Create an Active Directory policy

Console

Use the following instructions to create an Active Directory policy in the Google Cloud console:

1. Go to the NetApp Volumes page in the Google Cloud console.

   Go to NetApp Volumes

2. Select Active Directory policies.

3. Click Create.

4. In the Create Active Directory Policy dialog, fill out the fields shown in the following table.

   Required fields are marked with an asterisk (*).

   Field	Description	Applies to NFS	Applies to SMB	Applies to dual protocol
   Active Directory policy name*	The unique identifier name for the policy	check	check	check
   Description	Optional: you can enter a description for the policy	check	check	check
   Region
   Region*	Associates the Active Directory to all volumes in the specified region.	check	check	check
   Active Directory connection details
   Domain name*	Fully qualified domain name for the Active Directory domain.	check	check	check
   DNS Servers*	Comma-separated list of a maximum of three DNS server IP addresses used for DNS-based domain controller discovery.	check	check	check
   Site	Specifies an Active Directory site to manage domain controller selection. Use when Active Directory domain controllers in multiple regions are configured. Defaults to Default-First-Site-Name if left empty.	check	check	check
   Organizational Unit	Name of the Organizational Unit where you intend to create the computer account for NetApp Volumes. Defaults to CN=Computers if left empty.	check	check	check
   NetBIOS Name Prefix*	NetBIOS name prefix of the server to be created. A five-character random ID is generated automatically, for example, -6f9a, and appended to the prefix. The full UNC share path has the following format: \\<NetBIOS_PREFIX>-<4-random-hexletters>.<DOMAIN_NAME>\<SHARE_NAME>.	check	check	check
   Enable AES Encryption for Active Directory authentication	Enables AES-128 and AES-256 encryption for Kerberos-based communication with Active Directory	check	check	check
   Active Directory credentials
   Username* and Password*	Credentials for the Active Directory account with permissions to create the compute account within the specified organizational unit.	check	check	check
   SMB settings
   Administrators	Domain user accounts to be added to the local Administrators group of the SMB service. Provide a comma-separated list of domain users or groups. The Domain Admin group is automatically added when the service joins your domain as a hidden group. Administrators only use the Security Account Manager (SAM) Account name. The SAM Account name supports a maximum of 20 characters for your username and 64 characters for your group name. Note: This option is available only in the REST API or Google Cloud CLI.		check	check
   Backup Operators	Domain user accounts to be added to the Backup Operators group of the SMB service. The Backup Operators group allows members to backup and restore files regardless of whether they have read or write access to the files. Provide a comma-separated list of domain users or groups. Backup Operators only use the Security Account Manager (SAM) Account name. The SAM Account name supports a maximum of 20 characters for your username and 64 characters for your group name.		check	check
   Security Privilege Users	Domain accounts that require elevated privileges such as SeSecurityPrivilege to manage security logs. Provide a list separated by commas of domain users or groups. This is specifically needed for the installation of a SQL Server where binaries and system databases are stored on an SMB share. This option isn't required if you use an administrator user during installation.		check	check
   NFS settings
   Kerberos Key Distribution Hostname	Hostname of the Active Directory server used as Kerberos Key Distribution Center	NFSv4.1 with Kerberos		SMB and NFSv4.1 with Kerberos
   KDC IP	IP address of the Active Directory server used as Kerberos Key Distribution Center	NFSv4.1 with Kerberos		SMB and NFSv4.1 with Kerberos
   Allow local NFS users with LDAP	Local UNIX users on clients without valid user information in Active Directory are blocked from access to LDAP enabled volumes. This option can be used to temporarily switch such volumes to AUTH_SYS authentication (user ID + 1-16 groups).	check		check
   Labels
   Labels	Optional: add relevant labels	check	check	check

5. Click Create.

gcloud

Create an Active Directory policy:

  gcloud netapp active-directories create CONFIG_NAME \
    --project=PROJECT_ID \
    --location=LOCATION \
    --dns=DNS_LIST \
    --domain=DOMAIN_NAME \
    --net-bios-prefix=NetBIOS_PREFIX \
    --username=USERNAME \
    --password=PASSWORD \
  

Replace the following information:

• CONFIG_NAME: the name of the config you want to create. The config name must be unique per region.

• PROJECT_ID: project ID you are creating the Active Directory policy in.

• LOCATION: the region of you want to create the config in. Google Cloud NetApp Volumes only supports one config per region.

• DNS_LIST: a list separated by commas of up to three IPv4 addresses of Active Directory DNS servers.

• DOMAIN_NAME: the fully qualified domain name of the Active Directory.

• NetBIOS_PREFIX: NetBIOS name prefix of the server you want to create. A five-character random ID generates automatically, such as -6f9a, and appends to the prefix.

  The full UNC share path has the following format:

  \\<NetBIOS_PREFIX>-<4-random-hexletters>.<DOMAIN_NAME>\<SHARE_NAME>.

• USERNAME: The name of a domain user with permission to join the domain.

• PASSWORD: Password for the username.

For more information on additional optional flags, see Google Cloud SDK documentation on Active Directory creation.