ACMP Server

You can configure performance using the performance settings. There are 6 different queues available for this purpose, each covering a separate performance area.

26

27

This division helps prevent potential performance issues that would otherwise cause delays in processing requests. With the various queues, you can specify the number of threads for each individual area.

28

29

|**Queue**|**Description**

30

|Allocated threads for the dispatcher queue|The dispatcher queue is responsible for all requests and distributes them to the other queues. It reads the header and performs the SSL handshake, which allows all requests to be routed to the other queues. The number of specified threads (default: 4) is sufficient for small to medium-sized environments.

31

|Allocated threads for the agent queue|The agent queue is one of the most important settings when you have many Clients in use. For the queue, you can use the “Active Client Connections” metric in performance monitoring to check whether there are any delays in terms of performance deviation.

32

|Allocated threads for the console queue|If you have many consoles running at the same time, delays may occur when there are a large number of concurrent requests. This can happen, for example, when many consoles are using the Helpdesk. If delays occur in the console, you can increase the number of threads to alleviate the load.

33

|Allocated threads for the Web Interface queue|The Web Interface queue occurs when many browsers in your environment are accessing the Web Interface at the same time, causing delays. In this case, increasing the number of threads may help.

34

|Allocated threads for agent in rollout queue|The difference between the agent queue and the agent rollout queue is that the latter explicitly refers to the Clients that are assigned a Rollout.

35

|Allocated threads for the ACMP Kiosk queue|This queue is used, for example, when you want to install Client Commands, Job Collections, or Managed Software via your clients and the ACMP Kiosk.

=== Checking Queues for Overload ===

40

41

You can use Performance Monitor to check whether the queues are overloaded. To do this, add a new performance counter using the //Performance Monitor// service and select the //ACMP Server// instance.

42

43

44

[[image:Performance Leistungen.png||data-xwiki-image-style-alignment="center"]]

45

46

47

Add ACMP Server as a Performance Indicator

You can identify an overload by looking at the graph; if it shows a consistently high value and does not drop toward 0, there is an overload. Use the various lines in the chart to determine which queue is causing a delay in the system.

52

53

=== **Port Settings** ===

54

55

The port settings allow you to customize the port for server communication with the ACMP Console.

56

57

To change the port, first enable the “Use alternative port” checkbox. Then enter the desired port number.

58

59

60

Before you can block connections from the ACMP Console to the ACMP Server via the default port, you must ensure that the ACMP Console is connected to the ACMP Server via the alternate port.

61

62

63

If you've changed the port, save your settings.

64

65

66

Access via the default port is possible at any time using the ACMP Console installed on the ACMP Server.

67

68

69

== Console Login Settings ==

70

71

This setting configures the option to save the password in the console login dialog. If you want to disable this option, check the checkbox below it. This prevents the password from being saved, and the user must enter it manually each time.

= Active Directory =

ACMP can read user and group information from Active Directory. To do this, you need a user account with read permissions in the domain.

77

78

79

[[image:69_System_Einstellungen_ActiveDirectory_1560.png||alt="68_System_Einstellungen_ActiveDirectory_1560.png" data-xwiki-image-style-alignment="center"]]

80

81

82

System Settings: Active Directory

== Manage Active Directory ==

87

88

Enter the required information under Active Directory. To do this, click the //Change// button and enter the domain, username, and password to be used. You can also choose whether to use encryption for Active Directory (SSL/TLS), which encrypts the data being transmitted. You can enter additional information in the “Description” field. If you want to use a static IP address to connect to a specific domain controller, you must enable the corresponding checkbox. It is advisable to use a static IP address (domain controller IP or global catalog IP) if, for example, the domain controller cannot be resolved using Windows’ built-in mechanisms. Otherwise, you can disable the field.

89

90

91

[[image:69_Einstellungen_Eigenschaften der Anmeldeinformationen_402.png||alt="63_Einstellungen_ActiveDirectory_EigenschaftenderAnmeldeinformationen_340.png" data-xwiki-image-style-alignment="center"]]

92

93

94

Credential Properties

**Recommendations for Use with Active Directory**

100

101

The following recommendations apply when using Active Directory:

102

103

* Under “User Domain,” enter the FQDN (Fully Qualified Domain Name) and not “just” the NetBIOS name. In this example, it is the internal Windows domain (//aagon.local//).

104

* Use SSL/TLS as the encryption method to secure data transmission.

105

* Ensure that the client executing the Query is a domain member (for example, in the case of this AD login, that would be the ACMP Server).

