Guidelines for Implementing Active Directory Permissions on Multi Server BizTalk Installations

This topic describes guidelines for creating Active Directory Organizational Units, which consist of the user accounts and groups that you use in a Microsoft BizTalk Server installation.

The accounts created herein do not need permissions in the domain beyond those of ordinary users. The domain accounts may need elevated privileges within the trust boundary that includes:

• BizTalk Server

• Microsoft SharePoint Services (on the BizTalk Server server)

• Microsoft SQL Server

• External Database One

• External Database Two

• External Database N

  For example, a domain account may need to be granted rights to perform certain actions on the systems hosting external databases. In another case, an account may need to write a file to a file drop folder, requiring write access to the folder.

  Use the Active Directory Users and Computers console to create and manage domain user and group accounts. Click Start, point to All Programs, point to Administrative Tools, and then click Active Directory Users and Computers to start the Active Directory Users and Computers console.

BizTalk Server Installation and Configuration Account

In the development environment, the BizTalk Server installation program and the BizTalk Server Configuration Wizard require the use of an account with administrative rights on the BizTalk Server and SQL Server systems. Rights can be revoked or the account disabled as soon as setup and configuration are complete. The account must also belong to several BizTalk groups, covered in the following sections.

BizTalk Server Development Accounts

Individuals doing BizTalk Server development require access to adapters, receive and send handlers, and receive locations. This access requires the domain developer group to be members of the BizTalk Server Administrators and SSO Affiliate Administrators groups.

BizTalk Server Deployment Accounts

Individuals deploying BizTalk Server applications will need to be administrators on the local systems and may require other permissions in the environment. A BizTalk Server deployment account is referenced in this topic for this purpose.

This access requires the domain deployment group to be members of the BizTalk Server Administrators and SSO Affiliate Administrators groups.

BizTalk Server Support Accounts

Individuals supporting BizTalk Server applications will need to be administrators on the local systems. A BizTalk support account is referenced in this topic for this purpose.

This access requires the domain support group to be members of the BizTalk Server Administrators group.

SQL Server Service Accounts

The service running the SQL Server instance must belong to the same Active Directory domain as the accounts installing, developing, and deploying BizTalk Server components.

• Use SQLAdmin for administrative functions (interactive logon).

• Use SQLService to manage the service (no interactive logon).

• Use SQLAccess to access external databases.

• SQLAdmin must be a member of the local Administrators group on the SQL Server system.

• SQLService must be a member of the local Administrators group on the SQL Server system and needs to be granted the Log on as a service user right.

• SQLAccess needs appropriate rights on the remote database servers.

  SQL Accounts:

Set account passwords according to company standards.

Windows SharePoint Services Account

The Windows SharePoint Services accounts must be created prior to installing SharePoint Services.

Recommendations and notes on the SharePoint Services account:

• Use the SharePoint Admin Account (SPAdmin) for administrative functions, SharePoint Timer Service and all SharePoint Services access.

• SPAdmin is the site owner and will need an e-mail alias.

• SPAdmin must be a member of the local administrators group on the local BizTalk Server computer (Windows SharePoint Services setup does this).

• SPAdmin must have the security administrator and database creator roles on the SQL Server computer (Windows SharePoint Services setup does this).

  Sharepoint Accounts:

Set account passwords according to company standards and be able to retrieve these passwords during the configuration steps. Refer to the Passwords section of this topic for issues surrounding generated passwords.

BizTalk Groups and Users

BizTalk Server Groups and Users must be created prior to running the BizTalk Server Configuration Wizard. In a single-system installation, BizTalk Server uses local groups and accounts which are created during configuration. However, if separate BizTalk Server hosts are deployed or if BizTalk Server and SQL Server are installed on two different computers you must use domain user and group accounts.

Recommendations and notes on BizTalk Server service and user accounts:

• Create an Organizational Unit (OU) for BizTalk Server. All accounts and groups will belong to this OU.

• Be descriptive with full names; the names in the following lists should enable the installer to select the proper groups/accounts/users during configuration.

• First name and last name are optional; included for consistency only.

• The differentiator BTService and BTUser refers to service accounts (automatons) and generic/shared human users.

• Create domain accounts and populate them via an ADSI script for user and group account creation for up line environments.

  BizTalk Service Accounts

Set user names according to company and environmental standards (for example, devBTService, alphaBTService). Set account passwords according to company standards and be able to retrieve them for the configuration steps. Refer to the Password Considerations for Development section of this topic for issues surrounding generated passwords.

The installer will notice the service accounts are quite granular, with a near one-to-one mapping to the services created by BizTalk Server. The granularity allows corporate IT security to track or restrict access as needed. The granularity is recommended, but it is up to the system designer and enterprise security personnel to determine if it is necessary in the enterprise environment.

The service accounts in the previous group are intended for automaton access only, not for interactive logon by users.

To set the appropriate account options

1. In the Active Directory Users and Computers console, click to expand the domain, and then click to expand the Users container.

2. Right-click the account and then select Properties to display the Properties dialog box for the account.

3. Click the Account tab of the Properties dialog box.

4. Click to check the following options:

   • User cannot change password (enterprise security will batch change the passwords).

   • Password never expires

5. Click the Log On To button to display the Logon Workstations dialog box.

6. Click the option for The following computers, add each computer running BizTalk Server and SQL Server, and then click OK.

