Chat now with support
Chat with Support

MessageStats 7.8.1 - Deployment Guide

MessageStats Architecture Overview Planning for Deployment Deployment Recommendations and Solutions

2. Enable delegation from the Reports Server to the Database Server.

The AD account used by the Web Reports application pool in IIS must be enabled for delegation to the MSSQLSvc SPN of the MessageStats database SQL server.  MessageStats creates the Web Reports application pool to "run as" NetworkService.  Consequently, you must enable the report server's AD account for delegation to the MSSQLSvc SPN.

To enable the report server AD Account for delegation to the database MSSQLSvc SPN
1
Open Active Directory Users and Computers and navigate to the properties for the MessageStats Reports server object.
2
Select the Delegation tab.
3
Select Trust this computer for delegation to any service to enable delegation from the server AD account to any SPN.
- OR-
Select Trust this computer for delegation to specified services only to add the MSSQLSvc SPN the list of specified services.
a
Click Add.
b
On the Add Services dialog, click Users or Computers.
c
Select the SQL service domain run-as account.
- OR -
Select the computer running the SQL server service (if the service is running as LocalSystem, NetworkService, or LocalService).
The SPNs for the account are added to the list of available services.
4
Select the MSSQLSvc SPN with the matching TCP port for the SQL Server instance that hosts the MessageStats database and click Add.
5
Click OK to save.

Once you have completed steps 1 and 2, you must either wait for Active Directory replication or you can manually force replication between all the domain controllers.

3. Specify Windows authentication in the QMSReports.udl file.

Now you must edit QMSReports.udl file located in MessageStats installation folder and ensure that Windows NT integrated security is used to log onto the MesssageStats database.

To verify authentication type in the QMSReports.udl file
1
On the server on which the MessageStats reports are installed, navigate to the MessageStats installation folder. By default, the installation folder is located at:
•
On 32-bit Windows computers: C:\Program Files\Quest\MessageStats
•
On 64-bit Windows computers: C:\Program Files (x86)\Quest\MessageStats
2
Double-click the QMSReports.udl file.
3
Select the Connection tab.
4
Ensure that Windows NT authentication is selected.

4. Enable IIS Settings and Restart IIS.

For MessageStats report servers that are hosted by Windows 2012 and later, you must ensure specific IIS settings are enabled under Authentication and that the applicationHost.config file is updated. For all Windows server versions, you must reset IIS by performing an iisreset.

To enable the Authentication Settings for Windows
1
In the Internet Information Services (IIS) Manager, select Sites | Default Web Site | MessageStats Reports.
2
Double-click Authentication and ensure the following settings are enabled:
•
ASP.NET Impersonation
•
Windows Authentication
IMPORTANT: As of release 7.7, for Web Reports, Anonymous Authentication must be disabled.
To update the config file for Windows
1
Locate the following file in the %windir%\System32\inetsrv\config folder:
applicationHost.config
2
Using a text editor such as Notepad, open the file and locate the <location> section that contains the following entry:
location path="Default Web Site/MessageStatsReports"
3
In the <authentication> section, find the entry for <windowsAuthentication> and look for the useAppPoolCredentials option:
•
If the useAppPoolCredentials option is in the <windowsAuthentication> entry, change the value to true.
•
If the useAppPoolCredentials option does not exist. add the option as follows: useAppPoolCredentials="true"
For example, the edited code might appear as follows:
<location path="Default Web Site/MessageStatsReports">
<system.webServer>
<security>
<authentication>
<anonymousAuthentication enabled="false" />
<windowsAuthentication enabled="true" authPersistSingleRequest="false" useKernelMode="true" useAppPoolCredentials="true">
</windowsAuthentication>
</authentication>
</security>

Perform an iisreset on the MessageStats reports server to ensure that IIS uses the updated delegation and QMSReport.UDL settings.

Deploying MessageStats Across Forests

MessageStats can be used in cross-forest scenarios to gather information from an Exchange organization that resides in a different forest by using an alternate account from the external forest and establishing a trust relationship.

The following steps must be completed to use MessageStats to gather information from an Exchange organization in an external forest.

In the following scenario, Domain A has MessageStats installed. Domain B holds the alternate account you want to use to connect to the second organization.

•
Domain A: MessageStats Console
•
Domain B (represents the client forest): Client Source Exchange Organization
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating