Enterprise Reporter 3.5.1 - Installation and Deployment Guide

Table 16. Credential Use and Required Permissions
Credentials	Used For	Permissions Needed
Logged in user	Installing the components of Enterprise Reporter	Administrator access on the local computer.
	Creating the Enterprise Reporter database, roles and logins on the SQL Server® (unless SQL credentials are provided)	Must have the right to create databases, logins and groups.
	Creating the security groups	Depends on the type of groups that are chosen, but must have the right to create groups in the chosen environment.
	Securing the Configuration Manager and the Report Manager. The logged in user is added to the Reporter_Discovery_Admins, Reporter_Reporting_Admins, Reporter_Reporting_Operators, and Reporter_Discovery_Nodes security groups as an administrator for both consoles when installing the server.
Service Account Supplied during installation	Installing and running the Enterprise Reporter server	Login as service right is conferred on the service account by the logged in credentials during installation.
	Connecting to the Enterprise Reporter database (unless SQL permissions are provided)	Read and write permissions are automatically granted during database creation.
	Securing the Configuration Manager and Report Manager. The service account is automatically added to the Reporter_Discovery_Admins, Reporter_Reporting_Admins, Reporter_Reporting_Operators, and Reporter_Discovery_Nodes security groups when installing the server.
Optional SQL credentials Supplied during installation	Can be used to create the Enterprise Reporter database	Must have the right to create databases, logins and groups.
Optional SQL credentials Supplied during installation	If supplied, are used to connect the database by the Enterprise Reporter server.	Read and write permissions are automatically granted during database creation.

Port Requirements

For the Enterprise Reporter components to communicate, some ports must be open.

•

The default port used for communication between the server and the consoles is 7738. This port is also used by the nodes to access the server. The port is configured during installation of the server, and is required in the connection dialog box for both the Configuration Manager and the Report Manager.

You can view the port currently in use on the Information page in the Configuration Manager, and the System Information tab in the Report Manager.

•

The default port used for communication from the Enterprise Reporter server to the nodes is port 7737. This port may be configured during installation.

The following figure shows the ports that are used by the various Enterprise Reporter components.

Figure 3. Ports used by Enterprise Reporter components.

*For more information on ports used when creating a discovery, see Table 17.

**For more information on ports used during data collections, see Table 18.

The following table shows the ports used by all of the Enterprise Reporter components.

Table 17. Ports used by Enterprise Reporter components
			Configuration Manager	Report Manager	SQL Server	ER Server	ER Nodes
Application	Port	Type	Components
FTP	20, 21	TCP		X
SMTP	25	TCP	X	X		X
WINS / NetBiOS Name Resolution	42	TCP UDP				X
DNS FQDN Resolution	53	TCP UDP	X	X		X
Kerberos	88	TCP UDP	X			X
RPC Service & Endpoint Mapper / WMI	135	TCP UDP	X
NetBIOS Name Service	137	UDP				X
NetBIOS Datagram (browsing)	138	UDP	X
LDAP	389	TCP UDP	X
SQL	1433	TCP		X	X	X	X
SQL Server Browser Service	1434	TCP UDP	X	X
Enterprise Reporter Node	7737	TCP				X	X
Enterprise Reporter Server	7738	TCP	X	X		X	X

The following table outlines the ports used by all of the Enterprise Reporter discoveries.

Table 18. Ports used by Enterprise Reporter discoveries
			Active Directory	Azure Active Directory	Azure Resource	Computer	Exchange	Exchange Online	File Storage Analysis	Microsoft Teams	NTFS	OneDrive	Registry	SharePoint Online	SQL Server
Application	Port	Type	Discoveries
WINS / NetBiOS Name Resolution	42	TCP UDP	X			X	X		X		X		X		X
DNS FQDN Resolution	53	TCP UDP	X			X	X		X		X		X		X
HTTP	80	TCP		X	X		X*	X		X		X		X	X
Kerberos	88	TCP UDP	X			X	X*		X		X		X		X
RPC Service & Endpoint Mapper / WMI	135	TCP UDP				X			X		X		X		X
NetBIOS Name Service	137	UDP	X			X	X		X		X		X		X
Remote Registry	139	TCP				X	X		X		X		X
ICMP						X			X		X		X		X
LDAP	389	TCP UDP	X			X	X		X		X		X		X
HTTPS	443	TCP UDP		X	X					X		X		X	X
SMB / Remote Registry	445	TCP	X			X			X		X		X		X
LDAP Secure	636	TCP	X
DCOM on XP/2003 and below (uses an open port in this range)	1024 - 5000	TCP UDP				X	X		X		X				X
SQL	1433	TCP	X	X	X	X	X	X	X	X	X	X	X	X	X
SQL Server Browser Service	1434	UDP													X
LDAP GC	3268	TCP	X				X
WinRM	5985 5986	TCP UDP					X	X							X
DCOM on Vista/2008 and above (uses an open port in this range)	49152 - 65535	TCP UDP		X	X	X	X		X		X				X

*Exchange 2013 and higher

The following figures outline the ports used by the Enterprise Reporter discoveries.

