Determine the Number of AGPM Servers Required In the single-server scenario, only one AGPM Server is deployed, which means the one AGPM Server manages the GPOs for all the domains in a single forest. In the multiple-server scenario, you deploy two or more computers running AGPM Server in your environment. You can deploy AGPM Server on a member server or a domain controller. Installing AGPM Server installs the AGPM Service on the computer. For information on the AGPM Server installation requirements, see “AGPM Server Installation Requirements,” later in this guide. In the multiple-server scenario, deploy a separate AGPM Server for: Each forest in your AD DS infrastructure. Each site that is isolated by network connectivity issues. Each site that your organization’s structure requires to be managed separately. Note At this step in the planning process, you are concerned only with the number of AGPM Servers required to support your environment. Deploying additional AGPM Servers for availability and scalability is discussed later in this guide. Determine the Number of AGPM Clients Required In either the single-server or multiple-server scenario, you deploy one or more AGPM Clients. Deploy the AGPM Client on every computer used to administer GPOs. For information on the AGPM Client installation requirements, see Client Installation Requirements” later in this guide. “AGPM Determine the User Accounts Required for Deployment Before you begin the AGPM Server installation process, create the AGPM Service Account and determine which account will become the Archive Owner account, as listed in Table 2. These accounts must exist prior to deployment of the AGPM Server. Table 2. Accounts to Create Prior to AGPM Server Deployment Account Description AGPM Service Account This user account provides the identity for the AGPM Service. This account must also be a member of the Administrators group on the computer on which AGPM is deployed, unless the computer is a domain controller. While you can make the account a member of the Domain Admins security group, the minimum privileges required for the AGPM Service Account include: Membership in the Group Policy Creator Owners group in each domain the AGPM Server manages. Membership in the Backup Operators group in each domain the AGPM Server manages. The AGPM Service Account also requires the following permissions Full Control permission on the AGPM archive folder, which is automatically granted during the installation of AGPM Server if the folder is on a local drive. Full Control permission on the local system temp folder, which is typically %windir%\temp.
Determine the Number of AGPM Servers Required In the single-server scenario, only one AGPM Server is deployed, which means the one AGPM Server manages the GPOs for all the domains in a single forest. In the multiple-server scenario, you deploy two or more computers running AGPM Server in your environment. You can deploy AGPM Server on a member server or a domain controller. Installing AGPM Server installs the AGPM Service on the computer. For information on the AGPM Server installation requirements, see “AGPM Server Installation Requirements,” later in this guide. In the multiple-server scenario, deploy a separate AGPM Server for: Each forest in your AD DS infrastructure. Each site that is isolated by network connectivity issues. Each site that your organization’s structure requires to be managed separately. Note At this step in the planning process, you are concerned only with the number of AGPM Servers required to support your environment. Deploying additional AGPM Servers for availability and scalability is discussed later in this guide. Determine the Number of AGPM Clients Required In either the single-server or multiple-server scenario, you deploy one or more AGPM Clients. Deploy the AGPM Client on every computer used to administer GPOs. For information on the AGPM Client installation requirements, see “AGPM Client Installation Requirements” later in this guide. Determine the User Accounts Required for Deployment Before you begin the AGPM Server installation process, create the AGPM Service Account and determine which account will become the Archive Owner account, as listed in Table 2. These accounts must exist prior to deployment of the AGPM Server. Table 2. Accounts to Create Prior to AGPM Server Deployment Account Description AGPM Service Account This user account provides the identity for the AGPM Service. This account must also be a member of the Administrators group on the computer on which AGPM is deployed, unless the computer is a domain controller. While you can make the account a member of the Domain Admins security group, the minimum privileges required for the AGPM Service Account include: Membership in the Group Policy Creator Owners group in each domain the AGPM Server manages. Membership in the Backup Operators group in each domain the AGPM Server manages. The AGPM Service Account also requires the following permissions Full Control permission on the AGPM archive folder, which is automatically granted during the installation of AGPM Server if the folder is on a local drive. Full Control permission on the local system temp folder, which is typically %windir%\temp.
AGPM%20Planning%20Guide.docx