Windows and Active Directory Integration
Hitachi ID Identity Manager uses the NTLM client built into the Windows server OS to
manage passwords on individual Windows servers and on Active
Directory domains.
Integration with Active Directory domains is also supported using LDAPS to one or more domain controllers. Please note that use of LDAPS requires that an SSL certificate be installed on each target DC.
Identity Manager can integrate with multiple domains, in multiple forests at the same time. Trust relationships are not required to do this.
The Identity Manager Active Directory connector is able to dynamically identify the most suitable domain controller(s) on which to make password updates, in order to expedite clearing of intruder lockouts where required. For example, a password update and concurrent unlock of a user can be directed to DCs selected specifically for that user -- at the user's home site, near the user's mail server, near the user's current browser IP, etc.
No agent software is installed locally on Windows servers and DCs to set passwords, clear lockouts or make other updates on Windows and AD.
Identity Manager connectors can create, delete, enable, disable, modify, rename and move users Kerberos users hosted on over 22 types of Unix systems and on on Windows 2000/2003/2008 servers and Active Directory domains. It creates new Windows users by cloning existing ones, copying and adjusting hundreds of native Windows, Active Directory and Exchange attributes in the process. It can also manage the membership of users in Windows and Active Directory groups.
When managing Windows/AD users, Identity Manager connectors can also create, update and move Exchange mailboxes; create, populate and set ACLs on Windows home directories and more. In other words, it can manage the entire Windows-platform user profile, rather than just AD user objects.