Figure 4. Ports used by Active Directory collections

Figure 5. Ports used by Azure and Microsoft 365 collections (Exchange Online, MS Teams, OneDrive, and SharePoint Online)

Additional ports for Azure and Microsoft 365 discoveries to be set on the Node:

•

Open ports 49151-65535 TCP Outbound

•

Open ports 49151-65535 UDP Outbound

Figure 6. Ports used by Computer collections

Figure 7. Ports used by Exchange collections

Additional port for Exchange discovery to be set on the Node:

•

Open WinRM HTTP port 5985 TCP Outbound

Figure 8. Ports used by File Storage Analysis collections

Figure 9. Ports used by NTFS collections

Figure 10. Ports used by Registry collections

Figure 11. Ports used by SQL collections

Ports for Enterprise Reporter to connect to Active Roles server

These ports need to be set on Active Roles server and Enterprise Reporter server:

•

Active Roles Administration Service open port 15172,1024-65535 TCP Inbound/Outbound

•

Active Roles Web Interface open port 80 HTTP Inbound/Outbound

•

Active Roles Web Interface open port 443 HTTPS Inbound/Outbound

Port for Enterprise Reporter to connect to IT Security Search

•

On the Enterprise Reporter server open port 8087 TCP Outbound

•

On the IT Security Search server open port 8087 TCP Inbound

Firewall Requirements

The following changes are required to be made to the Windows Firewall settings to allow Enterprise Reporter to return all available data during a discovery. Without these settings, the data returned during a discovery will be limited and the discovery will indicate the following error:

•

The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)

Table 19. Firewall requirements for a discovery
Operating System	Firewall Requirement
Windows 2022	Start \| Control Panel \| System and Security \| Windows Defender Firewall Scroll down and select Allow an app or feature through Windows Defender Firewall Select File and Print Sharing and Windows Management Instrumentation (WMI) (if not already selected) The check box in the Domain column will be selected. Click OK..
Windows 2019	Start \| Control Panel \| System and Security \| Windows Defender Firewall Scroll down and select Allow an app through Windows Firewall Select Windows Management Instrumentation (WMI) and File and Print Sharing (if not already selected) The check box in the Domain column will be selected. Click OK.
Windows 2016	Start \| Control Panel \|System and Security Select Allow an app through Windows Firewall Select Windows Management Instrumentation (WMI) and File and Print Sharing The check box in the Domain column will be selected. Click OK.
Windows 2012 and Windows 2012 R2	Start \| Control Panel \| System and Security Select Allow an app through Windows Firewall. Select Windows Management Instrumentation (WMI). The check box in the Domain column will be selected. Click OK.
Windows 2008 R2	Start \| Control Panel \| System and Security \| Windows Firewall. Select Allow a program or feature through Windows Firewall. Select Windows Management Instrumentation (WMI). The check box in the Domain column will be selected. Click OK.
Windows 2008	Start \| Control Panel \| Windows Firewall. Select Allow a program through Windows Firewall. Select the Exceptions tab. Scroll down and select Windows Management Instrumentation (WMI) and click OK.
Windows 2003 and Windows 2003 R2	Run the following command-line context: netsh firewall set service type = remoteadmin mode = enable
Windows 11	In the center on the Task Bar, select Search and type Windows Defender Firewall Select Allow a program or feature through Windows Firewall. Select File and Printer Sharing and Windows Management Instrumentation (WMI). The checkbox in the Domain column will be selected. Click OK. Start the Remote Registry service and set it to Automatic. This step is required to collect data such as installed software, event logs, and security policies.
Windows 8, Windows 8.1, and Windows 10	In the lower left hand corned of the screen right click and select Control Panel. Select System and Security \| Windows Firewall. Select Allow a program or feature through Windows Firewall. Select File and Printer Sharing and Windows Management Instrumentation (WMI). The checkbox in the Domain column will be selected. Click OK. Start the Remote Registry service and set it to Automatic. This step is required to collect data such as installed software, event logs, and security policies.
Windows 7	Start \| Control Panel \| System and Security \| Windows Firewall. Select Allow a program or feature through Windows Firewall. Select File and Printer Sharing and Windows Management Instrumentation (WMI). The checkbox in the Domain column will be selected. Click OK. Start the Remote Registry service and set it to Automatic. This step is required to collect data such as installed software, event logs, and security policies.
Windows Vista	Start \| Control Panel \| Security \| Windows Firewall. Select Allow a program or feature through Windows Firewall. Select the Exceptions tab. Select File and Printer Sharing and Windows Management Instrumentation (WMI). Click OK.
Windows XP	Start \| Control Panel \| Security Center\| Windows Firewall. Select the Exceptions tab. Select File and Printer Sharing. Click OK.

