Prior to deploying Data Governance agents:
Ensure disk space is sufficient on the drive hosting the agent files.
Ensure the trusted root certificates on the agent are up to date.
|
Note: The agent requires VeriSign Class 3 Public Primary Certification Authority - G5.cer. |
This table lists the methods that can be used to deploy Data Governance agents.
|
Note: As of Data Governance Edition version 7.0.2, manually deploying agents is NOT allowed. You must use the Manager client to deploy and configure Data Governance agents because you need access to the Data Governance application roles within One Identity Manager. |
Deployment method | Description | Notes/Where to find additional information | ||||||
---|---|---|---|---|---|---|---|---|
Manager - single agent deployment |
The recommended method for adding a managed host.
|
For more information on determining the type of agent to be deployed, see Working with managed hosts and agents. For more information on deploying the different types of managed hosts, see Adding and configuring managed hosts. For more information about the configuration settings available, see Managed host configuration settings. | ||||||
Manager - multiple agent deployment |
Use to add and configure multiple managed hosts at once.
|
Not available for adding SharePoint managed hosts. Does not apply to DFS, NFS, or Cloud host types (you do not select host computers when adding these types of managed hosts). The server deploys the agents in a staggered manner. All hosts must be in managed domains. For more information on adding or configuring managed hosts, see Adding and configuring managed hosts. | ||||||
Windows PowerShell |
Use the following PowerShell cmdlets in the OneIdentity.DataGovernance snap-in to deploy and configure managed hosts:
|
These PowerShell cmdlets do not support adding Cloud managed hosts or setting managed paths for Cloud managed hosts. For more detailed information on using Windows PowerShell to manage your agent deployment, see the One Identity Manager Data Governance Edition Technical Insight Guide. |
Different types of managed hosts behave differently. The following sections provide the steps to configure each type of managed host.
You can add the following host computers as a managed host to your Data Governance Edition deployment:
Managed host configuration settings
|
NOTE: You can configure one target host computer at a time or multiple host computers (of the same type) at once. |
To add a local managed host to a Windows computer
Select Manage host from the Tasks view or right-click menu.
|
NOTE: If you selected multiple host computers with the status of Not Managed and of the same host type, use the Manage multiple hosts task or right-click menu command. The settings specified on the Managed Host Settings dialog will apply to all selected host computers. |
The Managed Host Settings dialog appears.
|
NOTE: If you select a host computer on a domain that was not previously identified as a managed domain, the Domain Credentials dialog appears. Click the Set button to supply the credentials of an Active Directory user with administrative rights on the selected domain. Assigning the credentials for the domain registers the user as a Data Governance Edition service account, links the service account to the domain and adds it to the managed domains list. Once the domain credentials are set, the Managed Host Settings dialog appears. |
Agent Install Path: (Optional) Use this field to specify an alternate installation location. This must be a local path (for example, C:\MyPath) and cannot exceed 512 characters.
|
NOTE: By default, this field displays Use default install directory and the agent is installed in the Data Governance agent services installation directory (%ProgramFiles%\One Identity\One Identity Manager Data Governance Edition\Agent Services). |
By default, local agents scan all local fixed volumes (NTFS devices) on the host computer. To limit the amount of security data being scanned, use the Managed Paths page to specify the root of an NTFS directory to be scanned. Once you configure one or more managed paths, only those paths are scanned.
To add managed paths:
On the Managed Paths Picker dialog, select the check box to the left of the directories to be scanned.
|
NOTE: For local managed hosts, the Agent Selection field at the bottom of this dialog is pre-populated with the name of the selected target machine. |
By default, local agents begin scanning immediately once deployed. Use the Security Scanning page to define a different scanning schedule for the agent.
For example, to delay the scan to run during off peak hours:
Use the Scan start time control to specify the desired time to perform the full scan.
|
NOTE: The Scan start time is local agent time. |
Review the options at the bottom of the page to determine if the default security scanning behavior needs to be modified:
By default, resource activity is not collected. Use the Resource Activity page to enable and configure resource activity collection on the target host.
|
IMPORTANT: Collecting resource activity on your managed hosts impacts network usage and increases the load on the database server and Data Governance server, especially when collecting activity on large busy servers. Configuring the proper exclusions and aggregation window is important to limit some of this load. Carefully plan out which resources you want to collect activity on and enable resource activity collection only on those resources. |
To configure resource activity collection and aggregation:
By default, certain well-known system accounts, file extensions and folders are excluded from the resource activity collection. To modify the exclusion list, click the Resource Activity Exclusions button to specify the accounts and objects to be excluded.
|
NOTE: By default, the Data Governance agent excludes the run as account (LOCAL SYSTEM) from activity collection and aggregation. |
By default, the security scan begins immediately upon agent deployment. Once the managed host is successfully added (Status is Managed), you are able to see and manage security information for the folders and shares on the target managed host using the Resource browser. Double-click a managed host in the Managed hosts view to launch the Resource browser.
© 2023 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy