Enterprise Reporter 3.5 - Installation and Deployment Guide

Table 16. Security Group Types
Security type	Location of group	Who you can add to the group
Domain Local (recommended)	Added to the domain Users OU The groups are given the appropriate SQL roles.	A domain local group can have the following members: user accounts, groups with universal scope, and groups with global scope — all from any domain. If users are in multiple domains, this type of group is required.
Global	Added to the domain Users OU The groups are given the appropriate SQL roles.	A domain global group can have the following members: accounts from the same domain and other groups with global scope from the same domain. If all users are in the same domain, this type of group may be used.

Your choice will affect the following options:

•

Determine where the groups will be created and what type of groups they are—Active Directory objects (Domain Local and Global groups).

•

Determine who in your environment can be added to the groups (and therefore who can access Enterprise Reporter).

•

The account being used to create the database will be added to the security groups, thus giving this account full access to Enterprise Reporter.


	NOTE: To create groups, the currently logged-in account must have appropriate rights for the type of groups you are creating. If you are creating Domain Local or Global groups, you must be able to add users to the domain Users OU, and add members to groups.

Role-Based Security in Enterprise Reporter

The data collected and reported by Enterprise Reporter can contain sensitive information about your environment. To ensure that only appropriate users can access this information, each console has role based security.


	NOTE: During installation, the logged-in user is added to the Reporter_Discovery_Admins group, the Reporter_Discovery_Nodes group, and the Reporter_Reporting_Admins group. The Enterprise Reporter server service account is added to the Reporter_Discovery_Admins group and Reporter_Discovery_Nodes group.


	NOTE: Each security group name may be customized during installation. The security group names for your system are displayed on the Configuration Manager System \| Information page.

To be able to open a console, you must be assigned to one of the security groups. Four security groups are created when the Enterprise Reporter server is installed, and four are associated with SQL roles:

Table 17. Security Group and SQL Role Permissions

Security Group

SQL Role

Permissions

Reporter_Discovery_Admins

Discovery_Admin_Role

(also known as discovery administrator)

•

Access to all functionality in the Configuration Manager

Reporter_Reporting_Operators

Reporting_Operator_Role

(also known as reporting user)

•

Run published reports

•

Copy published reports to My Reports.

•

Create and edit reports in My Reports container

•

Export report definitions from Published Reports and My Reports

•

Import report definitions into My Reports

•

Manage the My Reports container (move, copy, create categories)

Reporter_Reporting_Admins

Reporting_Admin_Role

(also known as reporting administrator)

•

All reporting user functionality

•

Paste or import reports into the Published Reports container

•

Publish to SSRS

•

Run reports from the Report Library

•

Export report definitions and copy from the Report Library

•

View all reporting users’ schedules, edit the properties of the schedule, or delete it

Reporter_Discovery_Nodes

Discovery_Nodes_Role

•

Deployment of node

•

Upgrade of node

•

Access to all functionality on the Enterprise Reporter Node

To add a user or group to a security role

•

Determine if your security groups are domain groups by checking the System | Information page.

•

To add an account to the discovery administrator role, use native tools to add the user to the Reporter_Discovery_Admins group.

•

To add an account to the reporting administrator role, use native tools to add the user to the Reporter_Reporting_Admins group.

•

To add an account to the reporting user role, use native tools to add the user to the Reporter_Reporting_Operators group.

•

To add an account to the discovery node role, use native tools to add the user to the Reporter_Discovery_Nodes group.

For more information, see the Microsoft documentation for your operating system.

Managing Your Database Using the Database Wizard

By default, the Database Wizard is installed on the same computer where the server is installed. You can also install it on a separate computer if needed. For more information, see Installing the Components . Using the Database Wizard, you can:

•

Create a new database. This gives you the option to create a new database or to connect to an existing empty database. You may then select this database during subsequent server installations.

•

Select or Upgrade an Enterprise Reporter database. You can use this to change the database or server that you want to use, to change the type of authentication you are using, or to change the SQL credentials.

When you select a database, it is automatically upgraded if it is not the same version as the server.


	CAUTION: It is recommended that you back up your database and encryption key before upgrading it, or before changing to a different database, as this may trigger an upgrade. You cannot undo an upgrade once it has started.