106

* Additional examples: For kiosk visibility, the client must be a domain member; for Client Commands, the executor itself must be a domain member (either the ACMP Console or the ACMP Agent).

107

108

Only by following the recommendations above can you ensure that Windows uses Kerberos for authentication and does not fall back on NTLM.

Please note that you can only use LDAPS in ACMP if both the server and the console are in the same domain; otherwise, the certificates will not be transferred. If you are in a workgroup, LDAP may work, but the encrypted version (LDAPS) will not, as a domain is required for this.

113

114

115

== Multiple Domains ==

116

117

If you want to use multiple domains for Active Directory - for example, to search them for users - you can assign global accounts here. You assign these accounts by clicking //Link//. A mask will open where you can add new accounts, edit existing ones, or delete them entirely. Clicking //OK// will immediately enable the account to find the specified domain. If you want to deselect all domains, select the appropriate domain and click the //Unlink// button. This function allows you to delete old domains from your system and exclude them from searches.

118

119

120

== Active Directory Login ==

121

122

You can import Active Directory users into the ACMP [[User Management>>doc:ACMP.610.ACMP-Solutions.System.Benutzerverwaltung.WebHome]] module. This means that user account management is configured entirely in Active Directory, but permissions are still managed in the ACMP User Management module.

123

124

To enable ACMP login for AD users, enable the checkbox labeled //Enable ACMP Console Login for Active Directory Users//. Additionally, you must configure the ACMP access group “AD Login” and assign to it the AD groups that are permitted to log in to ACMP. To do this, click the link displayed under the “Access Groups” heading and navigate to user management to customize the access group. Now assign the groups from your domains - which are permitted to log in to the ACMP Console - to the ACMP group “AD Login.”

125

126

127

Please note that you can only select a domain after you have first created a user account with the appropriate read permissions under [[Active Directory>>doc:||anchor="HActiveDirectory"]]!

128

129

130

== LDAP Result Cache ==

131

132

The LDAP Result Cache allows you to specify how long the ACMP Server should cache the results of LDAP Queries. The default value is 15 minutes; you can enter up to 120 minutes as the maximum cache lifetime.

133

134

== Importing AD Users ==

135

136

To import an AD user, you must first add an AD account via //System > Settings > ACMP Server > Active Directory//. Then configure an [[AD-Login>>doc:||anchor="HActiveDirectoryLogin"]] and select an AD group. Next, in user management, import the desired AD users.

137

138

== Convert Existing ACMP Users to AD Users ==

139

140

If AD login is enabled at a later date, the existing ACMP users can be converted to AD users. The conversion is performed using ADUserMigrate.exe, which is located in the ACMP server directory. Run the executable from the Command line. First specify the ACMP User, then the AD User (e.g., “C:\Program Files (x86)\Aagon\ACMP Server\ADUserMigrate.exe” tester [[tester@domain.local>>mailto:tester@domain.local]]). Once the execution has been completed, the users will be converted.

141

142

== **Allowing Additional Users from a Trusted Domain** ==

143

144

If you want to allow additional users from a trusted domain - hat is, another trusted domain - you must grant the querying AD user read permissions on the //ForeignSecurityPrincipal// object and its child objects.

145

146

147

[[image:Erweiterte Sicherheitseinstellungen für „ForeignSecurityPrincipals“.png||data-xwiki-image-style-alignment="center" height="509" width="750"]]

148

149

150

Advanced Security Settings for “ForeignSecurityPrincipals”

To do this, enable the advanced features in your //Active Directory Users and Computers// MMC. On the //Security// tab of the //ForeignSecurityPrincipal// container, click //Advanced// to view all users and groups that already have access to this object. Using //Add//, you can then add the user who should have access to the Trusted Domain. Make sure that the user is granted Read permissions (these are usually already selected) and that the permissions are applied to //This object and all child objects//.

155

156

This user must then also be added in ACMP under //Settings// > //ACMP Server// > //Active Directory//.

157

158

159

Please note that the logon group you have defined in ACMP must be a domain-local group. The users you add to the logon group from the Trusted Domain must be directly linked to this group. You cannot specify a group from the Trusted Domain here, because the LDAP search does not allow for nested objects from Trusted Domains at this point.

