Enterprise Reporter 3.5.1 - Installation and Deployment Guide

Table 24. Node Considerations for Active Directory Discoveries
	Performance Influences
# Objects	Network Bandwidth	RAM	Disk Speed	CPU	# Nodes Needed	Discovery Settings
Small < 100K 1 domain	Primary Concern	No Concern	No Concern	Secondary Concern	1
Medium 100K - 500K 1 domain	Primary Concern	No Concern	No Concern	Secondary Concern	1
Large 500K - 1M 1 domain	Primary Concern	No Concern	No Concern	Secondary Concern	1	•break single discoveries by object type •use one discovery per object type combined with schedules

Azure Active Directory and Azure Resource Discoveries: Node Setup

Azure Active Directory collections are sequential and create heavy network traffic as they query Azure. Ensuring the node machine has optimal network bandwidth is the primary concern. The CPU benchmarks of the node computer affect the threading capability, so it is a secondary concern. Typically, an organization with one tenant only needs one node.

Table 25. Node Considerations for Azure Active Directory and Azure Resource Discoveries
	Performance Influences
# Objects	Network Bandwidth	RAM	Disk Speed	CPU	# Nodes Needed
Small < 100K 1 tenant	Primary Concern	No Concern	Tertiary Concern	Secondary Concern	1
Medium 100K - 500K 1 tenant	Primary Concern	No Concern	Tertiary Concern	Secondary Concern	1
Large 500K - 1M 1 tenant	Primary Concern	No Concern	Tertiary Concern	Secondary Concern	1

Computer Discoveries: Node Setup

Computer collections are sequential and create heavy network traffic as they query each local computer. Ensuring the node machine has optimal network bandwidth is the primary concern.

Table 26. Node Considerations for Computer Discoveries
	Performance Influences
# Objects	Network Bandwidth	RAM	Disk Speed	CPU	# Nodes Needed
Small < 5K	Primary Concern	No Concern	Secondary Concern	Tertiary Concern	1 - 3
Medium 5K - 10K	Primary Concern	No Concern	Secondary Concern	Tertiary Concern	3 - 8
Large > 10K	Primary Concern	No Concern	Secondary Concern	Tertiary Concern	8 - 10

File Storage Analysis Discoveries: Node Setup

Table 27. Node Considerations for File Storage Analysis Discoveries
		Performance Influences
# Targets	# Files / Computer	Network Bandwidth	RAM	Disk Speed	CPU	# Nodes Needed
Small 1 - 10 Computers	< 2M	Primary Concern	Secondary Concern	No Concern	Secondary Concern	1 - 3
Medium 1 - 10 Computers	< 20M	Primary Concern	Secondary Concern	No Concern	Secondary Concern	3 - 9
Large > 10 Computers	> 20M	Primary Concern	Secondary Concern	No Concern	Secondary Concern	10

Microsoft SQL Discoveries: Node Setup

Table 28. Node Considerations for Microsoft SQL Discoveries
	Performance Influences
# SQL Servers	Network Bandwidth	RAM	Disk Speed	CPU	# Nodes Needed
Small 1 - 3	Primary Concern	Tertiary Concern	Secondary Concern	No Concern	1
Medium 3 - 5	Secondary Concern	Primary Concern	Tertiary Concern	No Concern	2
Large > 5	Secondary Concern	Primary Concern	Tertiary Concern	No Concern	> 3

NTFS Discoveries: Node Setup

The most important guideline is to collect only the information required. For example, most files have inherited permissions so, typically, collecting folder permissions is sufficient.

By default, NTFS discoveries, will create multiple tasks (one task per share) to improve performance. If disk speed is slow, network bandwidth is low, or there is only one node, disable this performance option.

Table 29. Node Considerations for NTFS Discoveries
	Performance Influences
# Objects	Network Bandwidth	RAM	Disk Speed	CPU	# Nodes Needed	Discovery Settings
Small 0 - 5M	Secondary Concern	Tertiary Concern	Primary Concern	No Concern	1 - 3
Medium 5M - 100M	Secondary Concern	Tertiary Concern	Primary Concern	No Concern	3 - 6
Large 100M - 1B multiple shares	Secondary Concern	Tertiary Concern	Primary Concern	No Concern	6 - 10¹	•use multiple tasks option unless slow disk speed, low network bandwidth, or one node

Microsoft 365 Discoveries: Node Setup

These considerations apply to Exchange Online, SharePoint Online, Microsoft Teams, and OneDrive discoveries.

OneDrive can be divided into multiple discoveries to increase collection speed. If Microsoft throttling is often an issue, the use of multiple credentials can help minimize throttling.

Table 30. Node Considerations for Microsoft 365 Discoveries
	Performance Influences
# Objects	Network Bandwidth	RAM	Disk Speed	CPU	# Nodes Needed
Small	Primary Concern	No Concern	Tertiary Concern	Secondary Concern	1
Medium	Primary Concern	No Concern	Tertiary Concern	Secondary Concern	1
Large	Primary Concern	No Concern	Tertiary Concern	Secondary Concern	1

Plan Credential Use

There is granular control over the credentials that are used to perform various functions in Enterprise Reporter. For more information, see Role-Based Security in Enterprise Reporter and

Logged-In User Details

You can use as many or as few credentials as you need. Many of the credentials used in Enterprise Reporter are stored in the Credential Manager, which makes it easy to replace or update credentials across your environment.

Credentials for the Configuration Manager are stored in a single Credential Manager, shared by all Configuration Manager users. If only certain employees know the passwords or are responsible for certain credentials, such as service credentials, one of those employees can add the credentials to the Credential Manager, and then all Enterprise Reporter administrators can use them.

Credentials in the Credential Manager are used in the following ways in the Configuration Manager:

•

Running the node service.

•

Accessing the Enterprise Reporter server and database from the node. You can use either a Windows or a SQL account.

•

Accessing the targets of a discovery to collect data.

•

Accessing the shared data location of a cluster, if used.

Each Report Manager user has their own Credential Manager. Credentials in the Credential Manager are used in the following ways in the Report Manager:

•

Delivering scheduled reports to a share.

•

Configuring an email server for email delivery through an SMTP server or a Microsoft 365 Exchange Online connection.

•

Publishing reports to SQL Server Reporting Service (SSRS).

The logged in user is used for:

•

Logging into both consoles.

•

Connecting to the Enterprise Reporter server (Configuration Manager and Report Manager).

•

Connecting to the Enterprise Reporter database (Configuration Manager and Report Manager).

•

Browsing the targets of a discovery.

Understanding Credentials Using Scenarios

The following scenarios outline how credentials can be used in different environments:

•

Minimizing the Number of Credentials Used by Enterprise Reporter

•

Minimizing the Permissions Required for Credentials Used by Enterprise Reporter

Minimizing the Number of Credentials Used by Enterprise Reporter

If you have a simple deployment, you can permission two sets of credentials to perform all functions. In this scenario, you have a single Enterprise Reporter administrator, who manages installation, discoveries, and reporting. The following table outlines the required permissions:

Table 31. Required Permissions
Account	Use	Permissions
Administrator’s user account Use these credentials to log in to the computer, and to schedule reports.	Launch consoles	Be a member of Reporter_Discovery_Admins and Reporter_Reporting_Admins groups
	Enumerate scopes	Read access to all discovery targets
	Publish to SSRS	Write access to the SSRS server
	Deliver reports by email	Access to the SMTP server
	Enumerate report delivery shares and deliver reports	Read and write access to the delivery share
Service credentials Use these credentials for the Enterprise Reporter server and all nodes.	Use the shared data location, if configured for a cluster	Read and write access to the share
	Writing to the database	Be a member of Reporter_Discovery_Nodes group
	Collect data	Be a local administrator on all computer targets, and have read access to targeted domains, SQL servers, NTFS objects

Minimizing the Permissions Required for Credentials Used by Enterprise Reporter

A complex deployment may require some thought to determine what credentials you want to use in different situations. With effort, you can minimize the permissions you must add to accounts to use Enterprise Reporter. Keep in mind that some of the data collected is available only to privileged accounts. In most cases, accounts with inadequate privileges can collect partial data.

For this scenario:

•

You have several large domains, each with its own Enterprise Reporter administrator. Trusts exist between all domains.

•

There is one report administrator for the whole deployment.

•

Each domain has a dedicated cluster with a shared data location.

•

Each domain has a set of service credentials for use by the nodes.

•

Discoveries use alternate credentials specific to the targets.

•

SQL credentials are used to access the Enterprise Reporter database.

For each domain you need:

Table 32. Permissions Required
Account	Use	Permissions
Service credential Use these credentials for the Enterprise Reporter server and all nodes.	Enterprise Reporter server service	Local administrator access to the server host. Use the credentials from the domain in which the server is hosted
	Node service	Local administrator access to the node host
	Shared Data Location for each cluster	Read and write access to the share
Administrator’s user account Use these credentials to log in to the computer running the Configuration Manager.	Launch console	Be a member of Reporter_Discovery_Admins group
SharePoint Online An account with access to the discovery target tenant.	Collection of all SharePoint Online site collections	Administrator permissions, including tenant settings and policies, site information, and permissions are required. A SharePoint administrator role is recommended.

You also need:

Table 33. Additional Permissions Required
Account	Use	Permissions
SQL Account When creating the database or modify using the Database Wizard	Communication between the server and database Logging in to the Report Manager Communication between the node and the database	Read and write access to the database
Report Administrator account	Log in to the Report Manager	Must be a member of the Reporter_Reporting_Admins group
	Publish to SSRS	Write access to the SSRS server
	Deliver reports by email	Access to the SMTP server
	Enumerate report delivery shares and deliver reports	Read and write access to the delivery share
SharePoint Online	Collection of all SharePoint Online site collections	The discovery credentials must have site collection administrator rights to each site collection that is being collected. If additional credentials are being specified to minimize Azure throttling limitations, these credentials must have the same permissions. Refer to credentials required to create and consent to the Enterprise Reporter SharePoint Online application required for this discovery.

For browsing to your discovery targets and collecting the data you can choose the credentials that make sense for your environment. Set these credentials at the discovery level. For example:

•

For Active Directory discoveries, you could use a domain admin account that has access to the targeted domain.

•

For computer accounts, you could either use existing accounts with local administrator access, or set up specific accounts for groups of similar computers.


	NOTE: The Credential Manager allows the owner of the credentials to enter the password. Other administrators can then use the credentials as appropriate.

•

For more information about credentials required to collect data with Enterprise Reporter discoveries, see Detailed permissions for Enterprise Reporter discoveries .

•

For more information about credentials required to collect data from Azure, Azure Active Directory, Azure Resource, Exchange Online, Microsoft Teams, and OneDrive, see Permissions for Enterprise Reporter tenant applications .

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Enterprise Reporter 3.5.1 - Installation and Deployment Guide

Optimize Node Setup

Plan Credential Use

Logged-In User Details

Understanding Credentials Using Scenarios