To create Enterprise PDM groups using Active Directory, you must set delegation on the archive server Active Directory domain controller to Trusted.
If the archive server uses Windows login, when the administrator manages users and groups in Enterprise PDM the archive server queries Active Directory for user and group information. As part of the query, Active Directory does an authentication challenge to ensure that the user has access rights.
For the authentication challenge to succeed when a client is run from a computer other than the archive server, delegation for the archive server computer account in Active Directory must be set to “Trust this computer for delegation.” When Active Directory asks for credentials, this setting lets the archive server computer account forward the client credentials for a user who is logged in to a different computer.
The Active Directory Users and Computers console is required to configure the Active Directory domain controller. Only a domain controller has the Active Directory Users and Computers console installed by default. If the archive server is not a domain controller, you must set up a Microsoft Management Console with the Active Directory Users and Computers snap-in before you perform this procedure.
To set delegation to trusted:
- Log in to the archive server computer as a member of the Domain Admins group or the Enterprise Admins group in Active Directory.
- Click .
-
In the Active Directory Users and Computers dialog box, in the left pane, expand the domain controller and locate the computer account for the archive server.
By default, computer accounts are kept in the Computers folder, but they can be located in other folders under the domain controller.
- In the right pane, right-click the account and click Properties.
- On the Delegation tab, select Trust this computer for delegation to any service (Kerberos only).
- Click OK.
- Close the Active Directory Users and Computers dialog box.