Army National Guard 

Information Network Division 

Contract Number 263-01-D-0050 / Task Order W9133L-06-F-1000-P00013 

Enterprise Operations and Security Services 

REQUEST FOR QUOTATION FOR SUPPORTING TECHNOLOGIES - 

ACTIVE DIRECTORY 

Version 1.1 

Date: 09 March 2010 

Document Control Number (DCN): EOSS-RFQ/701068-V1.1 

Prepared for: 

Army National Guard 

Information Network Division 

111 S George Mason Dr 

Arlington, VA 22204-1382 

Prepared by: 

SRA International, Inc. 

8260 Willow Oaks Corporate Dr Ste 700 

Fairfax, VA 22031-4513 

FOIA Requested Record #FA-10-0127 

Page 1 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 ii EOSS-RFQ/701068-V1.1

CHANGE HISTORY 

The table below identifies all changes incorporated into updated versions of this report after the 

initial approval. Updates to attachments that constitute new versions of those documents, e.g., a 

change in twenty percent (20%) of the document, are also identified here. The change request 

number (CR #) provides a link to the history of the change request. 

CR # Date Version # Change Description

03/08/10 1.0 Initial Release

03/09/10 1.1 Updated quantities, Scope and Purpose

03/10/10 1.2 Modified paragraphs 1.1, Scope and 1.5, 

Place of Performance

FOIA Requested Record #FA-10-0127 

Page 2 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 iii EOSS-RFQ/701068-V1.1

CONTENTS 

1. INTRODUCTION .......................................................................................................................................... 1-1

1.1 PURPOSE ...................................................................................................................................................... 1-1

1.2 SCOPE .......................................................................................................................................................... 1-1

1.3 BACKGROUND.............................................................................................................................................. 1-1

1.4 COMMON SYSTEM REQUIREMENTS.............................................................................................................. 1-5

1.5 PLACE OF PERFORMANCE............................................................................................................................. 1-5

1.6 DOCUMENT STRUCTURE .............................................................................................................................. 1-5

2. SERVER HARDWARE ................................................................................................................................ 2-1

2.1 REQUIREMENTS............................................................................................................................................ 2-1

3. STORAGE ...................................................................................................................................................... 3-1

3.1 REQUIREMENTS............................................................................................................................................ 3-1

3.2 QUOTATION ................................................................................................................................................. 3-1

4. NETWORK HARDWARE ........................................................................................................................... 4-1

4.1 REQUIREMENTS............................................................................................................................................ 4-1

5. UNINTERRUPTIBLE POWER SUPPLIES (UPS) .................................................................................... 5-1

5.1 REQUIREMENTS............................................................................................................................................ 5-1

6. PROVISIONING SYSTEM .......................................................................................................................... 6-1

6.1 DESCRIPTION ............................................................................................................................................... 6-1

6.2 REQUIREMENTS............................................................................................................................................ 6-1

7. GROUP POLICY ADMINISTRATION TOOL ......................................................................................... 7-1

7.1 DESCRIPTION ............................................................................................................................................... 7-1

7.2 REQUIREMENTS............................................................................................................................................ 7-1

8. ACTIVE DIRECTORY MIGRATION TOOL ........................................................................................... 8-1

8.1 REQUIREMENTS............................................................................................................................................ 8-1

9. BACKUP SOLUTION ................................................................................................................................... 9-1

9.1 REQUIREMENTS............................................................................................................................................ 9-1

10. EVENT LOG BACKUP SOLUTION ........................................................................................................ 10-1

10.1 REQUIREMENTS..................................................................................................................................... 10-1

APPENDIX A: ACRONYMS ................................................................................................................................ A-1

APPENDIX B: DEFINITIONS .............................................................................................................................. B-1

FIGURES 

FIGURE 1.1 - MAPPING OF STATES BY ENTERPRISE HOSTING FACILITY ..................................................................... 1-2

FIGURE 1.2 - ARNG NETWORK TOPOLOGY AND CONNECTION TYPES....................................................................... 1-3

FIGURE 1.3 – „NOTIONAL‟ CONTENTS OF ONE OF THE ENTERPRISE HOSTING FACILITIES IN THE NEW CONSOLIDATED 

ARNG ENVIRONMENT ...................................................................................................................................... 1-4

FOIA Requested Record #FA-10-0127 

Page 3 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 1-1 EOSS-RFQ/701068-V1.1

1. INTRODUCTION 

This section provides the purpose, scope, background, and common system requirements and 

document structure for the Request for Quotation for Supporting Technologies - Active 

Directory. 

1.1 Purpose 

The purpose of this request for quotation (RFQ) is to obtain pricing and to procure the software 

and equipment for integration testing and evaluation, proof concept and implementation of 

Active Directory 2008 services Army National Guard (ARNG) IT Consolidation (ITC) project of 

the Enterprise Operations Systems and Security Program. Within seven calendar days after 

award, the winner will provide the lab equipment and the tools to the Willow Oaks location. The 

remaining equipment will be shipped to the 50 States, three Territories, the District of Columbia 

and the National Capitol Region (NCR) when required.

1.2 Scope 

The scope of this document is a request for quotation and to subsequently procure the 

technologies and related solutions necessary to address the customer requirements identified for 

the ITC project Active Directory 2008 consolidation and migration. Outside of the scope of this 

document are the technologies and related solutions that would be used for the Exchange 2010 

component of the ITC project. 

