Use the Log Receiver Service tab to manage the Defender Log Receiver service. This service retrieves log files from the Defender Security Servers to the Defender Management Portal computer. The Defender Management Portal uses the retrieved log files to display authentication statistics and Defender Security Server warning messages and logs.
On this tab, you can use the following elements:
- Service status Shows the current status of the Defender Log Receiver service.
- Restart Restarts the Defender Log Receiver service. This button is only available when the service is running.
- Stop Stops the Defender Log Receiver service. This button is only available when the service is running.
- Start Starts the Defender Log Receiver service. This button is only available when the service is stopped.
- Communication port Specifies the port on which the Defender Log Receiver Service connects to the Defender Security Servers. The default port is TCP 13131. The Defender Management Portal automatically creates a rule in Windows Firewall to allow traffic on port specified in this text box. The rule is automatically updated when you change the port number.
- DSS log cache size limit (MB) Specifies the maximum size of the Defender Security Server log cache (.dat) file that is located on each Defender Security Server. The default maximum file size is 1000 MB. When the specified maximum file size is reached, older contents in the .dat file are overwritten. For more information, see Defender Security Server log cache.
- Log Receiver Service database size limit (MB) Specifies the maximum size of each Log Receiver Service database (.sdf) file that stores log data from the corresponding Defender Security Server. A separate .sdf file is created on the Defender Management Portal computer for each Defender Security Server. The default maximum size set for each .sdf file is 1000 MB. For more information, see Log Receiver Service database.
Use the Reports tab to specify folder for storing log files of the Defender Security Servers deployed in your environment. These log files are used to generate Defender reports. Use the DSS logs location text box to type the local or UNC path to the log files.
A portal role defines the actions available to the role holder in the Defender Management Portal. You can assign the following portal roles to users:
- Administrator
- Helpdesk
- Read-Only Helpdesk
- Reports
The next table provides information about the actions that a particular role allows its holder to perform in the Defender Management Portal. For instructions on how to assign portal roles to users, see Configuring the portal.
Table 16:
Defender Management Portal roles
|
View authentication statistics on the Dashboard |
Yes |
Yes |
Yes |
No |
|
Configure Defender Management Portal |
Yes |
No |
No |
No |
|
View Defender Security Server logs and warnings |
Yes |
Yes |
Yes |
No |
|
View token requests from users |
Yes |
No |
No |
No |
|
Configure self-service for users |
Yes |
No |
No |
No |
|
Use Helpdesk to diagnose authentication issues |
Yes |
Yes |
Yes |
No |
|
Use Helpdesk to resolve authentication issues |
Yes |
Yes |
No |
No |
|
Manage users |
Yes |
No |
No |
No |
|
Manage security tokens |
Yes |
No |
No |
No |
|
View Defender reports |
Yes |
No |
No |
Yes |
By default, the Defender Management Portal is configured to use form-based authentication. As a result, the users need to supply their credentials to sign in to the portal. However, you can enable automatic sign-in for the portal users who are already logged on to the Active Directory domain where the Defender Management Portal is installed.
To enable the automatic sign-in, use IIS Manager to disable anonymous authentication in the Defender Management Portal Web site settings.
To enable automatic sign-in to the portal
- On the Defender Management Portal computer, open IIS Manager.
- In the left pane, expand the appropriate nodes to select the Defender Web Interface site.
- In the right pane, under IIS, double-click Authentication.
- Right-click the Anonymous Authentication option to select Disabled.
With anonymous authentication disabled, when users access the Defender Management Portal, they are automatically signed in with their Windows credentials. When an administrator accesses the Defender Management Portal, the user name and domain name are entered on the sign-in page automatically — only the password is required.