= Email Service =

On this page, you can enter the connection details for your email service and the server. This allows emails to be retrieved automatically and saved as tickets. Emails can also be sent automatically, for example, during automatic ticket generation or when a specific escalation level is reached (see [[Escalations>>doc:ACMP.610.ACMP-Solutions.System.Einstellungen.Helpdesk.WebHome||anchor="HEscalations"]] and [[Rules>>doc:ACMP.610.ACMP-Solutions.System.Einstellungen.Helpdesk.WebHome||anchor="HRules"]]).

166

167

168

[[image:68_Einstellungen_E-Mail Service Allgemein_1716.png||alt="33c_64_System_Einstellungen_E-MailService_1395.png" data-xwiki-image-style-alignment="center"]]

169

170

171

Settings: Email Service

=== **Server information** ===

176

177

First, specify whether you want to enable receiving and sending emails. To do this, check the box next to //Enable Email Service//. This is also a condition for making changes in the following sections. Insert the sender and the display name. The sender should be an email address, and the display name is the name that will appear when sending and receiving emails. You can use the timeout setting to specify how long the email service should wait before responding to a connection request. The default setting is 30 seconds. You can also specify the interval at which incoming emails should be retrieved.

178

179

After you have entered all relevant information for sending and receiving email, you can also test the connection to verify that all entered data is correct.

180

181

=== **Receiving Email** ===

182

183

First, enable the //Enable Email Reception// checkbox to enter additional information in this section. Then enter the incoming mail server. New emails will then be retrieved via IMAP4 or POP3 through this account. If you use IMAP, you must also specify the corresponding inbox folder. In addition to entering the incoming mail port, you can also configure transport encryption. You have the following options:

184

185

186

|=(% style="width: 166px;" %)Option|=(% style="width: 1197px;" %)Explanation

187

|(% style="width:166px" %)No SSL|(% style="width:1197px" %)An unencrypted connection is established for communication.

188

|(% style="width:166px" %)STARTTLS|(% style="width:1197px" %)In this process, the connection is initially established in unencrypted form. Once encryption has been negotiated, the subsequent connection is encrypted. If the negotiation fails, communication continues in unencrypted form.

189

|(% style="width:166px" %)SSL/TLS|(% style="width:1197px" %)Encryption is negotiated at the start of the connection establishment. If this fails, communication is not possible, and no unencrypted data is transmitted.

190

191

192

The following SSL versions are supported for STARTTLS and SSL/TLS: TLS 1.0, TLS 1.1, and TLS 1.2

193

194

195

Now enter a username and password for the account.

196

To configure password encryption, you have the following options in addition to the encryption level:

197

198

|=(% style="width: 163px;" %)Option|=(% style="width: 1201px;" %)Explanation

199

|(% style="width:163px" %)Regular Password|(% style="width:1201px" %)In this case, the system attempts to use PLAIN or login as the authentication mechanism. If the Server does not explicitly support any of these mechanisms in its capabilities, the protocol default is used.

200

|(% style="width:163px" %)Encrypted Password|(% style="width:1201px" %)The SASL mechanism performs an automatic determination of which authentication mechanism is used. The available options are CRAM SHA1, CRAM MD5, SKEY, OTP, and DIGEST.

201

|(% style="width:163px" %)NTLM|(% style="width:1201px" %)The NTLM mechanism is used here.

202

|(% style="width:163px" %)OAuth|(% style="width:1201px" %)(((

203

With this encryption method, you cannot enter a password; however, OAuth configuration is available. Selecting the //OAuth// option enables OAuth configuration. Here, you can request a new token or delete an existing one.

)))

Read here to learn how to set up [[Setp Up OAuth2 for the ACMP Server's email service>>doc:.OAuth2 am ACMP Server einrichten.WebHome]].

208

209

210

Under “Inbox Folder,” you can enter a caption; the default is //INBOX//. If you want to delete emails after retrieving them from the Server, you can check the checkbox with the same name.

211

212

=== **Send Email** ===

213

214

Enter some details for sending emails. Specify the Server and port through which the messages are to be sent. To do this, you must specify the outgoing port and the transport method:

215

216

|(% style="width:171px" %)**Option**|(% style="width:1193px" %)**Explanation**

217

|(% style="width:171px" %)No SSL|(% style="width:1193px" %)An unencrypted connection is established for communication.

218

|(% style="width:171px" %)STARTTLS|(% style="width:1193px" %)In this process, the connection is initially established in unencrypted form. Once encryption has been negotiated, the subsequent connection is encrypted. If the negotiation fails, communication continues in unencrypted form.

