Enterprise Reporter 3.5 - Installation and Deployment Guide

Table 26. Required Permissions
Account	Use	Permissions
Administrator’s user account Use these credentials to log in to the computer, and to schedule reports.	Launch consoles	Be a member of Reporter_Discovery_Admins and Reporter_Reporting_Admins groups
	Enumerate scopes	Read access to all discovery targets
	Publish to SSRS	Write access to the SSRS server
	Deliver reports by email	Access to the SMTP server
	Enumerate report delivery shares and deliver reports	Read and write access to the delivery share
Service credentials Use these credentials for the Enterprise Reporter server and all nodes.	Use the shared data location, if configured for a cluster	Read and write access to the share
	Writing to the database	Be a member of Reporter_Discovery_Nodes group
	Collect data	Be a local administrator on all computer targets, and have read access to targeted domains, SQL servers, NTFS objects

Minimizing the Permissions Required for Credentials Used by Enterprise Reporter

A complex deployment may require some thought to determine what credentials you want to use in different situations. With effort, you can minimize the permissions you must add to accounts to use Enterprise Reporter. Keep in mind that some of the data collected is available only to privileged accounts. In most cases, accounts with inadequate privileges can collect partial data.

For this scenario:

•

You have several large domains, each with its own Enterprise Reporter administrator. Trusts exist between all domains.

•

There is one report administrator for the whole deployment.

•

Each domain has a dedicated cluster with a shared data location.

•

Each domain has a set of service credentials for use by the nodes.

•

Discoveries use alternate credentials specific to the targets.

•

SQL credentials are used to access the Enterprise Reporter database.

For each domain you need:

Table 27. Permissions Required
Account	Use	Permissions
Service credential Use these credentials for the Enterprise Reporter server and all nodes.	Enterprise Reporter server service	Local administrator access to the server host. Use the credentials from the domain in which the server is hosted
	Node service	Local administrator access to the node host
	Shared Data Location for each cluster	Read and write access to the share
Administrator’s user account Use these credentials to log in to the computer running the Configuration Manager.	Launch console	Be a member of Reporter_Discovery_Admins group
SharePoint Online An account with access to the discovery target tenant.	Collection of all SharePoint Online site collections	Administrator permissions, including tenant settings and policies, site information, and permissions are required. A SharePoint administrator role is recommended.

You also need:

Table 28. Additional Permissions Required
Account	Use	Permissions
SQL Account When creating the database or modify using the Database Wizard	Communication between the server and database Logging in to the Report Manager Communication between the node and the database	Read and write access to the database
Report Administrator account	Log in to the Report Manager	Must be a member of the Reporter_Reporting_Admins group
	Publish to SSRS	Write access to the SSRS server
	Deliver reports by email	Access to the SMTP server
	Enumerate report delivery shares and deliver reports	Read and write access to the delivery share
SharePoint Online	Collection of all SharePoint Online site collections	The discovery credentials must have site collection administrator rights to each site collection that is being collected. If additional credentials are being specified to minimize Azure throttling limitations, these credentials must have the same permissions. Refer to credentials required to create and consent to the Enterprise Reporter SharePoint Online application required for this discovery.

For browsing to your discovery targets and collecting the data you can choose the credentials that make sense for your environment. Set these credentials at the discovery level. For example:

•

For Active Directory® discoveries, you could use a domain admin account that has access to the targeted domain.

•

For computer accounts, you could either use existing accounts with local administrator access, or set up specific accounts for groups of similar computers.


	NOTE: The Credential Manager allows the owner of the credentials to enter the password. Other administrators can then use the credentials as appropriate.

•

For more information about credentials required to collect data with Enterprise Reporter discoveries, see Detailed permissions for Enterprise Reporter discoveries .

•

For more information about credentials required to collect data from Azure, Azure Active Directory, Azure Resource, Exchange Online, Microsoft Teams, and OneDrive, see Permissions for Enterprise Reporter tenant applications .

Effectively Deploy Remote Nodes

You can deploy nodes from the Configuration Manager or manually. When you are deploying a node to a remote computer, factors such as firewall configuration and network latency can cause problems. In this case, you can deploy a node manually on the host computer. For more information, see Node Deployment Issues . You can also supply alternate credentials to be used for Node service deployment. This account must have permission to copy files in the Admin$ share folder and to install and run services.

Deploying a Node to a Trusted Domain

When deploying a node to a trusted domain, the remote domain must trust the domain where the Enterprise Reporter Server is installed because the account that runs the node service has to authenticate to the Enterprise Reporter Server.

We strongly recommend deploying the Enterprise Reporter Node software on a computer that is local to the discovery targets - in this case, in the remote domain.

The Enterprise Reporter Service Account requires Local Administrator access to the remote node computers to deploy the node using the Configuration Manager.

The Enterprise Reporter Node service account has the following requirements.

•

It must be from the same domain as the Enterprise Reporter Server service account.

•

It requires sufficient rights to the Enterprise Reporter database (member of the Reporter_Discovery_Nodes group is sufficient).

•

It requires Local Administrator rights on the node computer.

When deploying a node to a trusted domain, the port requirements are the same as when deploying a node to a local domain. For more information, see Port Requirements .

Optimize Data Transfer

When you run a discovery for the first time, all of the data is collected and written to the database. For subsequent runs, only the changes are written. Determining the changes requires some processing, and you can choose the data source against which to compare the new data. You have two choices, and you may need to experiment to find the best setting for each cluster:

•

Compare to a local copy of the data

The shared data location is a network share, used by all nodes in the cluster. When data is collected, a copy of the data is stored in the shared data location. Subsequent runs of the discovery are compared to this data, and once the comparison is complete, only changes are sent to the SQL Server. This reduces traffic across the network and load on your SQL Server.


	NOTE: Not all discovery types utilize the shared data location. For example, Active Directory, Exchange, and NTFS, do not use the shared data location to optimize on the number of collection tasks generated to collect the data in a more efficient manner.

•

Compare to the main database

For subsequent runs of a discovery, the comparison can be made directly against the Enterprise Reporter database, instead of the shared data location. This can be faster if the node is physically close to your SQL Server, or if the SQL Server is lightly loaded.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Enterprise Reporter 3.5 - Installation and Deployment Guide

Understanding Credentials Using Scenarios

Effectively Deploy Remote Nodes

Deploying a Node to a Trusted Domain

Optimize Data Transfer