1.3 Background 

The IT Consolidation project will migrate and consolidate Active Directory (AD) and Exchange 

and support the regionalization of Exchange onto GuardNet XXI at four regional Enterprise 

Hosting Facilities. The ARNG, Networks Division (NGB-AIN) provides Wide Area Network 

(WAN) connectivity to all 50 States, three Territories, the District of Columbia and the National 

Capitol Region (NCR) through a network infrastructure known as GuardNet XXI. The ARNG 

locations connect to this network at each state‟s Joint Forces Headquarters (JFHQs) which then 

connect to one of seven Regional NIPRNet Gateways. The seven Regional NIPRNet Gateways 

are being consolidated into four Regional NIPRNet Gateways as part of another NGB-AIN 

consolidation project and they act as the connection points to the Non-Classified Internet 

Protocol Router Network (NIPRNet), which in turn has gateways to the Internet. 

The ITC project is dependent upon the successful completion of the Regional NIPRNet Gateway 

consolidation project to provide the necessary bandwidth required to support the consolidation of 

AD and Exchange at four regional Enterprise Hosting Facilities. Figure 1.1 below reflects the 

mapping of States and Territories to each of the four Enterprise Hosting Facilities: 

FOIA Requested Record #FA-10-0127 

Page 4 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 1-2 EOSS-RFQ/701068-V1.1

Figure 1.1 - Mapping of States by Enterprise Hosting Facility

The ITC project has two overarching objectives. The first is to consolidate Microsoft AD 

services throughout ARNG from 55 separate user domains in a single forest to one user domain 

in one forest. The second objective is to take the current MS Exchange component from a 

distributed model to a more centralized architecture. 

The AD component of this effort will transform the current implementation of MS Windows 

Server 2003 R2 which supports approximately 120,000 users in 55 separate user domains to MS 

Windows Server 2008 into one user domain at the Enterprise level (intra-forest migration). This 

single domain will contain top-level Organizational Units (OUs) for each State. 

The Exchange component of this project will take the current distributed model where Exchange 

servers and user mailboxes are located in each State, to a more centralized architecture where all 

the Exchange servers will be located at four Enterprise Hosting Facilities. As part of this project, 

Exchange 2003 will be upgraded to Exchange 2010. Additionally, the Enterprise will provide 

Mobile Messaging (BlackBerry and Windows Mobile), Unified Messaging (UM) to existing 

users, Exchange journaling and User Provisioning services. 

The four Enterprise Hosting Facilities will provide high availability (HA) of Enterprise-level 

services in an Active-Active Hosting Facility model where one facility provides Continuity of 

Operations (COOP) capabilities to another facility. This HA model will ensure that Hosting 

Facility services will continue to be accessible from a secondary or alternate Hosting Facility 

should an outage occur at the primary Enterprise Hosting Facility servicing a particular State. 

This project will also include a hardware refresh component replacing all State-level domain 

controllers and tool servers. 

FOIA Requested Record #FA-10-0127 

Page 5 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 1-3 EOSS-RFQ/701068-V1.1

All proposed solutions should include options or features to optimize network bandwidth 

utilization and minimize overall storage requirements using all available supporting 

technologies. All proposed solutions should minimize footprint requirements and environmentals 

within the Enterprise Hosting Facility. The Enterprise Hosting Facilities are constrained by 

available physical space and other facilities infrastructure that was never engineered and 

designed to support a full-scale Enterprise IT environment. 

Figure 1.2 reflects the overall network topology of the four Enterprise Hosting Facilities along 

with the number and type of network connections between the sites: 

NIPRNet to Internet NIPRNet to Internet GuardNet XXI Sprint Cloud Enterprise Hosting Facility (West) Enterprise Hosting Facility (East) CA-HF

CA-GW RC-HF RC-GW

NIPRNet to Internet

State

State

State

State

State

State Legend Optical Carrier >= 622 Mbps

State x54 State-Level GuardNet Service Delivery Points Optical Carrier <= 45 Mbps (Alternate) Optical Carrier <= 45 Mbps (Primary)

State State State

State State State

For Official Use Only

For Official Use Only

MN-GW MN-HF

Enterprise Hosting Facility (North)

NIPRNet to Internet

AR-GW Enterprise Hosting Facility (South)

AR-HF

Non-GuardNet Dedicated Hosting Facility Interconnect

Non-GuardNet Dedicated Hosting Facility Interconnect

Figure 1.2 - ARNG Network Topology and Connection Types 

The „notional‟ content of one of the Enterprise Hosting Facilities in the new consolidated ARNG 

environment is found in Figure 1.3 below.

FOIA Requested Record #FA-10-0127 

Page 6 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 1-4 EOSS-RFQ/701068-V1.1

Figure 1.3 – ‘Notional’ contents of one of the Enterprise Hosting Facilities in the new 

consolidated ARNG environment 

The objectives of this AD and Exchange Enterprise migration and consolidation initiative 

include: 

 Provide the capability for all ARNG domain users with common access cards (CAC) and 

properly configured Government Furnished Equipment (GFE) to access core services and 

resources anytime, anywhere (ubiquitous access) 

 Provide centralized Enterprise management of a consolidated AD and Exchange IT 

infrastructure that provides core systems and services with improved performance, 

functionality, and information sharing with greater resource efficiency 

 Enable standardization for Enterprise solutions, and limit non-standard state-specific 

solutions for common Enterprise services 

 Reduce server hardware and software licensing costs by consolidating AD into a single 

Enterprise managed domain within the current ARNG Forest. 

 Offer new and enhanced Exchange messaging services by consolidating the existing 

Exchange IT infrastructure, currently maintained at the State-level, into four regional 

Enterprise-managed Hosting Facilities. 

Information requested is for product technologies and solutions that are consistent with the 

objectives of this RFQ and clearly address the nine technology areas included in this document. 

It is not expected that one technology vendor would provide a response to all nine technology 

areas covered in this RFQ. However, any response, for any technology must first satisfy the 

common system requirements before any specific technical requirements are addressed. The 

FOIA Requested Record #FA-10-0127 

Page 7 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 1-5 EOSS-RFQ/701068-V1.1

response must also address dependencies between technology areas as described in this 

document. 

1.4 Common System Requirements 

The proposed technologies and solutions for this RFQ shall satisfy all of the following common 

system requirements. If these common requirements are not satisfied, specific technologies 

proposed will not be considered: 

 Shall be available via Computer Hardware Enterprise Software and Solutions 

(CHESS) 

 Shall be supported on Windows Server 2008 64-Bit Operating System 

 Shall be supported on Exchange Server 2010 by the end of Q2 2010

 Shall either have a Certificate of Networthiness (CoN) or a CoN has been submitted to 

NETCOM for approval, to include, any applicable AD schema extensions required

 Shall have Central/Enterprise Management Capabilities

 Shall support Virtualization (except for Unified Messaging Solutions)

 Shall support alerting/monitoring via SNMP V3 or Windows Event notifications. If 

SNMP V3 is not currently supported, product must have a roadmap to V3 support

 Shall provide High-Availability and Site Resiliency Capabilities

 Shall be Internet Protocol version 6 (IPv6) capable

Note: the definition of IPv6 as accepted in this document is found in Appendix B.

 Shall include pricing for both 3 year and 5 year support/maintenance

 Shall include pricing for 24 x 7 x 365 support with 4 hour response

 Software shall support role-based access / customizable permissions model for 

granular permissions delegation

 Software shall not require the use of the built in Domain Administrator group. The 

vendor will provide a list of granular level permissions that are required so they can be 

delegated as needed.

1.5 Place of Performance 

This equipment will be integrated and tested at the NGB-AIN Test Lab, 8260 Willow Oaks 

Corporate Drive, Fairfax, VA. The manufacturer will ship the equipment directly to the sites for 

installation. The relevant sites are the ARNG 50 States, three Territories, the District of 

Columbia and the National Capitol Region (NCR). 

1.6 Document Structure 

This document is structured as follows: 

Section 1 of this document provides introductory material for the audience including scope, 

background, common system requirements and place of performance. Sections 2 – 10 each 

FOIA Requested Record #FA-10-0127 

Page 8 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 1-6 EOSS-RFQ/701068-V1.1

contain descriptions and a technical section of describing the technologies or solutions sought 

within this RFQ. Appendix A contains a table of abbreviations used in this document and 

Appendix B contains a Department of Defense memorandum which provides the definitions of 

IP v6 capable products and networks as accepted in this document. 

FOIA Requested Record #FA-10-0127 

Page 9 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 2-1 EOSS-RFQ/701068-V1.1

2. SERVER HARDWARE 

2.1 Requirements 

Server Grouping #1 (quantity 232 rack mount servers) 

 No taller than 1 Rack Unit Size 

 Intel® Nehalem Dual Socket, Quad Core 64-bit 2.5GHz or faster processors 

 12GB RAM 

 At least 100GB of usable disk space in a RAID-1 configuration with 10K RPM drives 

 At least 400GB of usable disk space in a RAID-5 configuration with 10K RPM drives 

 Dual 1Gb NICs 

 1 PCI Express Slot 

 Trusted Platform Module (TPM) v. 1.2 chip 

 Out-Of-Band (OOB) capability 

 Dual Redundant Power Supplies 

 Rack mounting hardware 

 110v and 220v single phase Alternating Current (A/C) power

 Power cables for both 110v and 220v power 

Server Grouping #2 (quantity 96 rack mount servers)

 No taller than 2 Rack Units 

 Intel® Nehalem Dual Socket, Quad Core 64-bit 2.5GHz or faster processors 

 12GB RAM 

 At least 250 GB of usable disk space in a RAID-1 configuration with 10K RPM drives 

 At least 1.5 TB of usable disk space in a RAID-5 configuration with 7.2K RPM drives 

 Dual 1Gb NICs 

 2 PCI Express Slots 

 Trusted Platform Module (TPM) v. 1.2 chip 

 Out-Of-Band (OOB) capability 

 Dual Redundant Power Supplies 

 Rack mounting hardware 

 110v and 220v single phase Alternating Current (A/C) power 

 Power cables for both 110v and 220v power 

Server Grouping #3(quantity 12 rack mount servers)

 No taller than 2 Rack Units 

 Intel® Nehalem Quad Socket, Quad Core 64-bit 2.5GHz or faster processors 

 24GB RAM 

 At least 250 GB of disk space in a RAID-1 configuration with 10K RPM drives 

 Dual 1Gb NICs 

 2 PCI Express Slots 

 Trusted Platform Module (TPM) v. 1.2 chip 

 Out-Of-Band (OOB) capability 

 Dual Redundant Power Supplies 

 Rack mounting hardware 

 110v and 220v single phase Alternating Current (A/C) power 

FOIA Requested Record #FA-10-0127 

Page 10 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 2-2 EOSS-RFQ/701068-V1.1

 Power cables for both 110v and 220v power 

Racks quantity (quantity 62) 

 42U lockable racks fully populated with PDUs 

 Internal Fan 

KVMs (quantity 62) 

 16 Port IP Keyboard, Video, Mouse (KVM) switch and monitor console with keyboard 

and mouse 

 IP KVM supports PKI CAC authentication 

 Supports both 110v and 220v single phase Alternating Current (A/C) power 

 Power cables for both 110v and 220v power 

 All necessary KVM adapters 

 All necessary mounting hardware 

 The quotation shall include pricing for both 3 year and 5 year support/maintenance

 The quotation shall include 24 x 7 x 365 support with 4 hour response 

Request for Quote – Server Hardware

Product/Component Description Unit Quantity Total Quantity

Server Grouping #1 1 226

Support Maintenance - 3 Yrs 1

226

Support Maintenance - 5 Yrs 1

226

24 x 7 x 365 support with 4 hour response 1226

Server Grouping #2: 1 92

Support Maintenance - 3 Yrs 1 92

Support Maintenance - 5 Yrs 1 92

24 x 7 x 365 support with 4 hour response 1 92

Server Grouping #3: Clustered SQL Servers 1 12

Support Maintenance - 3 Yrs 1 12

Support Maintenance - 5 Yrs 1 12

24 x 7 x 365 support with 4 hour response 1 12

Racks 1 62

Support Maintenance - 3 Yrs 1 62

Support Maintenance - 5 Yrs 1 62

24 x 7 x 365 support with 4 hour response 1 62

KVMs 1 62

Support Maintenance - 3 Yrs 1 62

Support Maintenance - 5 Yrs 1 62

FOIA Requested Record #FA-10-0127 

Page 11 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 2-3 EOSS-RFQ/701068-V1.1

24 x 7 x 365 support with 4 hour response 1 62

FOIA Requested Record #FA-10-0127 

Page 12 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 3-1 EOSS-RFQ/701068-V1.1

3. STORAGE 

3.1 Requirements 

 The storage solution will be Direct Attached Storage (DAS) (no Network Attached 

Storage [NAS] or Storage Area Network [SAN]) 

 The storage solution will be fully redundant (redundant power supplies and controllers) 

 The storage solution will support RAID 5, RAID 6, RAID 10, RAID 50, or RAID 60 

 The storage solution will support hot spares 

 The storage solution will provide 30 TB of raw storage 

 The storage solution will include 7.2K RPM SATA drives 

 The storage solution will support both 110v and 220v power 

 The storage solution will provide the ability for expansion of additional disk shelves 

 The storage solution will support the ability to be connected into two servers 

simultaneously 

3.2 Quotation 

 The quote shall include a quantity of TWELVE (12) DAS devices for 30TB each 

 The quote shall include a total quantity of EIGHTEEN (18) PCI-Express cards 

 The quote shall include any other required devices, cards, or cables 

 The quote shall include pricing for both 3 year and 5 year support/maintenance 

 The quote shall include pricing for both a 3 year and 5 year fee for the ability to keep 

failed hard drives 

 The quote shall include 24 x 7 x 365 support with 4 hour response 

Request for Quote - Storage 

Product/Component Description Unit Quantity Total Quantity

DAS devices 30TB each 1 12

Fee for the ability to keep failed hard drives - 3 Yrs 1 12

Fee for the ability to keep failed hard drives - 5 Yrs 1 12

Support / Maintenance - 3 Yrs 1 12

Support / Maintenance - 5 Yrs 1 12

24 x 7 x 365 support with 4 hour response 1 12

PCI-Express cards 1 18

Support / Maintenance - 3 Yrs 1 18

Support / Maintenance - 5 Yrs 1 18

24 x 7 x 365 support with 4 hour response 1 18

FOIA Requested Record #FA-10-0127 

Page 13 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 4-1 EOSS-RFQ/701068-V1.1

4. NETWORK HARDWARE 

4.1 Requirements 

 Total Number of Layer 2 Ethernet IP Switches: 122 

o Number of 1 Gb Ethernet Ports per Switch: 24 ports per switch 

o Dual 1Gb Fiber SFP for uplink 

o Power: Supports both 110v and 220v power 

o QOS

o SSHv2 

o TACACS/RADIUS 

o Port Authentication 802.1x/EAP/PEAP (NAC/NAP) 

 The quotation shall include pricing for both 3 year and 5 year support/maintenance

 The quotation shall include 24 x 7 x 365 support with 4 hour response 

Request for Quote – Network Hardware

Product/Component Description Unit Quantity Total Quantity

Layer 2 Ethernet IP Switches 1 122

Support / Maintenance - 3 Yrs 1 122

Support / Maintenance - 5 Yrs 1 122

24 x 7 x 365 support with 4 hour response 1 122

FOIA Requested Record #FA-10-0127 

Page 14 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 5-1 EOSS-RFQ/701068-V1.1

5. UNINTERRUPTIBLE POWER SUPPLIES (UPS) 

5.1 Requirements 

The UPS product specified shall conform to the following specifications / parameters: 

 Shall be no taller than 5U rack height 

 Shall be mountable in a standard 42U rack with front and rear doors closed 

 Shall have Out-Of-Band (OOB) remote management capability 

 Shall have Rack mounting hardware included 

 Shall be fully operational on variable Power Input of 100 to 250 VAC at 50 or 60 hertz 

 Shall provide variable Power Output of 100 to 250 VAC at 50 or 60 hertz with 3000 VA 

/ 2100 W output rating 

 Shall provide at least 5 minutes of backup power at full load 

 Battery shall be replaceable 

 Shall have a power cord at least 4 feet in length 

 Shall have physical audible alarm activated by battery overload or battery draw-down 

 Shall have physical Online/Offline button and emergency power off switch 

 Shall have a physical LED status display for load, battery, and online/offline status; 

warning lights for battery replacement and battery overload 

 Shall provide power output connectivity port types: NEMA 5-20R, NEMA L5-30R, L6-

20R, NEMA L6-30R 

 Shall provide surge protection up to 480 Joules 

 Remote management software shall automatically detect power outage and battery drawdown, and be configurable to perform unattended shutdown of connected components 

 Remote Management Interface shall allows for remote administration via web browser; 

shall support SNMP, HTTP/HTTPs protocols; connectivity via RJ-45 Ethernet interface 

 The quotation shall include pricing for both 3 year and 5 year support/maintenance

 The quotation shall include 24 x 7 x 365 support with 4 hour response 

Request for Quote - UPS

Product/Component Description Unit Quantity Total Quantity

UPS 1 120

Support Maintenance - 3 Yrs 1 120

Support Maintenance - 5 Yrs 1 120

24 x 7 x 365 support with 4 hour response 1 120

FOIA Requested Record #FA-10-0127 

Page 15 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 6-1 EOSS-RFQ/701068-V1.1

6. PROVISIONING SYSTEM 

6.1 Description 

An Enterprise Provisioning System is needed to achieve the new Army National Guard (ARNG) 

administration model. The goal of this system is to control Active Directory (AD) changes 

through administrative rules and policies and to enable a least-privilege access model which 

would be accomplished through granting of granular permissions and approval-based workflow 

processes. 

The Provisioning System will establish and enforce Enterprise-wide business rules and 

standards for a number of common administrative actions. The Provisioning System will assist 

State Directorate of Information Management (DOIM) administrative personnel in performing 

administrative tasks for AD 2008 and Exchange 2010 while ensuring that they perform these 

tasks in a manner consistent with Army and ARNG policy and procedures. The Provisioning 

System will automate user and group provisioning including account creation in AD, mailbox 

creation in Exchange, and group population and resource provisioning in Windows. 

The Provisioning System will also automate re-provisioning and de-provisioning. The 

Provisioning System will support self-service roles which allow end-users to carry out selfadministrative tasks such as modifying their personal data through a simple to use of a selfservice Web interface. 

6.2 Requirements 

The proposed solutions for the Provisioning System shall satisfy all of the following specific 

technical requirements in addition to the common requirements above, in order to be considered 

for the solution addressed by this RFQ. 

The Provisioning System shall perform the following tasks: 

 Shall support approximately 120,000 user objects as well as associated computers, 

groups, and resources. 

 Quote shall include both 3 and 5 year maintenance costs 

 Create, delete, move, and modify the following Active Directory objects and attributes: 

- OUs

- Users 

- Groups 

- Contacts 

- Computers

- Group Policy 

- DNS records 

 Allow for customization of the software for customer specific provisioning requirements 

 Prohibit the existence of any „backdoor‟ access to the Exchange mailbox system or 

Active Directory that could circumvent the solution‟s controls to a System 

Administrator‟s access to the system.

 Have the ability to enforce naming standards. 

 Provide a customizable web interface for Administrators or Help Desk support staff 

 Provide for automated group management based on attributes of the Active Directory 

user object 

FOIA Requested Record #FA-10-0127 

Page 16 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 6-2 EOSS-RFQ/701068-V1.1

 Provide an audit trail for any changes to an Active Directory object to include those 

attributes specific to the Exchange enclave 

 Include the ability to manage similar users across any forest at a top level rather than 

having to manage these users at an individual OU level 

 Have the ability to provide role-based delegation 

 Enforce attribute conformity of an Active Directory object upon new creation or object 

updating 

 Shall auto-generate specific values of the AD/Exchange attributes that should not be 

modified by an OU level administrator 

 Shall provide an accounts/users removal capacity that will: 

- Remove a user from groups. 

- Disable the account. 

- Hide the exchange account from the GAL. 

- Move the user to a deletion OU and automate the delete after X number of days 

 Provide change approval/workflow for specific actions (such as: move the users to 

different information store/database) to occur in the directory with the ability to leverage 

the following features: 

o Delegate role based permissions to submitters 

- Create a workflow form that is populated with as many drop-down lists as possible 

for standardization 

- Validate user entry fields when form is submitted 

- Have multiple workflows based on action and role with the following outcomes: 

 Ability to execute a change and log the details 

or 

 Ability to flag the change for approval and e-mail a specific configurable 

distribution group 

- Notify all involved parties of the change via e-mail. 

 Operate without performing a Schema Extension to Active Directory 

 Have the ability to perform tasks outside of Active Directory once a user is provisioned 

in Active Directory 

 Have the ability to perform cross forest management 

 Provide full scale reporting of configuration, auditing, and permissions assigned across 

an Active Directory forest 

 Provide a self service option. to allow users to update designated attributes of their 

Active Directory account 

 Provide a rotation based load balancing model for Exchange mailbox provisioning as 

described below. Additionally, the purpose of this tool is to determine the availability of 

any Exchange mailbox database store for future provisioning based on whether the 

Exchange mailbox database store contains a configurable number of users, and if so, the 

store is to be unavailable for further automated provisioning. 

o Of the current mailbox database stores dedicated for a specific tier of users, the 

mailbox provisioning tool is to check the number of users in the tier for each of 

the stores before provisioning a mailbox and presenting the mailbox database 

store with the lowest amount of the users in that tier to the System Administrator 

as the proposed mailbox database store for the new user to be provisioned from. 

