Microsoft® Web Admin Tool 1.0

Sample Web-based Provisioning Tool

 

Table of Contents

About this Document. 1

About Web Admin.. 1

Notice to User. 2

Pre Installation Decisions. 2

Clients. 2

Setup.. 2

Installation of Web Admin web pages. 2

Register AdsType.dll 2

Exchange 2000 Services. 3

DNS Services. 4

Logging & Reporting.. 4

Profile Information.. 5

Configuration.. 5

Branding the Web Admin.. 5

Enabling & Disabling Features. 5

Provisioning.. 5

Active Directory. 5

Office 2000 on Terminal Server. 6

Exchange 2000.. 6

Other Known Issues. 7

Frequently Asked Questions. 8

Support. 8

More Information.. 8

 

About this Document

This document lists critical issues that can potentially impede you from successfully installing or deploying the Web Admin Tool in your environment.

About Web Admin

Web Admin is a tool to enable users and administrators to manage their respective resources via Internet Explorer.  Web Admin is a great example of how Windows 2000 and Active Directory can be easily leveraged and utilized.

 

Users, groups, and organizational units can be created, modified, and deleted in a similar fashion to the Active Directory Users and Computers MMC snap-in. 

 

Web Admin is not a replacement to the Active Directory Users and Computers MMC snap-in, but it does provide a great example of how to utilize the Active Directory.  This tool should provide a good starting point for the creation of a web based administration utility.

 

Web Admin was developed in Visual Interdev 6.0 using Active Server Pages, Visual Basic Script, Active Directory Service Interface (ADSI), Internet Explorer 5.0 (IE5), and Windows Management Instrumentation (WMI).

 

The following bullets point out the main goals for the Web Admin development effort:

 

It is also necessary to point out what Web Admin doesn’t achieve with this first release of the tool:

 

Overall, the Web Admin tool will provide you with a great place to start.  This is especially true for understanding how to effectively utilize and leverage the power of Active Directory and ADSI.

Notice to User

The Web Admin tool is a Sample tool that is not meant to be used in a production environment.  The tool has not been regression tested for use in a production environment.  It is also important to note that the Web Admin is not supported by the Microsoft Corporation. Please read the EULA.htm file also located in the Web Admin Zip File for more details.


Pre Installation Decisions

Below is a list of items that need to be decided on prior to installing the Web Admin.

 

  1. If you are implementing a Front-End / Back-End Architecture for Exchange Protocol Services, you may want to install the Web Admin on the Front-End Mail servers.  This will help create the effect of single sign on because of the Basic Authentication used by both the Web Admin and the Front-End Exchange Servers.  More information on this is available below in the Exchange Portion of this Read Me.

 

 

Clients

The list below indemnifies the clients that are able to access Web Admin.

 

Setup

Installation of Web Admin web pages

Web Admin functions without the need for hard coding your domain, server, or any other name.  It does this by recognizing what domain the server that is serving up the web pages for the Web Admin is a member.  So, for it to function properly, the following requirements ALL need to be satisfied:

  1. If planning to use the Exchange 2000 functionality of the Web Admin, please refer to the Exchange Service Section below for additional Installation Requirements.

Register AdsType.dll

The AdsType.dll was created for the ViewAcl.asp page.  The ViewAcl.asp page allows an administrator to see all of the Access Control Entries for a given object.  ADsType.dll serves one purpose ---and that's given the cn (common name) of a schema class or attribute, fetch the corresponding schemaIDGUID attribute, convert it to a string using the StringFromGUID2 Win32 API, and return the string to the calling script. The issue is that the schemaIDGUID attribute is stored in the schemaNamingContext as an OctetString. Unfortunately, VBScript cannot read OctetStrings ---much less convert an OctetString to a string as required by the IADsAccessControlEntry::ObjectType and InheritedObjectType properties. So in order to initialize an ACE's ObjectType and/or InheritedObjectType properties for delegation purposes, one must find a way to convert the schemaIDGUID from an OctetString to a string if they're using VBScript. There are a few possible solutions:

1. Develop an ActiveX component to perform the conversion ---that's what is done with ADsType.dll.

2. Hardcode the schemaIDGUID's in your script or the like. You can find the string-i-fied representation of the schemaIDGUID in the Active Directory Developer's Reference Library ---see Volume 5, Active Directory Schema.

