Issue
Managing Users within StruxureWare Data Center Expert

Product Line
StruxureWare Data Center Expert (DCE)

StruxureWare Central (SWC)
InfraStruXure Central (ISXC)

Environment
StruxureWare Data Center Expert (all versions)
StruxureWare Central (all versions)
InfraStruXure Central (all versions)
Active Directory (AD) or OpenLDAP Authentication Server

Resolution

Local Users

Remote Users

Additional Information / Troubleshooting / Known Issues

Managing Local Users

Local: Creating Users

1) Within the DCE Desktop Client navigate to the System Menu and select Users and Device Group Access.

2) Click Add User...
3) Fill in the required/necessary user information.
4) If you would like the user to be part of a group, select the group within the User Group membership tab.

5) Click OK to create the user.

Local: Creating User Groups

1) Within the DCE Desktop Client navigate to the System Menu and select Users and Device Group Access.
2) Click Add User Group...
3) Fill in the required/necessary User Group information.
4) Click the User Group Members tab.
5) Select (checked box) the Users that should be part of this group.

Local: Editing a User or User Group

1) Within the DCE Desktop Client navigate to the System Menu and select Users and Device Group Access.
2) Select (left-click once) a user or user group from the list and click Edit.
3) Edit the necessary information.
4) Click OK to save the changes.

​Local: Deleting Users / User Groups

1) Within the DCE Desktop Client navigate to the System Menu and select Users and Device Group Access.
2) Select (left-click once) the User or User Group.
3) Click Delete.
4) Confirm the username and click Yes to delete the user.

Local: Editing User or User Group Access Permissions

1) Within the DCE Desktop Client navigate to the System Menu and select Users and Device Group Access.
2) Click Device Group Access.
3) Select (left-click once) the user or user group within the left pane.
​4) Select (left-click once) a device group in the right pane.
5) Click Modify Device Group Access.
6) Select the desired radial buttons for Monitoring Access and Surveillance Access.
7) Click OK to save the changes.

Managing Remote Users

Remote: Adding an Authentication Server and Users/Groups​

1) Define a user within your AD/OpenLDAP server that will be used to make the connection.

2) Within the DCE Desktop Client navigate to the System Menu and select Users and Device Group Access.
3) Click the Authentication Servers tab.
4) Click Add Authentication Server...

5) Enter the Bind User DN, which is the full path to bind user within the authentication server structure.

7) Enter the Search Base where the users and groups are located within the AD/LDAP authentication server.

8) Click Next.
9) Check the boxes next to the users and user groups. Select Finish.

10) Click Finish to add the Authentication Server.

---

Remote: Adding/Deleting Users and User Groups within an already added Authentication Server

1) Within the DCE Desktop Client navigate to the System Menu and select Users and Device Group Access.
2) Click the Authentication Servers tab.
3) Select (left-click once) the Authentication Server.
4) Click Edit Authentication Server.
5) Click Next twice.
6) Select (checked box) or Deselect (unchecked box) the users and user groups.
7) Click Finish to finish the user additions/removals.

---

Remote: Editing User or User Group Access Permissions

1) Within the DCE Desktop Client navigate to the System Menu and select Users and Device Group Access.
2) Click Device Group Access.
3) Select (left-click once) the remote user or remote user group within the left pane.
​4) Select (left-click once) a device group in the right pane.
5) Click Modify Device Group Access.
6) Select the desired radial buttons for Monitoring Access and Surveillance Access.
7) Click OK to save the changes.

---

Remote: Deleting an Authentication Server

1) Within the DCE Desktop Client navigate to the System Menu and select Users and Device Group Access.
2) Click Authentication Servers tab.
3) Select (left-click once) the Authentication Server.
4) Click Delete.
5) Confirm the Authentication Server and click Yes to delete the Authentication Server.

---

Remote: Determining Bind User DN

1) Open Windows Powershell and run the following command, ensuring to replace "binduser" with the username of the user you want to use to connect to the Active Directory server.

Get-ADUser -Identity binduser | select DistinguishedName

If you receive an error you likely need to download and install RSAT (Remote Server Administration Tools) from Microsoft
Example Result:

DistinguishedName
-----------------
CN=username,OU=Admins,OU=NAM,OU=Countries,DC=example,DC=com

3) Example Bind User DN from step 2 to enter into Bind User DN field:

---

Remote: Determining Search Base

1) Open Windows Powershell and run the following command, ensuring to replace "OU_Name" with the Organization Unit Name of the user you want to use to connect to the Active Directory server.

Get-ADOrganizationalUnit -Filter 'Name -like "OU_Name"' | select DistinguishedName

If you receive an error you likely need to download and install RSAT (Remote Server Administration Tools) from Microsoft: https://www.microsoft.com/en-us/download/details.aspx?id=45520
Example Result:

DistinguishedName
-----------------
OU=Admins,OU=NAM,OU=Countries,DC=example,DC=com

3) Once a result is obtained, the Bind User DN should be the full result.

---

​Additional Information

Please ensure to reference Data Center Expert | Tips for configuring Active Directory integration for further troubleshooting and guidance. Note for port 636 connections: DCE does not support wildcard certificates. The hostname of the server has to be the common name on the certificate if they do not match in any capacity it will fail.

AD/LDAP Remote Users cannot be added to Local Groups

AD/LDAP Search Base may be Too Large

Active Directory Users must login using Pre-Windows 2000 Usernames

Users can no longer log into DCE after changing Active Directory or OpenLDAP structure.

Released for: Schneider Electric Vietnam