Re: Domain users

[Lukas Beeler <lukas.beeler@xxxxxxxxxxxxxxxx>]

On Mon, Jun 1, 2009 at 20:16, Jeff Crosby <jlcrosby@xxxxxxxxxxxxxxxx> wrote:
> A windows consultant is going to be setting us up as a domain instead of a
> workgroup. ÂHe's asked some questions I don't know how to answer. ÂSince
> he's not really a System i guy, he won't know.

A very good idea. I remember we had a thread about your configuration
a few weeks back, on what kind of hardware and software did you
settle?

> 1) He wants a list of users along with passwords. ÂSince the System i is on
> the LAN, does every System i user need to be set up in the domain?
> Including IBM supplied ones? ÂHow about ones I created that have no password
> because they're not used for signon?

No, you only need a Windows account per physical user. Usernames on
the i and on Windows don't even need to match, even if you're planning
for SSO later they don't need to. However, it makes it easier for
without SSO and access to Netserver shares.

Basically, just talk to the guy what he wants to achieve - Windows
guys don't bite ;)

> 2) He asked for password rules. ÂDo I regurgitate the System i rules and he
> duplicates them? ÂI've heard of something called single sign-on, should we
> use this? ÂNot a good idea at setup time? ÂI can see the domain and the
> System I each trying to enforce rules making it tough for users to keep them
> in sync.

Password rules - well, making them the same is a very sensible idea.
SSO is good, but do it AFTER the Windows migration. Don't open to many
streets at once. Standard windows password configuration rules are not
as flexible as what you have on the i - this may mean changing the
default password policy on your i or purchase a password management
solution for your Windows domain.