Adding endpoints using an AD domain server

You can manually import endpoints from an Active Directory (AD) server. You can import and synchronize information about computer accounts with an LDAP or LDAPS service. You can add endpoints by identifying endpoints that are part of an AD domain server.

The LDAP connection is read-only.

A video on how to add a domain is available in the Fortinet Video Library.

You can add the entire domain or an organization unit (OU) from the domain.

EMS does not support importing subdomains if you have already imported the parent domain in to EMS.

To add endpoints using an AD domain server:

1. Do one of the following:
   • Go to Endpoints > Manage Domains > Add.
   • Go to User Management > Authorized User Groups > Add.
2. Configure the following options:

   Option	Description
   IP address/Hostname	Enter the domain server IP address or hostname.
   Port	Enter the port number.
   Distinguished name	Enter the distinguished name (DN) (optional). You must use only capital letters when configuring the DN. You cannot import domains and OUs that have a DN with more than 256 characters.
   Alias	Enter the alias (optional).
   Bind type	Select the bind type: Simple, Anonymous, or Regular. When you select Regular, you must enter the Username and Password.
   Username	Available when you set Bind type to Regular. Enter the username.
   Password	Available when you set Bind type to Regular. Enter the user password.
   Show Password	Available when you set Bind type to Regular. Turn on and off to show or hide the password.
   LDAPS connection	Enable a secure connection protocol when Bind Type is set to Regular.
   Certificate	Browse to and upload a certificate authority or server certificate in PEM or DER format to secure the LDAPS connection. This option is only available if you enable LDAPS connection.
   Sync every	Enter the sync schedule between FortiClient EMS and the domain in minutes. The default and minimum is sixty minutes.

3. Click Test to test the domain settings connection.
4. If the test succeeds, click Save to save the new domain. If not, correct the information as required, then test the settings again.

After importing endpoints from an AD server, you can move them to custom created groups. These groups are not seen in AD and EMS does not have the ability to modify the AD server in any way. See Managing groups.