Chat now with support
Chat with Support

Enterprise Reporter 3.5.1 - Configuration Manager User Guide

Product Overview Configuring the Configuration Manager
Starting the Configuration Manager Finding answers and getting help Overview of Enterprise Reporter Communications and Credentials Required Using the Credential Manager Setting Up Your First Collection Computers (Nodes) Modifying Your Deployment Configuring Global Settings Customizing the Configuration Manager View
Understanding Discoveries Creating Discoveries
Step 1. Create the Discovery (Name) Step 2. Choose what to include in your discovery (Scopes) Step 2a. Choose scopes for your on-premises discoveries
Choosing your Active Directory Scopes Choosing your Computer Scopes Choosing Your Exchange Scopes Choosing Your File Storage Analysis Scopes Choosing Your Microsoft SQL Scopes Choosing Your NTFS Scopes Choosing Your Registry Scopes
Step 2b: Choose scopes for your cloud discoveries Step 3. Schedule your Discovery Step 4: Review the summary
Managing Discoveries Troubleshooting Issues with Enterprise Reporter Appendix: PowerShell cmdlets Appendix: Encryption Key Manager Appendix: Log Viewer

Configuring Email Notifications

Enterprise Reporter can be configured to send email notifications that indicate when nodes and discoveries change state and may need administrator intervention. There are two methods available for sending email notifications:

•
For SMTP authentication, you can configure a default SMTP server that users can select when setting up email notifications. You can provide a server that uses anonymous connections or one that uses authentication. Users can provide their own credentials when they create a schedule.
•
If you need OAuth2 authentication for sending email, you can use Exchange Online to send email notifications. To use Exchange Online, you must register an application for Enterprise Reporter with Azure Active Directory, using certificate-based authentication. For more information, see Registering an Application for Exchange Online Email Delivery .

After you configure the email service type (SMTP or Exchange Online), you can configure address information such as sender and recipients, and notification options, such as whether to send notifications for node state changes, discovery state changes, or both. You can also select whether to include all discovery state changes or just the failures.

See the following sections for the steps to configure email notifications:

1a. To configure email notifications using SMTP Authentication
- OR -
1b. To configure email notifications using Exchange Online (OAuth2)
2. To configure addresses for email sender and recipients
3. To specify the notification options
1a. To configure email notifications using SMTP Authentication
1
On the Configuration page, under Email Notifications, click Manage email notifications.
2
For service type, select SMTP.
3
Enter the host name or IP address.
4
Enter the host port number.
5
For User Account, you can click the ellipsis (...) to access the Credential Manager to enter and select the credentials required to access the SMTP server. For more information, see Using the Credential Manager .
If you need to remove the credentials, click Clear.
If you want to test the Host configuration, press Click to test your connection.
1b. To configure email notifications using Exchange Online (OAuth2)
1
On the Configuration page, click Manage email notifications.
2
For service type, select Exchange Online.
3
Enter the following information for the app that has been registered in Azure Active Directory for Enterprise Reporter:
•
Application (client) ID: The application (client) ID for the Azure Active Directory application created for Enterprise Reporter email notifications.
•
Directory (tenant) ID: The directory (tenant) ID for the Azure Active Directory application created for Enterprise Reporter email notifications.
•
Certificate Thumbprint: The certificate thumbprint for the certificate that was uploaded to the registered app.
•
Cloud instance: Select the type of cloud instance to use for notifications - Azure Cloud (default), US Government Cloud L4, or US Government Cloud L5 (DoD).
For details about how to register an application in Azure Active Directory, see Registering an Application for Exchange Online Email Delivery .
2. To configure addresses for email sender and recipients
1
Under Address Configuration, enter the email address to be displayed as the sender of the notifications. If you are using Exchange Online for OAuth2 authentication, the address must be an Exchange Online account.
2
In the To, CC, and BCC fields, enter the email addresses of the people to receive the notifications (separated by commas or semicolons).
3
Click View address format errors and fix any errors.
3. To specify the notification options
1
Select Send notifications on node state changes.
- OR -
Select Send notifications on discovery state changes.
2
If you selected Send notifications on discovery state changes:
•
Select Send all to send email notifications for every discovery state change.
- OR -
Select Send only failures to send email notifications only for only discovery state changes that are failures.

Registering an Application for Exchange Online Email Delivery

To send email using Microsoft 365 Exchange Online (for OAuth2 authentication), you must register an application for Enterprise Reporter with Azure Active Directory. During the registration process in the Azure portal, you must configure different variables that will be used when you set up Exchange Online for email delivery in the Configuration Manager and Report Manager.

To register Enterprise Reporter with Azure Active Directory and use Exchange Online accounts to send email, the following prerequisites must be met:

•
You must register an application in Azure portal. Record the Application (client) Id and Directory (tenant) Id.
•
The application must have the following Microsoft Graph API permissions: Mail.ReadWrite and Mail.Send.
•
A certificate is required. Make note of the certificate thumbprint.
•
You must upload a certificate public key (.cer) in Azure App Registrations.
•
You must also upload the certificate to the Enterprise Reporter server machine (Configuration Manager).

Topics:

Generating a Certificate
If a Certificate is Available
Registering and configuring an application through Azure Active Directory
Generating a Certificate

You will require a certificate when registering an app for Enterprise Reporter in the Azure Active Directory. You can use a certificate from a Registration Authority or you can use a self-signed certificate. If you do not have a certificate from a Registration Authority, you can use the following Powershell cmdlets to create a self signed certificate.

It is useful to generate your self-signed certificate on the computer on which the Enterprise Reporter server service (Configuration Manager) is installed since that reduces the number of steps you must perform.

For information on the New-SelfSignedCertificate cmdlets, see https://learn.microsoft.com/en-us/powershell/module/pki/new- selfsignedcertificate?view=windowsserver2022-ps.

Before you create the certificate, the Powershell PKI module must be installed.

Get-Command -Module PKI
Creating a Self-signed Certificate

Use the following Powershell cmdlets to create a self-signed certificate that will be used when you register the application for Exchange Online. Run these cmdlets on the computer that contains the Enterprise Reporter server service.

$cert = New-SelfSignedCertificate -certstorelocation "cert:\LocalMachine\My" -dnsname myersystem.domain.com
$pwd = ConvertTo-SecureString - -Force -AsPlainText Export-PfxCertificate -cert $path -FilePath "C:\exchange online\myersystem.domain.com.pfx" -Password $pwd

NOTE: For the -dnsname you enter the name of the computer that hosts Enterprise Reporter server service (Configuration Manager) and C:\exchange online\ is a folder location on that computer.

To export the certificate

If you have run the PowerShell cmdlets on the system that hosts the Enterprise Reporter server service (Configuration Manager), do the following steps:

1
Start the MMC (Microsoft Management Console) and select File | Add/Remove Snap-in...
2
Select Certificates and click Add.
3
In the Certificate snap-in window, select Computer account and click Next,
4
Select Local computer and click OK.
5
Expand Certificate | Personal | Certificate. Ensure that the newly created certificate is listed.
6
Select the certificate, right-click and select All Tasks | Export.
7
In the Certificate Export Wizard, click Next.
8
Select No, do not export the private key and select Next.
9
In the Export File Format page, select DER encoded binary X.509 (.CER) as the format, unless you require a different format, and click Next.
10
Browse to the location to which you want to export the certificate. Enter a file name for the certificate file. and click Next.
11
Review the settings for the certificate export and click Finish.
To obtain the certificate thumbprint
1
After the export is complete, double-click the certificate and select the Details tab.
2
Scroll down and select Thumbprint.
3
Copy or note the thumbprint value since you will need it when you register the application in Azure for Enterprise Reporter.
If a Certificate is Available

Use the following procedure to install a certificate if you have one available. Do this on the computer on which the Enterprise Reporter server service (Configuration Manager) is installed.

To import the certificate on the console machine (if needed):
1
Start the MMC (Microsoft Management Console) and select File | Add/Remove Snap-in...
2
Select Certificates and click Add.
3
Open the Certificate Import Wizard.
4
Select Local machine for Store location and click Next.
5
Select Place all certificates in the following store, click Browse.
6
Select the Personal store and click Next.

After the certificate is imported to the store, obtain and save the certificate thumbprint. The certificate thumbprint will be needed when you are setting up OAuth authentication.

Registering and configuring an application through Azure Active Directory

Once you have the certificate, you can register an app for Enterprise Reporter to be used for mail delivery through Exchange Online.

You use the following process to register and configure the application through the Microsoft Azure portal:

1
Register the application in Azure Active Directory. See To register an application in Azure Active Directory.
2
Add Microsoft Graph API permissions for mail delivery. See To add Microsoft Graph API permissions for mail delivery.
3
Upload the certificate for authentication. See To upload the certificate for authentication.
To register an application in Azure Active Directory
1
Log into the Azure Active Directory portal (https://portal.azure.com) as global administrator or using an account that has the necessary permissions to create an application in the tenant.
2
In the Microsoft Azure dashboard, click Azure Active Directory.
3
In the left navigation pane, scroll down and click App registrations | New registration.
4
On the Register an application page, enter the application registration information:
•
Name: Enter a name for the application that identifies its use such as Enterprise Reporter for Exchange Online.
•
Supported account types: Select Accounts in this organizational directory only (tenant name only - Single tenant) for the accounts that can access the application API.
 
* 
NOTE: Leave the Redirect URI (optional) field empty as it is not needed
 
5
Click Register.
The Settings window for the newly-created application opens, displaying the application name you specified.
To add Microsoft Graph API permissions for mail delivery
IMPORTANT: It is highly recommended that the application does not have access to all mailboxes. For information about how to limit the application access to mailboxes see the Microsoft article Limiting application permissions to specific Exchange Online mailboxes at https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access.
1
In the left navigation pane, scroll down and click API Permissions.
2
Click Add a permission, click Microsoft Graph, and click Application Permissions.
3
Scroll down to and expand Mail.
4
Add Mail.ReadWrite and Mail.Send permissions.
* 
NOTE: The Enforce approver account validation option found when configuring email notifications will not function if you have used the Microsoft article to restrict access to a single mailbox.
5
Click Add Permissions.
6
In the center of the API Permissions page, notice the Grant admin consent for tenant name.Click Grant admin consent for tenant name to apply the permissions.
7
Click Yes to confirm.
8
On the Overview page (top left) you can find Application (client) ID and the Directory (tenant) ID. Copy these values as you will need them when you set up Exchange Online for OAuth authentication in Enterprise Reporter.
9
Return to Home (top left) and select Azure Active Directory which displays the tenant overview page.
10
In the left navigation pane, click Roles and administrators and browse through the roles to find Exchange Administrator (or enter Exchange Administrator in the search window).
The Exchange Administrator role is now available.
11
Click the Exchange Administrator role and click Add Assignments.
12
In the right search window, enter the name of the application you registered.
13
When the application appears, select Add at the bottom on the right side.
14
Click Home and select Azure Active Directory to display the tenant Overview page.
15
Select App registrations and either browse to your new app or enter the name the application in the search window.
16
Click the application and the page for the app is now available.
To upload the certificate for authentication

Your Azure Active Directory application requires a certificate for authentication.

1
In the left navigation pane, click Certificates & secrets.
2
Select Certificates and select Upload Certificate.
3
In the right side window, browse to the location of your certificate (.CER) file and select the file.
4
Add a description for the .CER file to distinguish it from other certificates.
5
Click Add at the bottom of the screen. Notice the certificate information is displayed including the thumbprint.
6
Copy the thumbprint value for use when you configure Enterprise Reporter.

The application configuration is complete. Ensure that you record the Application (client) ID and Directory (tenant) ID and the certificate thumbprint as they are required to configure the connection in Enterprise Reporter email settings.

Also, take note of when the certificate will expire so it can be replaced or renewed. Email using Exchange Online will stop flowing once the certificate has expired.

Managing the Collection of Additional Attributes

Managing the Collection of Additional Attributes

Enterprise Reporter collects a defined set of attributes for each object in a discovery. The attributes collected vary depending on the type of discovery, the object, and the version of Enterprise Reporter you are using. You can add and remove attributes collected by Active Directory and computer discoveries. You can extend:

•
Active Directory discovery attributes for users, groups, computers, organizational units, and service account.
•
Computer discoveries with attributes from WMI classes added.
•
Active Roles attributes for users, groups, computers, contacts, and organizational units.
The following data types are supported:
•
Boolean
•
Case Ignored String
•
Case Sensitive String
•
DN String
•
Integer
•
Large Integer
•
Numeric String
•
Print Case String
•
Time
•
Unicode
 
* 
NOTE: Collecting Active Roles attributes for users, groups, computers, and organizational units can significantly increase collection time. Attributes that are known to increase collection time are:
•
edsaDialinAccessPermissions
•
edsaDialinApplyStaticRoutes
•
edsaDialinApplyStaticIP
•
edsaDialinCallbackNumber
•
edsaDialinCallbackOptions
•
edsaDialinCallerID
•
edsaDialinStaticIP
•
edsaDialinStaticRoutes
•
edsaDialinVerifyCallerID

Attributes that you extended in previous versions of Enterprise Reporter can become default attributes in newer versions. In this case, the extended attribute is preserved to ensure that your reports continue to work, but only the default attribute is available for new reports.

When you add or remove attributes for a discovery type, Enterprise Reporter has to process them. This can take some time, during which any running discoveries of the type you extended may fail. You should perform the extension only after ensuring that no discoveries of that type are running or scheduled to run. Additionally, any attributes that are no longer being collected should be removed from any reports in which they were included.

* 
TIP: To minimize collection time, it is recommended that you only collect attributes that you know are required by your reporting users. You cannot remove attributes that are collected by default.
* 
NOTE: Reporting users must restart their consoles to have the most up-to-date list of available attributes in their reports. Consider informing users that data is no longer being collected so they can remove the associated fields from their reports.
To add or remove Active Directory attributes
1
Ensure that no Active Directory discoveries are running or scheduled to run while your changes are processed.
2
Click Configuration.
3
Click Manage attributes.
4
Click Yes in the warning dialog box.
5
In the Active Directory section, click Extend.
6
If you want to use a different forest to enumerate the schema, click the ellipsis and select an appropriate domain.
If your logged-in user does not have access to a domain in the forest whose schema you want to enumerate, right-click in the dialog box and choose Connect as user.
7
Click Get Schema.
The Extend Enterprise Reporter Attributes dialog box is displayed. Default attributes have grey check marks. Extended attributes have blue check marks for easy identification.
8
Select the type of attributes to collect from the Type menu.
9
Select to add or deselect to remove attributes.
To view a list of your currently selected attributes, select Only show selected attributes.
* 
NOTE: An error message is displayed for any attribute that cannot be collected. Use the error message to troubleshoot any issues with collecting the attribute and then redo the steps above.
10
Click Apply.
11
Click Close.
To extend computer attributes (using WMI classes)
1
Ensure that no computer discoveries are running or scheduled to run while your changes are processed.
2
Click Configuration.
3
Click Manage attributes.
4
Click Yes in the warning dialog box.
5
In the Computer section, click Extend.
6
Click Add.
If you want to use a different computer to enumerate the WMI classes, click the ellipsis and select the computer.
The Extend Enterprise Reporter Attributes dialog box is displayed. Any classes that have been extended are shown.
7
Expand the WMI class treeview as necessary to locate the desired classes.
8
Select the classes and click the Add button.
You can only add entire classes, not individual properties.
To remove classes, select them from the list and click the Remove button.
9
Click Add.
The Extend Enterprise Reporter Attributes dialog box reappears, with the newly added classes in bold letters.
If you add more than the recommended number of classes, a warning appears. Ensure that you require the selected extended WMI classes, as they will increase your collection time.
10
Verify the list and then click Apply.
To remove computer attributes (non-default)
1
Ensure that no computer discoveries are running or scheduled to run while your changes are processed.
2
Click Configuration.
3
Click Manage attributes.
4
Click Yes in the warning dialog box.
5
In the Computer section, click Extend.
The Extend Enterprise Reporter Attributes dialog box is displayed. Any classes that have been extended are shown.
6
Select the desired classes and click Remove.
7
Click Apply.
To add or remove Active Roles attributes
1
Ensure that no Active Directory discoveries are running or scheduled to run while your changes are processed.
2
Click Configuration.
3
Click Manage attributes.
4
Click Yes in the warning dialog box.
5
In the Active Roles section, click Extend.
6
If you want to use a different forest to enumerate the schema, click the ellipsis, select an appropriate domain, and click OK to continue.
If your logged-in user does not have access to a domain in the forest whose schema you want to enumerate, right-click in the dialog box and choose Connect as user. Use the Credential Manager to select or create a user with the required credentials and click OK.
7
To select the Active Roles server, click the ellipsis, select a computer, and click OK.
8
To set the credentials to access the Active Roles server, click the ellipsis, use the Credential Manager to select or create a user with the required credentials, and click OK.
9
Click Get Schema.
The Extend Enterprise Reporter Attributes dialog box is displayed. Selected Active Roles attributes have blue check marks for easy identification. Extended attributes have blue check marks for easy identification.
10
Select the type of attributes to collect from the Type menu.
11
Select to add or deselect to remove attributes.
To view a list of your currently selected attributes, select Only show selected attributes.
12
Click Apply.
13
Click Close.
* 
NOTE: The Multiple Tasks option is not available when collecting Active Roles attributes.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating