Windows authentication

This section will talk about setting up Windows auth, using Local Groups and Active Directory groups.

You can use the following groups for authentication in this method:

• Local Groups (on the DeployR Server)

  • Nested with Local Users, AD groups, AD users

• Active Directory Groups [from the AD the DeployR server is joined to]

  • Nested with AD groups, AD users

Enabling in Config Editor

Enable Windows authentication in the DeployR Config Editor in the Security Settings area. Toggle "Enable Windows authentication" to the right (on position) and then set a Local Windows group on the DeployR Server or Active Directory group name. By default, it will use the local administrators group on the DeployR server.

The Windows group in the Config Editor, put the exact group name, do not add a domain name prefix into the field.

Example: Configure with Active Directory Group

In active directory, another group was created called DeployR WinPE Auth which was probably a poor name looking back, but I don't feel like changing it now, but "DeployR OSD Auth" would have been more accurate. However, I also know many organizations have the oddest naming standards, so the group name might not make any sense at all, but that's neither here nor there, so moving along, the group has been created and members have been added that will then be able to authenticate to DeployR's OSD process. Currently there are 4 user accounts in the DeployR WinPE Auth group, including the user DeployR OSD with a login name of DROSD.

Add the exact name from your AD group into the field:

Now any users in that group will be able to auth:

Example: Configure with Local group & nested AD groups

This is handy in cases that additional accounts need to be created for techs and the DeployR server is not part of Active Directory or if you want to add additional accounts for OSD only that do not have rights in Active Directory.

At this point, a local group can be created along with local user accounts that can be added to that local group, or Active Directory users and/or groups can be added, so you could have a mix of local accounts and AD accounts all able to authenticate the task sequence process.

In this example, a new local group called DeployROSDAuth has been created on the local DeployR server, which has been populated with an AD group and 2 local accounts. The local group is set in the Config Editor

Now that the group is set, anything in or nested in the group DeployROSDAuth will have rights to authenticate the task sequence:

Task Sequence Variables | Reporting

When using authentication, once authenticated into the task sequence, the user is captured into a varaible which can be used in your task sequence, or just used later to look up who ran the task sequence: