Adding an ADDS server
You can manually import endpoints from an Active Directory Domain Services (ADDS) server. You can import and synchronize information about computer accounts with an LDAP or LDAPS service. You can add endpoints by identifying endpoints that are part of an AD domain server. EMS supports Kerberos or NTLM authentication for LDAP(S).
The LDAP connection is read-only.
|
A video on how to add a domain is available in the Fortinet Video Library. |
|
You can add the entire domain or an organization unit (OU) from the domain. |
|
|
EMS does not support importing subdomains if you have already imported the parent domain in to EMS. |
To add endpoints using an AD domain server:
- Go to Administration > Authentication Servers.
- Click Add > Active Directory.
- Configure the following options:
Option
Description
IP address/Hostname
If using NTLM authentication, enter the LDAP server IP address or FQDN.
If using Kerberos authentication, enter the domain FQDN. The Windows Active Directory DNS server should be reachable for EMS to resolve the FQDN and communicate with the resolved server to obtain the Kerberos ticket over TCP port 88.
Port
Enter the port number.
Username
Enter the username.
If using Kerberos authentication, the username is case-sensitive. Enter the username in one of the following formats:
- <domain>\<username>
- <username>@<domain>.com
Password
Enter the user password.
Show Password
Turn on and off to show or hide the password.
LDAPS connection
Enable a secure connection protocol.
Certificate
Browse to and upload a certificate authority or server certificate in PEM or DER format to secure the LDAPS connection. This option is only available if you enable LDAPS connection.
Certificate hostname check
When enabled, EMS checks if the provided certificate's common name (CN) matches the CN of the certificate that the LDAPS connection provides.
Alias
Enter the alias (optional).
Comment
If desired, enter a comment about the server (optional).
Use Connector
If desired, enable this option to configure an AD connector to act as a proxy between EMS and the AD server. See AD connector.
Connector
From the dropdown list, select the desired AD connector.
- Click Test to test the domain settings connection.
- If the test succeeds, click Save to save the new domain. If not, correct the information as required, then test the settings again.
|
|
After importing endpoints from an AD server, you can move them to custom created groups. These groups are not seen in AD and EMS does not have the ability to modify the AD server in any way. See Managing groups. |