Enterprise Reporter 3.5.1 - Quick Start Guide


	NOTE: SQL Server performance is needed to support inserting data into the database tables and to support querying that data for reporting purposes. To improve the performance of data collection or reporting, consider enhancing the SQL Server memory and processor.

Database size estimator

The Enterprise Reporter database is the storage location of all data collected for reporting. As such, the amount of hard disk space required is directly related to the amount of data being collected. The Database Size Estimator tool shipped with Enterprise Reporter can help determine how much space will be required.

Larger environments

Larger environments may have additional requirements for memory, processor, and hard disk space. There are many factors that can affect these requirements.

•

The type of collections being performed.

Some discoveries collect many object types and attributes that require multitudes of inserts into multiple database tables; therefore, they require a more robust SQL Server. Other discoveries collect just a few object types that require minimal inserts into a few database tables; therefore, they require a less robust SQL server.

For example, A computer discovery collecting 10,000 computers will be inserting into 20+ database tables. An NTFS discovery collecting 10,000 files and folders will only be inserting into 3 database tables. The inserts are more expensive and the computer discovery will require more SQL server resources.

•

The size of collections being performed.

The size of the database directly relates to the amount of data being collected and being queried from the SQL Server. In other words, the size of the database directly relates to the number of rows in the database. Each discovery type stores different amounts of data. Use the Database Estimator tool for further information based on the types of collections being performed.

•

The location of the SQL Server in relation to the collection targets.

The power of your SQL Server combined with the performance of your network will dictate how fast data can be sent and retrieved from the database. The further away the SQL server is from collection targets and the slower the network speeds, the more a robust SQL Server will help improve performance.

New required hardware

The following hardware is required for Enterprise Reporter 3.2 and higher.

•

Intel® or AMD 2 GHz multiprocessor (with at least 2 cores)

Supported operating systems

The following operating systems are supported for Enterprise Reporter components.


	NOTE: It is not recommended that the server or console be installed on a domain controller.

Table 5. Supported Operating Systems
	ER Server	Consoles	Nodes
Operating Systems	Enterprise Reporter
Windows Server® 2022	X	X	X
Windows Server® 20H2	X		X
Windows Server® 2004	X		X
Windows Server® 1909	X		X
Windows Server® 1903	X		X
Windows Server® 2019	X	X	X
Windows Server® 1809	X		X
Windows Server® 2016	X	X	X
Windows Server® 1803	X		X
Windows® 11		X
Windows® 10		X

The following operating systems are supported for Enterprise Reporter discovery targets.

Table 6. Supported Operating Systems for Discovery Targets


	Active Directory	Windows Server	File Storage Analysis	SQL Server	Exchange
Supported Operating Systems for Discovery Targets	Licences
Domain Functional Levels
Windows Server® 2016 Functional Level	X
Windows Server® 2012 R2 Functional Level	X
Windows Server® 2012 Functional Level	X
Computers
Windows Server® 2022		X	X
Windows Server® 20H2		X	X
Windows Server® 2004		X	X
Windows Server® 1909		X	X
Windows Server® 1903		X	X
Windows Server® 2019 and 1809		X	X
Windows Server® 2016 and 1803		X	X
Windows Server® 2012, 2012 R2, and 2012 Core		X	X
Windows® 11		X	X
Windows® 10		X	X
Windows® 8.1		X	X
Network Attached Storage (NAS) Devices
Dell Fluid File System 6.0		X	X
Dell Fuild File System 5.0		X	X
NetApp® 9.4		X	X
NetApp® 9.3		X	X
NetApp® Filer - Data ONTAP® 8..x - 9.x and above (Cluster mode is supported as of version 8.2)		X	X
EMC Isilon OneFS (Collections require a secure connection to Isilon with a valid certificate.)		X	X
EMC® VNX 7.1.47.5 X (Supported by collecting as a Windows Server)		X	X
EMC® VNX 7.0.35.3 X (Supported by collecting as a Windows Server)		X	X
Pure Storage FlashBlade Purity//FB 4.3.0 * Note: File Storage Analysis partially supported for Pure Storage Flashblade device. Collection of files, folders and shares is supported. Collection of volumes and computer information is not supported.		X	X*
SQL Server Instances
SQL Server® 2022				X
SQL Server® 2019				X
SQL Server® 2017				X
SQL Server® Clusters				X
SQL Server® 2016				X
SQL Server® 2014				X
SQL Server® 2012				X
Exchange Servers
Exchange® 2019					X
Exchange® 2016					X
Exchange® 2013					X

Active Roles supported versions

The following versions of Active Roles are supported as targets of Active Directory discoveries. See the Active Roles web site for the hardware and software requirements for your version of Active Roles.

•

•

•

•

•

•

•

•

IT Security Search supported versions

Enterprise Reporter can be configured to send discovery information to the following versions of IT Security Search. See the IT Security Search web site for the hardware and software requirements for your version of IT Security Search.

•

IT Security Search 11.4.1

•

IT Security Search 11.3

Supported Internet protocols

Enterprise Reporter can support IPv6 (Internet Protocol version 6) as well as IPv4.

SQL Server supported versions

The following versions of SQL Server® are supported for the Enterprise Reporter database. See the Microsoft® web site for the hardware and software requirements for your version of SQL Server®:

•

SQL Server® 2022

•

SQL Server® 2019

•

SQL Server® 2017

•

SQL Server® 2016

•

SQL Server® 2014

•

SQL clusters and database mirroring are supported for your deployment, including

•

SQL Server® 2016 Always On

•

SQL Server® 2014 Always On

Using SQL Server certificates

SSL encryption of SQL Server connections using certificates

Enterprise Reporter can be configured to work with a SQL Server® instance. To secure communications while working with Enterprise Reporter, data sent over connections to the SQL Server can be encrypted using an SSL certificate.

The steps required to configure this encryption are as follows.

•

Using the Microsoft Management Console (MMC):

•

Install the Certificates snap-in for the SQL Server host computer.

•

Import the certificate to the SQL Server host computer.

•

Using SQL Server Configuration manager:

•

Configure the SQL Server to use the certificate.

•

Configure the SQL Server to force encryption.

•

Restart the SQL Server host computer.

•

Import the certificate to all Enterprise Reporter computers that will communicate with the SQL Server, such as the:

•

Enterprise Reporter server host computer

•

Enterprise Reporter nodes

•

Enterprise Reporter Configuration Manager host computer

•

Enterprise Reporter Report Manager host computer

•

Install Enterprise Reporter on a host computer.

Required software

The following software is required for Enterprise Reporter.

•

Microsoft.NET Framework 4.8

•

Microsoft Excel 2010, 2013, 2016, or 2019 (required to view reports exported as spreadsheets)

•

Microsoft 365 Excel

•

PowerShell 3.0

Active Roles required software

To collect Active Roles information, the following software is required on the computer where the Enterprise Reporter Configuration Manager is installed and on the computer where the Enterprise Reporter node is installed:

•

ADSI Provider (the version must match the Active Roles version)

For more information and installation instructions, see the Active Roles Quick Start Guide.

The following additional considerations are required:

•

There must be a trust between the Enterprise Reporter domain and the Active Roles domain.

•

The credentials used for the Active Roles discovery must have access to the Active Roles domain.

Exchange required software

To collect Exchange information, the following additional considerations are required:

•

Ensure the Windows Remote Management (WinRM) service is running.

To collect Exchange mailbox folders, the following additional considerations are required:

•

Impersonation needs to be configured on the Exchange organization. Refer to your Exchange Server documentation or use the following method to set up role assignments.

•

PowerShell can be used to add an assignment

New-ManagementRoleAssignment –Name:impersonationAssignmentAdministrator
–Role:ApplicationImpersonation –User:Administrator

•

Alternatively, you can create an administrator role with ApplicationImpersonation role assigned to it and add the required account as a member (or assign ApplicationImpersonation role to an existing administrator role)

Exchange Online required software

To collect Exchange Online information, the following additional considerations are required:

•

Ensure the Windows Remote Management (WinRM) service is running.

Multi-Factor Authentication Cloud Discovery Credential Limitations

Cloud discoveries (Azure Active Directory, Azure Resources, Exchange Online, Teams, and SharePoint Online) support both MFA (Multi-Factor Authentication) enabled and disabled credentials. However, using Multi-Factor Authentication enabled credentials on cloud discoveries can result in an incomplete collection that omits one or more of the following objects and attributes.See the following table for details.

Table 7. Cloud discoveries that may be excluded due to Multi-Factor Authentication
Type	Omitted objects and attributes
Azure Active Directory	Risky users and Azure Active Directory extended attributes
Azure Resources	Fails with no data returned
Exchange Online	All Exchange Online Permissions, Mailbox Folders, Mailbox Statistics, Public Folders, Dynamic Groups and Members
Microsoft Teams	No files and folders (drives)
SharePoint Online	Fails with no data returned
One Drive	Fails with no data returned

Required services

The following services are required on the Enterprise Reporter server and nodes.

•

Net.TCP Port Sharing

The following services must be enabled on discovery targets for collections.

•

Remote Registry

•

SQL Server Browser service for SQL Discovery

•

Windows Management Instrumentation (WMI)

Overview of Enterprise Reporter communications and required credentials

There are many communication channels in Enterprise Reporter, involving different sets of credentials. This allows for controlled access to your environment, but you must understand where each set of credentials are used and the permissions they need.

Figure 2 outlines where and for what each of the credentials are used, and the following tables explain the necessary permissions. For information on managing the credentials used in the Configuration Manager, see the Using the Credential Manager section in the Quest Enterprise Reporter Configuration Manager User Guide.

Figure 2. Credentials used to communicate in the Configuration Manager

Topics:

•

Node credential and alternate credential details for on-premises discoveries

•

Detailed permissions for Enterprise Reporter discoveries

•

Permissions for Enterprise Reporter discoveries on NAS devices

•

Permissions for Enterprise Reporter tenant applications

Node credential and alternate credential details for on-premises discoveries

Node credentials are provided when a discovery node is created, and you can modify them as needed. By default, the node’s credentials are used to enumerate scopes and access on-premises targets.

If you want to use different credentials for a particular discovery, you can configure them in the Discovery Wizard. By using these alternate credentials, you can target anything on-premises for which you have credentials, in any domain. You can minimize the permissions given to node credentials, and use alternate credentials for scoping and collecting your on-premises discoveries.

The following table outlines the use of the node and alternate credentials, and how to properly configure your environment to ensure successful data collection:

Table 8. Node Credentials and Alternate Credentials in Configuration Manager
From	To	Permission Details	Configuration
Discovery Node	Enterprise Reporter Server	Provide server with job status, errors, statistics and logs.	Configured during node creation, or when you edit the node properties to change the credentials. The node credentials must have local administrator access to the host computer and be a member of the group “Reporter_Discovery_Nodes”.
Discovery Node	Shared Data Location (if the cluster is configured to use one)	Read and write to the shared data location during data collection.	The shared data location is configured during the creation of a cluster. Ensure the node has read and write access to this file share. For more information, see the Things to Consider Before Creating a Cluster section in the Configuration Manager User Guide
Discovery Node	Enterprise Reporter Database	There are two options for communicating with the database: 1. You can use the same service credentials that the node service uses. 2. You can specify SQL credentials only for use when the database is accessed. The credentials you choose must be able to read and write to the database.	The account must be in the Reporter_Discovery_Nodes security group. (Note that if you use the same account as the Enterprise Reporter server it is already permissioned appropriately). If you use SQL authentication to connect with the database, you must manually permission the SQL user, either by adding them to the database role Discovery_Nodes_Role or by permissioning specific tables in the database.
Discovery Node	Targets	Read access on all targets. For on-premises discoveries, all domains with which the credentials have a forest or domain level trust will be enumerated. If required, you can configure alternate credentials for specific discoveries, instead of using the default node credentials.	The targets are defined as part of a discovery. The discovery tasks are assigned to a particular node based on availability, so all nodes in a cluster should have access to all targets defined in all discoveries assigned to the node’s cluster. For on-premises discoveries, ensure the node credentials or alternate credentials have read access to the target. In addition, a trust is required between the node computer and the targets. For more information on Azure and Microsoft 365 Discoveries, see Detailed permissions for Enterprise Reporter discoveries .