Database Requirements

The Enterprise Reporter server requires a database to store configuration specifications and the information that will be collected from your network environment. Before you install Enterprise Reporter, determine where you will set up your database. It should reside on a SQL Server® that is accessible from the computer running the Enterprise Reporter server. For more information, see SQL Server supported versions .

See also:

•

Configuring the Database and Security Groups

For the server to function, you must have a fully configured Enterprise Reporter database. You can either:

•

Create and configure the database automatically during the installation process. Unless you have corporate reasons for not doing so, this is the recommended method. For more information, see To create a new database during the installation process .

•

Use an existing Enterprise Reporter database. If the database is from a previous version of Enterprise Reporter, it will be upgraded, so ensure you back up your database before beginning. For more information, see To use an existing Enterprise Reporter database during the initial installation .

The simplest way to configure the database is to allow Enterprise Reporter to set up the database following installation. You need to know the SQL Server® on which you want to create the database, and you can use either Windows® or SQL Server® credentials to connect to your SQL Server®.


	NOTE: In order to create the database, the currently logged in account must have appropriate rights (including SysAdmin rights) on the SQL Server®, or you must use appropriate SQL credentials. NOTE: In order to upgrade the database, the currently logged in account must have db-owner rights on the SQL Server, or you must use appropriate SQL credentials. NOTE: In order to create groups, the currently logged in account must be able to add groups to the domain’s Users OU, and be able to add members to groups.

•

If you use an existing database, you can connect to it during the installation process. You must know the database name and the SQL Server® where it resides.


	CAUTION: Any existing database will automatically be upgraded (even if it is new and empty). Ensure you back up the database before beginning.

•

If you complete the installation process without a fully functioning database, use the Database Wizard to create a new database. For more information, see Using the Database Wizard to Create or Connect a Database .


	NOTE: Enterprise Reporter must have a database to fully function. If there is no database, you will receive an error message when trying to log on with the Configuration Manager.

There are parameters that you can set when creating an Enterprise Reporter database:

•

You can adjust the initial size of the database or the database log file. If your database will contain a lot of collected data, increase its size. This will improve performance. Use the Database Estimator Tool for further information based on the types of collections being performed.

•

You can choose where to store the database and logs by specifying file paths.

When you allow Enterprise Reporter to create the database, you also have the option to automatically create the following Domain Local security groups:

•

Reporter_Discovery_Admins

•

Reporter_Reporting_Admins

•

Reporter_Reporting_Operators

•

Reporter_Discovery_Nodes

You may optionally enter customized group names during setup. Assign names that reflect the purpose of each group to ensure clarity when group names are displayed in various system administration tools.

These groups provide access to the appropriate tables in the Enterprise Reporter database and are used to allow Windows authentication on the SQL Server. For more information, see Security Groups in Enterprise Reporter .


	NOTE: If you enter the names of existing security groups, Enterprise Reporter will use the existing groups instead of creating new ones.


	NOTE: If you choose not to allow Enterprise Reporter to create the necessary groups, the database will be created without the necessary security groups and SQL roles for Enterprise Reporter to function.

A corresponding SQL login and role is created for each group.

•

For example, for the Reporter_Discovery_Admins group, a Reporter_Discovery_Admins login and a Discovery_Admin_Role are created.

•

In this example, the Reporter_Discovery_Admins will then be given the Discovery_Admin_Role. These roles will define the scope of access to Enterprise Reporter. For more information, see Role-Based Security in Enterprise Reporter .

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Enterprise Reporter 3.5.1 - Installation and Deployment Guide

Minimum permissions for installing Enterprise Reporter

Port Requirements

Database Requirements

Configuring the Database and Security Groups