本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 预调配 Active Directory 服务账户
<a name="provision-service-account"></a>

如果您想将 Amazon f NetApp o FSx r ONTAP SVMs 加入您的本地 Active Directory 域，则必须在亚马逊 FSx 文件系统的整个生命周期内保持有效的活动目录服务账户。Amazon FSx 必须能够全面管理文件系统并执行需要退出并重新加入 Active Directory 域的任务，例如替换出现故障的文件 SVM 或修补 NetApp ONTAP 软件。在 Amazon 中更新您的 Active Directory 配置，包括服务账户凭证 FSx。

此服务账户必须在 Active Directory 中拥有以下权限：
+ 将计算机加入域的权限
+ 在您要加入文件系统的组织单元（OU）中，拥有以下权限：
  + 重置密码
  + 限制账户读取和写入数据
  + 写入 DNS 主机名
  + 写入服务主体名称
  + 创建和删除计算机对象
  + 读取和写入账户限制

Active Directory 域管理员可以使用 **Active Directory 用户和计算机** MMC 管理单元手动创建服务账户。有关说明，请参阅 [for ONTAP 文档中的向您的亚马逊 FSx 服务账户委派权限](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-managed-AD-best-practices.html#connect_delegate_privileges)。 FSx 您也可以通过编程方式配置此账户。例如，你可以使用 [PowerShell](https://learn.microsoft.com/en-us/powershell/)，如以下示例所示。

```
param(
    [string] $DomainName,
    [string] $Username, #Service Account username
    [string] $Firstname, #Service Account Firstname
    [string] $Lastname, #Service Account Lastname
    [string] $saOU, #OU where Service Account is created
    [string] $delegateOrganizationalUnit #OU where Service Account has delegation
)

#Retrieve Active Directory domain credentials of a Domain Admin
$DomainCredential = ...

#Import Active Directory PowerShell module
...

#Create Service Account in specified OU
New-Active DirectoryUser -Credential $DomainCredential -SamAccountName $Username -UserPrincipalName "$Username@$DomainName" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Lastname, $Firstname" -Path $saOU -CannotChangePassword $True -PasswordNotRequired $True
$user = Get-Active Directoryuser -Identity $Username
$userSID = [System.Security.Principal.SecurityIdentifier] $user.SID

#Connect to Active Directory drive
Set-Location Active Directory:

$ACL = Get-Acl -Path $delegateOrganizationalUnit
$Identity = [System.Security.Principal.IdentityReference] $userSID

#GUID of Active Directory Class
$Computers = [GUID]"bf967a86-0de6-11d0-a285-00aa003049e2"
$ResetPassword = [GUID]"00299570-246d-11d0-a768-00aa006e0529"
$ValidatedDNSHostName = [GUID]"72e39547-7b18-11d1-adef-00c04fd8d5cd"
$ValidatedSPN = [GUID]"f3a64788-5306-11d1-a9c5-0000f80367c1"
$AccountRestrictions = [GUID]"4c164200-20c0-11d0-a768-00aa006e0529"

#Delegation list
$rules = @()
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "CreateChild, DeleteChild", "Allow", $Computers, "All"))
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "ExtendedRight", "Allow", $ResetPassword, "Descendents", $Computers))
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Identity, "ReadProperty, WriteProperty", "Allow", $AccountRestrictions, "Descendents", $Computers))
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($userSID, "Self", "Allow", $ValidatedDNSHostName, "Descendents", $Computers))
$rules += $(New-Object System.DirectoryServices.ActiveDirectoryAccessRule($userSID, "Self", "Allow", $ValidatedSPN, "Descendents", $Computers))

#Set delegation
foreach($rule in $rules) {
    $ACL.AddAccessRule($rule)
}
Set-Acl -Path $delegateOrganizationalUnit -AclObject $ACL
```