-
Titolo
How to run a discover against a Trusted domain? -
Descrizione
How to configure a discovery to collect from a trusted domain? -
Risoluzione
At a minimum, the remote domain has to trust the domain where the ER server is installed. This needed as the the account that runs the node service has to authenticate to the ER server.
When ever possible, it is always recommended to deploy the ER node software on a machine that is local to the discovery targets, in this case the remote domain. The node service needs to be configured to run as an account from the ER domain and that has sufficient rights to the ER database (member of the Reporter_Discovery_Admins group should be sufficient) as well as local Administrator rights on the node machine.
If you are using a node installed in the remote domain, the following ports need to be open:
- Between the ER server and the Node server: 7737, 7738 and ICMP
- Between the node and the SQL server where the ER database is hosted: 1433 (or the port configured for SQL if not using the default of 1433)
- Between the ER server and the remote domain: 42, 53, 389 (needed to enumerate the remote domain when creating the discovery)
If you are using a node installed in the ER domain, the following ports need to be open:
- Between the node and the remote domain: 42, 53, 88, 137, 389, 445, 636, 3268
- Between the ER server and the remote domain: 42, 53, 389 (needed to enumerate the remote domain when creating the discovery)
When creating a discovery, by default, the node service account is used to run the discovery. If the account that is configured to run the node service does not have read rights to the remote domain, select "Use alternate credentials" on the first page of the discovery configuration and select an account that has read rights to the remote domain.
When you try to add the remote domain to the discovery Scope, if the domain does not appear in the Available Scopes window, right click Active Directory, select Add domain and enter the FQDN of the remote domain.