You can install/configure Dynamics 365 application in two different ways. Here are they:
You have two options when you install Microsoft Dynamics CRM with the minimum required permissions. You can let the Microsoft Dynamics CRM server Setup program create the security groups during the installation. Or, you can use pre-created Active Directory security groups.
You can also select to turn on the Auto Group Management functionality or to turn off the Auto Group Management functionality. By default, the Auto Group Management functionality is turned on. Microsoft Dynamics CRM automatically adds the appropriate user accounts and the appropriate computer accounts to the required Microsoft Dynamics CRM security groups. If you turn off Auto Group Management, Microsoft Dynamics CRM does not automatically add these accounts. In this case, a domain administrator or a user who has sufficient permissions must add the appropriate user accounts and the appropriate computer accounts to the required groups. These additions must be made after the installation and after any user is added to Microsoft Dynamics CRM.
Installation option 1: The Setup program creates the Active Directory security groups when you install Microsoft Dynamics CRM
Add the user account of the user who is installing Microsoft Dynamics CRM as a member of the local administrator group. To do this, follow these steps on the Microsoft Dynamics CRM server and on the computer that is running Microsoft SQL Server:
Log on to the server as a user who has local administrator permissions.
Click Start, point to Administrative Tools, and then click Computer Management.
Expand System Tools.
Expand Local Users and Groups.
Click Groups.
Right-click Administrators, and then click Properties.
To add the account of the user who is installing Microsoft Dynamics CRM, click Add.
If SQL Server Reporting Services (SSRS) is installed on a server other than the server on which you added permissions in step 1, you must add the Content Manager role at the root level for the installing user account. And, you must add the System Administrator role at the site-wide level for the installing user account. To do this, follow these steps on the Reporting Services server:
Start Windows Internet Explorer, and then locate the following site:
http://srsserver/reports
On the Properties tab, click New Role Assignment.
In the Group or user name box, type the user name of the user who is installing Microsoft Dynamics CRM, click to select the Content Manager check box, and then click OK.
Note Use the following format when you type the user name:
domainname\username
Click Site Settings.
Under Security, click Configure site-wide security, and then click New Role Assignment.
In the Group or user name text box, type the user name of the user who is installing Microsoft Dynamics CRM, click to select the System Administrator check box, and then click OK.
Note Use the following format when you type the user name:
domainname\username
For the user account of the user who is installing Microsoft Dynamics CRM, add the following permissions to the organizational unit (OU) in the Active Directory directory service. You must do this step for the OU to which you select to install during the installation of Microsoft Dynamics CRM 4.0.
Permissions
Read
Create All Child Objects
Advanced permissions
Read Permissions
Modify Permissions
Read Members
Write Members
To add the permissions, follow these steps:
Log on to the domain controller server as a user who has domain administrator permissions.
Click Start, click Administrative Tools, and then click Active Directory Users and Computers.
On the View menu, click Advanced Features.
In the navigation pane, find the OU that you want to use for the Microsoft Dynamics CRM installation. To do this, expand the tree to the node that contains the security group.
Right-click the security group, click Properties, and then click the Security tab.
In the Group or user names list, click the user account of the user who is installing Microsoft Dynamics CRM if the account is listed. If the account is not listed, click Add to add the user account.
In the Allow column, click to select the check box for the Create All Child Objects permission.
Note By default, the Allow check box is selected for the Read permission.
Click Advanced.
In the Permission entries list, click Add, select the user account of the user who is installing Microsoft Dynamics CRM, and then click OK.
In the Apply onto list, click Group objects.
In the Allow column, click to select the following check boxes:
Read Permissions
Modify Permissions
Click the Properties tab.
In the Apply onto list, click Group objects.
In the Allow column, click to select the following check boxes:
Read Members
Write Members
Click OK three times.
Install Microsoft Dynamics CRM.
Installation option 2: Use the pre-created Active Directory security groups when you install Microsoft Dynamics CRM
Create the following security groups in Active Directory:
PrivUserGroup
PrivReportingGroup
ReportingGroup
SQLAccessGroup
UserGroup
To create the security groups in Active Directory, follow these steps:
Log on to the domain controller server as a user who has domain administrator permissions.
Click Start, click Administrative Tools, and then click Active Directory Users and Computers.
Expand the "Active Directory Users and Computers" tree to the root of the domain or to the specific organizational unit (OU) that you want to use to install Microsoft Dynamics CRM.
Right-click the domain root or the OU that you want to use, click New, and then click Group.
In the Group Name field, type the name of the group. For example, type PrivUserGroup.
If the domain functional level is Windows Server 2003 or Microsoft Windows 2000 native, click Domain local in the Group scope list. If the domain functional level is Windows 2000 mixed, click Global in the Group scope list.
Click OK.
Repeat steps 1d through 1g earlier in this section to create each security group.
Add the user account of the user who is installing Microsoft Dynamics CRM as a member of the Local Administrator group. You must complete this step on the computer that is running the Microsoft Dynamics CRM server and on the computer that is running SQL Server.
Log on to the server as a user who has local administrator permissions.
Click Start, click Administrative Tools, and then click Computer Management.
Expand System Tools, expand Local Users and Groups, and then expand Groups.
Right-click Administrators, and then click Properties.
To add the user account of the user who is installing Microsoft Dynamics CRM, click Add, and then click OK.
If SQL Server Reporting Services (SSRS) is installed on a server other than the server on which you added permissions in step 1, add the Content Manager role at the root level for the installing user account. Then, add the System Administrator Role at site-wide level for the installing user account. To do this, follow these steps on the server that is running Reporting Services:
Start Internet Explorer, and then locate the following site:
http://srsserver/reports
Click the Properties tab, and then click New Role Assignment.
In the Group or user name box, type the name of the user who is installing Microsoft Dynamics CRM, click to select the Content Manager check box, and then click OK.
Note Use the following format when you type the user name:
domainname\username
Click Site Settings.
Under Security, click Configure site-wide security, and then click New Role Assignment.
In the Group or user name box, type the name of the user who is installing Microsoft Dynamics CRM, click to select the System Administrator check box, and then click OK.
Note Use the following format when you type the user name:
domainname\username
If you want Microsoft Dynamics CRM to manage the Microsoft Dynamics CRM security groups that are created during the installation, add the following permissions to the security groups that you created in step 1 earlier in this section:
Permissions
Read
Write
Add/Remove self as member
Advanced permissions
List Contents
Read All Properties
Write All Properties
Read Permissions
Modify Permissions
All Validated Writes
Add/Remove self as member
To add the permissions, follow these steps for each security group that you created in step 1 earlier in this section:
Log on to the domain controller server as a user who has domain administrator permissions.
Click Start, click Administrative Tools, and then click Active Directory Users and Computers.
On the View menu, click Advanced Features.
In the navigation pane, expand the tree to the security group, right-click the security group, click Properties, and then click the Security tab.
In the Group or user names list, click the user account of the user who is installing Microsoft Dynamics CRM if the account is listed. If the account is not listed, click Add to add the user account.
In the Allow column, click to select the check box for the Write permission. This action causes the system to automatically select the check box for the Add/Remove self as member permission.
Note By default, the Allow check box is selected for the Read permission.
Click Advanced.
In the Permission entries list, click the user account of the user who is installing Microsoft Dynamics CRM, and then click Edit.
Click to select the Modify Permissions check box in the Allow column.
Click OK three times.
Notes
By default, the following permissions are set to Allow:
List Contents
Read All Properties
Write All Properties
Read Permissions
All Validated Writes
Add/Remove self as member
If you will turn off Auto Group Management for the installation, you do not have to complete step 4.
For more information about Auto Group Management, see the "Auto Group Management options" section.
When you first log on to Microsoft Dynamics CRM, and every time that a user is added to Microsoft Dynamics CRM, you must complete the following actions:
To log on, use a user account that has the necessary rights.
Manually add the users and the computers to the appropriate security groups.
To use the pre-created Active Directory security groups, create a configuration file to point to Microsoft Dynamics CRM. To do this, create an XML configuration file that uses the syntax that is in the following example. Modify the variables as appropriate. The list that follows the sample code describes how to modify the variables that are in this example.
In the following sample code, the XML file is named Config_precreate.xml. The domain name is microsoft.com. These names represent the actual names that you use. The Active Directory hierarchy is as follows:
root domain
Company Name OU
Company Name OU
Sample code
<CRMSetup>
<Server>
<Groups AutoGroupManagementOff="true">
<PrivUserGroup>CN=PrivUserGroup,OU=Company Name,OU=Company Name,DC=<domain>,DC=<domain_extension></PrivUserGroup>
<SQLAccessGroup>CN=SQLAccessGroup,OU=Company Name,OU=Company Name, DC=<domain>,DC=<domain_extension></SQLAccessGroup>
<UserGroup>CN=UserGroup,OU=Company Name,OU=Company Name,DC=<domain>,DC=<domain_extension></UserGroup>
<ReportingGroup>CN=ReportingGroup,OU=Company Name,OU=Company Name, DC=<domain>,DC=<domain_extension></ReportingGroup>
<PrivReportingGroup>CN=PrivReportingGroup,OU=Company Name,OU=Company Name, DC=<domain>,DC=<domain_extension></PrivReportingGroup>
</Groups>
</Server>
</CRMSetup>
Modify the parameters in the example by using the following replacement values:
PrivUserGroup: The name of the PrivUserGroup security group
SQLAccessGroup: The name of the SQLAccessGroup security group
UserGroup: The name of the UserGroup security group
ReportingGroup: The name of the ReportingGroup security group
PrivReportingGroup: The name of the ReportingGroup security group
domain: The domain name
domain_extension: The domain extension
Note For more information about all the configuration file parameters and samples, see the implementation guide.
Run the Microsoft Dynamics CRM server installation. To do this, click Start, click Run, type C:\ServerSetup.exe /config C:\configprecreate.xml in the Open box, and then click OK.
Notes
"C:\ServerSetup.exe" refers to the path of the ServerSetup.exe file on the installation medium.
"C:\configprecreate.xml" refers to the name and the path of the configuration file that was created.