Enterprise Reporter 3.2.2 - Configuration Manager User Guide

What does the status of a node or cluster indicate?

As you deploy, enable and disable nodes and clusters, the Configuration Manager gives you feedback. This feedback is visible in the Status column of the Manage Discovery Clusters pane. By default, clusters and nodes are grouped and sorted by Status.

NOTE: You can change the sort order and grouping of your nodes and clusters.

The following table outlines each status of a cluster:

The following table outlines each status of a node:

Using the Credential Manager

Credentials are used in different places in Enterprise Reporter. For example, nodes and report schedules both use credentials. The Credential Manager is a central store for accounts and passwords used throughout the system. This makes it easy to keep passwords up to date, and allows you to enter the credential details once, and access them repeatedly.

NOTE: Office 365 discoveries now support multi-factor authentication. The Office 365 discovery credentials will need to be authenticated by Microsoft through the Credential Manager. NOTE: Credentials added in the Report Manager are only available to the user who added them, while accounts added in the Configuration Manager are available to all Configuration Manager users on the same Enterprise Reporter server.

Accounts are not verified when you add them, and they must already exist in order to be used by Enterprise Reporter. For each account, you can add a description. This is particularly useful for differentiating between similar accounts, such as similarly named service credentials, or your SQL Server® default "sa" accounts. The combination of the account name and the description must be unique.

Accounts with multi-factor authentication enabled need to be authenticated by Microsoft through the Credential Manager.

Credential passwords are encrypted with FIPS 140-2 compliant algorithms and an encryption key that has a user-supplied password. The encryption key is secured in the Windows Credential Manager (not to be confused with the Enterprise Reporter Credential Manager). The encryption key is used to encrypt all passwords that are used in Enterprise Reporter for collections and reporting. Additionally, Enterprise Reporter security groups and roles are used to validate who has access to the encryption key and the key cannot be retrieved without proper authorizations.

The Credential Manager will display a red key icon next to each account that requires a password.

See also:

NOTE: If you are entering credentials in the Configuration Manager, remember that other users may have entered the same credential, so if necessary, verify that you are adding a unique account.

NOTE: The combination of the account name and the description must be unique.

NOTE: When entering credentials in the Configuration Manager, verify that no other users have used the same credential and that the account you are adding is unique.

NOTE: The Credential Manager displays a Last Authenticated On date, which indicates when the credential was authenticated through the Microsoft authentication process as a multi-factor authenticated credential. If there is no date, then the credential was not authenticated.

NOTE: When entering credentials in the Configuration Manager, verify that no other users have used the same credential and that the account you are adding is unique.

NOTE: The Credential Manager displays a Last Authenticated On date, which indicates when the credential was authenticated through the Microsoft authentication process as a multi-factor authenticated credential. If there is no date, then the credential was not authenticated.

NOTE: When entering credentials in the Configuration Manager, verify that no other users have used the same credential and that the account you are adding is unique.

NOTE: The Credential Manager displays a Last Authenticated On date, which indicates when the credential was authenticated through the Microsoft authentication process as a multi-factor authenticated credential. If there is no date, then the credential was not authenticated.

Changing Passwords Using the Credential Manager

When passwords are changed in Active Directory® and Azure Active Directory, they need to be updated everywhere they are in use in Enterprise Reporter. It is possible that the account could be locked if you do not make this change. The Credential Manager makes this easy by providing a central store for accounts. You can change the password, and it is updated in all nodes, schedules, discoveries, and so on.

NOTE: You can modify credentials from anywhere you can access the Credential Manager. Be aware when you make a change to a credential, it is applied throughout your deployment, not just in your current context.

If you modify credentials that are used by a discovery node, the node service must be restarted before the changes take effect. Enterprise Reporter will attempt to restart the node; however, if the restart fails, you may need to manually start the service on the computer hosting the node. If there are jobs currently running on the node, they will be canceled. To prevent this, either change the credentials during a down time, or cancel the discoveries yourself and restart them once the change takes effect.

Credential passwords are encrypted with FIPS 140-2 compliant algorithms and an encryption key that has a user-supplied password. For further information on creation and management of the Enterprise Reporter encryption key, see Appendix: Encryption Key Manager .

The Credential Manager will display a red key icon next to each account that requires a password.

NOTE: The Credential Manager displays a Last Authenticated On date, which indicates when the credential was authenticated through the Microsoft authentication process as a multi-factor authenticated credential. If there is no date, then the credential was not authenticated.

NOTE: When entering credentials in the Configuration Manager, verify that no other users have used the same credential and that the account you are adding is unique.

NOTE: The Credential Manager displays a Last Authenticated On date, which indicates when the credential was authenticated through the Microsoft authentication process as a multi-factor authenticated credential. If there is no date, then the credential was not authenticated.

Changing Account Names Using the Credential Manager

In general, if you want to change an account name, it is recommended that you create a new credential, and delete the old one. However, in the case where you want to replace the credentials in use in a number of places in Enterprise Reporter, the Credential Manager enables you to make a single change and have it be applied across your deployment. For example, if you are provided a new service credential to replace a credential used for a dozen nodes in your environment, you can change the account name on the credential.

If you modify credentials that are used by a discovery node, the node service must be restarted before the changes take effect. Enterprise Reporter will attempt to restart the node; however, if the restart fails, you may need to manually start the service on the computer hosting the node. If there are jobs currently running on the node, they will be canceled. To prevent this, either change the credentials during a down time, or cancel the discoveries yourself and restart them once the change takes effect.

NOTE: The Credential Manager displays a Last Authenticated On date, which indicates when the credential was authenticated through the Microsoft authentication process as a multi-factor authenticated credential. If there is no date, then the credential was not authenticated.

NOTE: When entering credentials in the Configuration Manager, verify that no other users have used the same credential and that the account you are adding is unique.

NOTE: The Credential Manager displays a Last Authenticated On date, which indicates when the credential was authenticated through the Microsoft authentication process as a multi-factor authenticated credential. If there is no date, then the credential was not authenticated.