Enterprise Reporter 3.5.1 - Configuration Manager User Guide

To assign one or more specific domain controllers, choose Select available domain controllers, and then select the domain controllers from the list, or choose Select Available Domain Controllers from current Sub-Net and then select the domain controllers from the list.

Click OK.

AD Discovery: Decide what to collect from any domain in the discovery

When you run an Active Directory discovery, it is resolved to a list of domains. You can collect a variety of information from these domains. The basic domain information, including a list of all OUs in the domain, is always collected.

The following table outlines the additional information that can be collected. Collecting additional information impacts discovery performance. Options with a high performance cost will slow discovery performance more than options with a medium or low performance cost.

Table 27. Active Directory Discovery: Optionally collect information for the following objects

•

Collect the count of items in the TokenGroups attribute to monitor access token sizes and to assist with group cleanup and consolidation projects.

High

•

Query all domain controllers for last logon

The Active Directory® LastLogonTimestamp attribute is always collected for users and computers and can be used to determine if a user or computer account has recently logged onto the domain. To determine the actual time of the most recent logon for a user or computer account, enable this option to query all domain controllers for the LastLogon attribute. The LastLogon attribute is subsequently used to calculate the total number of times each domain user has successfully logged on (Number of Logons field).

There are two known cases where the Number of Logons total may be inaccurate.

•

Since the LastLogon attribute is not replicated, domain controllers that are retired, and are therefore not collected, may have contained logons for users that would be missing from the count.

•

The attribute can track up to 65535 logons. After this limit has been reached, it becomes an inaccurate indicator of user activity on this domain controller.

High

•

In addition, you may choose to collect remote desktop information for the accounts collected.

Medium

•

You may also choose to collect thumbnail photographs of domain users.

Medium

Groups and members

When this option is selected, groups and members are collected from the target domain.

High

•

Include members from foreign domains

When this option is selected, all members of the group are collected, even if those members are from other domains or other forests.

Medium

•

Collect nested groups and members from foreign domains

If Include members from foreign members is enabled, you can select this option to collect all nested groups and their members from foreign domains.

In addition to collecting Active Directory® objects, you may also choose to collect Active Directory® object permissions.

Active Roles Virtual Attributes and Active Roles Server

When this option is selected, Active Roles virtual attributes are collected from all targets managed by the Active Roles Server.

NOTE: Collecting Active Roles attributes for users, groups, computers, and organizational units can significantly increase the collection time. Some attributes that are known to increase collection time are:

•

edsaDialinAccessPermissions

•

edsaDialinApplyStaticRoutes

•

edsaDialinApplyStaticIP

•

edsaDialinCallbackNumber

•

edsaDialinCallbackOptions

•

edsaDialinCallerID

•

edsaDialinStaticIP

•

edsaDialinStaticRoutes

•

edsaDialinVerifyCallerID

If Active Roles Virtual Attributes is enabled, you must specify the Active Roles Server that manages the target domains. Optionally, you may supply credentials to be used for contacting the Active Roles Server during collection. If these credentials are left empty, the node credentials or alternate credentials specified in on the Name page of the discovery in Step 1. Create the Discovery (Name) will be used.

High

The following options further refine how collection tasks are handled. When collecting additional attributes, especially ones with a high performance cost, consider enabling these performance options to help improve collection performance.

Table 28. Active Directory Discovery: Additional Options

Options

Notes

Performance Options

•

Do not collect object counts

When this option is cleared, the discovery collects the total number of users, groups, contacts, computers, and organizational units. To collect summary counts of these objects and display them, reports such as Domain Summary, require this option to be cleared.

•

Create multiple tasks for each domain

A collection task is always created for each domain in an Active Directory® discovery. Selecting this option will create individual tasks for domains, users, groups, computers, domain controllers, permissions, and deleted objects. This allows tasks to be load balanced using multiple nodes.

Use LDAPS and specify port number

When selected, the Active Directory discovery will use Secure LDAP (LDAPS) and data will be encrypted in transit.

Choosing your Computer Scopes

Computer scopes determine what information will be collected when you run the discovery. There are several steps you should take to properly design your discovery.

Computer Discovery: Include scopes

You can specifically add domains, OUs, containers or computers. Domains, OUs and containers can contain many computers, which can significantly increase the time it takes to run the discovery.

For full information on using the browser to add scopes, see Step 2b: Choose scopes for your cloud discoveries . You can create scopes using a dynamic query, which is resolved when the discovery is run. This gives you the flexibility to describe the computers you want to target. For more information, see Using Queries to Define Your Scopes .


	NOTE: Use caution when creating your queries. Ensure that the resulting set of targets is not too large for a single discovery. As well, query results should not include computers included in another discovery of the same type. If a target is in more than one discovery of a particular type, rejected tasks will appear. For more information, see Data Collection Issues .

To explicitly include objects in your Computer scope

Click

Add.

- OR-

If you have a text file containing the computers to be selected, click Import and follow the steps as outlined in Importing Computers to Your Scopes .

In the treeview, locate the desired object and select it.
To select multiple objects, press Ctrl during selection.

For more information, see Filtering in the Browser .

- OR -

To add a scope using a query, expand the Add to scope menu, select Add scope using a query, and click Add. For more information, see Using Queries to Define Your Scopes .

- OR -

To include a scope using a subnet, expand the Add to scope menu, select Add Subnet, and click Add. For more information, see Using Subnets to Define Your Scopes .

Click Include to add to your selected scopes list.

Click OK.


	NOTE: When you add a domain, its child domains are not included - each domain must be explicitly added. When you add an OU or container, all children are included.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Enterprise Reporter 3.5.1 - Configuration Manager User Guide

AD Discovery: Optionally select one or more domain controllers

AD Discovery: Decide what to collect from any domain in the discovery

Choosing your Computer Scopes

Computer Discovery: Include scopes