Note:

In addition to setting the required permissions for the OpenDNS_Connector user, the Domain Controller Configuration script also registers a domain controller by issuing API calls to Umbrella. If you will be manually modifying the permissions instead of using the configuration script, then this registration must also be done manually. Refer to Umbrella documentation on how to manually add domain controllers on the Umbrella dashboard. 

Replicate Directory Changes

This permission allows the OpenDNS_Connector user to query LDAP. This is the required permission typically given with the "Enterprise Read-Only Domain Controllers" group. This provides the Umbrella Dashboard with the information needed to display the names of AD objects, and to determine group memberships. The connector requests the following attributes:

sAMAccountName

userPrincipalName

dn (Distinguished Name)

memberOf

objectGUID

primaryGroupId

primaryGroupToken

userAccountControl

member

from the following objectClasses:

(&(objectCategory=person)(objectClass=user))

(objectClass=organizationalunit)

(objectClass=computer)

(objectClass=group)

The built-in "Enterprise Read-only Domain Controllers" group should provide this permission, and thus the OpenDNS_Connector user should be a member of this group. You can verify the group's permissions or specify the permissions specifically for the OpenDNS_Connector user (if the group above does not supply these permissions) as follows:

• Open the Active Directory Users and Computers snap-in
• On the View menu, click Advanced Features.
• Right-click the domain object, such as "company.com", and then click Properties.
• On the Security tab, select either "Enterprise Read-only Domain Controllers" or the "OpenDNS_Connector" user.
• If necessary, you can add the "OpenDNS_Connector" user by clicking "Add".
• In the Select Users, Computers, or Groups dialog box, select the desired user account, and then click Add.
• Click OK to return to the Properties dialog box.
• Click to select the Replicating Directory Changes and Read check boxes from the list.
• Click Apply, and then click OK.
• Close the snap-in. 

 

Note:

In a Parent/Child domain scenario, the "Enterprise Read-only Domain Controller" only exists in the parent domain. In this case, the permissions should be manually added for the OpenDNS_Connector as shown above.

 

Event Log Readers

 

This change is required only if the deployment includes Virtual Appliances in the same Umbrella site as the Domain Controller. Membership in this group allows the OpenDNS_Connector user to read the logon events from the Event Logs. 

On the Domain Controller machine, in the Windows Advanced Firewall settings ensure that the Inbound rules for Remote Event Log Management (NP-In, RPC and RPC-EPMAP) are allowed. The Umbrella AD Connector may log an error saying "The RPC Server is unavailable" and may not be able to read login events if these rules are not allowed.

You can also enable these rules through the following command:

netsh advfirewall firewall set rule group="Remote Event Log Management" new enable=yes  

 

Remote Admin 

Remote Administration is needed to allow the connector to read login events on the domain controller. This permission is required only if the deployment includes Virtual Appliances in the same Umbrella site as the Domain Controller.

From a Command prompt, please run the following commands:

netsh advfirewall firewall set rule group="remote administration" new enable=yes

netsh advfirewall set currentprofile settings remotemanagement enable 

Audit Policy

This change is required only if the deployment includes Virtual Appliances in the same Umbrella site as the Domain Controller. The Audit policy defines what events get logged in the Event Log of the Domain Controller. The Connector requires that successful logon events are recorded so that users can be mapped to their IP addresses.

In normal Windows Server 2008+ environments, the legacy "Audit logon events" setting must be configured.  Specifically, the "Audit logon events" policy must be set to "Success". This can be verified by running the following command at a Command Prompt:

GPRESULT /z

This policy is defined as a Group Policy Object. To modify it, edit the appropriate Group Policy for your DC (typically the "Default Domain Controller Policy"), and set the following policy to include "Success" events:

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit logon events

Please ensure that you update the Group Policy on the DC after making this change.

However, Windows Server 2008 also introduced the Advanced Audit Policy Configuration. While the legacy Windows Audit Policies can still be used, they will be ignored if any of the Advanced Audit Policies are defined. Refer to Microsoft documentation to understand how the two Audit Policies interact.

 For the purposes of the Connector, if any Advanced Audit Policies are defined (including ones not related specifically to logon), then the Advanced Audit Policies MUST be used.

The Advanced Audit Policy should be set for all DCs using Group Policy.  Edit the appropriate Group Policy for your DC (typically the "Default Domain Controller Policy"), and go to the following section:

Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff

In that section, set the following policies to include both "Success" and "Failure" events:

Audit Logon

Audit Logoff

Audit Other Logon/Logoff Events

Ensure that you update the Group Policy on the DC after making this change. 

 

IMPORTANT:

If you are deploying the AD Connector with Virtual Appliances, the firewall rule changes and audit policy settings must be done on all Domain Controllers in the domain which the Connector will be communicating with.

 

If after confirming/changing the aforementioned settings, you are still seeing "Access Denied" messages in the Dashboard, please send Umbrella Support the Connector logs as outlined in this article: Provide Support with AD Connector Logs

When providing this information to Support, include the output of the following two commands:

auditpol.exe /get /category:* > DCNAME_auditpol.txt
GPRESULT /H DC_NAME.htm