Topic Last Modified: 2010-07-16
This section describes the global settings and objects, and the universal service and administration groups that are created by the forest preparation step.
Active Directory Global Settings
and Objects
If you store global settings in the Configuration container (as is the case for all new Communications Server deployments), forest preparation uses the existing Services container and adds an RTC Service object under the Configuration\Services object. Under the RTC Service object, forest preparation adds a Global Settings object of type msRTCSIP-GlobalContainer. The global settings object holds all the settings that apply to the Microsoft Communications Server 2010 deployment. If you store global settings in the System container, forest preparation uses a Microsoft container under the root domain System container and an RTC Service object under the System\Microsoft object.
Forest preparation also adds a new msRTCSIP-Domain object for the root domain in which the procedure is run.
Active Directory Universal
Service and Administration Groups
Forest preparation creates universal groups based on the domain that you specify and adds access control entries (ACEs) for these groups. This step creates the universal groups in the User containers of the domain that you specify. The following groups are added:
Service groups:
- RTCHSUniversalServices - includes service accounts used to run
Front-End Server and allows servers read/write access to
Communications Server global settings and Active Directory user
objects.
- RTCComponentUniversalServices - includes service accounts used
to run conferencing servers, Web Services, Mediation Server,
Archiving Server, and Monitoring Server.
- RTCProxyUniversalServices - includes service accounts used to
run Communications Server Edge Servers.
Administration groups:
- RTCUniversalServerAdmins - allows members to manage server and
pool settings.
- RTCUniversalUserAdmins - allows members to manage user settings
and move users from one server or pool to another.
- RTCUniversalReadOnlyAdmins - allows members to read server,
pool, and user settings.
Infrastructure groups:
- RTCUniversalGlobalWriteGroup - grants write access to global
setting objects for Communications Server.
- RTCUniversalGlobalReadOnlyGroup - grants read-only access to
global setting objects for Communications Server.
- RTCUniversalUserReadOnlyGroup - grants read-only access to
Communications Server user settings.
- RTCUniversalServerReadOnlyGroup - grants read-only access to
Communications Server settings. This group does not have access to
pool level settings, only to settings specific to an individual
server.
Forest preparation then adds service and administration groups to the appropriate infrastructure groups, as follows:
- RTCUniversalServerAdmins is added to
RTCUniversalGlobalReadOnlyGroup, RTCUniversalGlobalWriteGroup,
RTCUniversalServerReadOnlyGroup, and
RTCUniversalUserReadOnlyGroup.
- RTCUniversalUserAdmins is added as a member of
RTCUniversalGlobalReadOnlyGroup, RTCUniversalServerReadOnlyGroup,
and RTCUniversalUserReadOnlyGroup.
- RTCHSUniversalServices, RTCComponentUniversalServices and
RTCUniversalReadOnlyAdmins are added as members of
RTCUniversalGlobalReadOnlyGroup, RTCUniversalServerReadOnlyGroup,
and RTCUniversalUserReadOnlyGroup.
Forest preparation also creates the following role-based access control (RBAC) groups:
- CSAdministrator
- CSArchivingAdministrator
- CSBranchOfficeTechnician
- CSHelpDesk
- CSLocationAdministrator
- CSResponseGroupAdministrator
- CSRoleAdministrator
- CSServerAdministrator
- CSUserAdministrator
- CSViewOnlyAdministrator
- CSVoiceAdministrator
For details about RBAC roles and the tasks allowed for each, see Role-Based Access Control.
Forest preparation creates both private and public ACEs. It creates private ACEs on the global settings container used by Communications Server. This container is used only by Communications Server and is located either in the Configuration container or the System container in the root domain, depending on where you store global settings. The public ACEs created by forest preparation are listed in the following table.
Public ACEs created by Forest Preparation
| RTCUniversalGlobalReadOnlyGroup | |
|---|---|
|
Read root domain System Container (not inherited)* |
X |
|
Read Configuration’s DisplaySpecifiers container (not inherited) |
X |
 Note: |
|---|
| *ACEs that are not inherited do not grant access to child objects under these containers. ACEs that are inherited grant access to child objects under these containers. |
On the Configuration container, under the Configuration naming context, forest preparation performs the following tasks:
- Adds an entry {AB255F23-2DBD-4bb6-891D-38754AC280EF} for
the RTC property page under the adminContextMenu and
adminPropertyPages attributes of the language display specifier for
users, contacts, and InetOrgPersons (for example,
CN=user-Display,CN=409,CN=DisplaySpecifiers).
- Adds an RTCPropertySet object of type
controlAccessRight under Extended-Rights that applies
to the User and Contact classes.
- Adds an RTCUserSearchPropertySet object of type
controlAccessRight under Extended-Rights that applies
to User, Contact, OU, and DomainDNS classes.
- Adds msRTCSIP-PrimaryUserAddress under the
extraColumns attribute of each language organizational unit
display specifier (for example,
CN=organizationalUnit-Display,CN=409,CN=DisplaySpecifiers) and
copies the values of the extraColumns attribute of the
default display (for example, CN=default-Display,
CN=409,CN=DisplaySpecifiers).
- Adds msRTCSIP-PrimaryUserAddress,
msRTCSIP-PrimaryHomeServer, and msRTCSIP-UserEnabled
filtering attributes under the attributeDisplayNames
attribute of each language display specifier for Users, Contacts,
and InetOrgPerson objects (for example, in English:
CN=user-Display,CN=409,CN=DisplaySpecifiers).