Skip to content

Commit 50b6a5a

Browse files
author
Manika Dhiman
committed
Added Alpa's feedback
1 parent bf3027d commit 50b6a5a

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

azure-local/deploy/deployment-prep-active-directory.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -97,17 +97,17 @@ To create a dedicated OU, follow these steps:
9797
9898
## Considerations for large scale deployments
9999
100-
The LCM user account is used during servicing operations, such as applying updates via PowerShell. It's also used when performing domain join actions against your AD, such as [repairing a node](../manage/repair-server.md) or [adding a node](../manage/add-server.md). This requires the LCM user identity having delegated permissions to add computer accounts to the target OU in the on-premises domain.
100+
The LCM user account is used during servicing operations, such as applying updates via PowerShell. This account is also used when performing domain join actions against your AD, such as [repairing a node](../manage/repair-server.md) or [adding a node](../manage/add-server.md). This requires the LCM user identity having delegated permissions to add computer accounts to the target OU in the on-premises domain.
101101
102-
During the cloud deployment of Azure Local, the LCM user account is added to the local Administrators' group of the physical nodes. To mitigate the risk of a compromised LCM user account, **we recommend having a dedicated LCM user account with a unique password for each Azure Local instance.** This recommendation limits the scope and impact of a compromised LCM account to a single instance.
102+
During the cloud deployment of Azure Local, the LCM user account is added to the local administrators group of the physical nodes. To mitigate the risk of a compromised LCM user account, **we recommend having a dedicated LCM user account with a unique password for each Azure Local instance.** This recommendation limits the scope and impact of a compromised LCM account to a single instance.
103103
104104
We recommend that you follow these best practices for OU creation. These recommendations are automated when you use the `New-HciAdObjectsPreCreation` cmdlet to [Prepare Active Directory](#active-directory-preparation-module).
105105
106106
- For each Azure Local instance, create an individual OU within Active Directory. This approach helps manage computer account, CNO, LCM user account, and physical machine computer accounts within the scope of a single OU for each instance.
107107
- When deploying multiple instances at-scale, for easier management:
108108
- Create an OU under a single parent OU for each instance.
109109
- Enable the **Block Inheritance** option at both the parent OU and sub OU levels.
110-
- To apply a GPO to all Azure Local instances, such as for nesting a domain group in the local Administrators' group, link the GPO to the parent OU and enable the **Enforced** option. By doing this, you apply the configuration to all sub OUs, even with **Block Inheritance** enabled.
110+
- To apply a GPO to all Azure Local instances, such as for nesting a domain group in the local administrators group, link the GPO to the parent OU and enable the **Enforced** option. By doing this, you apply the configuration to all sub OUs, even with **Block Inheritance** enabled.
111111
112112
If your organization's processes and procedures require deviations from these recommendations, they are allowed. However, it's important to consider the security and manageability implications of your design taking these factors into consideration.
113113

0 commit comments

Comments
 (0)