Active Directory Integration is a really useful feature that the ShoreTel phone system makes available. I believe the feature was introduced in ShoreTel 9 or 10. This will let you tie a user to their Active Directory account. You want to do this if you can because it will allow you to make changes in Active Directory and the changes persist to the phones. It will also make adding new users a lot quicker.
Joining your ShoreTel server to your domain first is necessary. This goes against some conventional wisdom that ShoreTel used to put out. You might want to do this after hours as it will need at least one reboot.
Please note that the sub numbers are just notes on the step.
- Join your ShoreTel server to your domain.
- Make sure your server has a good descriptive computer name first. This helps a lot with DNS entries. Some partners don’t really set ShoreTel servers up with anything but a random name if they don’t join it to a domain. This will make setting up Communicator for new users so much easier, especially remotely as they only have to put in the server name.
- Open Active Directory Users and Computers. Find your ShoreTel server and right click on it and hit “Properties”.
Click on the “Delegation” tab and select the radio button that says “Trust this computer for delegation to any service (Kerberos only). Click OK.
- Open Shoreware Director and log in as an administrator. If you named your ShoreTel server “SHORETEL” like I did you can go to http://shoretel/shorewaredirector.
- Go to System Parameters and click “Administrators” under Administrative Permissions. Make sure that you’ve got an administrator set up that isn’t tied to a windows user. You’ll note in the picture we’ve got a public phone user and a fax server user on the list. You just need one and it has to be tied to an extension. The reason is if you have to log into ShoreTel from a non-administrative user’s computer you’ll need a non-AD login name to log in with.
- Now go into the “Other” section under System Parameters and scroll all the way to the bottom. Check the “Enable AD Integration” box. Fill in the AD Path box.
- It gives some suggestions on how to go about this. I tried them, and at least on our environment it didn’t work. I found that just putting in “LDAP://fqdn” in worked perfect. Yes it will include everyone in your domain. I can’t come up with a scenario where this is a problem. You could include the entire forest this way.
- Click Save. If there are errors, it will tell you. The times I’ve done this it was usually a mistyped string in the AD Path field. Some of the errors will just mean you need to wait a few minutes for changes to propagate in AD.
- To enable auto-login to the Shoreware Director and to the Web Based Call Manager you need to make sure a few settings are enabled in IIS. My ShoreTel server runs on Server 2003, so I only have pictures for IIS 6, but I can post how to do this on 2008 if there’s interest.
- Open Internet Information Services Manager – This is under your Administrative Tools menu. You can get to this menu through Control Panel if it isn’t already on your Start Menu.
- Expand Web Sites -> Default Website
- Right click on ShorewareDirector and click Properties.
- Select the Directory Security Tab
- Click on the Edit button under “Authentication and Access Control”
- Make sure the “Integrated Windows Authentication” box is check and hit OK. Hit OK on the Properties box too.
- Note that you may have to restart IIS. You can do this by clicking on the Server Name under the IIS Manager, select All Tasks and hit Restart IIS.
Adding Users With AD Integration
Adding a user is a lot simpler now. All you need to do is make a new user, click the “AD” user checkbox, add their domain user name (domainusername), click the “Synch from AD” button. It will fill most of their information. I typically only have to select the right extension, DID and what sort of license they use. I have noticed that sometimes you have to wait a bit for Active Directory to catch up. This only happened to me when entering an AD user to another AD site than the one that the ShoreTel server was located in.
The coolest part of this now is that your users don’t have to remember a ShoreTel password for their Communicator when they set it up. All they have to do is put in the server name when they first run Communicator, and everything else is filled in for them. Doing this alone has reduced the time needed to set up a new user by about 20 minutes.
If you find any of this information useful, do me a huge favor and like it on Facebook or Google+. I’d really appreciate it.