Chat now with support
Chat with Support

Enterprise Reporter 3.5.2 - Configuration Manager User Guide

Product Overview Configuring the Configuration Manager
Starting the Configuration Manager Finding answers and getting help Overview of Enterprise Reporter Communications and Credentials Required Using the Credential Manager Setting Up Your First Collection Computers (Nodes) Modifying Your Deployment Configuring Global Settings Customizing the Configuration Manager View
Understanding Discoveries Creating Discoveries
Step 1. Create the Discovery (Name) Step 2. Choose what to include in your discovery (Scopes) Step 2a. Choose scopes for your on-premises discoveries
Choosing your Active Directory Scopes Choosing your Computer Scopes Choosing Your Exchange Scopes Choosing Your File Storage Analysis Scopes Choosing Your Microsoft SQL Scopes Choosing Your NTFS Scopes Choosing Your Registry Scopes
Step 2b: Choose scopes for your cloud discoveries Step 3. Schedule your Discovery Step 4: Review the summary
Managing Discoveries Troubleshooting Issues with Enterprise Reporter Appendix: PowerShell cmdlets Appendix: Encryption Key Manager Appendix: Log Viewer

Database Settings

•
Database Timeouts
You can increase the timeout for the Enterprise Reporter server. Connection timeouts control how long the server has to establish a connection to the database, while the command timeout controls the amount of time available for processing a command on the database.
For more information, see Troubleshooting Connection Timeouts .
•
Defragment Indices
This option is available for systems running SQL Server Enterprise edition and is enabled by default. When this option is enabled, database indices are defragmented in the background as a regular part of collections to enhance the performance of both collection and reporting tasks.
•
Frequency Threshold
Database indices will become more fragmented from frequent collections or from collections with large amounts of data. If Defragment Indices is enabled, you may optionally set the Frequency threshold to control the minimum amount of time that must elapse between tasks to defragment the database indices.
For example, if the frequency threshold is set to 3 hours, and a defragmentation task finishes at 9am, no other defragmentation task will be allowed to begin until 12 pm at the earliest. For any threshold, only one defragmentation task will run at a time.
Enterprise Reporter running on systems that are not equipped with SQL Server Enterprise edition requires database indices to be defragmented manually during a shutdown using the Database Wizard to Perform Database Maintenance.

Configuring Email Notifications

Enterprise Reporter can be configured to send email notifications that indicate when nodes and discoveries change state and may need administrator intervention. There are two methods available for sending email notifications:

•
For SMTP authentication, you can configure a default SMTP server that users can select when setting up email notifications. You can provide a server that uses anonymous connections or one that uses authentication. Users can provide their own credentials when they create a schedule.
•
If you need OAuth2 authentication for sending email, you can use Exchange Online to send email notifications. To use Exchange Online, you must register an application for Enterprise Reporter with Microsoft Entra ID, using certificate-based authentication. For more information, see Registering an Application for Exchange Online Email Delivery .

After you configure the email service type (SMTP or Exchange Online), you can configure address information such as sender and recipients, and notification options, such as whether to send notifications for node state changes, discovery state changes, or both. You can also select whether to include all discovery state changes or just the failures.

See the following sections for the steps to configure email notifications:

1a. To configure email notifications using SMTP Authentication
- OR -
1b. To configure email notifications using Exchange Online (OAuth2)
2. To configure addresses for email sender and recipients
3. To specify the notification options
1a. To configure email notifications using SMTP Authentication
1
On the Configuration page, under Email Notifications, click Manage email notifications.
2
For service type, select SMTP.
3
Enter the host name or IP address.
4
Enter the host port number.
5
For User Account, you can click the ellipsis (...) to access the Credential Manager to enter and select the credentials required to access the SMTP server. For more information, see Using the Credential Manager .
If you need to remove the credentials, click Clear.
If you want to test the Host configuration, press Click to test your connection.
1b. To configure email notifications using Exchange Online (OAuth2)
1
On the Configuration page, click Manage email notifications.
2
For service type, select Exchange Online.
3
Enter the following information for the app that has been registered in Microsoft Entra ID for Enterprise Reporter:
•
Application (client) ID: The application (client) ID for the Microsoft Entra ID application created for Enterprise Reporter email notifications.
•
Directory (tenant) ID: The directory (tenant) ID for the Microsoft Entra ID application created for Enterprise Reporter email notifications.
•
Certificate Thumbprint: The certificate thumbprint for the certificate that was uploaded to the registered app.
•
Cloud instance: Select the type of cloud instance to use for notifications - Azure Cloud (default), US Government Cloud L4, or US Government Cloud L5 (DoD).
For details about how to register an application in Microsoft Entra ID, see Registering an Application for Exchange Online Email Delivery .
2. To configure addresses for email sender and recipients
1
Under Address Configuration, enter the email address to be displayed as the sender of the notifications. If you are using Exchange Online for OAuth2 authentication, the address must be an Exchange Online account.
2
In the To, CC, and BCC fields, enter the email addresses of the people to receive the notifications (separated by commas or semicolons).
3
Click View address format errors and fix any errors.
3. To specify the notification options
1
Select Send notifications on node state changes.
- OR -
Select Send notifications on discovery state changes.
2
If you selected Send notifications on discovery state changes:
•
Select Send all to send email notifications for every discovery state change.
- OR -
Select Send only failures to send email notifications only for only discovery state changes that are failures.

Registering an Application for Exchange Online Email Delivery

To send email using Microsoft 365 Exchange Online (for OAuth2 authentication), you must register an application for Enterprise Reporter with Exchange Online. During the registration process in the Azure portal, you must configure different variables that will be used when you set up Exchange Online for email delivery in the Configuration Manager and Report Manager.

To register Enterprise Reporter with Exchange Online and use Exchange Online accounts to send email, the following prerequisites must be met:

•
You must register an application in Azure portal. Record the Application (client) Id and Directory (tenant) Id.
•
The application must have the following Microsoft Graph API permissions: Mail.ReadWrite and Mail.Send.
•
A certificate is required. Make note of the certificate thumbprint.
•
You must upload a certificate public key (.cer) in Azure App Registrations.
•
You must also upload the certificate to the Enterprise Reporter server machine (Configuration Manager).

Topics:

Generating a Certificate
If a Certificate is Available
Registering and configuring an application through the Microsoft Azure portal
Generating a Certificate

You will require a certificate when registering an app for Enterprise Reporter in the Microsoft Entra ID. You can use a certificate from a Registration Authority or you can use a self-signed certificate. If you do not have a certificate from a Registration Authority, you can use the following Powershell cmdlets to create a self signed certificate.

It is useful to generate your self-signed certificate on the computer on which the Enterprise Reporter server service (Configuration Manager) is installed since that reduces the number of steps you must perform.

For information on the New-SelfSignedCertificate cmdlets, see https://learn.microsoft.com/en-us/powershell/module/pki/new- selfsignedcertificate?view=windowsserver2022-ps.

Before you create the certificate, the Powershell PKI module must be installed.

Get-Command -Module PKI
Creating a Self-signed Certificate

Use the following Powershell cmdlets to create a self-signed certificate that will be used when you register the application for Exchange Online. Run these cmdlets on the computer that contains the Enterprise Reporter server service.

$cert = New-SelfSignedCertificate -certstorelocation "cert:\LocalMachine\My" -dnsname myersystem.domain.com
$pwd = ConvertTo-SecureString - -Force -AsPlainText Export-PfxCertificate -cert $path -FilePath "C:\exchange online\myersystem.domain.com.pfx" -Password $pwd

NOTE: For the -dnsname you enter the name of the computer that hosts Enterprise Reporter server service (Configuration Manager) and C:\exchange online\ is a folder location on that computer.

To export the certificate

If you have run the PowerShell cmdlets on the system that hosts the Enterprise Reporter server service (Configuration Manager), do the following steps:

1
Start the MMC (Microsoft Management Console) and select File | Add/Remove Snap-in...
2
Select Certificates and click Add.
3
In the Certificate snap-in window, select Computer account and click Next,
4
Select Local computer and click OK.
5
Expand Certificate | Personal | Certificate. Ensure that the newly created certificate is listed.
6
Select the certificate, right-click and select All Tasks | Export.
7
In the Certificate Export Wizard, click Next.
8
Select No, do not export the private key and select Next.
9
In the Export File Format page, select DER encoded binary X.509 (.CER) as the format, unless you require a different format, and click Next.
10
Browse to the location to which you want to export the certificate. Enter a file name for the certificate file. and click Next.
11
Review the settings for the certificate export and click Finish.
To obtain the certificate thumbprint
1
After the export is complete, double-click the certificate and select the Details tab.
2
Scroll down and select Thumbprint.
3
Copy or note the thumbprint value since you will need it when you register the application in Azure for Enterprise Reporter.
If a Certificate is Available

Use the following procedure to install a certificate if you have one available. Do this on the computer on which the Enterprise Reporter server service (Configuration Manager) is installed.

