:
Category:
Install
Solution Id:
1056398
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.