3. Finally, you can use something other than VBScript, e.g. Perl. You can convert OctetStrings to anything you like using Perl's unpack function.

In order to use the AdsType.dll, it will need to be registered.  This is done by using the regsvr32.exe which part of the Windows operating system and is available at the command prompt.

Here are the steps to setting up the Web Admin Website:

  1. Click Run, point to Programs, point to Administrative Tools, and then select Internet Services Manager.
  2. Expand the web server in which you want to install the Web Admin tool.
  3. Right-Click on the Default Web Site and select New>Virtual Directory.  It is recommended to use a different web site other than the Default Web Site.  The Default Web Site was created when Internet Information Services was installed on the server and contains sample code and help documentation.  This is why it is recommended that a new Virtual Web Server instance be created for use with the Web Admin.  However, for the purpose of this installation we will install the Web Admin tool on the Default Web Site. 
  4. Click Next, to pass the Welcome Page
  5. Enter WebAdmin as the new Virtual Directory Alias,  It does not have to be WebAdmin, but it's helpful to keep the name standardized for future versions. Click Next.
  6. Enter the Directory location.  Using the Browse button, locate the HTML directory within the directory tree of the Web Admin tools and click OK.  This will be located where you unzipped the Web Admin files.  Now, click Next.
  7. No changes for the  Access Permissions page will be necessary.  Leave all entries at the default state and click Next and Finish.
  8. Right-Click on the new WebAdmin Virtual Directory and select Properties.
  9. Click on the Directory Security Tab.  Now click on the Edit button for Anonymous access and authentication control.
  10. Uncheck Anonymous access.  The Web Admin Setup Wizard will make additional configuration changes.  These changes are necessary so that the Web Admin can obtain your security context and ensure you have to privileges to configure the IIS meta-base and the Active Directory. 
  11. Click OK, Apply, OK.

Note: In order to secure the Web Admin tool authentication, it is recommended that you enable Secure Sockets Layer (SSL) on the IIS server.  Please refer to the IIS documentation for details on how to configure SSL.  This is VERY important, because authentication between the client browser and the web server is done via basic/clear text.

Now that the Web Admin has been installed. It's time to walk through the Web Admin Setup Wizard.

  1. On the server that has Web Admin installed, log on as Administrator and open Internet Explorer and go to the URL that points to the Web Admin - http://servername/webadmin. 
    Note: For better viewing and usage of the Web Admin tool, set the display’s screen area to by 1024 by 768.
  2. Click on the Link: Web Admin Setup Wizard.
  3. The Wizard will now guide you through the rest of the setup process. Step 1, read the text and then click Next.  Step 2, read the text and then click Next.  Now you will be prompted for a Network Password – enter Administrator and the appropriate password.  Step 3, read the text and then click Make Changes.  Step 4, review the modifications and then click on the Next button.  Step 5 – Web Admin Setup Wizard complete.

After completing the Wizard, it would be best to turn off the link to the Wizard.  This can be done by editing the Config.asp page, which is located in the “<build number>\ HTML\Lib” Web Admin Tool source tree directory.  Open the config.asp with notepad and search for the constant variable Hide_Setup_Wizard and set this variable to equal True.  Note: A refresh within Internet Explorer will be necessary for this change to take affect.

Exchange 2000 Services

For the Web Admin to function properly with Exchange, Exchange must be installed on the Web Server the Web Admin is running on.  This is necessary because of the Application Programmers Interface’s (API) that are called from the Web Admin when performing Exchange 2000 specific functions.  The full installation of exchange is not necessary for the Web Admin to function properly. 

During the Installation of Exchange, and Component Selection screen will appear.  This section will allow you to chose what major functionality of Exchange 2000 you want installed on the server.  As far as the Web Admin goes, it only needs Microsoft Exchange System Management Tools.  This will give you the bare minimum to use the Web Admin with Exchange 2000 provisioning.

There is a catch though.  There is one other object that is needed for the Web Admin to function properly.  The Microsoft CDO 1.21 Library Object is also needed for the Web Admin to function properly.  This object is located on the Exchange 2000 CD (Setup\I386\Exchange\Bin\CDO.dll).  Copy the DLL and paste it in the WinNT\System32\ folder on the server.  Then register the DLL using regsvr32.exe:  regsvr32.exe <path to the CDO.dll>\CDO.dll

The CDO.dll can also be found for download at: http://www.microsoft.com/exchange/downloads/CDO.htm

This is a bit of a hack, but it keeps you from having to install the entire installation of Exchange 2000 on the Web Server.

If you also chose as a part of the installation for Exchange 2000, “Microsoft Exchange Messaging and Collaboration Services” you do not have to manually register the Microsoft CDO 1.21 Library

If using Exchange Front End Servers for Outlook Web Access, installing the Web Admin on one of these servers is preferred.  Now all you have to do is install the Web Admin and the Web Admin Exchange DLL on that server.

DNS Services

The Web Admin now has the capability to create a new DNS Zone and record for a given service.

By default, DNS Services are not enabled.  This is due to the fact that it takes additional steps to configure this.  In the Extras\DNS WMI folder there is another zip filed named, “dnsprov.zip.”  Unzip that file to the local hard drive and follow the installation instructions.  Then enable DNS Services for the Web Admin.

Below is a subset of the DNS Installation instructions:

To install the dns provider,

1.       Copy dnsschema.mof and dnsprov.dll to <winntdir>\system32\wbem.

2.       Run "mofcomp dnsschema.mof" to register the class information.

3.       Run "regsvr32 dnsprov.dll" to register the dll.

Steps 1-3 must be done on all servers that the Web Admin is being ran from.  Only Setup 2 is necessary on the target DNS Server.  The DNS Server must also be at least a member server of the domain in which the Web Admin is administering.  This is because the DNS WMI Provider functions off of the current users security context that was given during logon to the Web Admin.

To enable DNS Services for the Web Admin:

1.       To make this setting permanent, open the Global.ASA file and set the Enable_Service_DNS to True

2.       To make this setting take affect immediately, but temporary, Click on Manage Organization and then click on the Config link on the Web Admin toolbar.  Set the Enable DNS to True, and then click the Set button.

Logging & Reporting

There are multiple methods of logging that the Web Admin is capable of doing.  Below is list of the types of logging the Web Admin can do and the values that are used by the Constant LOGGING_TYPE that determine which type of logging the Web Admin will use.

1 = No Logging -No events will be logged.

2 = File System -Stored in a text file on the local Web Server

3 = Event Log -Store in the Application Event Log

4 = SQL Database -Store in a SQL/MSDE Database - Follow Direction below

The Constant LOGGING_TYPE can be  found at \html\Lib\config.asp.

If you Choose SQL Logging, you must first do the following steps.

1.       Run the Web Admin SQL Setup Script: SQL\SetupLogDB.sql on your SQL 2000 Server.

2.       Edit the file, “\html\Global.asa” and edit the Constant LOGGING_SQL_PROVIDER to reflect the proper settings for Server, Database, User Id, and Password.

3.       Uncomment all fields in the Global.asa that are properly marked for SQL Logging.  ( Read the embedded comments in the Global.asa, they will give further directions)

4.       Save Global.ASA

5.       Set the Constant LOGGING_TYPE to 4 (this is in the Lib\Config.asp file)

By Default, LOGGING_TYPE is set to 2 for File System Logging on the C drive.

When SQL based logging is enabled, reporting is also enabled.  If the logged on user to the Web Admin is an Organizational Administrator or higher, they are able to see a link named, “Special” while managing an Organizational Unit.  By Clicking on that link, the user will see other selections that are special, to include Reporting.  For Beta 3, only RAW Reporting is enabled.

Profile Information

By Default, the Web Admin will add a profile path to each new user that is created.  This will be the location of the roaming profile for the user.  To set the proper location for your environment, open the Global.ASA file and modify the SET_USER_PROFILE and DEFAULT_PROFILE_PATH attributes to the settings of your choice.

Configuration

Branding the Web Admin

The Web Admin is very flexible when it comes to branding.  For a Service Provider to brand the Web Admin with their own top and side bar navigation, they would only need to modify two files: : Header.asp and Home.asp.  Neither of these files may be directly overwritten or erased, but they can be heavily modified.  There are two html comment tags in each file that points out what can and can't be modified or erased.

Enabling & Disabling Features

The Web Admin gives the Service Provider the ability to determine how the Web Admin will function with some simple modifications.  Config.asp is the file in which the Service Provider can make these functional changes.  The file is located in the <path to WebAdminTool>\build 8\lib folder.  This file contains a number of constant variables that function as "switches."  The function of a switch is to allow for the Service Provider to turn certain features on and off.  Within the file, Each switch has its own description of what it does.  Note:  The Web Admin is a web application that can be put on many different servers.  To maximize consistency, make sure that all of the switches are set identically on all servers.

 

Provisioning

To do any type of provisioning of services for a particular organization or user, you must be a direct member of the Domain Administrators or Enterprise Administrators Group for that specific domain.  If you are a member of a group that is a nested in one of the two groups mentioned above, you would not be able to provision any services.

Active Directory

The Web Admin allows for fast, easy, and consistent management of the Active Directory.  It does it in such a way that it allows for Service Providers to create a new organization and a single user in that organization with organizational administrative rights.  An organizational administrator has the ability to create and manage all users, groups, organizational units, and services within their respective organization.

Administration Roles

There are 4 roles that the Web Admin takes into account.  These roles are used by the Web Admin to determine what information should be show to the user and what actions that user can make.  Active Directory Security is used to enforce what a user can and cannot do.

Domain Administrators: Domain Administrators are at the top of the food chain.  To be a member of this role, a user must be a direct member of either the Domain Administrators group or the Enterprise Administrators Group.

Multi Organizational Administrator:  Multi Organizational Administrators are allowed to create New Organizations and administer only the Organization that they created.  The only way to become a Multi Organizational Administrator is to:

1.       Logon to the Web Admin as a Domain Administrator or Enterprise Administrator.

2.       Create a New Organization, but before clicking on the Create button, make sure the check box next to, “Multi Org Management” is checked.

3.       Click the Create Button

4.       Create a new User

5.       Select the Mutli Org Adminstrator Checkbox

6.       Click Create

Now the new user that was created above can create and manage other organizations.  Even though the Mulit Org Administrator has full rights to the Organizations that it created, the user must still be appointed as an Organizational Administrator to administer its own Organization.

Organizational Administrator:  The Organizational Administrator can administer all of the users, groups, and computers that lye within their Organization.  This includes Creating and Managing New User/Group/Organizational Units, Reset Passwords, Edit Users Information, etc.  If enabled, the Organizational Administrator may also provision Exchange 2000 mailboxes to their own users.

End User:  End Users are at the bottom of the Management food chain, but they are the most important, because they are the reason why all of this is done.  End Users can manage their own information as well as search for other users and view their information.

 

Office 2000 on Terminal Server

The Web Admin has the ability to provision Office 2000 installed on Windows 2000 servers utilizing Terminal Services.  However, the Web Admin is unable to setup the environment needed to allow for that service to work properly.

There is another toolkit with scripts and documentation that explains how to enable that service.  Once the service is enabled, the Web Admin can provision the service for an organization and the users within them.

In Config.asp set the following Constants to False if you are not going to provide Office 2000 via Terminal Server as one of your services.

