Enterprise Reporter 3.5.1 - Configuration Manager User Guide

Table 16. Microsoft 365 discoveries that may be excluded due to Multi-Factor Authentication
Type	Omitted objects and attributes
Azure Active Directory	No Risky users and Azure Active Directory extended attributes
Azure Resources	Fails with no data returned
Exchange Online	All Exchange Online Permissions, Mailbox Folders, Mailbox Statistics, Public Folders, Dynamic Groups and Members
Microsoft Teams	No files and folders (drives)
SharePoint Online	Fails with no data returned
One Drive	Fails with no data returned

Best Practices for Creating Discoveries

To get the best performance, and meet the needs of your reporting users, there are a number of things you should consider.

For On-Premises and Microsoft 365 Discoveries

•

The default settings of a discovery are designed to optimize performance. If you are going to change them, ensure that your reporting users require the data you are going to collect.

•

Schedule your discoveries to collect data only as frequently as required to satisfy the needs of your reporting users.

For On-Premises Discoveries

•

Group together targets in a discovery based on the data you are collecting. A discovery should collect generally the same data from all targets. For example, if you have some targets from which you only want to collect the Windows folder, and other targets from which you want to collect both the Windows and Program Files folders, you should create two different discoveries. This makes it easier to design and maintain discoveries.

•

Each discovery must be assigned to a cluster. Assign the discovery to the cluster geographically closest to the targets. If necessary, break a discovery into smaller discoveries to accomplish this. By assigning each discovery to a cluster, you can also control which nodes are used for each discovery. For example, you can create one cluster with two nodes for running your Active Directory discoveries and create a second cluster with 5 nodes for running NTFS discoveries.

•

Understand how each discovery type works with tombstoning. For example, you cannot collect SQL information from a single SQL Server using multiple discoveries; however, you can collect NTFS information for a single computer using multiple discoveries. Refer to Table 3. On page 48.

•

The following table contains sample collection timings for on-premises discoveries.

Table 17. Sample collection timings for on-premises discoveries
Discovery Type	Number of Objects	Number of Nodes	Collection Time
Active Directory	100,000 users	1	40 minutes
Active Directory	500,000 users, groups, and computers (includes 10 million group members)	2	11 hours
Computer	200 computers	12	25 minutes
File Storage Analysis	1 server with 1 million files and folders	1	2 hours 25 minutes
Exchange	1,000 mailboxes and 15,000 mailbox folders	1	40 minutes
Exchange	10,000 mailboxes with permissions	1	1 hour 20 minutes
NTFS	5 million files and folders with permissions	6	5 hours 50 minutes
NTFS	31 million files and folders with permissions	10	20 hours

Note: All collection times are affected by hardware specifications and network activity.

For Microsoft 365 Discoveries

•

Microsoft will throttle traffic when it determines the need for it. This means that when an Azure or Microsoft 365 discovery is running, Microsoft will send throttle warnings and force the collection to slow down or stop and wait for a specific period of time. In testing, Quest has seen a throttling delay period of two minutes. Quest has implemented methods to handle throttle warnings and keep the collection going. The use of multiple credentials can help minimize throttling.

For large collections, it is highly recommended that you provide multiple properly-provisioned credentials per discovery. For Azure discoveries, the credentials are alternately used to query the data from the tenant so using multiple credentials will reduce the number of calls per minute. For OneDrive discoveries, throttling is handled differently and the collection will only switch to an alternate credential if a throttling message is received.

In general, for large Microsoft 365 discoveries, testing has shown that providing three or more credentials works very well. If the Enterprise Reporter node log files indicate that the discovery credentials are consistently locked, try adding a credential to the discovery to assist collection.

•

Selecting smaller discoveries improves performance.

For OneDrive discoveries, select only the drives that contain information you need.

For Azure Active Directory discoveries, only collect Microsoft 365 object attributes if they are needed. For large Azure discoveries, Quest recommends creating multiple discoveries for the same tenant and splitting up discoveries by object type. It is recommended that you collect users and groups in one discovery and the remaining Azure objects in different discoveries. For Azure Active Directory discoveries, the reason to collect users and groups together is that users are group members and need not be collected twice.

For Azure Resource discoveries, select only the subscriptions that contain information you need. For large subscriptions, Quest recommends creating multiple discoveries for each subscription.

•

Understand how each discovery type works with tombstoning. For example, you can collect Azure AD objects from a single tenant across multiple discoveries and data will not be tombstoned. For more information, see How Scopes Affect Tombstoning .

•

Understanding how your discovery will resolve to collection tasks is very important.

For Azure discoveries, as show in Table 18, the scoped tenant will resolve to a single collection task for the tenant. This means that if you want to use more nodes for the collection of a single tenant, you should create a discovery by object type for optimal performance. For Azure discoveries, there are five object types (users, groups, contacts, roles, and service principals) that can be collected so a maximum of five nodes can be used at one time.

For OneDrive discoveries, as shown in Table 18, the scoped tenant will resolve to a single collection task for the tenant, but the discovery will be tombstoned based on the drives, not the object type as in Azure AD discoveries. This means that if you want to use more nodes for the collection of a single tenant, you must create a discovery for each drive or group of drives. For example, if your tenant has 10 drives, you can create 10 discoveries so a maximum of 10 nodes can be used at the same time.

•

The following table contains sample collection timings for Microsoft 365 discoveries.

Table 18. Sample collection timings for Microsoft 365 discoveries
Discovery Type	Number of Objects	Number of Nodes	Number of Discovery Credentials	Number of Threads (OneDrive only)	Collection Time
Azure AD	30,000	1	2	N/A	30 minutes
Azure AD	300,000	1	1	N/A	5.5 hours
Azure Resource	7 subscriptions with 7,000 resources	1	3	N/A	30 minutes
Exchange Online	1,000 mailboxes	1	1	N/A	8 minutes
Exchange Online	1,000 mailboxes with permissions and delegates	1	1	N/A	3 hours 59 minutes
Exchange Online	1,000 mailboxes with folders	1	1	N/A	1 hour 12 minutes
Exchange Online	1,000 mailboxes with folders	1	3	N/A	24 minutes
Exchange Online	5,000 mailboxes	1	1	N/A	15 minutes
Exchange Online	5,000 mailboxes with permissions	1	1	N/A	4 hours 35 minutes
Microsoft Teams	1,000 teams with 10,000 files and folders	1	1	N/A	1 hour 30 minutes
Microsoft Teams	1,000 teams with 200,000 files and folders	1	1	N/A	5 hours
OneDrive	Drives: 1 Files/Folders: 400,000	1	11	10	17 hours
OneDrive	Drives: 5 Files/Folders: 20,000	1	5	10	1
OneDrive	Drives: 100 Files/Folders: 500,000	1	11	10	21 hours
SharePoint Online	20,000 Site Collections (25,000 sites including 5000 sub-sites)	1	1	N/A	2 hours

Note: All collection times are affected by hardware specifications and network activity.

Improving the Performance of Your Discoveries

When a discovery is run on a cluster, the Enterprise Reporter server assigns work to its nodes. You can add nodes to a cluster at any time. Each node can only belong to one cluster. You can increase the performance of your discoveries by ensuring that nodes are configured to optimize the maximum number of concurrent tasks or by adding new nodes.

Each collection task is assigned to a node, balancing the distribution across the nodes until all the nodes are processing as many tasks as they are able. If no nodes are available to process the task, the task must wait until a node becomes available.

Node performance is based on a combination of memory, processor speed, and network bandwidth. If your network, computer memory, or processor speed are less than you would like, consider adding nodes. If your node is under used, set the maximum concurrent tasks to 0 to optimize node performance instead of adding more nodes. If a node starts to slow down when node performance is already optimized (by setting the maximum concurrent tasks to 0), adding a node will increase performance. For more information, see Nodes and Improving the Performance of a Node .

Adding a Node

Since a node must belong to a cluster, you must first create a cluster. For more information on creating clusters, see To create your first cluster and node .


	NOTE: The credentials you provide are the credentials used to access the targets of your discovery. Ideally, this should be a service account that has elevated privileges, not a user account. The account must be a member of the group Reporter_Discovery_Nodes. If you use credentials that are different than the Enterprise Reporter server credentials, they must be granted access to the database.


	NOTE: Performance counters must be enabled on the node machine as the performance information is required by the Enterprise Reporter node performance optimization functionality.

To add a node

On the Manage Discovery Clusters pane, select the cluster to which the node will be added.

In the bottom pane, on the Discovery Nodes tab, click Add Node.

Browse to the computer where the node is to be created and click OK.

Select a service account from the Credential Manager.

If the account you want is not on the list, click Add and enter the credential, then select it from the list. For more information, see Using the Credential Manager .


	NOTE: These credentials are also used to access the target computers during a discovery, unless alternate credentials are specified for a discovery. For more information, see Step 1. Create the Discovery (Name) .

To use SQL credentials to connect to the database, select Database Credential, then choose SQL Authentication and select the SQL account from the Credential Manager.

Optionally, select Specify an alternate credential for Node service deployment, then select the account.


	NOTE: This account must have permission to copy files in the Admin$ share folder and to install and run services.

Set tasks to be System - managed to optimize performance. For more information, see Nodes and Improving the Performance of a Node .


	NOTE: CPU load is always used to determine how many concurrent tasks are assigned. Optionally, enter any number greater than 0 to set a Maximum number of tasks that the node will never exceed.