Enterprise Reporter 3.5.2 - Installation and Deployment Guide


	CAUTION: We recommend that you back up your Enterprise Reporter database and encryption key before beginning this process. This process cannot be undone once it has started.


	NOTE: Once an upgrade has started, all connections to the database will be closed and the database will be unavailable until the upgrade completes.

Click the Start menu and select All Programs | Quest | Enterprise Reporter | Database Wizard and click Next.

If the Database Wizard is already running, skip this step.

Choose Select/Upgrade Existing Database and click Next.

Enter the target SQL Server.

You can either type the SQL Server name or browse to it. If you browse, you will see all configured SQL Servers in your subnet. If you do not see your server on the list, type its name.

Confirm database name.

You can type a database name or browse to find one. Enterprise Reporter validates that the database exists, and is a valid Enterprise Reporter database. If the Browse dialog box is empty, ensure the SQL Server is correct or try different credentials since only databases to which the current credentials have access are shown.

Confirm which type of authentication to use to connect to the SQL Server and click Next.

Select the appropriate level of encryption for the data sent between the client and SQL server.


	NOTE: Enterprise Reporter supports TLS 1.3; however, TLS 1.2 remains a requirement since SQL Server 2022 satellite services require TLS 1.2 to be enabled. For more information on TLS support, see Microsoft documentation.

•

Strict (SQL Server 2022): Select this option for SQL Server 2022 and Azure SQL Managed Instance or when the instance has Force Strict Encryption enabled.

•

Mandatory: Select this option when the instance has Force Encryption enabled. It can also be used when no encryption is configured for the instance, but Trust server certificate is enabled. While this method is less secure than installing a trusted certificate, it does support an encrypted connection.

•

Optional

Enabling Trust server certificate, when 'Optional' or 'Mandatory' encryption is selected, or if the server enforces encryption, means that SQL Server will not validate the server certificate on the client computer when encryption is enabled for network communication.

Under Host name in the certificate, you can provide an alternate, yet expected, Common Name (CN) or Subject Alternative Name (SAN) in the server certificate. You would use this option when the server name does not match the CN or SAN, for example, when using DNS aliases. Leaving this option blank allows certificate validation to confirm that the CN or SAN matches the server name.

By default, Enterprise Reporter connects to the SQL Server using Windows authentication. If you want to connect using SQL credentials, enter them.

Confirm that you backed up the Enterprise Reporter database and encryption key using the Encryption Key Manager.

Select to enable The encryption key will need to be backed up, using the Encryption Key Manager and The database cannot be used until the upgrade completes successfully and click Next.

The Domain Local security groups should be populated for the upgrade and no action is needed. If the field is not populated browse to the Domain and OU for the groups and click Next. A pop up displays stating that the groups have been found. Click OK to proceed.

Review the Database Maintenance Wizard warning message and click OK to continue.

Click Finish to start the upgrade.

If the upgrade was successful a popup displays providing important information on the groups.

Click OK and close the Database Wizard.

To upgrade nodes

Start the Configuration Manager and select Manage Discovery Clusters.

In this case we will only have one cluster and two nodes. One installed on the same system where Enterprise Reporter is installed and one on another system on the network.

Click the Discovery Nodes tab.

One node may display a Status of Incompatible Version and the other as Faulted. The node on the same system as Enterprise Reporter (upgraded) is displaying a Status of Incompatible Version, because Windows does not restrict WCF communication with the node on the same system and the UPN or SPN is not needed in this case.

Right click the node that displays the status of Incompatible Version and select Node Properties.

While the Enterprise Reporter server service communicates with this node via WCF communication because it is on the same system, it is advised to add the UPN or SPN to be used for Kerberos authentication to the node.

Enter the UPN or SPN to use during the upgrade and click OK.

The Applying changes to Node dialog opens stating that the change has been successfully made to the node. Click on Close.

Click on the Incompatible Version node and in the Discovery Nodes menu bar select Upgrade Node (or right click and select Upgrade Node).

A dialog opens, click Yes if you want to proceed.

There is a check box to select if you want to use alternate credentials for the node.

The upgrade process for the node will start.

When the upgrade is completed the node will display Enabled and the version will be the version of the upgrade. The node is now available and discoveries can be run using this node.

Upgrading nodes in a failed state or faulted state

Nodes in the failed or faulted state can only be updated by removing the node from the Enterprise Reporter database and then reinstalling. Nodes can be in this state:

•

If Kerberos is implemented before Enterprise Reporter is upgraded to a version that supports Kerberos on the nodes (3.5.2x and above).

•

If during the upgrade of Enterprise Reporter nodes are stopped, Kerberos is enabled, and the upgrade to Enterprise Reporter 3.5.2.x is done.

To resolve nodes in a failed state

Open Configuration Manager and check nodes.

Local nodes with a status of Incompatible can be upgraded by selecting it, and clicking Upgrade Node.

The remote nodes are still stopped.

For nodes on a remote system that are stopped, select them, and click on Start.

Nodes that start and then fail with a status of Starting Failed will need to be removed.

This does not remove the node from the remote system, it only removes it from the Enterprise Reporter database so you can add it back again. Adding the node will update the node on the remote system.


	NOTE: Remove and add back the nodes one at a time to keep track which nodes have been updated and the name of the remote system.

Click Remove Node on the node on the remote system.

The node status will display as Removal Failed.

Close and then open the Configuration Manager and check the Nodes tab.

The node should be gone from remote node.

NOTE:

•

You may need to remove the node, close and open the Configuration Manager again for the removal to take affect.

•

The nodes are just removed from the Enterprise Reporter database, they are still installed on the remote system.

Click Add Node, select the system from which the failed node was removed.

Select the Node Credentials.

Enter the UPN or SPN in the required field.

Add any additional credentials as needed.

Click OK.

On the remote system, the out of date node will be remove and the new version node will be installed. The newly added node will have a status of Enabled once the upgrade is complete.

To resolve nodes in a faulted state

Open the Configuration Manager and check the status of the nodes.

Nodes installed on the Configuration Manager system will be enabled.

Nodes installed on the remote systems have a status of Faulted. These nodes will not bei able to communicate with Enterprise Reporter server service over Kerberos.

To resolve this, Enterprise Reporter needs to be update to version 3.5.2.x that includes Kerberos support for nodes.

Disable and stop the enabled nodes.

Close the Configuration Manager and upgrade to Enterprise Reporter to 3.5.2.x following To upgrade to Enterprise Reporter 3.5.2.x in a Kerberos only environment.

During the upgrade, you will receive a notification to disable and stop all active nodes. The Configuration Manager detects that it cannot communicate with these nodes. Thisis expected, so select the I understand and wish to continue check box to continue.

After the required reboot, log back in to Enterprise Reporter.

Open the Configuration Manager and check the nodes.

Local nodes (installed on the same system as Enterprise Reporter) will have a status of Incompatible Version. Select these nodes and click on Upgrade Node. Once upgrade the nodes will have a status of Enabled.

Right click the Enabled node, select Node Properties, and enter the UPN or SPN.

A Node Change pop-up opens to indicate that a change has been made to the node.

Nodes with the status of Faulted, due to the enabling of Kerberos, need to be removed.

This does not remove the node from the remote system, it only removes it from the Enterprise Reporter database so you can add it back again. Adding the node will update the node on the remote system.


	NOTE: Remove and add back the nodes one at a time to keep track which nodes have been updated and the name of the remote system.

Select the required node and click Remove Node.

The node will display an error message.

Select the node again and click Remove Node.

Close and open the Configuration Manager.

The node will no longer be displayed.

Click Add Node, select the system from which the faulted node was just removed.

Select the Node Credentials.

Enter the UPN or SPN.

Add any additional credentials as needed.

Click OK

On the remote system, the out of date node will be removed and the new version of the node will be installed.

The newly add node will have a status of Enabled once the upgrade is complete.

Perform the same procedure with all remaining Faulted nodes.

Once all node have been upgraded, the discoveries can be run in the typical manner.

Updating Nodes using Enterprise Reporter PowerShell cmdlets

Use the following information to update nodes in environments where Kerberos authentication has been implemented, but Enterprise Reporter has not been updated for Kerberos support.

Even after upgrading Enterprise Reporter with Kerberos support, the nodes will indicate as Faulted. The only exception to this will be the node (if configured) installed on the same system as Enterprise Reporter. This node can be upgraded in the typical manner.

To upgrade the other nodes, you need to run the node installation on each of the systems that have faulted. The reason is that since Kerberos has been implemented, the installed node software cannot communicate with the Enterprise Reporter Server Service located on the system where Enterprise Reporter is installed.

To resolve this, the Update-ERNode command includes a UpnSpn parameter to allow the inclusion of the User or Service Principal Name needed for Kerberos communications. For example, the following command upgrades the specified node in specified cluster using a User or Service Principal Name for node installation in a Kerberos only environment.

Update-ERNode "First Cluster" "AMERGEN01" administrator@amer.sitraka.com


	NOTE: Depending on the Enterprise Reporter setup, it is recommended that nodes be upgraded within a cluster.

To upgrade nodes within a cluster

Run the following command to list all the nodes in the variable $Nodes:
$Nodes = Get-ERNode -Cluster "First Cluster" $Nodes

-OR-

Run the following command to retrieve the nodes:

Get-ERNode -Cluster "First Cluster"

The returned information includes the following:

Version : 3.5.1.6
Computer : AMERGEN01.amer.sitraka.com
ServiceCredentialId : 08814be4-7b6d-41b2-8f66-998ebcd671ee
SqlCredentialId : 00000000-0000-0000-0000-000000000000
Status : Enabled
MaxJobSlots : 0
ClusterId : 94356c24-ab3f-4ab8-a407-65de08bfe4dc

Run the Update-ERNode command to update the node. For example,

Update-ERNode "First Cluster" "AMERGEN01" administrator@amer.sitraka.com

To retrieves all the nodes in the cluster (one at a time), and then updates each node:

Run the Get-ERNode command. For example,

Get-ERNode -Cluster "First Cluster" | ForEach-Object -Process {Update-ERNode "First Cluster" $_.Computer -UpnSpn "administrator@amer.sitraka.com"}

Stop and restart the Enterprise Reporter Server Service so that it can connect, through Kerberos, with the nodes and retrieve the node status.

Stop-Service QuestReporterServer

Get-Service QuestReporterServer

This can be done 3 to 5 minutes after the command is run to retrieve the nodes. The status is stored in the database.

Run the Get-ERNode -Cluster "First Cluster" command to see the process of the upgrade of the nodes.

The node may report Upgrading and seem to be stuck. In this case, restart the Server Service to get the latest status from the nodes and store it in the database.

See the appendix in the Enterprise Reporter Configuration Manager User Guide for details on using the Enterprise Reporter PowerShell commands.