219

|(% style="width:171px" %)SSL/TLS|(% style="width:1193px" %)Encryption is negotiated at the start of the connection establishment. If this fails, communication is not possible, and no unencrypted data is transmitted.

220

221

Check this box if you do not want to accept trusted certificates. For the authentication mechanism, you can choose from various options (//no authentication//, //use settings from the email inbox//, or //use these credentials//). Depending on your selection, the user credentials will be imported from the email inbox, or you will need to enter your own credentials. Also select password encryption for sending emails:

222

223

|(% style="width:174px" %)**Option**|(% style="width:1189px" %)**Explanation**

224

|(% style="width:174px" %)Regular Password|(% style="width:1189px" %)In this case, the system attempts to use PLAIN or login as the authentication mechanism. If the Server does not explicitly support any of these mechanisms in its capabilities, the protocol default is used.

225

|(% style="width:174px" %)Encrypted Password|(% style="width:1189px" %)The SASL mechanism performs an automatic determination of which authentication mechanism is used. The available options are CRAM SHA1, CRAM MD5, SKEY, OTP, and DIGEST.

226

|(% style="width:174px" %)NTLM|(% style="width:1189px" %)The NTLM mechanism is used here.

227

|(% style="width:174px" %)OAuth|(% style="width:1189px" %)(((

228

With this encryption method, you cannot enter a password; however, OAuth configuration is available. Selecting the //OAuth// option enables OAuth configuration. Here, you can request a new token or delete an existing one.

229

)))

230

231

== OAuth configuration ==

232

233

Using the OAuth configuration, you can view a token username, request a new token, or delete a token. To use the latter two options, you must already have a token. You can only use this option if you have selected OAuth as the password encryption method.

234

235

== End-to-End Encryption ==

236

237

In ACMP, you have the option to use S/MIME encryption technology for your email traffic. End-to-end encryption is established when both the sender and the recipients have received the other party’s public key via an S/MIME-encrypted email. The content of the communication can then only be read by the sender and recipients. Third-party access is prevented.

238

239

Go to //System > Settings > ACMP Server > Email Service > End-to-End Encryption//. By default, ACMP does not use any email encryption technology. If you want to use S/MIME, you must first choose an encryption mode:

|(((

**Encryption Mode**

)))|**Meaning**

|No email signing or encryption|S/MIME is not used; email traffic is transmitted without sender verification and is unencrypted.

245

|Signing Emails|The email is digitally signed, which verifies the sender's identity. In this case, however, third parties can still read the message. There is no encryption.

246

|Sign and encrypt emails, but allow them to be sent unencrypted|The email is digitally signed and encrypted. However, emails can still be sent even if an S/MIME certificate is not on file for every recipient.

247

|Sign and encrypt emails; never allow them to be sent unencrypted|The email is digitally signed and encrypted. However, emails can only be sent if an S/MIME certificate is on file for EVERY recipient.

248

249

**Manage Certificates**

250

251

To ensure that your emails have an S/MIME certificate and are therefore encrypted, you must first specify your certificate in ACMP. You can obtain a certificate either by generating one yourself or by purchasing a CA certificate.

252

253

Go to //Manage Certificates > Add Certificate//.

254

255

Specify the //certificate file// and the //private key file//.

256

257

258

The PKCS#12 or PFX/P12 format is commonly used. ACMP does not support this format in principle, since the certificates and keys are combined into a single file. However, you can use the OpenSSL commands `openssl pkcs12 -in path.p12 -out newfile.crt -clcerts –nokeys` for the certificate and `openssl pkcs12 -in path.p12 -out newfile.pem -nocerts –nodes` for the private key to generate two separate files from the original file.

259

260

261

For the private key file, enter the corresponding password under //Passphrase//. Click OK. The certificate's serial number and validity period will be automatically retrieved and filled in.

262

263

When you send an email, a certificate with S/MIME will be automatically attached.

264

265

If you want to delete the certificate later, click //Manage Certificates > Delete Certificate//.

266

267

**Adding Recipient Certificates Manually**

268

269

By default, public certificates from received emails are automatically saved. However, if you receive a sender’s certificate through a method other than email, you can add the certificate manually.

270

271

To do this, go to //Master Data > Contacts// on the ribbon bar. In the //Contact Details// of an existing contact or a new contact you are creating, click the icon in the //Email// field and enter the certificate there.

272

273

274

[[image:64_System_Stammdaten Kontakte_1504.png]]

275

276

277

Add a Certificate for Contacts in Master Data

= Scheduled Server Tasks =

282

283

To manage server load, you can define predefined server tasks and their individual start conditions here.

284

285

286

[[Settings - Scheduled Server Tasks>>image:68_Einstellungen_GeplanteServeraufgaben_1918.png||alt="68_Einstellungen_GeplanteServeraufgaben_1611.png" data-xwiki-image-style-alignment="center"]]

You can select the start conditions yourself by double-clicking on the corresponding task. The following options are available to you:

294

295

|**Possibility**|**Explanation**

296

|At a specific time|The task is executed daily at the specified time.

297

|Within a start interval|The task will be performed at the specified time.

298

|On the last day of every month (deprecated)|In this case, the execution always starts on the last day of the month. You can also specify whether the execution should run at a specific time, during shutdown, based on a start interval, or within a time window.

299

|Within a date range|Specify an interval in minutes, hours, or days.

300

|On specific days of a week|Specify one or more days. You can then specify a specific time, a start interval, or a time window.

301

|On specific days of a month|Specify a day of the month. You can then specify a specific time, a start interval, or a time range.

302

|Within a time frame|Specify a time window for execution.

303

304

305

When entering a time window, you can enable the “Check before execution” option. This causes the time window to be checked again on the device before the task is executed, ensuring that the task is not executed outside the time window.

306

307

308

You can also manually trigger the execution by clicking //Start Now//.

309

310

You can choose from the following predefined server tasks:

311

312

|=General|=

313

|Checks for items with new Distribution Ring|Checks whether elements can be moved to the next distribution ring.{{aagon.infobox}}This option applies to both Managed Software and Windows Update Management (including Defender and Office 365 Updates).{{/aagon.infobox}}

314

|Client Tenant relation calculation|Dynamically links clients to clients based on the tenant filter.

315

|ACMP Gateway cleanup|Removes expired certificates from the ACMP Gateway.

316

|Server Monitor log cleanup|Removes server job executions that are older than 30 days (default).

317

|Assigns Clients to Containers dynamically|Calculates dynamic shortcuts from Clients to containers.

318

|Renew Client Certificates|Renew the Gateway certificates on the Clients.

319

|Scan network|Scan the network for new Clients.

320

|Server license update|(((

321

Retrieves new license information from the Aagon license server.

322

323

324

Disabling this server task will prevent license information from being retrieved from and updated on the license server. Do not disable this task, as doing so will interfere with ACMP operations!

325

326

)))

327

|VMware vSphere Scanner|Scans VMware vSphere Server for guest systems.

328

|Generate value directory|Updates the available values for filters.{{aagon.infobox}}This option causes the inventory data to be checked in order to populate the filter value lists. It is used for queries with the IN operator.{{/aagon.infobox}}

329

| |

330

|**Client Commands**|

331

|Client Command versions cleanup|(((

332

Performs a cleanup of Client Command versions whose last date modified is older than 120 days (default).

333

334

335

These scheduled server tasks are available only in ACMP version 6.9.

A new Client Command version is a complete copy of the previous version. As a result, the ACMP Server and the ACMP Database can become cluttered with redundant data when many versions are created, which is why it makes sense to perform cleanup.

340

By double-clicking the setting, you can specify cleanup options in the wizard.

341

A Client Command version is deleted if the following conditions are met:

342

1. The Client Command version has the status “Removed From Production.”

343

2. The date modified was at least 120 days ago (default value).

344

3. There is at least one other version with the status “Removed From Production” in the quantity identified so far.

345

The number of deletion operations per server task per execution is also limited (default value: 50) to minimize the load on the ACMP Server and the deployed file repositories.

346

347

)))

348

|Client Command log cleanup|(((

349

Performs cleanup on logs that are older than 30 days (default).

350

351

352

By double-clicking the setting, you can specify in the Cleanup Options window which logs should be deleted after a certain number of days. You can distinguish between log details (e.g., client command log files, content of detailed views—such as in the Job Monitor for executed Client Commands, etc.) and simple logs (e.g., an entry in the Job Monitor itself). Both types of logs are set by default to be automatically deleted after 180 days. If you do not want simple logs to be deleted automatically, uncheck the //Delete Simple Logs// checkbox.

353

354

)))

355

|Job logs cleanup|Performs cleanup on logs that are older than 30 days (default).

356

| |

357

|**Defender Management**|

358

|Defender Event cleanup|Performs cleanup on logs that are older than 30 days (default).

359

|Defender quarantined items log cleanup|Performs cleanup on logs that are older than 40 days (default).

360

| |

361

|**Helpdesk**|

362

|Mail Service cleanup|Deletes message IDs that no longer exist on the email server from the database.

363

|Escalate Tickets|(((

364

Checks escalation criteria and escalates tickets as needed.

)))

| |

|**Intune**|

|Import Intune data|Imports Intune Apps, Groups, Users and Devices

369

| |

370

|**License Management**|

371

|Contract auto extension|Automatically renews the relevant contracts.

372

|Import Microsoft 365 license data|Importes Microsoft 365 license and product data for License Management.

373

|DNA2 catalog update|Updates the DNA2 catalog, calculates new and unrecognized software to improve the detection rate, and reports this information to ACMP.

374

|Recalculate License Management compliance view|Recalculates the compliance data.

375

|Clients without Primary User calculation|Calculates dynamically determined Clients that do not have a mapping to a primary user

376

| |

377

|**Managed Software**|

378

|Managed Software cleanup|Deletes software versions that are no longer needed, thereby freeing up storage space.

379

|Managed Software catalog update|Updates the software catalog for Managed Software.

380

|Managed Software version download|Downloads new versions of Managed Software.

381

| |

382

|**Vulnerability Management**|

383

|Vulnerability history cleanup|Performs a cleanup on logs that are older than 90 days.

384

|Update vulnerability definition file|Updates the vulnerability definition file.{{aagon.infobox}}The vulnerability definition file is the CVE list.{{/aagon.infobox}}(((

)))

| |

|**Windows Update Management**|

389

|Windows Update log cleanup|Performs cleanup on logs that are older than 30 days (default).

390

|Windows Update Managed Clients recalc|Calculates dynamic links for clients managed by ACMP Windows Update Management.

391

|Windows Update Management cleanup|Frees up hard drive space occupied by unnecessary Windows Updates.

392

|Windows Update Management metadata download|Downloads metadata about Windows Updates.

393

|Windows Update setup download|Downloads setup files for Windows Updates.

= Global User Accounts =

398

399

Here you can create global user accounts. These are used to access deployed file repositories, join domains during OS Deployment, run AD Queries, install agents, and execute Client Commands.

400

401

=== **Add a Global User Account** ===

402

403

To add a new user account, click the Add button. In the window that opens, enter the username and password. You must re-enter the password to perform passwort confirmation. After confirming with OK, the user account will appear in the overview. You can edit or delete it as needed.

404

405

406

[[image:68_System_Einstellungen_ACMPServer_GlobaleNutzerkonten_1918.png||data-xwiki-image-style-alignment="center"]]

Global User Accounts

=== **Edit Global User Account** ===

415

416

To edit a global user account, select it in the overview and click the Edit button on the right. You can now edit all the fields that are also available when you [[Add>>doc:||anchor="HGlobalUserAccounts"]] a user account. After you have made the desired customizations, click OK.

417

418

=== **Delete a Global User Account** ===

419

420

To delete a global user account, select the account in the overview and click the Delete button on the right. The system will now check whether the global user account to be deleted is being used by other elements in ACMP. The result will be displayed in a dialog box.

421

422

423

Please note that you will no longer be able to use elements if the registered global user account is deleted. It is not possible to access file repositories without a global user account.

= HTTP API =

In this setting, you can specify the port used for file transfers in the ACMP app or for the active SICS connection. The ACMP HTTP API port is responsible for uploading and downloading files. By default, the checkbox is enabled. To disable it, you must explicitly uncheck the box. Also, specify the port to be used for the connection.

429

Also, check the additional checkbox if you want to disable TLS Legacy. This will disable the versions available starting with Windows Server 2022.

430

431

432

[[ >>image:68_System_HTTP API_1007.png||alt="Einstellungen zu der HTTP API"]]

433

434

435

Settings for the HTTP API

= Multi tenancy =

Before you enable multi tenancy, you must have already assigned your Clients to the appropriate tenant groups and tenants. In addition, all existing conflicts should be resolved, and user permissions should be set up correctly. Only then can multi tenancy be enabled.

444

445

446

To enable general multi tenancy in ACMP, click //Enable// //Multi Tenancy//.

447

448

~1. Click “Enable Multi Tenancy.” A wizard will open.

449

450

2. On the first page, you’ll see a graphical representation of the multi tenancy architecture. Click Next.

451

452

3. On the second page, the system checks whether all prerequisites are met:

453

454

* At least one tenant must exist.

455

* There must be users who have permissions for at least one tenant or who are registered as tenant administrators.

**Attention:**

Any users who do not have permissions specified for individual tenants or the “Tenant Administrator” role will no longer be able to log in to the ACMP Console after multi tenancy is activated. If there are any such users, a warning will be displayed!

461

462

463

4. In the next step, you’ll configure two settings:

* Login:

Here, you specify whether a user is allowed to log in to multiple tenants at the same time.

468

469

* Execution of the “SQL Query” Command

470

471

You decide whether the “Execute on ACMP Server/Database” option should be enabled or disabled in SQL commands.

472

473

474

5. After configuration, click “Done” and save the settings via the ribbon bar to permanently enable multi tenancy.

475

476

Important Notes After Activation

477

478

479

**Important Notes After Activation**

480

481

**Job and Client Monitor**

482

483

Jobs that have already run may no longer be displayed. This is because the display is filtered by tenant—you will now only see the jobs for the tenant you are logged in to.

**Select a Tenant**

If you would like to view specific jobs again, simply select the appropriate tenant when logging in.

= Networks =

Here you can define the networks for the containers' network status.

494

495

First, specify whether the networks are mobile/VPN or local. This setting will later classify the Clients as “local” or “mobile/VPN.”

496

497

498

If you select “Specified networks are local,” clients with different network addresses will automatically be marked as mobile. It is therefore recommended that you organize local and mobile Clients in different subnets.

499

500

501

Once you have made your selection, click the Add button to add a new network. Enter the IP address and the subnet mask.

502

503

(% style="text-align:center" %)

504

[[image:XWiki.Images.WebHome@hmfile_hash_8b3f62ba.png||alt="9.4.4 - Netzwerkadresse Editieren" height="150" width="268"]]

505

Edit Network Address

506

507

This information is saved by clicking the OK button and displayed in the overview. To edit the information, select the corresponding entry and click Edit. An input form with the default data will reappear. To delete an entry, select it and click Delete.

508

509

510

[[image:68_System_Einstellungen_Netzwerke_1678.png||data-xwiki-image-style-alignment="center"]]

511

512

513

System settings (Networks)

In the lower section, you can specify trusted web servers, as well as edit and delete existing items. Specifying a trusted web server is important if you have licensed the Helpdesk Web Interface and installed it on a server other than the ACMP Server. The IP address of the ACMP Server is already entered during installation. You do not need to enter it again.

= Server proxy configuration =

522

523

The ACMP Server requires Internet access for some modules. If you are using a proxy to provide Internet access, you will need to make some configuration changes.

524

The [[Setup Checklist>>doc:ACMP.610.ACMP installieren.Checkliste zur Installation.WebHome||anchor="HRequiredURLs"]] section lists all the hosts you need for the connection between the ACMP Server and the respective modules..

525

526

527

All hosts listed there are accessed via HTTPS (port 443).

528

529

530

Check the box next to //Use these proxy settings instead of the Active Update proxy settings// if this applies to your work. Then select one of the available options from the drop-down menu: //Do not use a proxy//, //Use the system's proxy settings//, or //Use manual proxy settings//. Only if you select the last option can you specify a proxy and port in the fields below.

531

532

Enable the //Use proxy authentication// checkbox to enter a username and password there. Otherwise, these rows will remain grayed out. Save your changes by clicking the “Save” button in the ribbon bar.

533

534

535

[[image:68_Server Proxy Konfiguration_906.png||alt="68_System_Einstellungen_ServerProxy-Konfiguration_655.png" data-xwiki-image-style-alignment="center"]]

536

537

538

ACMP Server proxy settings

= SICS connection =

After installing the AESB, you must enable the SICS (Smart Infrastructure Communication Service) connection. To do this, navigate to //System// > //Settings// > //ACMP// //Server// > //SICS connection//.

547

548

549

[[image:68_System_Einstellungen_SICS-Verbindung_1172.png||data-xwiki-image-style-alignment="center"]]

550

551

552

Establish a SICS connection

First, check the checkbox to enable the connection. Then enter the host and port, as well as the username and password for the operator. You specified the relevant operator during the AESB installation; you must enter that name here as well. Specify whether the system should attempt to establish an unencrypted connection if SSL/TLS fails. To verify your entries, you can test the connection while still in the server settings. Click the button with the same name, and the test will begin. A small window will display the result, indicating whether the connection was successful or not.

557

558

Additional connection information is listed below the SICS connection credentials. If you have not yet entered any connection details, the status will be //Disconnected//. Only after a successful connection is established will the status change, and the routing key and virtual router will be automatically populated. You cannot manually edit these last two fields.

559

560

=== **Public API Access Rights** ===

561

562

You can specify whether you want to grant SICS users access to ACMP’s public API. By default, the checkbox //Grant Access// is not selected. However, if you wish to grant access, enable the corresponding checkbox.

563

564

=== **Public API Response** ===

565

566

Here, you can specify the maximum number of elements to be returned in a public API response. If you leave the value at 0, no limit is set. The maximum number of elements to be sent in a public API response is 1,000 by default when ACMP is delivered. Define your own range of values that best suits your needs.

567

568

=== **QR Code for App Login** ===

569

570

In this section, you can generate a QR code to simplify login for the ACMP Mobile App. If the SICS connection is activated, a corresponding [[menu item in the system menu>>doc:ACMP.610.Arbeiten mit der ACMP Console.Aufbau der Console.Ribbonleiste.WebHome]] is also available for this purpose. You can also specify alternative connection information. To do so, enable the checkbox and enter the alternative hostname and SICS port. The information you provide is required to start generating the QR code.

= Virtualization =

=== **Guest Settings** ===

577

578

First, specify the criterion to be used for uniquely identifying Hyper-V and vSphere guests. You can choose between the MAC address and the computer name.

579

580

581

If the selected criterion is not unique in your network, the scan data for your Hyper-V and vSphere guests will be overwritten.

=== **Block Lists for Computer Names** ===

587

588

Here, you can add Clients that have either Hyper-V or vSphere installed and that should be ignored by one of the virtualization scanners. This means that no mapping between the host and the VM will take place.

589

590

Clients can be added to the block list using a dynamic filter or statically via a Query. The filter supports the wildcards * (any character sequence) and ? (one character).

591

592

593

Existing host-VM relations are deleted after the Hyper-V Scanner or vSphere Scanner is executed. Clients that have already been inventoried and are on the block list are not automatically deleted. In addition, clients on which the agent is installed are still inventoried.

594

595

596

If you add a computer name to the block list via a Query or manually, any existing host-VM relations will be deleted afterward. In this case, you must manually remove the client itself from the database.

597

598

The Hyper-V or vSphere server will still be entered into the database even if it is on the block list.

599

600

All clients entered into the database consume a license.

601

602

=== **ACMP vSphere scanner** ===

603

604

605

Please note that the VMware vSphere PowerCLI tools must be installed on the ACMP Server in order to use the VMware vSphere Scanner. If you are unsure, you can use //Check PowerCLI// to verify availability.

606

607

608

If the PowerCLI tools are not installed on your system or are not installed in the system context, follow these steps:

609

610

~1. Open a CMD window with administrative privileges.

611

612

2. Enter the following Command:

{{{powershell}}}

3. Immediately afterward, execute the following Command, which will install the PowerCLI tools:

617

618

{{{Install-Module -Name VMware.PowerCLI -Scope AllUsers -Force -SkipPublisherCheck -AllowClobber}}}

619

620

621

It may take a little while for the installation to start and complete.

[[image:PowerCLI Tools CMD.png]]

626

627

628

CMD with the appropriate Commands

Only after you have installed the tools can you specify the Server(s) and allow ACMP to scan the virtual Clients correctly. Additionally, you must ensure that the installed vSphere PowerCLI tools are compatible with the installed vSphere Server.

633

634

635

Next, create a vSphere server. Proceed as follows:

636

637

First, click //Add// and, in the new window, enter the display name, the server (DNS or IP), as well as a username and password. You can also optionally enter a description.

638

639

640

Please make sure that the logged-in user has sufficient permissions to scan your vSphere environment.

641

642

643

Once you have entered all the values, you can click //Test// to verify that the specified server is reachable and that the user has sufficient permissions. If the test is successful, confirm your entries by clicking //OK//.

644

645

You can edit or delete existing vSphere servers using the corresponding buttons. If you have changed your configuration in any way, you can also run a connection test afterward.

646

647

After you have entered all necessary servers, you can specify below the list whether systems that are turned off should be ignored. To do this, you must enable the checkbox.

648

649

After you have entered your vSphere servers, go to [[Scheduled Server Tasks>>doc:||anchor="HScheduledServerTasks"]] in the settings and configure the VMware vSphere Scanner there.

Wiki source code of ACMP Server