Different types of managed hosts behave differently. The following sections provide the steps to configure each type of managed host.
You can add the following host computers as a managed host to your Data Governance Edition deployment:
Managed host configuration settings
|
NOTE: You can configure one target host computer at a time or multiple host computers (of the same type) at once. |
To add a local managed host to a Windows computer
Select Manage host from the Tasks view or right-click menu.
|
NOTE: If you selected multiple host computers with the status of Not Managed and of the same host type, use the Manage multiple hosts task or right-click menu command. The settings specified on the Managed Host Settings dialog will apply to all selected host computers. |
The Managed Host Settings dialog appears.
|
NOTE: If you select a host computer on a domain that was not previously identified as a managed domain, the Domain Credentials dialog appears. Click the Set button to supply the credentials of an Active Directory user with administrative rights on the selected domain. Assigning the credentials for the domain registers the user as a Data Governance Edition service account, links the service account to the domain and adds it to the managed domains list. Once the domain credentials are set, the Managed Host Settings dialog appears. |
Agent Install Path: (Optional) Use this field to specify an alternate installation location. This must be a local path (for example, C:\MyPath) and cannot exceed 512 characters.
|
NOTE: By default, this field displays Use default install directory and the agent is installed in the Data Governance agent services installation directory (%ProgramFiles%\One Identity\One Identity Manager Data Governance Edition\Agent Services). |
By default, local agents scan all local fixed volumes (NTFS devices) on the host computer. To limit the amount of security data being scanned, use the Managed Paths page to specify the root of an NTFS directory to be scanned. Once you configure one or more managed paths, only those paths are scanned.
To add managed paths:
On the Managed Paths Picker dialog, select the check box to the left of the directories to be scanned.
|
NOTE: For local managed hosts, the Agent Selection field at the bottom of this dialog is pre-populated with the name of the selected target machine. |
By default, local agents begin scanning immediately once deployed. Use the Security Scanning page to define a different scanning schedule for the agent.
For example, to delay the scan to run during off peak hours:
Use the Scan start time control to specify the desired time to perform the full scan.
|
NOTE: The Scan start time is local agent time. |
Review the options at the bottom of the page to determine if the default security scanning behavior needs to be modified:
By default, resource activity is not collected. Use the Resource Activity page to enable and configure resource activity collection on the target host.
|
IMPORTANT: Collecting resource activity on your managed hosts impacts network usage and increases the load on the database server and Data Governance server, especially when collecting activity on large busy servers. Configuring the proper exclusions and aggregation window is important to limit some of this load. Carefully plan out which resources you want to collect activity on and enable resource activity collection only on those resources. |
To configure resource activity collection and aggregation:
By default, certain well-known system accounts, file extensions and folders are excluded from the resource activity collection. To modify the exclusion list, click the Resource Activity Exclusions button to specify the accounts and objects to be excluded.
|
NOTE: By default, the Data Governance agent excludes the run as account (LOCAL SYSTEM) from activity collection and aggregation. |
By default, the security scan begins immediately upon agent deployment. Once the managed host is successfully added (Status is Managed), you are able to see and manage security information for the folders and shares on the target managed host using the Resource browser. Double-click a managed host in the Managed hosts view to launch the Resource browser.
You can add Windows servers and Windows clusters as managed hosts, with remote agents. However, you cannot collect resource activity for these types of remote managed hosts.
|
Note: Only Windows failover cluster configurations are supported. |
|
NOTE: You can configure one target host computer at a time or multiple host computers (of the same type) at once. |
To add a Windows cluster or Windows computer managed host with a remote agent
Select Manage host from the Tasks view or right-click menu.
|
NOTE: If you selected multiple host computers with the status of Not Managed and of the same host type, use the Manage multiple hosts task or right-click menu command. The settings specified on the Managed Host Settings dialog will apply to all selected host computers. |
The Managed Host Settings dialog appears.
|
NOTE: If you select a host computer on a domain that was not previously identified as a managed domain, the Domain Credentials dialog appears. Click the Set button to supply the credentials of an Active Directory user with administrative rights on the selected domain. Assigning the credentials for the domain registers the user as a Data Governance Edition service account, links the service account to the domain and adds it to the managed domains list. Once the domain credentials are set, the Managed Host Settings dialog appears. |
Agent Install Path: (Optional) Use this field to specify an alternate installation location. This must be a local path (for example, C:\MyPath) and cannot exceed 512 characters.
|
NOTE: By default, this field displays Use default install directory and the agent is installed in the Data Governance agent services installation directory (%ProgramFiles%\One Identity\One Identity Manager Data Governance Edition\Agent Services). |
Use the Agents page to select the remote agent and service account to be used to scan the target host.
To add a remote agent:
Select the service account: Select a service account with sufficient permissions to access the target computer and the agent host.
An agent requires a service account that has the rights to read security information on the remote host. Only previously configured service accounts that are registered with Data Governance Edition are available for selection. For more information, see Readying a service account and domains for deployment.
