Deployment team task checklist

Before you install the pilot deployment, you should prepare a deployment checklist to ensure you have the information you need to successfully complete the deployment. For example, you should review port requirements, verify DNS resolution, and create one or more spreadsheets that describe the user and group accounts to be imported and any special relationships, such as membership in specific groups that need to be preserved or any special configuration you want to implement.

Creating a deployment checklist is optional, but can help you to collect detailed information about each of the computers targeted for deployment.

The following example illustrates information you can collect and record in a deployment team task checklist.

Preparing computers for deployment
	Operating system, version, and patch level for target computers
	Host name and IP address for target computers
	Current disk space for target computers
	Review the details of the current DNS configuration For example: Is the address resolved through a UNIX DNS server, Windows DNS server, or settings in the /etc/hosts and /etc/resolv.conf files? Is the computer using a DNS server that has SRV records for Active Directory domain controllers? Are UNIX subnets registered and associated with Sites in Active Directory? Are you using a disjointed DNS namespace, where a UNIX computer name may be server.company.com but the Active Directory domain name is server.windows.company.com? Are you using DNS aliases and do they resolve correctly? Are there multiple network interfaces (NIC) in use?
	Current network time provider (NTP) For example, does the computer use a different server to determine the time than the Active Directory domain controller?
	Current firewall configuration For example, are there any firewalls blocking required ports between the UNIX computer and the Active Directory domain controllers for the registered sites?
	Current applications and services For example, do you have Perl, Samba, or OpenSSH deployed? Are the versions you have compatible with the Centrify agent or—if a Centrify version is available—to be replaced by versions provided by Centrify? Do you have existing authentication providers deployed? Are existing applications and services Kerberos-enabled or PAM-enabled? Are there other applications that require local users or groups?
	Current source of user and group information For example, are the /etc/passwd and /etc/group files the only source of user information for the users who access this computer or other identity stores, such as existing LDAP servers or NIS domains, used? Are there any specific users or groups that should remain locally defined?
	Current NSS configuration For example, have you reviewed the contents of the nsswitch.conf file to check for other sources of user and group information?
	Connectivity between this computer and the domain controller For example, is there a reply from the domain controller when you run the ping command?
	User names and UIDs checked for conflicts across the target group
	Zone requirements analyzed for the target group
	Zone identified for this computer
	Centrify agent installed and the computer joined to the domain
	Groups allowed or denied access identified for this computer
	Existing users and groups for this computer imported into Active Directory
	Imported user and group profiles mapped to Active Directory accounts
	Allowed or denied groups configured using parameter values or group policy

If you use a deployment checklist, you can also include additional notes and details about the activities performed. For example, a partially completed checklist might look something like this:

Preparing computers for deployment
	Operating system: Sun Solaris 10 with all patches applied (17-April-2017)
	Host name and IP address: aspen, 177.29.10.10
	Current DNS configuration: Resolved through the enterprise DNS server, spider.ajax.org
	Current time source is NTP server: ntpd on solstice.ajax.org Change for deployment: Use SNTP on the Active Directory domain controller
	Current firewall configuration: No port issues
	Existing OpenSSH version to be replaced, no other issues found.
	Current source of user and group information: /etc/passwd, /etc/group, and NIS domain nwest03 have users who access aspen
	Connectivity with the domain controller: Verified by JR (2-May-2011).
	User names and UIDs checked for conflicts across the target group: Analyzed by JR and DC (4-May-2017).
	Zone requirements analyzed for the target group: Zones required for the target group are nwest01, swest02, corp-main, and nwest03 (9 May 2017). SF to recommend new extended zone descriptions for approval.
	Zone identified for this computer: nwest03
	Centrify agent installed and the computer joined to the Active Directory domain: dc3colorado.ajax.org, OU: US-UNIX-Computers
	Groups allowed r denied access identified for this computer: Allowed access group—all_employees, oracle_sys Denied access—consultants, temps
	Existing users and groups for this computer imported into Active Directory: Completed by DC (20-May-2017).
	Imported user and group profiles mapped to Active Directory accounts: Work complete for users and groups that already had matching Active Directory candidates. Work in progress for the remaining profiles without any matching Active Directory candidate. Target date for completion: 31-May-2017
	Allowed or denied groups configured using parameter values or group policy: TBD