[Today’s post is provided by Carol Bailey]
I’ve been seeing a steady increase in the number of questions that customers ask about Active Directory Domain Services in relation to Configuration Manager. Tech-Ed North America was no exception, which prompted me to write up some of these frequently asked questions.
Although this information is in the product documentation, I can understand why it’s sometimes difficult to find the exact answer to a specific scenario, simply because there are so many possible variations. One documentation topic that holds a lot of this information is Configuration Manager in Multiple Active Directory Forests.
If you have an Active Directory-related question about Configuration Manager, see if it’s addressed in this blog post. If you don’t see the question listed, email SMSDocs@Microsoft.com with your question or suggestion.
Question: Can Configuration Manager manage clients when they are in a different domain to the site system servers?
Answer: Yes. The only potential gotcha here is when the site is in mixed mode, you must configure the management point with an FQDN for automatic approval to work. Tip: Check that name resolution (NetBIOS and FQDN) is working between the two domains.
Question: Do all my site system servers in a site have to be in the same domain?
Answer: No, site systems within the same site can be from different domains within the same forest, with the exception of the following:
- SMS Provider
- reporting point
- site database server
Question: Do all my site system servers in a site have to be from the same forest?
Answer: Most of the time, yes. There are a few exceptions:
- The System Health Validator point
- Internet-based site systems
- Server locator point (security best practice is to install this in the same forest)
- PXE service point (security best practice is to install this in the same forest)
Question: Can Configuration Manager manage clients when they are in a different forest from the site server?
Answer: Yes, and this configuration does not require any PKI certificates or that you install any site system servers into this other forest. The most important thing to remember here is that these clients cannot access site information that is published by the site server to Active Directory Domain Services – even if there is a trust in place between the two forests. This means that when you install these clients, they require a server locator point to complete site assignment. Make sure that the server locator point is installed and that these clients can access it – and the easiest way to do this is to use the SMSSLP property when you install the client. For more information, see How to Create a Server Locator Point in Configuration Manager and How to Specify the Server Locator Point for Configuration Manager Client Computers.
- Make sure that you have name resolution between the two forests – that the client can resolve the names of site system servers in the Configuration Manager site, and that the site system servers can resolve the name of the client computers.
- If there is no trust between the client domain and the site server’s domain, you will need a network access account for these clients to access distribution points. For more information, see How to Configure the Network Access Account.
- If the site is in mixed mode and there is no trust between the client domain and the site server’s domain, these clients will not be approved if the site is configured for the default option Automatically approve computers in trusted domains, and you must manually approve these clients.
- If the site is in native mode and the client will use intranet communication, the clients must be installed with the option that allows HTTP communication for roaming and site assignment. The easiest way to do this is to use the /native:fallback or /native:crlandfallback property when you install the client. For more information, see How to Configure HTTP Communication for Roaming and Site Assignment. Also ensure that your PKI solution is designed to span the two forests.
- If you want to discover these clients by using Active Directory discovery methods, there must be a full forest trust in place. However, only client push installation requires computers to be discovered. For more information about the other client installation methods and their dependencies, see Prerequisites for Configuration Manager Client Deployment.
Question: I need to support clients from another forest, so do I install the the server locator point in the same forest as these clients or in the site server’s forest?
Answer: Technically, you can install the server locator point in either forest. However, as a security best practice, install it in the site server’s forest. If you have a firewall between the two forests, note that the server locator point requires unauthenticated client connections over HTTP. If this is against your security policies, an alternative configuration is to configure these clients for Internet-only client management, which does require PKI certificates and that the site is in native mode. This configuration does not require that these clients contact a server locator point. For more information, see the question “Is it possible to manage clients from another forest by using HTTPS connections only?”
Question: Can I install clients in another forest without downloading the client installation source files from the management point?
Answer: Yes. Copy the client installation source files from the management point or site server onto a file server in the clients’ forest. Then use the CCMSetup property /source:<path> when you install the clients. The client installation source files are located in the <InstallationPath>Client folder on the Configuration Manager 2007 site server and management points.
Question: What ports need to be open on a firewall between my two forests for client communication?
Answer: To install the clients, see Ports Used During Configuration Manager Client Deployment. Note that client push installation is the least firewall-friendly installation method, because it requires SMB and RPC. The ports that might be used after client installation will depend on the Configuration Manager features that you are using. For a list of operational ports, see Ports Used by Configuration Manager.
Question: Is it possible to manage clients from another forest by using HTTPS connections only?
Answer: Yes, if your site is in native mode, configure the native mode site systems for Internet connections and install these clients for Internet-only client management. For more information about this configuration, see Tips and Tricks: Using Internet-Only Client Management on the Intranet.
Question: Can I install a secondary site in another forest?
Answer: No. When your primary site is in forest A, Configuration Manager does not support installing a secondary site in forest B. In this scenario, you must install a primary site in forest B or use the primary site in forest A to manage clients in forest B.
Question: What additional configuration is required if I install a site in another forest?
Answer: If you are using secure key exchange between the sites, use the hierarchy maintenance tool (Preinst.exe) to configure manual key exchange. For more information, see How to Manually Exchange Public Keys Between Sites.
If there is no trust between the two forests trusts you must configure domain user accounts as site address accounts in the sender address properties of each site. If there is a full forest trust between the sites, you can use the site server computer accounts.
Question: Can I install site systems on domain controllers?
Answer: Yes. There is no technical restriction that prevents you from installing any of the site system roles on domain controllers. However, for security best practices, this is not recommended in a production environment.
Question: Can I install site systems on stand-alone servers (not in an Active Directory forest)?
Answer: No. All site systems must belong to an Active Directory forest. This includes branch distribution points and Internet-based site systems.
Question: Does any Configuration Manager feature or operation require a specific domain or forest functional level?
Answer: No. The only exception is when a full forest trust is required, which itself requires a minimum forest level of Windows Server 2003. A full forest trust is needed for the following:
- To discover computers in another forest
- The option Allow only site server initiated data transfers from this site system, which is a configuration option for Internet-based site systems that are installed in the perimeter network to ensure that connections are only initiated from the intranet.
Question: Does Configuration Manager support all versions of Active Directory Domain Services, including Windows Server 2008 R2?
Answer: Yes. However, for supported versions of the operating systems on clients and site systems, always check the Supported Configurations documentation for the version of Configuration Manager that you are running.
Question: Do I need to extend the schema again if I create new Configuration Manager sites or add computers from new domains?
Answer: No. Active Directory schema extensions are for the entire forest, so you need to extend the schema for Configuration Manager only once if your Configuration Manager hierarchy is contained within the forest. The only exception is if you create a new primary site in another forest, and you want this new site to publish to Active Directory Domain Services. In this scenario, extend the schema in the new forest (and configure the security permissions for the System Management container).
Question: Do I need to extend the schema again for Configuration Manager after upgrading to a later version of Configuration Manager (for example, Configuration Manager SP2) or after raising my Active Directory domain or forest functional level?
Answer: No. If you have extended the Active Directory schema for Configuration Manager, you do not need to extend it again for these scenarios. However, if you’re upgrading from SMS 2003 to Configuration Manager, then you should extend the schema for Configuration Manager to benefit from the new site changes that are published to Active Directory Domain Services.
This posting is provided “AS IS” with no warranties and confers no rights.