7. Click the Remote Control tab of the Properties dialog box, and then click to clear the option to Enable remote control.

8. Click the Terminal Services Profile tab of the Properties dialog box.

9. Click to check the option to Deny this user permissions to log on to any Terminal Server.

10. Click OK to close the Properties dialog box for the account.

11. Repeat steps 3 through 10 for each service account.

    BizTalk User Accounts

To set the appropriate account options follow these steps

1. In the Active Directory Users and Computers console click to expand the domain, and then click to expand the Users container.

2. Right-click the account and then select Properties to display the Properties dialog box for the account.

3. Click the Account tab of the Properties dialog box.

4. Click to check the following options:

   • User cannot change password (enterprise security will batch change the passwords).

   • Password never expires

5. Click the Log On To button to display the Logon Workstations dialog box.

6. Click the option for The following computers, add each computer running BizTalk Server and SQL Server, and then click OK.

7. Click the Remote Control tab of the Properties dialog box, and then click to check the option to Enable remote control.

8. Click the Terminal Services Profile tab of the Properties dialog box.

9. Click to clear the option to Deny this user permissions to log on to any Terminal Server.

10. Click OK to close the Properties dialog box for the account.

11. Repeat steps 3 through 10 for each user account.

    Note

    Any of these accounts can be disabled if the roles they are to provide are assigned to actual users. In the early stages of release one and release two, it is assumed that these accounts are used in the development, alpha test, and beta test environments.

    BizTalk Group Accounts

Recommendations and notes on domain groups:

• Create the groups and add members prior to installing BizTalk Server.

• Domain groups can be Global or Universal groups.

• Use <DomainName>\<UserName> when specifying domain account information in the Configuration Wizard.

• Groups and user/service accounts must belong to the domain in which the BizTalk Server computer belongs (the Configuration Wizard checks this and will not display accounts or groups containing accounts from other domains).

• BizTalk Server requires domain accounts for all clustering scenarios.

• When installing BizTalk Server, the console user needs to be a member of the following groups:

  • BizTalk Server Administrators

  • SSO Administrators (only when configuring the master secret server)

  • Windows administrator

  • SQL Server administrator

  • OLAP administrator

    The BTUserInstall account should be used for installation and configuration and should be disabled after configuration is complete.

• To allow message event and service instance tracking to attach orchestrations to the debugger, the developer needs to belong to the BizTalk Server Administrators group, as outlined above in the section BizTalk Development Accounts.

Local Administrator Accounts

Confirm or add the following accounts and groups to the Local Administrators group on the SQL Server computer:

• Domain\BTUserInstall (disable when configuration is complete)

• Domain\BTUserDeploy (disable in production when deployment is complete)

• Domain\SPAdmin

• Domain\SQLAdmin

• Domain\SQLService

• Domain\BizTalk Development Users (omit in up line environments)

• Domain\BizTalk Deployment Users (omit in development environments)

  Confirm or add the following accounts and groups to the Local Administrators group on the BizTalk Server computer:

• Domain\BTUserInstall (disable when configuration is complete)

• Domain\BTUserDeploy (disable in production when deployment is complete)

• Domain\BTUserSupport

• Domain\SPAdmin

• Domain\BizTalk Development Users (omit in upline environments)

• Domain\BizTalk Deployment Users (omit in development environments)

SQL Server Administrator Accounts

Setup programs accept input from the installer and assigns SQL roles to users and groups:

• During SharePoint Services setup, the SPAdmin account is granted Security Administrator and Database Creator rights on the SQL Server computer. These rights can be removed if the SPAdmin account is a member of the Local Administrators group.

E-Mail Account

SharePoint Services will send mail based on certain system events. Setup prompts for an e-mail address during the configuration process. Create e-mail aliases for this purpose and monitor the alias during setup and unit testing. In the production environment, this account should be accessible by a system administrator who is monitoring the system.

The e-mail account used by SharePoint Services is the WSS Administrator E-mail account.

Password Considerations for Development

For development and test environments, account passwords can be set by a standard and be distributable. Installer standards vary; this topic uses the template of initial capital letters abbreviating the service component followed by a lower-case abbreviation for the rest of the account (service or user). For service accounts, this topic uses 'Serv', for user accounts this topic uses 'User'.

For example:

• Windows SharePoint Services (SharePoint) Service and admin account (SPAdmin) passwords: 'SPServ'.

• BizTalk Service account passwords: 'BTServ'.

• BizTalk User account passwords: 'BTUser'.

  Some IT environments require passwords to contain non-alpha and/or numeric characters. In this scenario you could substitute a dollar sign ($) for "s", and an 'at' sign (@) for "a". The symbols are samples; develop a pattern that works best for you for shared accounts with semi-public passwords.

  Sample redistributable passwords in use in the development environment are:

• BT$erv99 BizTalk Service Accounts

• BTU$er99 BizTalk User Accounts

• SP$erv99 WSS Service Account (SPAdmin)

• SQL$erv99 SQL Service/Access/Admin Account

For more information about deployment of secure passwords in up-line environments (including the method to test a BizTalk Server configuration file), see Configure BizTalk Server.

See Also

Troubleshooting BizTalk Server Permissions