Blackberry PRD-10459-016 User Guide - Page 317

Administration Guide Managing how users access enterprise applications and web content Configure the Microsoft Active Directory account to delegate access to a shared folder You are required to have only one Microsoft Active Directory account in each Microsoft Active Directory domain that includes the resources that you want to turn on Integrated Windows authentication for. For more information about configuring the Microsoft Active Directory account using setspn and Microsoft Active Directory, visit www.blackberry.com/btsc to read article KB22726. 1. In Microsoft Active Directory, in the Microsoft Active Directory account properties, if the Delegation tab does not display, update the default HOST SPN registrations for the Microsoft Active Directory account. 2. In the Microsoft Active Directory account properties, on the Delegation tab, configure the following settings: • trust this user for delegation to specified services only • use any authentication protocol 3. Click Add. 4. Select the the file server that hosts the shared folder. 5. Select the CIFS service type for the file server that you specified. 6. Repeat steps 3 to 5 for each shared folder that you want to turn on Integrated Windows authentication for. After you finish: • If required, configure BlackBerry MDS Connection Service to use a Microsoft Active Directory account when the messaging server is in a remote Microsoft Active Directory domain. • Turn on Integrated Windows authentication when users access resources on your organization's network. Configuring the BlackBerry MDS Connection Service when the messaging server is located in a remote Microsoft Active Directory domain If the computer that hosts the BlackBerry MDS Connection Service is not located in the same Microsoft Active Directory domain as the global catalog server or messaging server and you want to configure support for Integrated Windows authentication, you must create a Microsoft Active Directory account that the BlackBerry MDS Connection Service can use to connect to the global catalog server. In a Microsoft Exchange environment, you must create the Microsoft Active Directory account in the Microsoft Active Directory domain that includes the messaging server. In an IBM Lotus Domino environment, if the messaging server is located in the same Microsoft Active Directory domain as the global catalog server, you must create the Microsoft Active Directory account in that domain. If the messaging server is 317