Identity Manager Data Governance Edition 8.0.1 - User Guide

Adding and editing a service account

To add a service account

1. In the Navigation view, select Data Governance.
2. Right-click Service accounts and select New.
3. In the Change master data form, select the Active Directory account, enter the password associated with the selected account and optionally enter comments.
4. Click the Save toolbar button to add the service account.

To edit a service account

1. In the Navigation view, select Data Governance | Service accounts.
2. In the Service Accounts result list, double-click the required service account.

   From the service account overview, you can view the domains associated with the selected service account.

3. From the Tasks view, select Change master data.
4. Select the Active Directory account, and enter the password and comment.
5. Click the Save toolbar button to save your changes.

Adding a managed domain

The rights needed to perform operations and scan computers are established by assigning a service account to the required domain.

The service account must already be created in Data Governance Edition to be assigned to a domain. For more information, see Adding and editing a service account.

To enable the Data Governance server to interact with computers in a domain

1. In the Navigation view, select Data Governance | Service accounts.
2. In the Service Accounts result list, right-click the service account, and select Tasks | Assign domains.

3. In the Add assignments pane (lower pane), double-click the required domain. You can also right-click the managed domain and select Assign or Assign all objects.

   The managed domain now appears in the top pane.

4. Click the Save toolbar button to save your selection.

Working with managed hosts and agents

A managed host is any network object that can host resources and can be assigned an agent to monitor security and resource activity. For more information, see Adding and configuring managed hosts.

Depending on the type of managed host, you may be deploying different agents. There are two types of agents — local and remote.

You must have enough free space on the agent computer in the installation directory to store the data collected by the agent. Please contact Software Support for details on estimating the disk space usage.

To optimize searches for access points, agents send security index information for resources under managed paths to the Data Governance server for storage in the One Identity Manager database. This allows clients to quickly determine the hosts where detailed access queries are to be directed.

Detailed access information is maintained on the agent computer, only sending general access information to the server.

The server acts as an intermediary between the agents and the databases where information is stored. It coordinates all agent deployments and communication, and manages the security index for each managed host. Only indexing direct-access points is done for several reasons:

• Security information that is not explicit is, by definition, inherited from a resource higher in the hierarchy. Unless the resource is the managed path, the agent has already indexed the explicit security on the parent resource that is causing the inherited security to be present.
• Not including inherited access points greatly reduces the total size of the index.
• Resources with only inherited access are not interesting from a security standpoint. Data Governance Edition is interested in the resources that have had security applied directly to them.

Related Topics

Deployment best practices

Agent leases

Adding and configuring managed hosts

Managed host configuration settings

Deployment best practices

When deploying Data Governance agents, local agents are preferable to remote agents. Local agents reduce network bandwidth and increase responsiveness. When it is not possible to deploy local agents to a system (such as when using a network attached storage device, or a virtual cluster node), the following best practices should be considered:

• When deploying multiple remote agents to an agent host computer, the number of agents a host computer can handle is limited by several factors:

  • The total number of resources being scanned by all hosted agents.

  • The total number of resources with explicit security being indexed by all hosted agents.

  • All the queries that are serviced by agents hosted concurrently are executed on that local hardware.

• Overwhelming the host computer with too many agents can result in slow indexing performance and intermittent failures in agent queries or in indexing operations.

• When deploying remote agents, ensure that the agents are hosted on computers that have low latency, high-bandwidth connections to their targets. This ensures that agents that have real-time change watching enabled will not suffer from periodic watch failures.
• When possible, avoid deploying agents to the computer hosting the Data Governance service itself. The server requires significant network resources to perform its various operations. When agents are deployed to this system, they compete for these network resources. Leaving the server with as few agents as possible ensures that it will not suffer performance degradation due to resource scarcity.
• More than one remote agent may be used to scan remote Windows computers, Windows clusters, and NAS devices. This is useful if the managed host has a large set of managed paths. Multiple agents may not scan the same managed paths.
• Manually installing agents is not supported. You must use the Manager client to deploy and configure Data Governance agents because you need access to the Data Governance application roles within One Identity Manager.

• When adding a remote agent, ensure that a trust exists between:

  • the domains of the agent host and the agent service account

  • the domains of the agent service account and the computer being scanned

• When deploying multiple agents to manage a SharePoint farm, One Identity recommends that you manage the lowest resources in the SharePoint hierarchy that you plan on governing or reporting on. Also, divide these managed resources across as many agent services as your SharePoint server can handle. This will provide the fastest scanning and the least amount of downtime when running reports.

Once you have added a managed host, you can begin to manage the data contained within it. For more information, see Managing unstructured data access.