配置活动目录服务账户

如果您想将 Amazon f NetApp o FSx r ONTAP SVMs 加入您的本地 Active Directory 域，则必须在亚马逊 FSx 文件系统的整个生命周期内保持有效的活动目录服务账户。Amazon FSx 必须能够全面管理文件系统并执行需要退出并重新加入 Active Directory 域的任务，例如替换出现故障的文件 SVM 或修补 NetApp ONTAP 软件。在 Amazon 中更新您的 Active Directory 配置，包括服务账户凭证 FSx。

此服务帐户必须在 Active Directory 中拥有以下权限：

• 将计算机加入域的权限

• 在您要加入文件系统的组织单位 (OU) 中，具有以下权限：

  • 重置密码

  • 限制账户读取和写入数据

  • 写入 DNS 主机名

  • 写入服务主体名称

  • 创建和删除计算机对象

  • 读取和写入账户限制

Active Directory 域管理员可以使用 A ctive Directory 用户和计算机 MMC 管理单元手动创建服务帐户。有关说明，请参阅 for ONTAP 文档中的向您的亚马逊 FSx 服务账户委派权限。 FSx 您也可以通过编程方式配置此帐户。例如，你可以使用 PowerShell，如以下示例所示。

param(
    [string] $DomainName,
    [string] $Username, #Service Account username
    [string] $Firstname, #Service Account Firstname
    [string] $Lastname, #Service Account Lastname
    [string] $saOU, #OU where Service Account is created
    [string] $delegateOrganizationalUnit #OU where Service Account has delegation
)

#Retrieve Active Directory domain credentials of a Domain Admin
$DomainCredential = ...

#Import Active Directory PowerShell module
...

#Create Service Account in specified OU
New-Active DirectoryUser -Credential $DomainCredential -SamAccountName $Username -UserPrincipalName "$Username@$DomainName" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Lastname, $Firstname" -Path $saOU -CannotChangePassword $True -PasswordNotRequired $True
$user = Get-Active Directoryuser -Identity $Username
$userSID = [System.Security.Principal.SecurityIdentifier] $user.SID

#Connect to Active Directory drive
Set-Location Active Directory:

$ACL = Get-Acl -Path $delegateOrganizationalUnit
$Identity = [System.Security.Principal.IdentityReference] $userSID

#GUID of Active Directory Class
$Computers = [GUID]"bf967a86-0de6-11d0-a285-00aa003049e2"
$ResetPassword = [GUID]"00299570-246d-11d0-a768-00aa006e0529"
$ValidatedDNSHostName = [GUID]"72e39547-7b18-11d1-adef-00c04fd8d5cd"
$ValidatedSPN = [GUID]"f3a64788-5306-11d1-a9c5-0000f80367c1"
$AccountRestrictions = [GUID]"4c164200-20c0-11d0-a768-00aa006e0529"

#Delegation list
$rules = @()
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "CreateChild, DeleteChild", "Allow", $Computers, "All"))
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "ExtendedRight", "Allow", $ResetPassword, "Descendents", $Computers))
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "ReadProperty, WriteProperty", "Allow", $AccountRestrictions, "Descendents", $Computers))
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($userSID, "Self", "Allow", $ValidatedDNSHostName, "Descendents", $Computers))
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($userSID, "Self", "Allow", $ValidatedSPN, "Descendents", $Computers))

#Set delegation
foreach($rule in $rules) {
    $ACL.AddAccessRule($rule)
}
Set-Acl -Path $delegateOrganizationalUnit -AclObject $ACL