hmLoadTopic({
hmKeywords:"Account Integration,Accounts,Active Directory Authentication,AD Authentication,Importing,Importing Accounts,Integration,Security,Windows Account Integration",
hmTitle:"Windows Account Integration",
hmDescription:"MDaemon supports Windows Account integration. This support consists of a SAM\/Active Directory import engine, which can be reached from MDaemon\'s Accounts menu (Accounts »...",
hmPrevLink:"importing_accounts_from_a_text.html",
hmNextLink:"pdc--delivery--retry_queue_settings.html",
hmParentLink:"index.html",
hmBreadCrumbs:"Accounts Menu &gt; Importing Accounts",
hmTitlePath:"Accounts Menu > Importing Accounts > Windows Account Integration",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">Windows Account Integration<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText\"><span class=\"f_BodyText\">MDaemon supports Windows Account integration. This support consists of a SAM\/Active Directory import engine, which can be reached from MDaemon\'s Accounts menu (<\/span><span class=\"f_MenuPath\">Accounts » Importing... » Import accounts from SAM\/Active directory...<\/span><span class=\"f_BodyText\">). Additionally, support for<\/span><span class=\"f_BodyText\"> Active Directory (AD) authentication of users is embedded into the MDaemon user management code. It is possible to specify a Windows domain in an account’s password field and then MDaemon will dynamically authenticate such accounts in real-time, using the specified Windows domain’s security system. Under such a scheme, changing the account’s password in Windows user management will automatically update MDaemon. Therefore, your users will only have to remember one set of authentication credentials. This also makes for very easy account setup for new installations.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">The security context of the account running MDaemon must have the <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">SE_TCB_NAME<\/span><span class=\"f_Notes\"> privilege (i.e. “To act as part of the Operating System”). If the process is a service running in the <\/span><span class=\"f_Notes\" style=\"font-style: italic;\">Local System<\/span><span class=\"f_Notes\"> account, it will have this privilege by default. Otherwise, it must be set in the Windows user manager for the account under which MDaemon is running.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">SAM\/Active Directory Account Importer<\/span><\/p>\n\r<p style=\"text-align: center; margin: 0.3125rem 0.5625rem 0 0.5000rem;\"><img style=\"margin:0 auto 0 auto;width:19.4375rem;height:27.3125rem;border:none\" src=\".\/images\/sam-ad_account_importer.png\"\/><span class=\"f_ControlIndent\"> <\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Domains<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">PDC\/BDC Machine name<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This field allows you to specify the machine name from which MDaemon will read Windows account database information. You can specify \\\\&lt;DEFAULT&gt; and MDaemon will read data from the local machine.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Refresh<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to refresh the Windows Accounts listing.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Windows domain name<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Type the Windows domain name from which you wish to import accounts.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">MDaemon domain name<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Choose from the drop-down list box the MDaemon domain into which the accounts will be imported.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Accounts<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Windows accounts<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This window contains a list of all the account names collected from the Windows account database.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Selected accounts<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This window contains all the account names that you have selected and wish to import.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">&gt;&gt;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to move the highlighted account names from the &quot;Windows Accounts&quot; window into the &quot;Selected Accounts&quot; window.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">&lt;&lt;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to remove the highlighted entries from the &quot;Selected Accounts&quot; window.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Options<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Make account mailboxes equal to the SAM\/AD account name<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this switch to force each imported user<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent\">s Windows account name to be used as their Mailbox value. With this method, you will not need to worry about setting up the correct <a href=\"template-manager_mail-services.html\" class=\"topiclink\" style=\"font-style: normal; font-weight: normal; color: #000000; background-color: transparent; text-decoration: none;\">New Account Template<\/a> macros.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Use the account template to generate passwords<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This option causes MDaemon to generate passwords for imported accounts using the account template settings (see <a href=\"template-manager_mail-services.html\" class=\"topiclink\" style=\"font-style: normal; font-weight: normal; color: #000000; background-color: transparent; text-decoration: none;\">Account Defaults<\/a>).<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Set account passwords equal to account names<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This switch causes MDaemon to use the account name as the account password.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Make every password equal to…<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This switch allows you to specify a static password value that will be used by all imported accounts.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Authenticate passwords dynamically using SAM\/AD<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This switch enables<\/span><span class=\"f_ControlIndent\"> AD authentication of imported accounts. Rather than specifying a password MDaemon will simply authenticate the mail client supplied USER and PASS values using the NT database in real-time.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Authenticate on this Windows domain<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enter the name of the Windows domain that MDaemon will use when authenticating connections dynamically. <\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-weight: bold; color: #010100;\">This is not the machine name of the domain controller. It is the actual name of the Windows Domain.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">When accounts are configured for<\/span><span class=\"f_Notes\"> AD authentication, the name of the Windows domain preceded by two backslash characters is used in the account<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif;\">\'<\/span><span class=\"f_Notes\">s <\/span><span style=\"font-family: \'Courier New\',Courier,monospace;\">PASSWORD<\/span><span class=\"f_Notes\"> field and is stored unencrypted within the <\/span><span style=\"font-family: \'Courier New\',Courier,monospace;\">USERLIST.DAT<\/span><span class=\"f_Notes\"> file. For example, if an account is configured for<\/span><span class=\"f_Notes\"> AD authentication on a Windows domain called <\/span><span style=\"font-family: \'Courier New\',Courier,monospace;\">ALTN<\/span><span class=\"f_Notes\">, the account<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif;\">\'<\/span><span class=\"f_Notes\">s password field will contain the value <\/span><span style=\"font-family: \'Courier New\',Courier,monospace;\">\\\\ALTN<\/span><span class=\"f_Notes\">. The two backslash characters preceding the domain name signify to MDaemon that the password field actually contains the name of a Windows domain and that MDaemon<\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-weight: bold;\"> <\/span><span class=\"f_Notes\">should attempt to authenticate the USER and PASS values provided by the mail client using that domain<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif;\">\'<\/span><span class=\"f_Notes\">s account database. For that reason you must not start a password with two backslash characters unless the account is configured for<\/span><span class=\"f_Notes\"> AD authentication as described above. In other words, you can<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif;\">\'<\/span><span class=\"f_Notes\">t just have regular passwords that start with two backslashes. Passwords beginning with two backslashes are always assumed to be providing a Windows domain name and not a password.<\/span><\/p>\n\r<p class=\"p_Notes\"><span class=\"f_Notes\">You may enter the two backslashes and Windows domain name combination into an account<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif;\">\'<\/span><span class=\"f_Notes\">s password field on the <a href=\"ae_account.html\" class=\"topiclink\">Account Details<\/a> screen of the Account Editor. You need not restrict yourself to using the importer in order to setup accounts for AD authentication.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"importing_accounts_from_a_text.html\" class=\"topiclink\">Importing Accounts From a Text File<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ae_account.html\" class=\"topiclink\">Account Editor » Account<\/a><\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r"
})
