RE: [ActiveDir] effective policies blocking local policies

[Michael B. Smith]

Title: Message

You should be able to access the Unity admin page from http://<servername>/SAWeb/Default.htm -- for looking at stuff or modifying the Unity configuration, you shouldn't have any problems whatsoever. If you use the Unity Admin page for creating users in your A/D, you might have to give yourself some more permissions in Exchange. The default configuration uses Windows Integrated Authentication, so if your normal account is not an admin account, you may want to change that.   Exchange 2003 is supported with Unity 4.0(3) and above, and I'm certain of that because I've done two or three client installs of the product and upgraded a couple more so that we could upgrade their Exchange infrastructure.   If you are already on 4.0(3), it doesn't require a Unity re-install to switch to Exchange 2003, unless you are currently running Exchange 55. But switching from Exchange 2000 is pretty trivial.   Or are you currently using Domino?   You may (or may not) be aware, but on the 4.0+ stream, Unity requires that the message store be OFF the Unity server for UM configurations. VM-only configurations still allow it, but the practice is deprecated.   Unity and Callmanager are both somewhat fragile products -- in terms of their installation configuration. If the installation is not "just so", the products WILL fail, and it's extraordinarily easy to break their configurations. In the case of Unity, it's possible to give the service accounts TOO MANY permissions, and the product will fail. It's a really good reason to have Callmanager as a standalone server, and Unity have a separate message store, and not have that server sit in one of your normal containers (where normal GP's may apply).   Anyone (end-user or Cisco partner) can take the CUSE (Cisco Unity System Engineer) course and the equivalent Callmanager course. IMO, it really is a good idea to have exposure to the information and techniques exposed in those courses (which, as far as I am aware, isn't available anywhere else) before attempting to do some of this stuff on your own (and don't misunderstand -- what I'm saying is that Cisco did some things really DIFFERENT from what a normal Windows person would consider, well, normal). But if you can get a Cisco person to loan you the course manual -- that's a quick way to deal with it. :-)   An excellent resource for Unity is www.answermonkey.net and the Unity forums sponsored by Cisco at http://forums.cisco.com/eforum/servlet/NetProf?page=Voice_and_Video_discussion   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marvin Cummings Sent: Wednesday, January 21, 2004 9:43 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] effective policies blocking local policies Yeah that was my main gripe as I’m in the process of moving to Windows 2003. Did me no good to have the newly installed DC in place because I don’t have my Exchange CD yet and the only people “capable” of installing this app are cisco guys. SO my exchange deployment is on hold until I can justify spending the cash to get them back out here to re-install unity to modify the schema. This product also isn’t proven under SP4, another gripe, so I’m stuck with SP3 until they provide the OK on that. Another gripe is that it seems that only the unityadmin is able to log in and access the admin site, which means me and the other admin have to TS into this w2k box to log in as this admin to manage our users. The cisco guy didn’t want to elaborate on whether I could give our accounts access to this. Can anyone confirm this for me?   Oh and it seemed that adding these accounts to the domain admins group solved this issue. It wasn’t related to policy at all.   Thanks for the replies.   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kingslan, Rick T. Sent: Wednesday, January 21, 2004 3:07 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] effective policies blocking local policies   Yeah, and add to that - I sure wish that they (Cisco) would get their act together.  I'd REALLY like to go to Server 2003, except the CCM is not 'ready for prime time'.  Schema extensions and all, you know.....  Maybe Fall, 2004.   How much advance knowledge (aren't they a major Microsoft partner?) do you have to have to produce a product that is due 18 months after the OS that requires it?   (Sorry, Robbie....)   Rick Kingslan  MCSE, MCSA, MCT Microsoft MVP - Active Directory LAN Administration - Windows 2000 West Corporation 1-800-542-1000 ext. 116-1636 Direct# 402-716-1636 Fax# 402-343-2597 [EMAIL PROTECTED]   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. Smith Sent: Wednesday, January 21, 2004 1:43 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] effective policies blocking local policies That's what they said in class. :-) And on the CCM tests. :-)   More seriously, from the Callmanager 3.3 release notes:   Caution   When a server exists in a domain, authentication between servers may fail, or the non-default domain security policies may restrict Cisco CallManager from building critical NT Accounts. Failing to remove the system from the domain and add it to a workgroup may cause upgrade errors, upgrade failures, or a total system failure, which includes a loss of data and a complete reinstallation of Cisco CallManager.   This is combined with the fact that when you switch back and forth between workgroup and domain membership, you are required to basically reconfigure CCM each time (the server instance name changes).     From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charlie Kaiser Sent: Wednesday, January 21, 2004 2:14 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] effective policies blocking local policies Michael; why are CCMs not supposed to be domain members? Thanks!     ********************** Charlie Kaiser MCSE, CCNA Systems Engineer Essex Credit / Brickwalk 510 985 0975 x5083 ********************** -----Original Message----- From: Michael B. Smith [mailto:[EMAIL PROTECTED] Sent: Wednesday, January 21, 2004 10:34 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] effective policies blocking local policies CCM servers are not supposed to be domain members.   Having said that, what do gpresult and GPMC tell you?   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marvin Cummings Sent: Wednesday, January 21, 2004 1:19 PM To: [EMAIL PROTECTED] Subject: [ActiveDir] effective policies blocking local policies   I just added a w2k server running Cisco Call Manager to our network and it's not responding too well to our domain. For instance I need to provide a few of the accounts the right to log on as a service but I'm not able to because there appears to be an effective policy in place preventing me from adding the users. We don't have any policies in place on our network that would prevent this so I'm trying to figure out what would cause this. The Cisco guys are sure this is related to policy on our network and I think it's related to the local security policy settings on that server. The server is currently sitting in the Computers container and the accounts have all been added to the domain admins group as requested. Am I overlooking something here in regards to group policy?   Thanks