This solution will provide a rotation-based load balancing model. 

FOIA Requested Record #FA-10-0127 

Page 17 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 6-3 EOSS-RFQ/701068-V1.1

 Have the ability to automate the account creation and deletion process to improve Active 

Directory integrity and security by preventing the creation of additional accounts or 

orphaned accounts 

 The quotation shall include pricing for both 3 year and 5 year support/maintenance

 The quotation shall include 24 x 7 x 365 support with 4 hour response 

Request for Quote – Provisioning System

Product/Component Description Unit Quantity Total Quantity

Support for approximately 120,000 user objects as well as 

associated computers, groups, and resources. 1 120,000

Support Maintenance - 3 Yrs 1

120,000

Support Maintenance - 5 Yrs 1

120,000

24 x 7 x 365 support with 4 hour response 1 120,000

FOIA Requested Record #FA-10-0127 

Page 18 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 7-1 EOSS-RFQ/701068-V1.1

7. GROUP POLICY OBJECTADMINISTRATION TOOL 

7.1 Description 

The key component of the Group Policy Object (GPO) Administration Tool will be to allow 

State Administrators the ability to create, modify and delete GPOs for their own State. State 

Administrators should not have the ability to see other States GPOs even though all the GPOs 

will be located in one Domain. A workflow process should also be included so that Enterprise 

Administrators can review and authorize any changes to GPO‟s made by the State 

Administrators. The tool should also have the ability to compare dozens of GPOs in multiple 

Domains and do comparative analysis on all of them. 

7.2 Requirements 

The GPO Administrator Tool shall include the following features: 

 Licenses to support 120,000 users and/or 5,000 GPOs 

 Provide workflow processes which will allow GPO creation, deletion and modification to 

be implemented only after being authorized 

 Provide comparison and analysis tools to compare many GPOs across many Domains 

into one report. 

 Provide the ability to run resultant sets of policy on production objects without 

implementing changes or actually affecting production. 

 Limit the ability to view and modify GPOs based on AD Group Membership. 

 Provide auditing of GPO changes, noting what was changed and who made the change. 

 Supports GPOs using Microsoft Group Policy Preferences 

 Provide GPO versioning and the ability to rollback to previous versions 

 The quotation shall include pricing for both 3 year and 5 year support/maintenance

 The quotation shall include 24 x 7 x 365 support with 4 hour response 

Request for Quote – GPO Tool

Product/Component Description Unit Quantity Total Quantity

Group Policy Object Administration Tool

1

120,000 users 

and/or 5,000 

GPOs

Support Maintenance - 3 Yrs 1

120,000 users 

and/or 5,000 

GPOs

Support Maintenance - 5 Yrs 1

120,000 users 

and/or 5,000 

GPOs

24 x 7 x 365 support with 4 hour response

1

120,000 users 

and/or 5,000 

GPOs

FOIA Requested Record #FA-10-0127 

Page 19 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 8-1 EOSS-RFQ/701068-V1.1

8. ACTIVE DIRECTORY MIGRATION TOOL 

8.1 Requirements

The AD Migration Tool shall include the following features to support 120,000 users: 

 Allow for the migration efforts to take place during normal business hours with 

insignificant impact to the user community 

 Users will have access to resources regardless of the user, computer, group, or resource 

migration status 

 Allows for customization of the software for unique migration situations 

 Customizable reports available throughout the migration process 

 Comprehensive management features for pre-migration planning and analysis. This 

capability shall include automatic discovery and assessment of users, groups and 

computer resources to simplify preparatory work. 

 Automated migration functions. Automatic update of permissions and resources, 

including Active Directory, Exchange, cluster servers, File and Print, SharePoint, IIS, 

SQL Server, etc. Automation of repetitive migration tasks. 

 Tool Performance. Tool should utilize parallel processing technology to minimize 

network traffic and maximize performance. 

 Flexible Synchronization Options: 

o Permit administrator to identify the specific DC to be used, schedule the exact 

time of synchronization, and specify the specific Organizational Units (OU) to 

synchronize 

o Tool shall provide open and scriptable interfaces that enable the administrator to 

address unique data migration requirements 

 Management: 

o Provide the capability to migrate, synchronize and restructure Active Directory 

from a single console 

o Provide project-based, controlled migration. Management reports that provide 

the capability to track and audit the progress of this migration project. 

 Test Environment: 

o Tool shall provide a means by which to model and simulate the migration 

o Tool shall be capable of duplicating current Forest environment and account for 

its unique variables 

o It shall be capable of proactively identifying and resolving potential issues, such 

as name conflicts, as well as select multiple target Organizational Units (OUs) 

before migration 

 Tool shall provide the following additional capabilities: 

o Updating AD object permissions 

o Delegation functionality 

o “Undo” functionality

o “Pruning and grafting” feature

o Automatic exclusion of disabled and expired accounts if desired 

 The quotation shall include pricing for both 3 year and 5 year support/maintenance

 The quotation shall include 24 x 7 x 365 support with 4 hour response 

FOIA Requested Record #FA-10-0127 

Page 20 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 8-2 EOSS-RFQ/701068-V1.1

Request for Quote – AD Migration Tool

Product/Component Description Unit Quantity Total Quantity

Active Directory Migration Tool 1 120,000 users

Support Maintenance - 3 Yrs 1 120,000 users

Support Maintenance - 5 Yrs 1 120,000 users

24 x 7 x 365 support with 4 hour response 1 120,000 users

FOIA Requested Record #FA-10-0127 

Page 21 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 9-1 EOSS-RFQ/701068-V1.1