To Enable the Service for a particular Organization, let's assume that you already created an Organization called, "CompanyB.com” This new Organization also has a user name Mark Smith that was been named as an Organizational Administrator.

  1. Logon to the Web Admin with a user account that is Domain or Enterprise Administrator
  2. Click on Organizational Management
  3. Click on the Organization (CompanyB.com)
  4. Click on the Other Options Tab
  5. Select Office 2000 from the Manage Organizational Service drop-down list.  It doesn't matter if you select the service from a nested OU or not.  The Service affects the entire organization, not just that OU.  If you are Not a Domain or Enterprise Administrator then you will not see the Manage Organizational Service Section.
  6. If Office is not available to for that Organization, a hyperlink will appear asking you to click on it to enable the service.  When you click on that link, it will create a new group called ProfessionalServicePlan@CompanyB.com.  This Group is also nested in the Master Professional Service Plan Group, which is located in the ServicesOU. 
  7. Now you will see that the service is enabled with zero users that have it.  

Now to enable Service for Mark Smith:

  1. Logon to the Web Admin with a user account that is Domain or Enterprise Administrator
  2. Click on Organizational Management
  3. Click on the Organization (CompanyB.com)
  4. Click on the User (Mark Smith).  I am assuming that Mark Smith is in the Top OU
  5. Click on the Other Options Tab.
  6. Select Office 2000 from the Manage User Service drop-down list.  Selecting this you will manage that users service for Office.  If you are Not a Domain or Enterprise Administrator then you will not see the Manage Organizational Service Section.
  7. By default, the user has no service.  Select a Service Plan then click submit.

Exchange 2000

The Web Admin allows for the provisioning of Exchange 2000. 

In this release of the Web Admin, the provisioning of Exchange is not very clean nor scalable for a large service.  It is however, a good step in the write direction.  It does, in the release, show how Exchange can be a service that is both appealing to customers and provisioned via the web.

In Config.asp set the following Constants to False if you are not going to provide Exchange 2000 as one of your services.

To Enable Exchange for an Organization:

  1. Logon to the Web Admin with a user account that is Domain or Enterprise Administrator
  2. Click on Organizational Management
  3. Click on the Organization (CompanyB.com)
  4. Click on the Other Options Tab
  5. Select Exchange 2000 from the Manage Organizational Service drop-down list.  It doesn't matter if you select the service from a nested OU or not.  The Service affects the entire organization, not just that OU.  If you are Not Domain Administrator, Enterprise Administrator, or a Multi Organizational Admin then you will not see the Manage Organizational Service Section.
  6. If Exchange services for that Organization is not yet established, you will see a link that instructs you to click on it to enable the service.  You will then see a message saying that the service is enabled.  What just happened was a recipient policy was just created for that organization.

Create a New Mailbox for an existing user:

  1. Logon to the Web Admin with a user account that is Domain or Enterprise Administrator
  2. Click on Organizational Management
  3. Click on the Organization (CompanyB.com)
  4. Click on the User (Mark Smith).  I am assuming that Mark Smith is in the Top OU
  5. Click on the Other Options Tab.
  6. Select Exchange 2000 from the Manage User Service drop-down list.  Selecting this you will manage that users service for Exchange.  If you are Not a Domain Administrator, Enterprise Administrator, or a Multi Organizational Admin then you will not see the Manage Organizational Service Section.
  7. If the Users account is not yet established, then you will see a link that instructs you to click on it to create the mailbox.
  8. You will not get a drop down of the available Exchange Servers.  Select one of them and then click Next.
  9. Now you will get another drop down Asking for you to select a Storage Group.  Select one of them and then click Next.
  10. Then you will get another drop down Asking for you to select a Mail Store.  Select one of them and then click Next.
  11. Finally you will get a text box for the Alias name.  An alias will already be supplied that reflects the users User Principal Name Prefix.  There is no reason to make any modification here.  Click Next
  12. .  The Exchange 2000 mailbox has been created for the user, but an email address has still not been set in the directory.  This is because the Exchange System Attendant has not yet applied the appropriate recipient policy to the user. Once the Exchange Server is done with it's updates (time frame varies ~ 5-45 seconds), the email address will now be present for that user. Now in the Users Exchange Services Page there will be a list of Proxy Addresses .  These Proxy Address represent the address that is associated to the user.  If there are two address of the same Protocol (SMTP, x400, etc..), the one that has the Protocol capitalized is the default domain for that user.  So when the user sends and email address out, that will be the users reply-to address.  You may update which SMTP address is the Primary with the Web Admin.  The change is instant, although it may take anywhere between 5-45 seconds (or sometimes more) for the email address attribute to be updated as well.  Do not update the mail attribute directly.  The Exchange System Attendant will make then necessary changes. 

 

Other Known Issues  

  1. If Web Admin is running on a Domain Controller, customers will not be able to logon.  This is by design.  Windows 2000 has a restriction of allowing only Domain and Enterprise Admins logon to a Domain Controller.  Even though the Web Admin is web-based, users still need to authenticate for service on that machine.  To resolve this, Add Domain User to Logon Locally in the Default Domain Controllers Policy.  Click Here for more information
  2. The documentation found in the Docs folder were written for Beta 3 of the Web Admin Tool.  An updated document will appear soon on the Web Admin Tool website (more information on the site below).
  3. An initial WAP Interface has been added, but current functionality is very limited. It is recommended that this feature not be used or demoed unless further developed by yourself or until this feature is extended in the next release of the Web Admin.
  4. You must have the Web Admin on a local drive when creating the Virtual Directory for the Web Admin.  When using a file share to point to the Web Admin on another server a username and password must be used by the web server to access that resource.  This will lead to improper behavior by the Web Admin because of security credential issues.
  5. If the local administrator password for the web server the Web Admin is installed on is the same as the Domain Administrator password, then when logging on to the Web Admin a domain prefix must be entered when.

§           Example: <domain>\administrator

  1. Global Address List is currently not available when Exchange Enabling an Organization.  This is due to a security bug in the code.  This is an ok thing if you will only need access to OWA.  If your users need to access Exchange via Outlook (via TS or PC) then this will be a hindrance.  A fix will be supplied on the Web Admin Website as soon as it becomes available.  This has no affect on deployment when the Web Admin Tool is being used in Non ASP Mode (Enterprise Style).
  2. From Build 23+, there is no longer the need to to register a separate DLL for Exchange Services.  The code was moved into the ASP Pages.  If you had an earlier version of the Web Admin installed and you had registered the msWebAdmin.dll, you can now unregister the DLL.

 

Frequently Asked Questions

  1. After installing the Web Admin on a Web Server and running the Web Admin Setup Wizard, I’m still getting problems.  I can create a new organization and user, but that new user in the new organization is unable to logon.

Items to Check:

§           Is the Directory in Native Mode?  For the Web Admin to function proplerly in a Service Provider type of environment (which it’s in by default), the directory needs to be in Native Mode.  This is due to Group in Group Nesting required for efficient security settings.  Please reference the Microsoft Active Directory Application Service Kit (ADASK) http://www.microsoft.com/ISN/whitepapers/active_directory_ASP_Kit.asp?A=0

§           Is the server that the Web Admin installed on (the web server) a domain controller?  By default, only Domain Admins can log onto a domain controller.  Please read item 1 in the Known Issues section above for more details.

§           Check the Event Logs for other information.

 

Support

There is no support provided by Microsoft for the Web Admin Tool.  Please Reference the END-USER LICENSE AGREEMENT FOR MICROSOFT SOFTWARE provided for more information on the license agreement.

 

More Information

There is a growing community surrounding the Web Admin.

 

v        Websites:

Ø        Official Microsoft Website: http://www.microsoft.com/ISN/WebAdmin/

v        Newsgroups:

Ø        Microsoft : Please visit the site above for more information.

v        E-mail:  (Please only send Comments, Feedback, or Bugs Reports ONLY.)

Ø        webadmin@microsoft.com