HP Integrated Lights-Out 2 User Guide

admin named User1; you can copy the distinguished name of the domain admin security
group over to iLO 2 and give it full privileges. User1 would then have access to iLO 2.
Disadvantages of using schema-free directory integration
• Supports only Microsoft Active Directory
• Group privileges are administered on each iLO 2. However, this disadvantage is minimized
by group privileges rarely changing, and the task of changing group membership is
administered in the directory and not on each separate iLO 2. HP provides tools that enable
changes to a large number of iLO 2 to be made at the same time.
Setting up Schema-free directory integration
Before setting up the Schema-free option, your system must meet all the prerequisites outlined in
“Active Directory preparation” (page 132).
You can set up iLO 2 for directories in three ways:
• Manually using a browser, see “Schema-free browser-based setup” (page 133).
• Using a script, see “Schema-free scripted setup” (page 133).
• Using HPLOMIG, see “Schema-free HPLOMIG-based setup” (page 134).
Active Directory preparation
The schema-free option is supported on the following operating systems:
• Microsoft Active Directory
• Microsoft Windows Server 2003 Active Directory
SSL must be enabled at the directory. To enable SSL, install a certificate for the domain in Active
Directory. iLO 2 only communicates with the directory over a secure SSL connection. For more
information, refer to the Microsoft Knowledge Base, article number 247078: Enabling SSL
Communication over LDAP for Windows 2000 Domain Controllers on the Microsoft website at
http://support.microsoft.com/.
To validate the setup, you must have the directory distinguished name for at least one user and
the distinguished name of a security group the user is a member of.
Introduction to certificate services
Certificate Services are used to issue signed digital certificates to network hosts. The certificates
are used to establish SSL connections with the host and verify the authenticity of the host.
Installing Certificate Services allows Active Directory to receive a certificate that allows Lights-Out
processors to connect to the directory service. Without a certificate, iLO 2 cannot connect to the
directory server.
Each directory server that you want iLO 2 to connect to must be issued a certificate. If you install
an Enterprise Certificate Service, Active Directory can automatically request and install certificates
for all of the Active Directory controllers on the network.
Installing certificate services
1. Select Start>Settings>Control Panel.
2. Double-click Add/Remove Programs.
3. Click Add/Remove Windows Components to start the Windows Components wizard.
4. Select the Certificate Services check box. Click Next.
5. Click OK at the warning that the server cannot be renamed. The Enterprise root CA option is
selected because there is no CA registered in the active directory.
6. Enter the information appropriate for your site and organization. Accept the default time
period of two years for the Valid for field. Click Next.
132 Directory services