To import the certificate on the console machine (if needed):
1
Start the MMC (Microsoft Management Console) and select File | Add/Remove Snap-in...
2
Select Certificates and click Add.
3
Open the Certificate Import Wizard.
4
Select Local machine for Store location and click Next.
5
Select Place all certificates in the following store, click Browse.
6
Select the Personal store and click Next.

After the certificate is imported to the store, obtain and save the certificate thumbprint. The certificate thumbprint will be needed when you are setting up OAuth authentication.

Registering and configuring an application through the Microsoft Azure portal

Once you have the certificate, you can register an app for Enterprise Reporter to be used for mail delivery through Exchange Online.

You use the following process to register and configure the application through the Microsoft Azure portal:

1
Register the application. See To register an application.
2
Add Microsoft Graph API permissions for mail delivery. See To add Microsoft Graph API permissions for mail delivery.
3
Upload the certificate for authentication. See To upload the certificate for authentication.
To register an application
1
Log into the Azure portal (https://portal.azure.com) as global administrator or using an account that has the necessary permissions to create an application in the tenant.
2
In the Microsoft Azure dashboard, click Microsoft Entra ID.
3
In the left navigation pane, scroll down and click App registrations | New registration.
4
On the Register an application page, enter the application registration information:
•
Name: Enter a name for the application that identifies its use such as Enterprise Reporter for Exchange Online.
•
Supported account types: Select Accounts in this organizational directory only (tenant name only - Single tenant) for the accounts that can access the application API.
 
* 
NOTE: Leave the Redirect URI (optional) field empty as it is not needed
 
5
Click Register.
The Settings window for the newly-created application opens, displaying the application name you specified.
To add Microsoft Graph API permissions for mail delivery
IMPORTANT: It is highly recommended that the application does not have access to all mailboxes. For information about how to limit the application access to mailboxes see the Microsoft article Limiting application permissions to specific Exchange Online mailboxes at https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access.
1
In the left navigation pane, scroll down and click API Permissions.
2
Click Add a permission, click Microsoft Graph, and click Application Permissions.
3
Scroll down to and expand Mail.
4
Add Mail.ReadWrite and Mail.Send permissions.
* 
NOTE: The Enforce approver account validation option found when configuring email notifications will not function if you have used the Microsoft article to restrict access to a single mailbox.
5
Click Add Permissions.
6
In the center of the API Permissions page, notice the Grant admin consent for tenant name.Click Grant admin consent for tenant name to apply the permissions.
7
Click Yes to confirm.
8
On the Overview page (top left) you can find Application (client) ID and the Directory (tenant) ID. Copy these values as you will need them when you set up Exchange Online for OAuth authentication in Enterprise Reporter.
9
Return to Home (top left) and select Microsoft Entra ID which displays the tenant overview page.
10
In the left navigation pane, click Roles and administrators and browse through the roles to find Exchange Administrator (or enter Exchange Administrator in the search window).
The Exchange Administrator role is now available.
11
Click the Exchange Administrator role and click Add Assignments.
12
In the right search window, enter the name of the application you registered.
13
When the application appears, select Add at the bottom on the right side.
14
Click Home and select Microsoft Entra ID to display the tenant Overview page.
15
Select App registrations and either browse to your new app or enter the name the application in the search window.
16
Click the application and the page for the app is now available.
To upload the certificate for authentication

Your Microsoft Entra ID application requires a certificate for authentication.

1
In the left navigation pane, click Certificates & secrets.
2
Select Certificates and select Upload Certificate.
3
In the right side window, browse to the location of your certificate (.CER) file and select the file.
4
Add a description for the .CER file to distinguish it from other certificates.
5
Click Add at the bottom of the screen. Notice the certificate information is displayed including the thumbprint.
6
Copy the thumbprint value for use when you configure Enterprise Reporter.

The application configuration is complete. Ensure that you record the Application (client) ID and Directory (tenant) ID and the certificate thumbprint as they are required to configure the connection in Enterprise Reporter email settings.

Also, take note of when the certificate will expire so it can be replaced or renewed. Email using Exchange Online will stop flowing once the certificate has expired.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating