Home
IBM® Domino 10.0.1 Documentation
Welcome to the IBM® Domino 10.0.1 Administrator Help.
Configuring
Use this information to configure an IBM® Domino® network, users, servers (including Web servers), directory services, security, messaging, widgets and live text, and server clusters. Also use this information to set up IBM iNotes® on a server using Domino Off-Line Services (DOLS).
Configuring directory services
This section describes how to plan, set up, and use IBM® Domino® directory services.
Setting up Domino® Active Directory synchronization
When the Domino® server is installed on a Microsoft™ Windows™ 2003 server, as an administrator, you typically need to maintain two separate directories for the same set of people and groups. Maintaining user and group information involves adding entries to both directories, deleting entries, ensuring that passwords are the same when users use Notes® Single Logon, coordinating group membership in both directories, and ensuring that user or group settings, such as email addresses and telephone numbers, are identical.
Specifying Notes® settings for Active Directory synchronization
Use the Notes Settings tab on the ADSync Options dialog box to enable or disable Notes® and Microsoft™ Windows™ registration features in the Microsoft Management Console (MMC).

IBM® Domino 10.0.1 Documentation
Welcome to the IBM® Domino 10.0.1 Administrator Help.
- What's new in IBM® Domino® 10?
  Learn about all of the new features for administrators in IBM® Domino® 10.
- Overview
  Welcome to IBM® Domino® Administrator Help.
- Installing
  Use this documentation to install the IBM® Domino® server and subsequently deploy the IBM Notes® client.
- Planning
  Use this topic as an overview of planning task.
- Configuring
  Use this information to configure an IBM® Domino® network, users, servers (including Web servers), directory services, security, messaging, widgets and live text, and server clusters. Also use this information to set up IBM iNotes® on a server using Domino Off-Line Services (DOLS).
  - Configuring a network
    This section presents the planning concepts and setup procedures necessary for a successful IBM® Domino® deployment over a network. It provides information on network protocols from a Domino perspective but does not attempt to provide general network information.
  - Configuring users and servers
    Topics in this section describe how to set up users and servers.
  - Editing the NOTES.INI file
    You should rarely, if ever, need to modify a server's or client's NOTES.INI file. The NOTES.INI file contains many settings that Domino® and Notes® rely on to work properly. An accidental or incorrect change may cause Domino or Notes to run unpredictably. Therefore, you should edit the NOTES.INI file only if special circumstances occur or if IBM® Support Services recommends that you do so.
  - Configuring directory services
    This section describes how to plan, set up, and use IBM® Domino® directory services.
    - The Domino® Directory
      The Domino® Directory, which some previous releases referred to as the Public Address Book or Name and Address Book, is a database that Domino creates automatically on every server. The Domino Directory is a directory of information about users, servers, and groups, as well as custom entries you may add. Registering users and servers in a domain automatically creates corresponding Person documents and Server documents in the Domino Directory for the domain. These documents contain detailed information about each user and server.
    - The LDAP service
      Lightweight Directory Access Protocol (LDAP) is a standard Internet protocol for searching and managing entries in a directory, where an entry has one or more attributes associated with a distinguished name. A distinguished name -- for example, cn=Phyllis Spera,ou=Sales,ou=East,o=Renovations -- is a name that identifies an entry within a directory tree.
    - LDAP schema
      A directory entry contains information about a particular entity, or object -- for example, a person or a group -- and is associated with a distinguished name. An LDAP schema is a set of rules that define what can be stored as entries in an LDAP directory. Each LDAP directory has a default schema, which organizations can customize, or "extend," by adding elements to it. The elements of a schema are attributes, syntaxes, and object classes. LDAP directory servers provide the ability to enforce the schema to ensure that directory changes made using LDAP operations conform to it.
    - ldapsearch utility
      Domino® and Notes® provide a command-line search utility, LDAPSEARCH.EXE, that you use to search entries in any LDAP directory. The ldapsearch utility connects to a directory server and returns results that match search criteria you specify. It is available on Domino server and Notes client platforms.
    - Directory assistance
      Directory assistance allows a server to look up information in a directory other than a local primary Domino® Directory (NAMES.NSF).
    - Directory catalogs
      A directory catalog is an optional directory database that typically contains information aggregated from multiple Domino® directories. Clients and servers can use a directory catalog to look up mail addresses and other information about the people, groups, mail-in databases, and resources throughout an organization, regardless of the number of Domino domains and Domino Directories the organization uses.
    - Extended ACL
      An extended access control list (ACL) is an optional directory access-control feature available for a directory created from the PUBNAMES.NTF template -- a Domino® Directory or an extended directory catalog. An extended ACL is tied to the database ACL, and you access it through the Access Control List dialog box using a Notes® or Domino Administrator client.
    - Setting up Domino® Active Directory synchronization
      When the Domino® server is installed on a Microsoft™ Windows™ 2003 server, as an administrator, you typically need to maintain two separate directories for the same set of people and groups. Maintaining user and group information involves adding entries to both directories, deleting entries, ensuring that passwords are the same when users use Notes® Single Logon, coordinating group membership in both directories, and ensuring that user or group settings, such as email addresses and telephone numbers, are identical.
      - Enabling the Notes® synchronization options
        Use the Notes Synchronization Options tab on the ADSync Options dialog box to enable or disable Notes/Microsoft Windows™ synchronization features in the Microsoft™ Management Console (MMC).
      - Specifying Notes® settings for Active Directory synchronization
        Use the Notes Settings tab on the ADSync Options dialog box to enable or disable Notes® and Microsoft™ Windows™ registration features in the Microsoft Management Console (MMC).
      - Mapping Active Directory fields and groups with Domino® Directory fields and groups
        Use the Field Mappings and Group Mappings tabs on the ADSync Options dialog box to map specific Active Directory fields and groups to Domino® Person and Group document fields. Person and Group documents are stored in the Domino Directory. Mapping is different for the User and Group Field Mapping object classes.
      - Mapping Active Directory containers to Notes® certifiers and policies
        Use the Container Mappings tab on the ADSync Options dialog box to define the mapping between Active Directory containers and Notes® certifiers and Notes policies. Container mappings are used to register new users and translate group member names into the correct Notes format during synchronization. The group members must belong to an organizational unit that is mapped to a specific Notes certifier.
      - Synchronizing users and groups
        Active Directory user and group accounts can be synchronized with the corresponding Person and Group documents in the Domino® Directory.
      - Registering new users in Active Directory and in Domino® Directory simultaneously
        You can register new users in Notes® at the same time that you register them in the Active Directory, or you can register existing Active Directory users in Notes. If any of the users or groups being registered already exist in Notes, and the Synchronize if new user/group already exists in Notes option on the Notes Synchronization Options tab is checked, a duplicate user or group is not created. Instead, synchronization is performed.
      - Renaming Active Directory and Notes® users and groups
        When you rename a user or group in the Active Directory, and there is a corresponding user in the Domino® Directory that was previously synchronized with its Active Directory counterpart, ADSync renames or recertifies that user or group accordingly. The server that is used for synchronizing the Domino Directory with the Active Directory is the synchronization server that you specify on the Notes® Synchronization Options tab.
      - Deleting Active Directory and Notes® users and groups
        When you delete a user or group from the Active Directory and there is a corresponding user or group in the Domino® Directory that was synchronized with it, ADSync removes the Person document or Group document for that Domino Directory entry using the Administration Process on the deletion server.
      - Disabling Active Directory synchronization prior to uninstalling the Domino® Administrator
        If you have set up and registered Active Directory synchronization, prior to uninstalling the Domino® Administrator, you must unregister Active Directory synchronization.
  - Configuring messaging
    This section provides an overview of messaging and describes how to set up mail routing, how to set up and customize mail servers, and how to track mail.
  - Configuring iNotes®
    IBM® iNotes® (previously IBM Domino® Web Access) provides IBM Notes® users with browser-based access to Notes mail and to Notes calendar and scheduling features. Administrators specify mail policy and security policy settings as well as notes.ini file settings to complete the full implementation of IBM iNotes.
  - Configuring Web servers
    This section describes how to set up the IBM® Domino® Web server, the Domino Web Navigator, and other Web servers such as IBM HTTP.
  - Setting up a cluster
    Setting up a cluster includes the tasks of creating and verifying that it is working correctly, and then setting up user access, mail, replications, size quotas, directory assistance, roaming, web navigation, and use of a private LAN in the cluster.
- Securing
  This section describes IBM® Domino® security features, including execution control lists, IDs, and SSL.
- Administering
  This documentation provides information about the administration tools for managing and monitoring IBM Domino® servers and databases.
- Tuning
  Use this information to improve IBM® Domino® server, Domino Web server, and messaging performance through the use of resource balancing and activity trends, Server.Load commands, advanced database properties, cluster statistics, and the Server Health Monitor.
- Troubleshooting
  This section describes how to find and solve problems with IBM® Domino® server and Administrator client.
- Glossary

Specifying Notes® settings for Active Directory synchronization

Use the Notes Settings tab on the ADSync Options dialog box to enable or disable Notes® and Microsoft™ Windows™ registration features in the Microsoft™ Management Console (MMC).

Procedure

From the MMC, choose Domino Directory Synchronization.

Click Notes Settings and complete these fields:

Table 1. Notes® Registration settings
Field	Action
Administrator's ID	Click to open the Choose Notes® Administrator ID dialog box in which you can specify another Notes® User ID as the administrator ID. The initial user ID file name is taken from current Notes® client settings.
Registration Server	Click to open the Choose Server dialog box from which you can select a Registration server. The registration server must be a Domino® 6 or later server.
Use Registration server for all operations	Click to use the server that you designated as the Registration server for all synchronization operations and for deletions. When you deselect this option, these fields are enabled: Notes® server for synchronization Notes® server for deletion
Synchronization server	Click to open the Choose Server dialog box from which you can select a Synchronization server. All synchronization operations are done on this server. This check box is enabled only if the Use Registration server for all operations check box is not selected.
Deletion server	Click to open the Choose Server dialog box from which you can select a deletion server. All deletions are performed on this server. This check box is enabled only if the Use Registration server for all operations check box is not selected.
Delete entries from Domino® Directory immediately	Click to immediately remove the selected entries from the Domino® Directory instead of using the Administration Process to perform the deletion.
Mail file deletion	To specify options for mail file deletion when the user is deleted. Choose one: Don't delete mail file -- To delete the Person document but leave the user's mail files intact. Delete just the mail file specified in the Person record -- To delete only the mail file specified in the Person document. No replicas of the mail file are deleted. Delete mail file specified in the Person document and all replicas -- Deletes all mail database replicas on other servers in addition to the mail file specified in the user's Person document.
Default certifier	Click to specify a certifier that will be used during user registration. ADSync uses this certifier if mapping was not set for a particular Active Directory container on the Container Mappings tab.
Use Certificate Authority for user certification	Click this check box to use the Domino® server-based certification authority (CA) when registering new users.
Default explicit policy	Click to specify the explicit policy (and its related settings) to be applied to users during user registration.
Registration Options	Choose one or both: Search all directories for duplicate names -- Domino® checks all directories to ensure that the user name is unique. An error is generated if the name if found to be a duplicate. Enforce short name uniqueness -- Forces all short names to be unique.
Action on duplicate mail file	Choose one: Skip the person registration -- Registration for this user is skipped; other user registrations are performed. Generate a unique mail file name -- If a duplicate mail file is found, a new unique mail file is created by appending a number beginning with 1, then 2, etc., to the non-unique mail file name until a unique name is found. Replace the existing mail file -- This option does not apply when the mail file is being created in the background via the Administration Process, or if the current ID does not have delete access to the mail file that is being replaced.
Action on duplicate roaming folder	Choose one: Skip the person registration -- Does not register the user with the duplicate roaming folder name. Proceeds to the next user registration. Generate a unique roaming directory name -- Generates a unique roaming directory name by appending a number beginning with 1, then 2, etc., to a non-unique roaming file name until a unique name is found.

Click Apply and then click OK.