hmLoadTopic({
hmKeywords:"Active Directory,Active Directory,Active Directory Creating Accounts,Active Directory Deleting Accounts,Active Directory Dynamic Authentication,Active Directory File Security,Active Directory Persistent Monitoring,Active Directory Synchronizing with MDaemon,Active Directory Template,Active Directory Updating Accounts",
hmTitle:"Active Directory",
hmDescription:"Using the Active Directory options located at Accounts » Account Settings » Active Directory, MDaemon can be configured to monitor Active Directory and automatically create,...",
hmPrevLink:"template-manager_options.html",
hmNextLink:"active-directory_authentication.html",
hmParentLink:"index.html",
hmBreadCrumbs:"Accounts Menu &gt; Account Settings",
hmTitlePath:"Accounts Menu > Account Settings > Active Directory",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">Active Directory<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText\"><span class=\"f_BodyText\">Using the Active Directory options located at <\/span><span class=\"f_MenuPath\">Accounts » Account Settings » Active Directory<\/span><span class=\"f_BodyText\">, MDaemon can be configured to monitor Active Directory and automatically create, edit, delete and disable MDaemon accounts when their associated accounts are altered in Active Directory. Further, it can also be set to <\/span><span class=\"f_ControlIndent\">keep all public contact records updated with the most recent information stored in Active Directory. Common fields like an account\'s postal address, phone numbers, business contact information, and so on can be populated into the public contact records and updated any time they are changed in Active Directory.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Creating Accounts<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">When set to monitor Active Directory, MDaemon will query for changes at a designated interval and then create a new MDaemon user account whenever it finds that a new Active Directory account has been added. This new MDaemon user account will be created using the full name, logon, mailbox, description, and enabled\/disabled state found within Active Directory.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">By default, new MDaemon accounts created as a result of Active Directory monitoring will be added to MDaemon<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s Default Domain. Alternatively, you can choose to have those accounts added to the domain found within the account<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">UserPrincipalName<\/span><span class=\"f_BodyText\">&quot; Active Directory attribute. When using this option, if an account requires a domain that doesn\'t yet exist within MDaemon, a new <a href=\"domain-manager.html\" class=\"topiclink\">domain<\/a> will be created automatically.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_ControlIndent\">You can alternatively configure your <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\"><a href=\"active-directory_authentication.html\" class=\"topiclink\">Search filter<\/a><\/span><span class=\"f_ControlIndent\"> to monitor a group within Active Directory, so adding a user to the group or a group to the user will cause the user to be created in MDaemon, and removing a user from a group will cause the account to be disabled (not deleted) in MDaemon.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Deleting Accounts<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">MDaemon can be configured to take one of the following actions when an account is deleted from Active Directory: do nothing, delete the associated MDaemon account, disable the associated MDaemon account, or freeze the associated MDaemon account (i.e. the account can still receive mail but the user can<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">t collect it or access it).<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Updating Accounts<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">When MDaemon detects changes to Active Directory accounts, it will automatically update the associated properties in the matching MDaemon account.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Synchronizing MDaemon with Active Directory<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">A &quot;<\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-style: italic; color: #010100;\">Perform full AD scan now<\/span><span class=\"f_BodyText\">&quot; option is available to cause MDaemon to query the Active Directory database and then create or modify MDaemon user accounts as necessary. When an Active Directory account is found that matches an already existing MDaemon account, the MDaemon account will be linked to it. Then, any future changes made to the Active Directory accounts will be propagated to the MDaemon accounts automatically.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Active Directory Authentication<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Accounts created by MDaemon<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s Active Directory feature will be setup for Active Directory (AD) Authentication by default. With AD Authentication, MDaemon has no need to store the account<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s password within its own user database. Instead, the account holder will use his or her Windows login\/password credentials and MDaemon will pass those to Windows for authentication of the associated account.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">To use AD Authentication with Active Directory, a Windows domain name must be present in the space provided on the <a href=\"active-directory_monitoring.html\" class=\"topiclink\">Monitoring<\/a>. This is the Windows domain that MDaemon will use when attempting to authenticate accounts. In most cases, MDaemon will detect this Windows domain name automatically and fill it in for you. However, you can use an alternate domain in this option if you choose, or you can use &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">NT_ANY<\/span><span class=\"f_BodyText\">&quot; if you wish to allow authentication across all of your Windows domains<\/span><span class=\"f_BodyText\"> instead of limiting it to a specific one. If you leave this option blank then MDaemon will not use AD Authentication when new accounts are created. Instead it will generate a random password, which you will have to edit manually before users will be able to access their mail accounts.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Persistent Monitoring<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Active Directory monitoring will continue to work even when MDaemon is shut down. All Active Directory changes will be tracked and then MDaemon will process them once it restarts.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Active Directory File Security<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">It is worth noting that MDaemon<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s Active Directory features do not alter the Active Directory schema files in any way — all monitoring is one-way from Active Directory to MDaemon. MDaemon will not alter your directory.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Active Directory Template<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Whenever MDaemon adds or makes changes to accounts due to Active Directory monitoring and scanning, it will use an Active Directory template (&quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">MDaemon\/app\/ActiveDS.dat<\/span><span class=\"f_BodyText\">&quot;) to link certain Active Directory attribute names to MDaemon<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s account fields. For example, MDaemon links the Active Directory attribute &quot;<\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">cn<\/span><span class=\"f_BodyText\">&quot; to MDaemon<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">FullName<\/span><span class=\"f_BodyText\">&quot; field by default. These links, however, are not hard-coded. You can easily edit this template with Notepad if desired and alter any of the default field mappings. For example, &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">FullName=%givenName% %sn%<\/span><span class=\"f_BodyText\">&quot; could be used as a replacement for the default setting: &quot;FullName=%cn%&quot;. See <\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">ActiveDS.dat<\/span><span class=\"f_BodyText\"> for more information.<\/span><\/p>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><a id=\"update_public_contacts\" class=\"hmanchor\"><\/a><span class=\"f_Heading3\">Updating the Public Address Books<\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Active Directory monitoring can be used to periodically query Active Directory and keep all public contact records in MDaemon updated with the most recent information. Common fields like an account\'s postal address, phone numbers, business contact information, and so on will be populated into their public contact record, and this data will be updated any time it is changed in Active Directory. To enable this feature, use the &quot;<\/span><span class=\"f_BodyText\" style=\"font-style: italic;\">Monitor Active Directory and update public address book(s)<\/span><span class=\"f_BodyText\">&quot; option located at: <\/span><span class=\"f_MenuPath\"><a href=\"active-directory_monitoring.html\" class=\"topiclink\">Active Directory » Monitoring<\/a><\/span><span class=\"f_BodyText\">.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Numerous contact record fields can be monitored using this feature. For a complete list of which public contact record fields can be mapped to Active Directory attributes, see the <\/span><span class=\"f_PlainText\">ActiveDS.dat<\/span><span class=\"f_BodyText\"> file. This file has several new mapping templates which allow you to specify one or more Active Directory attributes from which to populate a particular contact record field (for example, <\/span><span class=\"f_PlainText\">%fullName%<\/span><span class=\"f_BodyText\"> for the fullname field, <\/span><span class=\"f_PlainText\">%streetAddress%<\/span><span class=\"f_BodyText\"> for the street address field, and so on).<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">MDaemon must match an account\'s email address to some attribute within Active Directory in order to know which contact record to update. If it can\'t find such a match it does nothing. By default MDaemon will try to construct an email address using the data taken from the attribute mapped to the Mailbox template (see <\/span><span class=\"f_PlainText\">ActiveDS.dat<\/span><span class=\"f_BodyText\">) to which MDaemon will internally append the <a href=\"domain-manager.html\" class=\"topiclink\">default domain<\/a> name, just as it would when actually creating and deleting accounts based on Active Directory data. However, you can uncomment the &quot;abMappingEmail&quot; template inside <\/span><span class=\"f_PlainText\">ActiveDS.dat<\/span><span class=\"f_BodyText\"> and tie it to any Active Directory attribute you wish (like <\/span><span class=\"f_PlainText\">%mail%<\/span><span class=\"f_BodyText\">, for example). However, please note that the value of this attribute must contain an email address that will be recognized as a valid local user account.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">This feature will create the contact records on the fly if they don\'t already exist and it will update contact records that do exist. Further, please note that it will overwrite any changes you make outside of Active Directory. Contact record fields that are not mapped are left unaltered. Therefore any existing data that is not subject to this process will not be altered or lost. Finally, MDaemon accounts that are set to<\/span><span class=\"f_BodyText\"> <a href=\"ae_options.html\" class=\"topiclink\">hidden<\/a> are not subject to having their contact records created or updated.<\/span><\/p>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"active-directory_monitoring.html\" class=\"topiclink\">Active Directory » Monitoring<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"active-directory_authentication.html\" class=\"topiclink\">Active Directory » Authentication<\/a><\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r"
})
