Use remote authentication for the following reasons:  The first step in configuring LDAP is to prepare the LDAP server. Our example uses a  Microsoft Windows 2008 R2 Enterprise server, which is promoted to be a Domain Controller  by using the  dcpromo  command. Next, the computer role  Active Directory Lightweight  Directory Services  is added. The privileges that the LDAP user receives on the IBM FlashSystem 900 are controlled by  user groups on the storage system. Matching user groups must be available on the Active  Directory (AD) server and on the IBM FlashSystem 900. The LDAP users must be added to  the AD server group. In this example, you create a group that is called  FlashAdmin , which you use to manage your  FlashSystem 900 storage device. Complete the following steps: Click the  Create a new group in the current container  icon.  Figure 8-15 Active Directory Users and Computers window to create a group 274  Implementing IBM FlashSystem 900 Model AE3 1. To create this group, log on to the AD Domain Controller and configure Active Directory.  An easy way to configure Active Directory from the AD controller is to select  Start  Run ,  enter  dsa.msc , and click  OK . The Active Directory Users and Computers management  console opens (see Figure 8-15). GLYPH<SM590000> Remote authentication saves you from having to configure a local user on every IBM  storage system in your storage infrastructure.  GLYPH<SM590000> If you have multiple LDAP-enabled storage systems, remote authentication makes it more  efficient to set up authentication. GLYPH<SM590000> The audit log shows the domain user name of the issuer when commands are run. The  domain user name is more informative than a local user name or just  superuser . GLYPH<SM590000> Remote authentication gives you central access control. If someone leaves the company,  you need to remove access at the domain controller only, which means that no orphan  user IDs remain on the storage system. Reasons for using remote authentication Prepare the LDAP server