Enterprise Reporter 3.2.1 - Installation and Deployment Guide

Failover Recovery using SQL Clusters

Using a SQL cluster instead of a single server allows for automatic failover recovery in the event that a SQL Server is down. Tasks are automatically passed to another SQL Server. Your cluster can be configured with Always On.

System Requirements

Before installing Enterprise Reporter 3.2.1, ensure that your system meets the following minimum hardware and software requirements.

See also:

For the Enterprise Reporter Server, we recommend the following minimum hardware.

For the Configuration Manager and Report Manager, we recommend the following minimum hardware.

For the Enterprise Reporter Nodes, we recommend the following minimum hardware. For more detailed recommendations for node requirements, see Optimize Node Setup .Technical Documentation. 

For the Enterprise Reporter SQL Server, we recommend the following minimum hardware.

The Enterprise Reporter database is the storage location of all data collected for reporting. As such, the amount of hard disk space required is directly related to the amount of data being collected. The Database Size Estimator tool shipped with Enterprise Reporter can help determine how much space will be required.

Larger environments may have additional requirements for memory, processor, and hard disk space. There are many factors that can affect these requirements.

The following hardware is required for Enterprise Reporter 3.2.1 and higher.

The following operating systems are supported for Enterprise Reporter components.

NOTE: It is not recommended that the server or console be installed on a domain controller.

The following operating systems are supported for Enterprise Reporter discovery targets.

The following versions of Active Roles are supported as targets of Active Directory discoveries. See the Active Roles web site for the hardware and software requirements for your version of Active Roles.

Enterprise Reporter can be configures to send discovery information to the following versions of IT Security Search. See the IT Security Search web site for the hardware and software requirements for your version of IT Security Search.

The following versions of SQL Server® are supported for the Reporter database. See the Microsoft® web site for the hardware and software requirements for your version of SQL Server®:

Enterprise Reporter can be configured to work with a SQL Server® instance. To secure communications while working with Enterprise Reporter, data sent over connections to the SQL Server can be encrypted using an SSL certificate.

The steps required to configure this encryption are as follows.

The following software is required for Enterprise Reporter 3.2.1 and higher.

NOTE: PowerShell 3.0 and Microsoft SharePoint Online Management Shell are required on the node machines to collect OneDrive configuration settings. NOTE: In addition, for OneDrive configuration settings to be collected successfully, an authorized connection must be established to the SharePoint Online service. To allow for credentials to be specified for your tenant, the “LegacyAuthProtocols” setting must be enabled on your tenant. To set this on your tenant, run the following commands using the Microsoft SharePoint Online Management Shell. This action must be performed on any node machine with Microsoft SharePoint Online Management Shell installed. Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned Import-Module -Name Microsoft.Online.SharePoint.PowerShell Connect-SPOService -Url "https://<tenant>-admin.sharepoint.com" Set-SPOTenant -LegacyAuthProtocolsEnabled $True Disconnect-SPOService

NOTE: Microsoft Azure Active Directory Module for Windows PowerShell is required on the node machines to collect multi-factor authentication attributes for Azure Users.

The following software is required for Enterprise Reporter.

To collect Active Roles information, the following software is required on the computer where the Enterprise Reporter Configuration Manager is installed and on the computer where the Enterprise Reporter node is installed:

For more information and installation instructions, see the Active Roles Quick Start Guide.

The following additional considerations are required:

To collect Exchange information, the following additional considerations are required:

To collect Exchange® 2007 information, the following additional considerations are required:

To collect Exchange mailbox folders, the following additional considerations are required:

To collect Azure information, the following additional software is required:

NOTE: Microsoft Azure Active Directory Module for Windows PowerShell is required on the node machines to collect multi-factor authentication attributes for Azure Users.

To collect Exchange Online information, the following additional considerations are required:

To collect OneDrive information, the following additional software is required:

NOTE: PowerShell 3.0 and Microsoft SharePoint Online Management Shell are required on the node machines to collect OneDrive configuration settings. NOTE: In addition, for OneDrive configuration settings to be collected successfully, an authorized connection must be established to the SharePoint Online service. To allow for credentials to be specified for your tenant, the “LegacyAuthProtocols” setting must be enabled on your tenant. To set this on your tenant, run the following commands using the Microsoft SharePoint Online Management Shell. This action must be performed on any node machine with Microsoft SharePoint Online Management Shell installed. Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned Import-Module -Name Microsoft.Online.SharePoint.PowerShell Connect-SPOService -Url "<full tenant name>" Set-SPOTenant -LegacyAuthProtocolsEnabled $True Disconnect-SPOService

The following services are required on the Enterprise Reporter server and nodes.

The following services must be enabled on discovery targets for collections.

An Overview of Enterprise Reporter Communications and Credentials Required

There are many communication channels in Enterprise Reporter, involving different sets of credentials. This allows for controlled access to your environment, but you must understand where each set of credentials are used, and what permissions they need.

Figure 2 outlines where and for what each of the credentials are used, and the following tables explain the necessary permissions. For information on managing the credentials used in the Configuration Manager, see the Using the Credential Manager section in the Quest Enterprise Reporter Configuration Manager User Guide in the Technical Documentation. 

Figure 2. Credentials used to communicate in the Configuration Manager

See also:

Node Credential and Alternate Credential Details for On-Premises Discoveries

Node credentials are provided when a discovery node is created, and you can modify them as needed. By default, the node’s credentials are used to enumerate scopes and access on-premises targets.

If you want to use different credentials for a particular discovery, you can configure them in the Discovery Wizard. By using these alternate credentials, you can target anything on-premises for which you have credentials, in any domain. You can minimize the permissions given to node credentials, and use alternate credentials for scoping and collecting your on-premises discoveries.

The following table outlines the use of the node and alternate credentials, and how to properly configure your environment to ensure successful data collection: