To install Dynamics 365 platform it is a good practice to have a well-defined Organization Unit (OU) in the Active Directory domain. The different OU’s that can be created in AD structure include the following:
- Service Accounts : Listing the various service accounts that will be used for the various CRM platform roles, SQL Server, SSRS, Active Directory Federation Services (ADFS) etc.
- Groups: This will have all of the four groups viz., PrivReportingGroup, PrivUserGroup, ReportingGroup, SqlAccessGroup that are part of the CRM platform
- LocalAdmin: This will contain groups that will assign LocalAdmin and SysAdmin permissions to the servers.
- RestrictedGroups: This will contain groups that will assing LogonAsService, LogonAsBatch, ImpersonateClient, PerformanceLogUsers.
- Servers: Contains the list of servers where the GPO will be applied
With the above requirements, the AD OU group(s) structure in test domain idynamics.dev is as per below:
Service Account(s) for CRM platform defined as per below:
With above structure in place we will now go ahead and create Group Policy Objects required:
- Open Group Policy Management editor
- Create a DB Admin GPO purpose is to have Administrator permissions on SQL Server
Right-click on Group Policy Objects > New and enter the following
Now we will associate CRM-DEV-SQL-Administrator group to this GPO to have Administrator permission on the server DEV-CRM.
Right-click on DB Admin GPO and bring up the Edit dialogue window
Navigate to Computer Configuration > Policies> Windows Settings > Security Settings> Restricted > Add Group and add CRM-DEV-SQL-Administrator. Configure membership as per the following:
Now that the GPO is defined we will link the above to the computers listed under Server OU
In the Group Policy Management editor right-click on server and Link to an existing GPO
Now logon to the server DEV-CRM and the CRM-DEV-SQL-Administrator group should be published through GPO in the Local Administrator group
Following similar steps create additional GPO’s as per the following table: