Setting Up Password Synchronization Filters

The driver needs to be configured to run on only one Windows machine.

However, after you install the driver, each of the other domain controllers needs a password filter (pwfilter.dll file) installed and the registry configured to capture passwords so that passwords can be sent to Identity Manager.

The password filter is automatically started when the domain controller is started. The filter captures password changes made by users through Windows clients, encrypts them, and sends them to the driver to update the Identity Manager data store.

NOTE:  For information about configuring Password Synchronization, see "Implementing Password Synchronization" in the Novell Nsure Identity Manager 2 Administration Guide.

To simplify your setup and administration of password filters, a DirXML PassSync utility is added to the Control Panel when the driver is installed. This utility gives you two choices for setting up the password filters, depending on whether you are willing to allow remote access to the registry on your domain controllers:


Separately Configuring Password Filters on Each Domain Controller

This procedure explains how to install and configure the password filter on each domain controller, one at a time.

Use this method if you don't want to allow remote access to the registry.

In this procedure, you install the driver so that you have the DirXML PassSync utility, then you use the utility to install the pwfilter.dll file, specify the port to use, and specify which host machine is running the DirXML Driver for NT.

Setting up the filter requires rebooting the domain controller, so you might want to perform this procedure after hours, or reboot only one domain controller at a time. If there is more than one domain controller in the domain, keep in mind that each domain controller where you want Password Synchronization to function must have the filter installed and must be rebooted.

  1. Confirm that these ports are available on both the domain controller and the machine where the DirXML Driver for NT is configured to run:

  2. On the domain controller, use the Identity Manager Installation to install only the DirXML Driver for NT.

    Installing the driver installs the DirXML PassSync utility.

  3. Click Start > Settings > Control Panel, and locate the DirXML PassSync utility.


    Control panel showing the yin-yang icon for the DirXML PassSync utility

  4. Double-click DirXML PassSync.

    The first time you open the utility, it asks whether this is the machine where the DirXML driver is installed.


    Dialog box where you indicate Yes or No for whether the driver runs on this machine

  5. Click No.

    After you complete the configuration, you are not shown this prompt again unless you remove the password filter using the Remove button in the Password Filter Properties dialog box.

    After you click No, the Password Filter Properties dialog box appears, with a status message indicating that the password filter is not yet set up on this domain controller.


    Dialog box showing whether the password filter is set up, the kind of port, and which machine runs the driver

  6. Click the Setup button to install the password filter, pwfilter.dll.

  7. For the Port setting, specify whether to use dynamic port or static port.

    Use the static port option only if you have decided to configure your remote procedure call (RPC) for the domain controller differently than the default.

  8. Specify the location of the DirXML driver, click the Add button, then specify the Host Name of the machine that is running the DirXML driver in the Password Sync Filter - Add Host dialog box. Click OK.


    Dialog box for specifying the host machine that runs the driver

    This step is necessary so that the password filter knows where to send the password changes. The password filter captures password changes, and must send them to the DirXML driver to update the Identity Manager data store.

  9. In the Password Filter Properties dialog box, click OK.

  10. Reboot the domain controller to complete the installation of the password filter.

    You can choose to reboot at a time that makes sense for your environment. Just keep in mind that password synchronization won't be fully functional until every domain controller has the password filter installed and has been rebooted.

    After the installation is complete and the domain controller is rebooted, the password filter is loaded automatically whenever the domain controller starts up.

  11. Check the status for the password filter again by clicking Start > Settings > Control Panel, and double-clicking the DirXML PassSync utility. Confirm that the status says Running.

  12. Repeat Step 2 through Step 11 for each domain controller that you want to participate in Password Synchronization.

  13. When the status says Running for all the domain controllers, test Password Synchronization to confirm that it is working.


Configuring Password Filters for All Domain Controllers from One Machine

This procedure explains how to install and configure the password filter on each domain controller, all from the same machine where you are running the driver.

Use this method if you allow remote access to the registry.

Setting up the filter requires rebooting the domain controller, so you might want to perform this procedure after hours, or reboot only one domain controller at a time. If there is more than one domain controller in the domain, keep in mind that each domain controller where you want Password Synchronization to function must have the filter installed and must be rebooted.

  1. Confirm that these ports are available on the domain controllers and on the machine where the DirXML Driver for NT is configured to run:

  2. At the computer where the driver is installed, click Start > Settings > Control Panel.


    Control panel showing the yin-yang icon for the DirXML PassSync utility

  3. Double-click DirXML PassSync.

    The first time you open the utility, it asks whether this is the machine where the DirXML driver is installed.


    Dialog box where you indicate Yes or No for whether the driver runs on this machine

    After you complete the configuration, you are not shown this prompt again unless you remove this domain from the list.

  4. Click Yes.

    A list appears labeled Synchronized Domains.


    The Synchronized Domains dialog

  5. To add a domain you want to participate in password synchronization, click Add and specify the domain name.


    Add Domain dialog

  6. Log in with administrator rights.

    The DirXML PassSync utility discovers all the domain controllers for that domain, and installs pwfilter.dll on each domain controller. It also updates the registry on the computer where you are running the drivers, and on each domain controller. This might take a few minutes.

    The pwfilter.dll doesn't capture password changes until the domain controller has been rebooted. The DirXML PassSync utility lets you see a list of all the domain controllers and the status of the filter on them. It also lets you reboot the domain controller from inside the utility.

  7. Click the name of the domain in the list, then click Filters.

    The utility displays the names of all the domain controllers and the status of the filter on each of them.

    The status for each domain controller should indicate that it needs rebooting. However, it might take a few minutes for the utility to complete its automated task, and in the meantime the status might say Unknown.


    Password Filters dialog

  8. Reboot each domain controller.

    You can choose to reboot them at a time that makes sense for your environment. Just keep in mind that password synchronization won't be fully functional until every domain controller has been rebooted.

  9. When the status for the domain controllers says Running, test password synchronization to confirm that it is working.

  10. To add more domains, click OK to return to the list of domains, and repeat Step 5 through Step 9.