Installing ISA Server 2006 Configuration Storage Server on a Domain Controller

[LEFT][CODE]http://blogs.technet.com/b/isablog/archive/2007/03/21/installing-isa-server-2006-configuration-storage-server-on-a-domain-controller.aspx[/CODE]
[SIZE=4][COLOR=#4f81bd][FONT=Cambria]Introduction[/FONT][/COLOR][/SIZE]

[SIZE=3][FONT=Times New Roman]In certain scenarios, you may want or need to install the Configuration Storage server on a domain controller. In that scenario, the most secure configuration is to configure the Configuration Storage server to run with USER privilege.[/FONT][/SIZE]
[SIZE=3][FONT=Times New Roman]See this snippet from the ISA Server Getting Started Guide:[/FONT][/SIZE]

[I][FONT=Arial]Getting started Guide (Installing the Configuration Storage Server):[/FONT][/I]

[I][FONT=Arial]Note the following:[/FONT][/I]

[I][COLOR=black][FONT=Arial]The Configuration Storage server service normally runs under the network service account. If you install the Configuration Storage server on a domain controller, you must provide an account under which the service will run. This is because the Network Service account cannot be used when the Configuration Storage server runs on a domain controller. You can run the Configuration Storage server service using the credentials of a user in the Domain Admins group (a domain administrator). However, for the most secure configuration, we recommend that you provide the credentials of a user who is not a domain administrator. If you provide the credentials of a user who is not a domain administrator, you must perform the following procedure to ensure that the user has the permissions required by the service.[/FONT][/COLOR][/I]


[SIZE=3][FONT=Times New Roman]When you install an ISA Server 2006 Configuration Storage server on a domain controller using a low-privileged account, the ADAM instance (ISASTGCTRL) installs and runs but complains in the event log about two things:[/FONT][/SIZE]


[LIST][*][SIZE=3][FONT=Times New Roman]It is unable to create a Service Connection Point (SCP)[/FONT][/SIZE][*][SIZE=3][FONT=Times New Roman]It is unable to initialize the auditing security system[/FONT][/SIZE][/LIST]

[SIZE=3][FONT=Times New Roman]This article outlines the things you need to do to fix these issues. For clarity it starts with installing the Configuration Storage server and configuring the service account.[/FONT][/SIZE]
[SIZE=3][FONT=Times New Roman]It is assumed you have administrator privileges when installing the Configuration Storage server.[/FONT][/SIZE]
[SIZE=3][FONT=Times New Roman]Before installing the Configuration Storage server create a user account for the Configuration Storage server. The example below uses an account called [B]isa-css[/B] which is a user in Active Directory. The user can have a long and complex password which never expires. It is only used for this purpose.[/FONT][/SIZE]
[B][COLOR=#4f81bd][FONT=Cambria]
[/FONT][/COLOR][/B] [B][SIZE=4][COLOR=#4f81bd][FONT=Cambria]Install the Configuration Storage server[/FONT][/COLOR][/SIZE][/B]


[SIZE=3][FONT=Times New Roman]At some point during setup specify the account you will use for the storage instance.[/FONT][/SIZE]

[SIZE=4][COLOR=#4f81bd][FONT=Cambria][IMG]http://blogs.technet.com/photos/isablog/images/702688/498x375.aspx[/IMG][/FONT][/COLOR][/SIZE]



















[SIZE=4][COLOR=#4f81bd][FONT=Cambria]Run the batch file[/FONT][/COLOR][/SIZE]
[SIZE=3][FONT=Times New Roman]When installation is complete you need to run a batch file to register Service Principle Names into Active Directory. The batch file is located in the ADAMData folder which is located in the Microsoft ISA Server folder. See the snippet which is taken from the installation guide:[/FONT][/SIZE]

[I][COLOR=black][FONT=Arial]In the Program Files\Microsoft ISA Server\ADAMData folder, locate the Dnsdomain.bat file, where Dnsdomain is the DNS name of the computer on which ADAM is running.[/FONT][/COLOR][/I]

[I][COLOR=black][FONT=Arial]At the command prompt, type Dnsdomain to run the file. The Dnsdomain.bat file appears in the directory approximately one minute after ADAM installation is complete.[/FONT][/COLOR][/I]

[B][SIZE=4][COLOR=#4f81bd][FONT=Cambria]Change permissions on the domain controller object[/FONT][/COLOR][/SIZE][/B]



[SIZE=3][FONT=Times New Roman][IMG]http://blogs.technet.com/photos/isablog/images/702718/500x225.aspx[/IMG][/FONT][/SIZE]













[SIZE=3][FONT=Times New Roman]Open ADSI Edit and go to the Domain Controller object on which you have installed the Configuration Storage server. In the picture above the Configuration Storage server has been installed on a domain controller called dc1 in the domain [I]corp.local[/I].[/FONT][/SIZE]
[SIZE=3][FONT=Times New Roman]Add the account isa-css to the permissions list and give the user account [B]Create All Child Objects[/B] permission on the domain controller object.[/FONT][/SIZE]

[SIZE=3][FONT=Times New Roman][IMG]http://blogs.technet.com/photos/isablog/images/702680/340x375.aspx[/IMG][/FONT][/SIZE]

[SIZE=3][FONT=Times New Roman]After restarting the ADAM service, you will see it successfully registers the SCP as shown in the screenshot below.[/FONT][/SIZE]



[SIZE=3][FONT=Times New Roman][IMG]http://blogs.technet.com/photos/isablog/images/702677/500x229.aspx[/IMG] [/FONT][/SIZE]

[SIZE=3][FONT=Times New Roman]The message below from the event log also confirms successful registration.[/FONT][/SIZE]


[U][FONT=Times New Roman][SIZE=3][IMG]http://blogs.technet.com/photos/isablog/images/702686/337x375.aspx[/IMG][/SIZE][/FONT][/U]


[B][COLOR=#4f81bd][FONT=Cambria]Modify [I]generate security audits[/I] policy on the domain controller[/FONT][/COLOR][/B]

[SIZE=3][FONT=Times New Roman]Add or edit the group policy object on the Domain Controllers OU and add the user account (isa-css) to the “Generate security audits” right. The screenshot below displays a separate GPO.[/FONT][/SIZE]

[U][FONT=Times New Roman][SIZE=3][IMG]http://blogs.technet.com/photos/isablog/images/702687/431x375.aspx[/IMG][/SIZE][/FONT][/U]
[B][SIZE=4][COLOR=#4f81bd][FONT=Cambria]Run gpupdate[/FONT][/COLOR][/SIZE][/B]


[SIZE=3][FONT=Times New Roman]Now you will see security audit events in the security event log, after restarting the ADAM instance. See below for a screenshot. The service no longer logs these warnings and errors. [/FONT][/SIZE]

[IMG]http://blogs.technet.com/photos/isablog/images/702682/337x375.aspx[/IMG]


[B][U][SIZE=3][FONT=Times New Roman]Note[/FONT][/SIZE][/U][/B]
[SIZE=3][FONT=Times New Roman]When you install a replica Configuration Storage server then you need to do two things:[/FONT][/SIZE]
[FONT=Symbol][SIZE=3]·[/SIZE] [/FONT][SIZE=3][FONT=Times New Roman]Set the permissions on the replica domain controller object (see previous) [/FONT][/SIZE]
[FONT=Symbol][SIZE=3]·[/SIZE] [/FONT][SIZE=3][FONT=Times New Roman]Run the batch file on the Configuration Storage server. [/FONT][/SIZE]
[SIZE=3][FONT=Times New Roman]If you use the same service account then it already has the [B]Generate security audits[/B] rights through application of the domain controller GPO.[/FONT][/SIZE]
[B][SIZE=4][COLOR=#4f81bd][FONT=Cambria]Eventlog entries after installation[/FONT][/COLOR][/SIZE][/B]


[SIZE=3][FONT=Times New Roman]Below are eventlog entries which the service will log when nothing has been fixed. So in the scenario of this document you will see these at the point right after the installation.[/FONT][/SIZE]

[U][SIZE=3][FONT=Times New Roman]Insufficient access to the domain controller-object:[/FONT][/SIZE][/U]


[FONT=Arial]ServiceConnectionPoint errors:[/FONT]
[FONT=Arial]AD/AM error 2537:[/FONT]

[FONT=Arial]Event Type: Error[/FONT]
[FONT=Arial]Event Source: ADAM [ISASTGCTRL] General[/FONT]
[FONT=Arial]Event Category: Internal Processing [/FONT]
[FONT=Arial]Event ID: 2537[/FONT]
[FONT=Arial]Date: 2/28/2005[/FONT]
[FONT=Arial]Time: 9:10:26 AM[/FONT]
[FONT=Arial]User: NT AUTHORITY\ANONYMOUS LOGON[/FONT]
[FONT=Arial]Computer: Configuration Storage server[/FONT]
[FONT=Arial]Description:[/FONT]
[FONT=Arial]The directory server has failed to create the ADAM serviceConnectionPoint object in the Active Directory. This operation will be retried. [/FONT]

[FONT=Arial][IMG]http://blogs.technet.com/photos/isablog/images/702684/337x375.aspx[/IMG][/FONT]



[U][SIZE=3][FONT=Times New Roman]No ‘Generate security audits’ right[/FONT][/SIZE][/U]

[FONT=Arial]Warning 2521:[/FONT]

[FONT=Arial]Event Type: Warning[/FONT]
[FONT=Arial]Event Source: ADAM [ISASTGCTRL] General[/FONT]
[FONT=Arial]Event Category: Security [/FONT]
[FONT=Arial]Event ID: 2521[/FONT]
[FONT=Arial]Date: 2/28/2005[/FONT]
[FONT=Arial]Time: 9:11:01 AM[/FONT]
[FONT=Arial]User: N/A[/FONT]
[FONT=Arial]Computer: Configuration Storage server[/FONT]
[FONT=Arial]Description:[/FONT]
[FONT=Arial]Active Directory was unable to initialize auditing security system. It will run with auditing disabled. No security audits will be generated.[/FONT]

[FONT=Arial]Additional Data: [/FONT]
[FONT=Arial]Error value: [/FONT]
[FONT=Arial]1314 A required privilege is not held by the client.[/FONT]

[IMG]http://blogs.technet.com/photos/isablog/images/702685/337x375.aspx[/IMG]

[SIZE=3][B][FONT=Arial]Matthijs ten Seldam[/FONT][/B][/SIZE]
[FONT=Arial]ISA Server Principal Consultant[/FONT]
[FONT=Arial]The Netherlands[/FONT]
[/LEFT]