Chat now with support
Chat with Support

Security Explorer 9.9.1 - Installation Guide

Minimum permissions for Access Explorer

 
Table 4. Minimum permissions for Access Explorer
Account
Requirement

Logged in user
•
To install the Access Explorer agent, the user must have administrator access on the local computer.
•
To create the Access Explorer database, the logged in user (Windows® Authentication) or SQL account must have rights to create databases, logins, and groups on the computer running SQL Server®.
•
Must have rights to create groups in Active Directory®.
•
Must be able to enumerate the targets during scope selection.

Security Explorer service account
•
Must have Login as service right on the computer on which it is being installed.
•
Will be automatically granted Read and Write permissions on the Security Explorer database (Windows Auth.)
•
If the server is configured to use SQL authentication, the SQL credentials will be used to access the database instead of the service account.
•
Must be able to write to the Admin$ share to deploy the node (local admin rights)

Service accounts for managed computers
•
Local Administrator rights for managed computers is recommended.
•
To create the database, Sysadmin rights on the computer running SQL Server are required. Once the database is created, the service account can be granted dbowner rights on the database alone.
•
The database has to be created using the wizard in Security Explorer.
•
Full Administrator rights are required on the Netapp filer / EMC
•
Must be able to do group expansion and SID resolution for managed accounts and their membership (Domain Admin recommended).

Port requirements for Access Explorer

On the server where the Access Explorer agent is installed, configure the firewall to allow outgoing traffic on TCP port 8721, as well as incoming traffic on TCP port 18530. Also, ensure that the Access Explorer service firewall has the following exceptions configured: incoming TCP 8721, 8722, and outgoing 18530.

Minimum requirements for Microsoft Exchange for Security Explorer

Client access server configuration
1
Check that all Exchange Windows services that have Automatic startup type are started.
2
Check that IIS Admin Service and World Wide Web Publishing Service IIS Services are started.
3
Check that the Exchange Web Application is configured correctly in IIS:
•
Authentication: Windows Authentication is Enabled
•
SSL Settings: Require SSL is switched on
4
Exchange Server 2010 - 2019: Enable Windows PowerShell® Remoting on the Exchange Server by running the Windows PowerShell command: Enable-PSRemoting –force.
Client Configuration
1
Open port 443 on the firewall.
2
Install an Exchange Server SSL certificate.

Permission requirements to manage Microsoft Exchange in Security Explorer

•
To connect to an Exchange 2010 Organization, a user must be a domain user, have a mailbox on one of the Exchange Servers, be a member of the Organization Management group, and have impersonation rights.
For more details on configuring user impersonation, see Configuring Exchange Impersonation in Exchange 2010.
•
To connect to an Exchange 2013, 2016, or 2019 Organization, a user must be a domain user, have a mailbox on one of the Exchange Servers, be a member of the Organization Management domain group, and have impersonation rights.
To configure impersonation in Security Explorer
1
In the Navigation pane, expand Role Based Access Control | Roles | ApplicationImpersonation | Assignments.
2
Select Assignments, and select File | New.
3
Enter the name and user.
4
Select RecipientRelativeWriteScope and choose Organization from the list.
5
Click OK and restart Security Explorer.
•
To connect to an Exchange 2010–2013 Organization (Mixed Mode), a user must be a domain user, have a mailbox on one of the 2013 Exchange Servers, be a member of the Organization Management domain group, and have impersonation rights on the Exchange 2010 and 2013 client access servers.
 
* 
IMPORTANT: Only a user who is a Domain Administrator and Exchange Administrator has no restrictions for mailbox management in Security Explorer. There are possible restrictions in Security Explorer for mailbox management. See Restrictions with mailbox management.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating