---
title: "Configuring Members to Manage Microsoft Servers"
canonical: "https://docs.infoblox.com/space/nios85/35914586/Configuring%20Members%20to%20Manage%20Microsoft%20Servers"
format: markdown
---
You can manage Microsoft DNS and DHCP servers on any Grid member. To avoid performance issues, Infoblox strongly recommends that you do not configure Microsoft DNS and DHCP servers on the Grid Master and Grid Master candidate.  
When an HA pair manages Microsoft servers, the active node handles synchronization. If an HA failover occurs during a synchronization, the failing node immediately aborts the synchronization. The new active node resumes the next synchronization. Changes that occurred on the Grid since the end of the last synchronization are lost.  
For Microsoft DHCP failover, NIOS supports both the hot standby and load sharing modes in both Read/Write and Read-only modes on DHCP servers running Microsoft Windows 2012 and 2012 R2. For more information about Microsoft DHCP failover, refer to the Microsoft documentation.  
Complete the following tasks to configure a Grid member to manage a Microsoft server:

1. On the Microsoft server, create a user account for the Grid member. For information, see <span style="color: #0000ff">[*Setting Microsoft Server Credentials*](#ConfiguringMemberstoManageMicrosoftServers-SettingMicrosoftServerCredentials)</span>.
2. On the Grid Master, configure the managing member, as described in <span style="color: #0000ff">[*Configuring a Managing Member*](#ConfiguringMemberstoManageMicrosoftServers-ConfiguringaManagingMember)</span>.

# > Macro (anchor)

> Macro (anchor)

Setting Microsoft Server Credentials

To enable a Grid member to synchronize data with a Microsoft server and control DNS and DHCP services, you must do the following on the Microsoft server:

1. Create a user account for the Grid member.
2. Grant the user account the necessary permissions.

You can either add the user account to the Administrators Group or add the user account to specific groups and explicitly set only the permissions necessary to access the DHCP and DNS services of the Microsoft server. The following sections provide general instruction on each method.

## Adding User Account to the Administrators Group

Adding the user account of the Grid member to the Administrators Group provides total control over the Active Directory Domain. Do one of the following:

- If the managed Microsoft server is a standalone server or a member server in a domain, open **Computer** **Management**, click **Groups**, and add the user account to the Administrators Group.
- If the managed Microsoft server is a domain controller, open **Active** **Directory** **Users** **and** **Computers**, select the domain name, click **Builtin**, and add the user account to the Administrators Group.

## Setting Specific Group Memberships and Permissions

If your security policy precludes adding user accounts to the Administrators group, you can add the user account to individual groups and grant only the required permissions. For guidelines and more information, see the following:

<span style="color: #0000ff">[*http://support.microsoft.com/kb/325349*](http://support.microsoft.com/kb/325349)</span>

<span style="color: #0000ff">[*http://support.microsoft.com/kb/914392*](http://support.microsoft.com/kb/914392)</span>

To add the user account of the Grid member to individual groups and grant specific permissions:

- To enable the member to synchronize DNS data with the Microsoft server, add its user account to the DnsAdmins Group.
- To enable the member to synchronize DHCP data with the Microsoft server, add its user account to the Dhcp Administrators Group.
- To enable the Grid member to monitor, start, and stop the DNS and DHCP services, grant the user account permissions on the Service Control Manager (SCM), as follows:
  - Grant permissions to the SCM on each managed Microsoft server. For more information, refer to the section* DNS* *Server* *Service* *Permissions* at <span style="color: #0000ff">[*http://technet.microsoft.com/en-us/library/gg638675.aspx*](http://technet.microsoft.com/en-us/library/gg638675.aspx)</span>.  
To find additional information, you can also search for "Least Privilege Setup" on the Microsoft sites.
  - Grant permissions to the DNS and/or DHCP service on each managed server by doing one of the following:
    - Use the `sc` command line utility to remotely configure each managed DNS or DHCP server.  
Note that you need to know the SID of the user account and its current permissions. You can retrieve the SID of the user account by using the `dsquery` and `dsget` commands.
    - Use the Domain Controller Policy editor to define a global policy that applies to all DNS or DHCP services running in a domain or on domain controllers. For additional information, refer to <span style="color: #0000ff">[*http://support.microsoft.com/kb/324802.*](http://support.microsoft.com/kb/324802)</span>

# > Macro (anchor)

> Macro (anchor)

Configuring a Managing Member

When you configure a member to manage Microsoft servers, you must specify the following:

- The management mode of the Microsoft server. For information, see <span style="color: #0000ff">[*Setting the Management Mode*](#ConfiguringMemberstoManageMicrosoftServers-SettingtheManagementMode)</span>.
- A network view, if there is more than one in the Grid, and a DNS view, if there is more than one in the network view. For information, see <span style="color: #0000ff">[*Synchronizing to a Network View and DNS View*](#ConfiguringMemberstoManageMicrosoftServers-SynchronizingtoaNetworkViewandDNSView)</span>.

For the steps on configuring the managing member, see <span style="color: #0000ff">[*Assigning Grid Members to Microsoft Servers*](#ConfiguringMemberstoManageMicrosoftServers-AssigningGridMemberstoMicrosoftServers)</span>.

## > Macro (anchor)

Setting the Management Mode

A Grid member can manage a Microsoft server in Read-only mode, which is the default, or in read-write mode. In Read-only mode, the Grid member copies the DNS and DHCP data from the Microsoft server to the Grid so Grid Manager admins can view the synchronized data. They cannot update the data, control the DNS and DHCP service of the Microsoft server, or configure any properties.

When you select Read-only mode for Active Directory sites, you can view the sites and networks that are present on the Microsoft server through Grid Manager. Note that you cannot manage the Active Directory sites and networks directly from the Grid, but you can manage an object within the Grid that is associated with a Read-only Active Directory Site or an Active Directory network. The synchronization process is Read-only and you cannot write into the Microsoft server in this mode. For more information, see <span style="color: #0000ff">[*Assigning Grid Members to Microsoft Servers*](#ConfiguringMemberstoManageMicrosoftServers-AssigningGridMemberstoMicrosoftServers)</span>.

In Read/Write mode, Grid Manager admins are allowed to update the data of the Microsoft server. Therefore during each synchronization, the Grid member applies changes from the Grid to the Microsoft server and vice versa. Read/Write mode also allows admins to control DNS and DHCP services of the Microsoft server and configure some of their properties.

When you select Read/Write mode for Active Directory Sites, you can view and manage the sites and networks that are present on the Microsoft server through Grid Manager. When you update an object that is associated with the Active Directory Site or an Active Directory network, the changes reflect on the Microsoft server. For more information, see <span style="color: #0000ff">[*Assigning Grid Members to Microsoft Servers*](#ConfiguringMemberstoManageMicrosoftServers-AssigningGridMemberstoMicrosoftServers)</span>.

Note that the management mode of a Microsoft server is separate from the admin permissions that the appliance requires to access the Microsoft servers and DNS and DHCP resources. An admin must still have the applicable permissions to the Microsoft servers and DNS and DHCP resources they want to access. For information on admin permissions, see <span style="color: #0000ff">[*Administrative Permissions for Microsoft Servers*](#ConfiguringMemberstoManageMicrosoftServers-AdministrativePermissionsforMicrosoftServers)</span>.

## > Macro (anchor)

Synchronizing to a Network View and DNS View

A Microsoft server can synchronize its data only to a single network view and a DNS view. Grid Manager automatically assigns Microsoft servers to the default view when a Grid contains only the default network view and DNS view. If a Grid has more than one network view, you must select a network view for the Microsoft server to synchronize its data; and if there are multiple DNS views, you must select a DNS view as well.

You cannot modify the assigned network view or DNS view of a Microsoft server after its data has been synchronized. Instead, you must remove the Microsoft server and then add it again. For information about removing a server, see <span style="color: #0000ff">[*Removing a Managed Microsoft Server*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35817156/Managing+Microsoft+Servers#ManagingMicrosoftServers-RemovingaManagedMicrosoftServer)</span>.

Microsoft servers do not support network views and DNS views. Therefore, network view and DNS view properties have no effect on the DNS and DHCP data that are synchronized from Microsoft servers.

## > Macro (anchor)

> Macro (anchor)

Assigning Grid Members to Microsoft Servers

To configure a Grid member to manage one or more Microsoft servers:

1. **Grid**: From the **Grid** tab -> **Microsoft** **Servers** tab -> **Servers** tab, click the Add icon.  
**Standalone** **appliance**: From the **System** tab -> **Microsoft** **Servers** tab -> **Servers** tab, click the Add icon.
2. In the *Add* *Microsoft* *Server(s)* wizard, complete the following:
  - **Which** **features** **do** **you** **want** **to** **configure?**: This section appears only when you have selected the **Enable** **MS** **AD** **feature** checkbox for mapping network users. For more information, see <span style="color: #0000ff">[*Enabling Identity Mapping*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35785278/Viewing+Identity+Mapping+Information#ViewingIdentityMappingInformation-EnablingIdentityMapping)</span>[.](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35785278/Viewing+Identity+Mapping+Information#ViewingIdentityMappingInformation-bookmark1304) You can select multiple options in this section:
    - **Network** **Users**: Select this checkbox to enable the Grid member to synchronize user information with the managed Microsoft servers.
    - **DNS** **and** **DHCP** **Services**: Select this checkbox to enable the Grid member to synchronize DNS and DHCP services with the Microsoft servers.
    - **Active** **Directory** **Sites**: Select this checkbox to enable the Grid member to synchronize Active Directory sites.
  - In the **General** **Settings** section, complete the following:
    - **Managing** **Member:** Click **Select** **Member** and select the Grid member that manages Microsoft servers.  
Select **None** if you do not want to associate a Microsoft server with a Grid member.
    - **Credentials** **to** **Connect** **to** **the** **Microsoft** **Server(s):** Enter the login name and password that the appliance uses to connect to the Microsoft servers. These must be the same as those you specified when you created the user account for the Grid member on the Microsoft servers. Note that you must specify the domain name and the user name in the following format: *domain_name**\user_name.*
    - **Manage** **Server(s)** **in:** Select the management mode, which is either **Read-only** or **Read/Write**. You can choose to manage the DNS and DHCP synchronization services in either **Read-only** or **Read/Write** mode. For more information, see <span style="color: #0000ff">[*Setting the Management Mode*](#ConfiguringMemberstoManageMicrosoftServers-SettingtheManagementMode)</span>.
    - **Minimum** **Synchronization** **Interval** **(min)**: The default synchronization interval is two minutes. This is the time between the completion of one synchronization and the start of a new one. Synchronizing large data sets could take longer than the synchronization interval, causing a delay in the start of the next synchronization. For example, if the synchronization interval is two minutes but a synchronization takes five minutes, the time between the start of the first synchronization and the start of the next one is approximately seven minutes.

> ⚠️ **Note**
> ⚠️ 
> ⚠️ The synchronization of Microsoft DHCP servers running Microsoft Windows 2012 or later includes the synchronization of DHCP failover relationships. Note that the DNS and DHCP failover synchronization rules do not have an impact on the Microsoft servers running a Windows version that is earlier than 2012.


> Macro (legacy-content)

3. Click **Next**.

> ⚠️ **Note**
> ⚠️ 
> ⚠️ Depending on your configuration in the **Which** **features** **do** **you** **want** **to** **configure?** section, the *Add* *Microsoft* *Server(s)* wizard displays the Microsoft server setting options.


4. Complete the following:

> Macro (legacy-content)

> Macro (legacy-content)

5. Click **Next** and do the following in the Managed Servers table:

> Macro (legacy-content)

> ⚠️ **Note**
> ⚠️ 
> ⚠️ You cannot start or stop a DNS or DHCP service on a specific Microsoft server if you disable the monitor and control setting for the respective service. You can control and monitor DNS and DHCP services at the Grid level and override the settings at the Microsoft server level. Each monitor and control setting applies only to the DNS or DHCP service and the respective Microsoft server.


> Macro (legacy-content)

You can assign multiple Microsoft servers to a Grid member and test their connection to the Grid member. Click the Add icon to add another Microsoft server.

6. Select a Microsoft server and click the Test Microsoft Server icon, or click the Action icon > Macro (inline-media-image)

 next to the respective Microsoft server and select **Test** **Microsoft** **Server** from the menu to verify whether the appliance can successfully connect to the Microsoft server. The appliance displays the test results in the *Test* *Microsoft* *Server* *Results* dialog box.

7. Save the configuration and click **Restart** if it appears at the top of the screen.

or

Click **Next:** Continue to the next step and define extensible attributes for the Microsoft servers. For information, see <span style="color: #0000ff">[*Managing Extensible Attributes*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35448912)</span>.

After you configure a Grid member to manage a Microsoft server, the member automatically connects to the Microsoft server and starts synchronizing data. You can then do the following:

- View the status of the servers in the *Microsoft* *Servers* panel, as described in <span style="color: #0000ff">[*Monitoring Managed Microsoft Servers*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35481995)</span>. Newly added servers first display a status of **Connecting** as the Grid member contacts the Microsoft servers. The status changes to **OK** after the Grid member successfully connects to the Microsoft server.
- View the data synchronized from the Microsoft servers. To view DNS data, navigate to the DNS view you specified. For information, see <span style="color: #0000ff">[*Viewing Zones*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35849329)</span>. To view DHCP data, navigate to the **Networks** tab of the network view that you specified. For information, see <span style="color: #0000ff">[*Managing IPv4 DHCP Data*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35783474)</span>.

Network conditions and the amount of data can affect the synchronization time. Therefore, you might not be able to view all of the synchronized data immediately.

- Use Smart Folders to organize the Microsoft servers and their data. For example, you can create a folder for DNS zones and another folder for DHCP scopes synchronized from a Microsoft server. For information about Smart Folders, see <span style="color: #0000ff">[*Smart Folders*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35749949)</span>.
- Update the synchronized data. For information, see<span style="color: #003366"> </span><span style="color: #003366">[Managing Microsoft DNS ](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35417252)</span><span style="color: #003366">[Services](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35417252)</span>*<span style="color: #0000ff">,</span>* and <span style="color: #0000ff">[*Managing Microsoft DHCP Services*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35783400)</span>.

You can also use Global Search to search for synchronized data, such as zones and IP addresses. For information, see<span style="color: #0000ff">* *</span><span style="color: #0000ff">[*Using Global Search*](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35417138/Finding+and+Restoring+Data#FindingandRestoringData-UsingGlobalSearch)</span>.