9. BACKUP SOLUTION 

9.1 Requirements

 Shall provide licenses for 6 individual backup server instances 

o Must have scheduling capability to schedule backup jobs 

 Shall provide licenses for 75 Windows Server 2008 backups agents 

o Must be capable of backing up the system state on Windows Server 2008 

o Must provide functionality to backup files while they are in use 

 Shall provide licenses for 6 Microsoft SQL 2005/2008 agents 

 Shall include the ability for restoration of Active Directory objects covering 26 domain 

controllers 

 The quotation shall include pricing for both 3 year and 5 year support/maintenance

 The quotation shall include 24 x 7 x 365 support with 4 hour response 

Request for Quote – Backup Solution

Product/Component Description Unit Quantity Total Quantity

Licenses for individual backup server instances 1 6

Support Maintenance - 3 Yrs 1 6

Support Maintenance - 5 Yrs 1 6

24 x 7 x 365 support with 4 hour response 1 6

Licenses for Windows Server 2008 backups agents 175

Support Maintenance - 3 Yrs 1

75

Support Maintenance - 5 Yrs 1

75

24 x 7 x 365 support with 4 hour response 175

Licenses for Microsoft SQL 2005/2008 agents 1 6

Support Maintenance - 3 Yrs 1 6

Support Maintenance - 5 Yrs 1 6

24 x 7 x 365 support with 4 hour response 1 6

FOIA Requested Record #FA-10-0127 

Page 22 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

09 March 2010 10-1 EOSS-RFQ/701068-V1.1

10. EVENT LOG BACKUP SOLUTION 

10.1 Requirements

 The Event Log Backup solution will provide a secured centralized repository for 550 

Microsoft Windows Server Event Logs distributed throughout the WAN 

 Scavenge logs from specified servers once the logs are copied and verified as being 

successfully backed up by the backup software 

 Shall support all of the standard event logs in Windows Server 2008, Active Directory, 

and Microsoft Exchange 2010 

 Shall be able to delegate end-users permissions to allow them to perform complex queries 

of the event logs from subsets of servers and subsets of a server‟s event logs 

 Shall be able to define a retention period on the centralized repository 

 The system should have the ability to schedule the collection (polling) of event logs, with 

the ability to create different schedules for the different event logs 

 The system must provide end-users a method to query events that have not yet been 

transferred to the central repository 

 The quotation shall include pricing for both 3 year and 5 year support/maintenance

 The quotation shall include 24 x 7 x 365 support with 4 hour response 

Request for Quote – Event Log Backup Solution

Product/Component Description Unit Quantity Total Quantity

Event Log Backup Software 1 550 server agents

Support Maintenance - 3 Yrs 1

550 server agents

Support Maintenance - 5 Yrs 1

550 server agents

24 x 7 x 365 support with 4 hour response 1 550 server agents

FOIA Requested Record #FA-10-0127 

Page 23 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

08 March 2010 A-1 EOSS-RFQ/701068-V1.1

APPENDIX A: ACRONYMS 

AD Active Directory

AES Advanced Encryption Services

ARNG Army National Guard 

BES BlackBerry Enterprise Server

CAC Common Access Card

CAS Client Access Server

CHESS Computer Hardware Enterprise Software and Solutions

CON Certificate of Networthiness

COOP Continuity of Operations

DAG Database Availability Group

DAS Direct Attached Storage

DC Domain Controller

DB Database

DNS Domain Name System

DOD Department of Defense

DOIM Directorate of Information Management

DR Disaster Recovery

DS Domain Services

EOSS Enterprise Operations and Security Services

FC Fiber Channel

Gb Gigabit 

Gbps Gigabits per Second

FOIA Requested Record #FA-10-0127 

Page 24 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

08 March 2010 A-2 EOSS-RFQ/701068-V1.1

GFE Government Furnished Equipment

GPO Group Policy Object

GNEC Global Network Enterprise Construct

GUI Graphical User Interface

HA High Availability

HT Hub Transport

IA-APL Army Information Assurance Approved Products List 

IP Internet Protocol

IPv6 Internet Protocol version 6

iSCSI Internet Small Computer Systems Interface

I/O Input/Output

IT Information Technology

ITC IT Consolidation

JFHQ Joint Forces Headquarters

MM Mobile Messaging

MMC Microsoft Management Console

NAS Network Attached Storage

NETCOM U.S. Army Network Enterprise Technology Command

NG National Guard

NGB National Guard Bureau

NGB-AIN Army National Guard, Networks Division

NIPRNET Non-Classified Internet Protocol Router Network

NOC Network Operations Center 

OOB Out-of-Band

FOIA Requested Record #FA-10-0127 

Page 25 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

08 March 2010 A-3 EOSS-RFQ/701068-V1.1

OS Operating System

OTA Over The Air

OU Organizational Unit

OWA Outlook Web Application

PBX Private Branch Exchange

PDU Protocol Data Unit

PKI Public Key Infrastructure

PST Personal Information Store

RAID Redundant Array of Inexpensive Disks

RID Relative Identifier

SAN Storage Area Network

SAS Serial Attaches SCSI

SATA Serial Advanced Technology Attachment

SCSI Small Computer Systems Interface

S/MIME Secure Multipurpose Internet Mail Extension

SMS Short Message Service

SMTP Simple Mail Transfer Protocol 

SNMP Simple Network Management Protocol

SNTP Simple Network Time Protocol

SSL Secure Sockets Layer

STIG Security Technical Implementation Guide

TCP Transmission Control Protocol

TLOU Top Level OU

TNOSC Theater Network Operations and Security Center

UM Unified Messaging

FOIA Requested Record #FA-10-0127 

Page 26 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

08 March 2010 A-4 EOSS-RFQ/701068-V1.1

VM Virtual Machine

VSS Volume Shadow Copy Service 

WAN Wide Area Network

FOIA Requested Record #FA-10-0127 

Page 27 of 29

Posted to NGB Reading Room 

June 22, 2011
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

08 March 2010 B-1 EOSS-RFQ/701068-V1.1

APPENDIX B: DEFINITIONS 

The following Department of Defense memorandum provides the definitions of IP v6 capable 

products and networks as accepted in this document. 

FOIA Requested Record #FA-10-0127 

Page 28 of 29

Posted to NGB Reading Room 

June 22, 2011

CHIEF INFOR"MAlION O FFICER 

DEPARTMENT OF DEFENSE 

6000 DEFE NSE PE N TAGON 

WASHINGTON , DC 20301-6000 

_ 16 1003 

MEMORANDUM FOR SECRETARIES OF THE MILITARY DEPARTMENTS 

CHAIRMAN OF THE JOINT CHIEFS OF STAFF 

UNDER SECRET ARIES OF DEFENSE 

ASSISTANT SECRETARIES OF DEFENSE 

GENERAL COUNSEL OF THE DEPARTMENT OF 

DEFENSE 

DIRECTOR, OPERATIONAL TEST AND EV ALUA TION 

INSPECTOR GENERAL OF THE DEPARTMENT OF 

DEFENSE 

ASSISTANTS TO THE SECRETARY OF DEFENSE 

DIRECTOR, ADMINISTRATION AND MANAGEMENT 

DIRECTOR, PROGRAM ANALYSIS AND EVALUATION 

DIRECTOR, NET ASSESSMENT 

DIRECTORS OF THE DEFENSE AGENCIES 

DIRECTORS OF THE DOD FIELD ACTIVITIES 

CHIEF INFORMATION OFFICERS, MILITARY 

DEPARTMENTS 

SUBJECT: DoD Internet Protocol Version 6 CIPv6) Definitions 

References: Ca) DoD CIO Memorandum, DoD Internet Protocol Version 6 CIPv6) 

Interim Transition Guidance, September 29,2003 

Cb) DoD CIO Memorandum, DoD Internet Protocol Version 6 CIPv6) 

Implementation, February 6,2008 

Cc) DoD Internet Protocol Version 6 (IPv6) Address Plan, March 21, 2008 

Reference Ca) provided an initial DoD definition for IPv6 Capable systems or 

products. Reference (b) tasked the Office of the DoD Deputy CIO and the Defense 

Information Systems Agency to develop an IPv6 Capable definition in coordination with 

the DoD Components. 

The Department recognizes the need to update and clarify definitions ofIPv6 

Capable and IPv6 Enabled to establish common terminology and understanding for each 

term, establish a reference for universal reporting, and identify tasks and milestones 

needed for each definition. While the DoD defmitions are derived from the IPv6 

standard profiles contained in the DoD Information Technology Standards Registry 

CDISR), harmonization with U.S. Government definitions is achieved through the ongoing synchronization of the DISR and the National Institute of Standards and 
263-01-D-0050 

Request for Quotation for Supporting Technologies - Active Directory

08 March 2010 B-2 EOSS-RFQ/701068-V1.1

FOIA Requested Record #FA-10-0127 

Page 29 of 29

Posted to NGB Reading Room 

June 22, 2011

Technology IPv6 standard profiles. Accordingly, the following are to be used when 

defining DoD products and networks as being IPv6 Capable or Enabled: 

IPv6 Capable Products - Products (whether developed by commercial vendor or 

the government) that can create or receive, process, and send or forward (as 

appropriate) IPv6 packets in mixed IPv4/v6 environments. IPv6 Capable Products 

shall be able to interoperate with other IPv6 Capable Products on networks 

supporting only IPv4, only IPv6, or both IPv4 and IPv6, and shall also: 

- Conform with the requirements of the DoD IPv6 Standard Profiles for IPv6 

Capable Products document contained in the DISR 

- Possess a migration path and/or commitment to upgrade from the developer 

(company Vice President, or equivalent, letter) as the IPv6 standard evolves 

- Ensure product developer IPv6 technical support is available 

- Conform to National Security Agency (NSA) and/or Unified Cross Domain 

Management Office requirements for Information Assurance products 

IPv6 Capable Networks - Networks that can receive, process, and forward IPv6 

packets from/to devices within the same network and from/to other networks and 

systems, where those networks and systems may be operating with only IPv4, only 

IPv6, or both IPv4 and IPv6. An IPv6 Capable Network shall be ready to have 

IPv6 enabled for operational use, when mission need or business case dictates. 

Specifically, an IPv6 Capable Network must: 

- Use IPv6 Capable Products 

- Accommodate IPv6 in network infrastructures, services, and management 

tools and applications 

- Conform to DoD and NSA-developed IPv6 network security 

implementation guidance 

- Manage, administer, and resolve IPv6 addresses in compliance with the 

DoD IPv6 Address Plan (reference (c», when enabled 

IPv6 Enabled Network An IP network that is supporting operational IPv6 traffic, 

through the network, end-ta-end. 

Thank you for your support to this effort. My point of contact for this action is 

Mr. Kris Strance (Office of the Deputy CIO), (703) 607-0249, kris.strance@osd.mil. 

dJw_ 

Deputy Chief Information Officer