Advanced Group Policy Management (AGPM) Installation

chdelay

This article covers the installation of AGPM. The steps are for an older version of AGPM, but as far as I know they are accurate for current versions as the product has not changed much as far as I know. I will post a blog in the future that covers the configuration of AGPM.

DNS Configuration

The AGPM client will be configured to point to the AGPM Server.  It is best to create an alias for the AGPM Server so that if the server name ever changes or is ever replaced you would not need to re-configure the clients. 

To complete this task right-click on the appropriate DNS Zone.  Select New Alias (CNAME)… from the context menu.

When the New Resource Record dialog box opens, enter the Alias Name and the Browse… to the A record for which you want to link the CNAME record. Then click OK.

AGPM Service Account

Creating the AGPM Service Account

Next you will need to create a service account for the AGPM Service.  Locate the OU in which you would like to create the service Account.  Right-click on the OU and from the context menu, select New, and then User.

At a minimum fill out Full Name and User logon name, and then click Next.

Enter and then confirm a password, then configure the appropriate account/password options and then click Next.

Click Finish to complete the creation of the AGPM service account.

Assigning Permission to AGPM Service Account

Group Policy Creator Owners Group

The Group Policy Creator Owners group has permissions to create Group Policies in the domain.  From a security perspective, members of this group should be restricted.  By default the domain Builtin Administrator account is a member of this group.  You can leave that account in the group assuming you have locked down that account so that users do not have access to the group and that it has been secured as outlined in the Best Practices for Securing Active Directory (http://www.microsoft.com/en-us/download/details.aspx?id=38785).

The AGPM Service Account will need to be added to the Group Policy Creator Owners group in each domain that is being managed.

Backup Operators Group

The AGPM service account also needs to be added to the Backup Operators account in each domain that is being managed.

Temp Directory Permissions

The AGPM Service Account needs to be given Full Control permissions on the %Windir%\Temp directory on the “AGPM Server”.

Securing the AGPM Service Accounts

Creating Fine-grained Password Policy

Open the Active Directory Administrative Center.  Under the domain in which the AGPM Server is located, navigate and then open the System container.

Locate and then select the Password Settings Container.  In the Tasks pane click on New, then Password Settings.

Fill out the settings that are required to increase the security of the Password Policy.  Configure the Directly Applies To section to include the AGPM Service Account.  Then click OK.

Security Policy

Create a New OU for the AGPM Server(s).  To do this right-click on the appropriate OU.  Then from the context menu select New, then Organizational Unit.

Enter a Name for the new OU, and then click OK.

Open up Group Policy Management Console.  From the context menu, select Create a GPO in this domain, and Link it here…

Give a Name to the GPO, and the click OK.

Right-click on the newly created GPO and select Edit from the context menu.

Navigate to \Computer Configuration\Policies\Windows Settings\User Rights Assignment. 

Open the setting Log on as a service.

Select Define these policy settings, then add the AGPM Service Account and click OK.

Next, locate the setting Deny log on locally and open the setting.

Select Define these policy settings, then add the AGPM Service Account and click OK.

AGPM Archive Owner

The next step is to create a group that will later be used to give users the AGPM Archive Owner permission.  Navigate to the OU or Container in which you would like to create the Group.  Righ-clickon the OU or Container.  Then from the context menu select New, then Group.

Enter a Group name, change the Group scope to Universal.  Then click OK.

AGPM Server Installation

The AGPM installer installs most of the Windows Features that are required by AGPM.  However, some features require access to the installation source files to complete installation.  One such example is .Net Framework 3.5.  So, to prevent any failures in the installation of AGPM you must install this feature prior to the installation of AGPM.  To do this insert the Windows Server 2012 R2 Installation Media.  Assuming the Installation Media is mounted on the D Drive, Run the following PowerShell command:

Install-WindowsFeature –Source D:\Sources\SxS WAS-NET_Environment

Next, insert the installation media for the Microsoft Desktop Optimization Pack.  Assuming the media has been inserted into the D Drive and you are installing AGPM on an x64 platform, navigate to D:\AGPM\AGPM 4.0 SP3.  Double-click on agpm_403_server_amd64.exe.

The Setup Wizard for Microsoft Advanced Group Policy Management – Server will then open.  On the Welcome page, click Next.

If you agree with the terms of the EULA, check Accept the license terms., then click Next.

Choose the location where AGPM will be installed, then click Next.

Next you will choose where to install the AGPM Archive.  Keep in mind that the size of the Archive will grow over time, so ensure the disk where the archive is located has adequate space.  After choosing the Archive Path, click Next.

On the AGPM Service Account page of the wizard, enter the AGPM Service Account.  Then enter and confirm the AGPM Service Account Password.  When complete, click Next.

On the Archive Owner page, enter the group that you previously created for the AGPM Archive Owner.  Then click Next.

On the Port Configuration page, click Next to accept the defaults.

On the Languages page of the wizard, click Next to accept the defaults.  Otherwise de-select the languages you do not want to install and then click Next.

On the Ready to Install… page of the wizard, click Install.

After installation completes, click Finish.

AGPM Client Prerequisites

The AGPM Client requires that the Group Policy Management Console and .NET Framework 3.5 be installed on the client. 

GPMC Install

In order to install the Group Policy Management Console the Remote Server Administration Tools (RSAT) must first be installed.  The RSAT for Windows 8.1 can be downloaded from http://www.microsoft.com/en-us/download/details.aspx?id=39296

.NET Framework Install

Search for Programs and Features. Then double-click on Programs and Features in the search results.

In the Programs and Features window, click on Turn Windows features on or off.

In the Windows Features window, select .NET Framework 3.5 (includes .NET 2.0 and 3.0)

Next, click on Download files from Windows Update.

Once installation is complete, click Close

Installing AGPM Client

Next, insert the installation media for the Microsoft Desktop Optimization Pack.  Assuming the media has been inserted into the D Drive and you are installing AGPM on an x64 platform, navigate to D:\AGPM\AGPM 4.0 SP3.  Double-click on agpm_403_client_amd64.exe.

On the User Account Control dialog box, click Yes.

This will open the Setup Wizard for Microsoft Advanced Group Policy Management – Client.  On the Welcome page, click Next.

If you agree with the terms of the EULA, check Accept the license terms., then click Next.

On the Application Path page of the wizard, choose where the AGPM application will be installed.  Then click Next.

On the AGPM Server page of the wizard enter the DNS Name for the AGPM server that you previously created, then click Next.

On the Languages page of the wizard, click Next to accept the defaults.  Otherwise de-select the languages you do not want to install and then click Next.

On the Ready to Install… page of the wizard, click Install.

After installation completes, click Finish.

Stay tuned for the upcoming blog posting on the configuration of AGPM.

-Chris