---
title: "Active Directory Service Configuration"
canonical: "https://docs.infoblox.com/space/netmri754/105942042/Active%20Directory%20Service%20Configuration"
format: markdown
---
Configuring AD services requires knowledge of the following key values:

- The Active Directory Domain.
- Whether to use **anonymous** or verified (**Authenticated**) Authentication between NetMRI and the AD server.
- An SSL certificate from the AD server if one is required.
- The IP address of the AD server.
- The port number (normally, you will retain the default).
- The names of the remote groups on the AD server containing the users intended to log in to the NetMRI appliance.

To configure an Active Directory authentication service for NetMRI, complete the following:

1. Go to the **Settings** icon > **General** **Settings** > **Authentication** **Services** page.
2. Click **New** to add a new authentication service. The **Add Authentication Service** dialog box opens.
3. Enter the **Name** and **Description**.
4. Set the **Priority** and **Timeout** of the AD service. The **Priority** value, in which higher values provide a lower priority for service execution ("3" provides a lower priority than "1") should be set to 1 if the AD service is planned to be the first of two or more authentication options.
5. Choose **Active** **Directory** as the **Service** **Type**. The Service Specific Information pane updates to show the required AD settings.
6. Enter the **AD** **Domain** value for the new AD service (example: engineering.corp100.local).
7. Click **Save**.
8. If desired, click **Disable** **service** (this completely disables the service, but does not change or delete any settings) or **Disable** **authorization. **This disables the new service from performing any group searches but allows basic authentication of user accounts from the Active Directory server, and requires the user accounts to be defined locally on the appliance.

To configure the authentication service's Active Directory servers, complete the following:

1. In the **Add Authentication Service** dialog box, click the **Servers** tab.
2. To add Active Directory servers to the service, click **New**. The **Add Authentication Server** dialog box opens
3. In the **Add Authentication Server** dialog box, do the following:
  1. Enter the **Host/IP** **Address**.
  2. Choose the **Encryption** **Type**: **None** or **SSL**. For information, see *[Using a Certificate File for an LDAP or AD Service](https://infoblox-docs.atlassian.net/wiki/spaces/netmri754/pages/105942108)*. In the **Encryption** field, if you select **SSL**, the **Authentication** **Port** field changes its value to match the SSL protocol.
  3. If using SSL, choose the certificate from the **Certificate** drop-down list. The certificate can be loaded into NetMRI from the server that issued it.  
When configuring authentication using Active Directory with SSL encryption, a fully qualified domain name (FQDN) is required for the **Server** **Name** **or** **IP** **address** field in the Add Active Directory Server dialog.
  4. Choose the **Priority** for the new server in the authentication service. In this context, the priority value determines the order in which servers in the services are queried by NetMRI.
  5. If necessary, enter the **Port** value. AD's default TCP application with SSL encryption port is 636, and 389 for non-encrypted communication.
  6. Click **Save** to save your configuration.
  7. Click **Cancel**.

To assign the AD service's remote groups with NetMRI's local roles, complete the following:

1. Click the **Remote** **Groups** tab.
  1. In the **Remote** **Group** field, enter the name of an AD server's remote group.
  2. Choose the **Role** for the new remote group. For more information, see *[Defining and Editing Roles](https://infoblox-docs.atlassian.net/wiki/spaces/netmri754/pages/105941880)*.
  3. Select the checkboxes for the device groups you want to allow for the remote group. Note that the SysAdmin role applies to all device groups. Other roles allow the selection of individual device groups.
  4. Click **OK** to complete the configuration.
  5. When finished with the remote group configuration, click **Save** and then **Close**. Note that you can add multiple Roles for the remote group.
2. To test the server settings, click **Test**. Enter a valid username and password. A successful test returns the list of groups to which the test user belongs.