Windows Authentication (using a Designated Account)

When connecting to a Microsoft SQL Server, Windows Authentication can also be used.

  • Depending on the configuration of your database server, you can use Windows Authentication on the server-level or on the database-level. Please note that switching between authentication modes on the server-level will also affect other databases on this server.
  • Windows Authentication is only supported in Ivanti Automation environments in which all components are members of a domain in the same AD forest or of a trusted domain (typically, single-tenant sites). In an environment with disjointed AD connectivity (typically in multi-tenant sites), Windows Authentication is not supported.

To use Designated Account authentication, follow the steps below in the section that applies to you:

New installations

  1. In Microsoft Active Directory, create a Group for service accounts.
  2. Create an Active Directory User that is a member of this service accounts group (this account is the Designated Account).
  3. Create the following policy:
    1. Log on as a service for the service accounts group.
    2. Add the service accounts group to the local administrators group.
  4. Link the policy to the OU that contains the computers running the Dispatchers.
  5. Open Microsoft SQL Server Management Studio.
    1. In the Security folder, create a new login.
    2. Click Search and then Object Types.
    3. Add the Active Directory User (Designated Account) that you created earlier.
  6. Create a new default database with the following settings:
    • Size 150MB, autogrow 25MB
    • Log 75MB, autogrow 10MB
  7. Open the properties of the Designated Account.
  8. On the User Mapping tab, select the database just created.
  9. In Database Role Membership, select the db_owner role.
  10. Add the account that is going to create the database tables and add the role "dbo".
  11. Install Ivanti Automation with the installation .MSI with any user that has install rights on the system.
  12. After installation, start the Ivanti Automation Console.
  13. When prompted, do NOT create a new database, but connect to the one that you just created.
  14. Provide the required information and select Windows Authentication.
  15. Specify the Service Account in the format: DOMAIN\username.
  16. Click OK.
  17. When connecting to the database, Ivanti Automation will ask for confirmation first. When confirmed, Ivanti Automation will create the required tables.

Existing installations using SQL Server Authentication

  1. On the Microsoft SQL Server, switch the authentication mode for the Ivanti Automation Datastore from mixed mode authentication to Windows Authentication.
  2. Follow the steps as described above until step 12. Skip the step where you create a new database.
  3. Start the Ivanti Automation Console and at Setup > Database change Database authentication to Windows Authentication.
  4. Provide the Designated Account credentials and click Connect. The Console will now restart.
  5. Repair all Consoles and Dispatchers in the Ivanti Automation environment. Every new Console and Dispatcher that you deploy will run using the Designated Account credentials.

Upgrading an environment that uses the old form of Windows Authentication to a version that has the new form of Windows Authentication (using Designated Account)

  1. Run the Upgrade Pack that contains the new implementation for Windows Authentication (using a Designated Account).
  2. Create the Active Directory User (the Designated Account) by repeating steps 5 through 10 from the "New Installations" section.
  3. Remove/disable the GPOs for "Log on as a service" and "add to local administrators group" for Console computers.
  4. Open the Ivanti Automation Console and change the current Windows Authentication account with the newly created one (the Designated Account).
  5. Repair all the Consoles and Dispatchers in the environment. They should all connect to the database server using the Designated Account credentials, regardless of the user logged on the system.
  6. Remove all the Active Directory users/group(s) configured as dbo from the Ivanti Automation database. Leave only the Designated Account user.

Downgrading to a version that has the old form of Windows Authentication from a version that has the new form of Windows Authentication (using Designated Account)

  1. Follow the steps from the old form of Windows Authentication (section “Existing installations using SQL Server Authentication”).
  2. Remove the User Mapping of the Designated Account login for the Ivanti Automation DB from the SQL Server.
  3. Open the Ivanti Automation Console and configure the Windows Authentication users according to their needs.
  4. Run the Ivanti Automation Upgrade Pack of an older version that contains the old form of Windows Authentication.
  5. After the Ivanti Automation Consoles get updated, set the Ivanti Automation Console Service to run with the corresponding user (as it was configured before upgrading to 2019.1 or later) and restart the service.
  • If you change the service account at a later stage, you need to repair all Consoles and Dispatchers.
  • For troubleshooting purposes, use the Windows Event log to validate a successful connection.
  • Windows Authentication is not supported on Domain Controllers and on Microsoft Windows Small Business Server. This only affects components that connect to the Datastore (Consoles and Dispatchers), not Agents.