Click the Add button to add the agent to the agents list.
|
TIP: For remote managed hosts, add only one remote agent during the host's initial deployment. You can add additional remote agents later using the Edit host settings task after the managed host is deployed. |
Use the Managed Paths page to specify the roots of the NTFS directory tree to be scanned by the agent.
To add managed paths:
On the Managed Paths Picker dialog, click the check box to the left of a directory to add it to the managed paths list.
|
NOTE: When using multiple agents to monitor a remote managed host, select an agent from the Agent Selection drop-down after selecting the managed path(s) to be monitored. Repeat this process for all of the other agents, selecting different managed paths for each agent. The Scanning Agent field in the Managed Paths Selection grid displays the agent selected to scan the different paths. |
Click OK to save your selections and close the dialog.
The selected paths appear on the Managed Paths page.
By default, remote agents scan daily at 2:00 A.M. Use the Security Scanning tab to change the time and frequency with which the agent scans the target computer.
To modify the scanning schedule and settings:
Scanning of the specified managed paths begins on the configured schedule. Once the managed host is successfully added (Status is Managed), you are able to see and manage security information for the folders and shares on the target managed host using the Resource browser. Double-click a managed host in the Managed hosts view to launch the Resource browser.
You can remotely scan managed hosts (other than those on the supported list) by adding a “generic” managed host. This type of managed host supports scheduled scans only and does not support real-time security updates or resource activity collection.
|
Note: These hosts must be accessible through Windows shares. To determine if a host can be scanned for security information, you can use the Filesystem Statistics Utility (QAM.Server.FileSystemStatistics.exe) that is included with a Data Governance Edition installation. It scans a file system, enumerates its contents, and provides statistics on the files and folders contained on the specified data roots. |
|
NOTE: You can configure one target host computer at a time or multiple host computers (of the same type) at once. |
To add a generic managed host
In the Navigation view, select Data Governance | Managed hosts.
|
NOTE: If you do not see the host you want to manage listed, edit the Data Governance service configuration file (DataGovernanceEdition.Service.exe.config) as follows:
All of the hosts found using this filter will now appear in the Managed Host view as Unknown host type. |
Select Manage host from the Tasks view or right-click menu.
|
NOTE: If you selected multiple host computers with the status of Not Managed and of the same host type, use the Manage multiple hosts task or right-click menu command. The settings specified on the Managed Host Settings dialog will apply to all selected host computers. |
The Managed Host Settings dialog appears.
|
NOTE: If you select a host computer on a domain that was not previously identified as a managed domain, the Domain Credentials dialog appears. Click the Set button to supply the credentials of an Active Directory user with administrative rights on the selected domain. Assigning the credentials for the domain registers the user as a Data Governance Edition service account, links the service account to the domain and adds it to the managed domains list. Once the domain credentials are set, the Managed Host Settings dialog appears. |
Agent Install Path: (Optional) Use this field to specify an alternate installation location. This must be a local path (for example C:\Mypath) and cannot exceed 512 characters.
|
Note: By default, this field displays Use default install directory and the agent is installed in the Data Governance Server installation directory (%ProgramFiles%\One Identity\One Identity Manager Data Governance Edition\Agent Services). If there is an existing agent, you cannot install another agent with a different installation directory. All agents must be installed in the same directory. |
Use the Agents page to select the remote agent and service account to be used to scan the target host.
To add a remote agent:
Select the service account: Select a service account with sufficient permissions to access the target computer and the agent host.
An agent requires a service account that has the rights to read security information on the remote host. Only previously configured service accounts that are registered with Data Governance Edition are available for selection. For more information, see Readying a service account and domains for deployment.
Click the Add button to add the agent to the agents list.
|
TIP: For remote managed hosts, add only one remote agent during the host's initial deployment. You can add additional remote agents later using the Edit host settings task after the managed host is deployed. |
Use the Managed Paths page to specify the roots of the NTFS directory tree to be scanned by the agent.
To add managed paths:
On the Managed Paths Picker dialog, click the check box to the left of a directory to add it to the managed paths list.
|
NOTE: When using multiple agents to monitor a remote managed host, select an agent from the Agent Selection drop-down after selecting the managed path(s) to be monitored. Repeat this process for all of the other agents, selecting different managed paths for each agent. The Scanning Agent field in the Managed Paths Selection grid displays the agent selected to scan the different paths. |
Click OK to save your selections and close the dialog.
The selected paths appear on the Managed Paths page.
By default, remote agents scan daily at 2:00 A.M. Use the Security Scanning page to change the time and frequency with which the agent scans the target computer.
To modify the scanning schedule and settings:
Ignore all files and only store folder security data: Clear this check box if you want to include file security data in the security index.
Scanning of the specified managed paths begins on the configured schedule. Once the managed host is successfully added (Status is Managed), you are able to see and manage security information for the folders and shares on the target managed host using the Resource browser. Double-click a managed host in the Managed hosts view to launch the Resource browser.
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy