Managing Epolicy Orchestrator Users With Active Directory - McAfee EPOLICY ORCHESTRATOR 4.5 Product Manual

Configuring ePolicy Orchestrator

Managing ePolicy Orchestrator users with Active Directory

Task
1 From your browser, start ePolicy Orchestrator. The Secure Connection Failed page appears.
2 Click Or you can add an exception at the bottom of the page. The page now displays
the Add Exception button.
3 Click Add Exception. The Add Security Exception dialog appears.
4 Click Get Certificate. The Certification Status information is populated and the Confirm
Security Exception button is enabled.
5 Make sure that Permanently store this exception is selected, then click Confirm
Security Exception.
Now when you log on to ePolicy Orchestrator, you are no longer prompted to accept the
certificate.
Managing ePolicy Orchestrator users with Active
Directory
ePolicy Orchestrator 4.5 offers the ability to dynamically create ePO users and assign permission
sets to them by automatically creating users based on Windows authenticated user credentials.
This process is accomplished by mapping ePO permission sets to Active Directory groups in
your environment. This feature can reduce the management overhead when you have a large
number of ePO users in your organization. To complete the configuration, you must work though
the following process:
1 Configure user authentication.
2 Register LDAP servers.
3 Configure Windows authorization.
4 Assign permission sets to the Active Directory group.
5 Enable user autocreation.
User authentication
ePolicy Orchestrator users can be authenticated with ePO password authentication or Windows
authentication. If you use Windows authentication, you can specify whether users authenticate:
• Against the domain that your ePO server is joined to (default).
• Against a list of one or more domain controllers.
• Using a WINS server to look up the appropriate domain controller.
If you use domain controllers or a WINS server, you must configure the Windows authentication
server setting.
Registered LDAP servers
It is necessary to register LDAP servers with your ePO server to permit dynamically assigned
permission sets for Windows users. Dynamically assigned permission sets are permission sets
assigned to users based on their Active Directory group memberships.
NOTE: Users trusted via one-way external trusts are not supported. Active Directory is the only
LDAP server type supported at this time.
36 McAfee ePolicy Orchestrator 4.5 Product Guide