Agentless Scanner

The Agentless Scanner allows you to inventory Windows clients through Active Directory (AD) without having to run or install any software on the Clients. In addition, you can also inventory Linux and MacOS Clients from the Agentless Scanner Configuration Manager using the integrated XML Importer.

4

5

= Functionality =

6

7

The Agentless Scanner consists of three main components: the AD connector, the AD agent and the WMI scanner. The basic data of a client is collected from the AD, compared with the data available in ACMP, and finally stored if it does not already exist. Once set up, Clients that are newly connected to the AD are automatically inventoried. This eliminates the need to trigger an inventory manually.

8

9

10

Because the agentless scanner cannot read all the data due to the way it works, it provides less data than the ACMP agent.

11

12

13

The following section explains how each component works in detail.

14

15

|=(% scope="row" %)AD Connector|(((

16

The AD Connector is responsible for collecting data from the Active Directory. The AD is scanned for new Clients in fixed intervals. It is also triggered by certain AD events, such as adding a new machine to the AD. The read data is collected and then passed to the AD Agent.

17

18

19

In multi-domain environments, the NetBios name may not be resolved correctly when read by the AD Connector. To avoid this error, an additional attempt is made to reach the clients via FQDN.

20

21

)))

22

|=AD Agent |The AD Agent is responsible for comparing the received data with the data already present in ACMP. If a new client or an existing client with new data is found in AD, the client's basic data (name, description, domain and address) is stored or modified in the ACMP database. This allows the client to be found in the agent installation and its basic data to be processed normally (e.g. in queries or client commands).

23

|=WMI Scanner |(((

24

The WMI scanner is required so that continuing data of the Client can be inventoried which go beyond the basic data. A scan of the WMI of the Client is triggered. This data is then stored in the ACMP Database. This means that Clients which are not accessible via NetBIOS (e.g. due to certain network guidelines) and therefore do not appear in the Agent Installation can also be inventoried.

25

)))

26

27

= Installation requirements =

28

29

Before you can perform the installation, check the following requirements:

30

31

* The services are installed on the server on which ACMP is also installed.

32

* At least .Net Framework version 4.7.2 is installed.

33

* Message Queuing is installed.

34

35

36

If Message Queuing is not yet installed, it can be installed via the Control Panel under Windows Components (for workstation systems) or via the Server Manager under Features (for server systems).

37

38

39

== Run installation ==

40

41

To use the Agentless Scanner, you must first install its services. To do this, run the ACMP Agentless Scanner_Installer.exe installation file located in the ACMP Server installation directory in the Installers/AgentlessScan folder. Follow the installation instructions and install all the components.

42

43

[[Installation of the Agentless Scanner>>image:Agentless Scanner_Installer.png||alt="Installation des Agentless Scanners"]]

44

45

46

The XML Importer is only required for inventorying Linux and macOS Clients and can be installed separately at a later date if necessary.

47

48

49

= Configuring the Agentless Scanner =

50

51

Now open the Configuration Manager to begin configuring the agentless scanner. The Configuration Manager is divided into six sections.

52

53

54

You can find the application in your specified installation directory or through Windows Quick Search under the name Configuration Manager.

== General ==

The connection string to the ACMP database is entered by default in the General area. If this is not available or if a different connection string is entered, click on Get database connection string from ACMP configuration to have the connection string to the ACMP database entered automatically.

60

Now click on Test connection string to test the connection. If you receive the message Connection successful, the connection to the database has been established. If you receive the message Failed to connect instead, the connection string must be customized.

61

To customize the connection string, click Edit connection string and enter the correct connection string. Then repeat the test process until the connection has been successfully established.

62

If you encounter any problems, Aagon Support will be happy to help you. Alternatively, you can find further information on general adjustments to the connection string here.

63

64

[[Establish connection to ACMP database>>image:Agentless Scanner_General.png||alt="Verbindung zur ACMP Datenbank herstellen"]]

== AD Connector ==

In the AD Connector area, you can define the settings for AD access:

69

70

1. Under //Domain Controller//, enter the name or IP address of the server on which the AD is installed.

71

1. Under //User Name//, enter a user who has read access to the domain from which the client data is to be read.

72

1. Under //Password//, enter the password for the user you entered previously.

73

1. Enter the name of the domain from which the client data is to be read in //NT Domain Name//.

74

1. Enter the AD path under which the clients whose data is to be read can be found in //BaseDN//. This can be the main directory, for example, but you can also specify a specific group (OU) within the AD.

75

1. If you want to filter Clients that have not been on the network for a certain number of days and have not logged on to the domain controller, assign a value for the number of days in the //Ignore Objects that haven't changed for X days// option.

76

77

[[Configuring the Active Directory Connector>>image:Agentless Scanner_AD Connector.png||alt="Active Directory Connector konfigurieren"]]

78

79

80

In addition to configuration through the Configuration Manager, you can make additional settings in the AD Connector configuration file. For more information, see the section Additional customizations in the AD Connector configuration file.

== AD Agent ==

The settings in the AD Agent section are required for the internal processes of the Agentless Scanner. This includes the message queue path and the number of internal IP scanner threads.

86

87

88

You should only change these settings if requested to do so by Aagon Support.

89

90

91

In addition to the two settings mentioned above, you can specify in the “Client Import Destination” entry how the detected clients and the collected data should be handled. You can choose from the following options:

92

93

* //Inventory// – The Inventory is populated with the clients, including the collected data

94

* //AgentDistribution// – The detected clients are added to the ACMP Agent Installation

95

* //Inventory and AgentDistribution// – Both processes are executed

96

97

[[Configure the Active Directory Agent>>image:Agentless Scanner_AD Agent.png||alt="Active Directory Agent konfigurieren"]]

== WMI Scanner ==

In the WMI Scanner section, just as with the AD Agent, you can customize the settings for the message queue path and the number of internal IP scanner threads for the WMI Scanner.

103

104

105

You should only change these settings if instructed to do so by Aagon Support.

106

107

108

[[Configure the WMI Scanner>>image:Agentless Scanner_WMI Scanner.png||alt="WMI Scanner konfigurieren"]]

109

110

In addition to the two settings mentioned above, you can use the //Database Request Frequency// entry to specify the interval (in hours) at which the ACMP Database should be checked. During this check, all Clients that have been detected by the //AD Connector// but for which no data is yet available are identified. These clients are then passed to the WMI Scanner, which initiates a scan of the clients’ WMI to retrieve their advanced data and properties.

111

112

Under //Domain Credentials//, you can specify user accounts that have administrator rights on the clients to be scanned. You must enter at least one user here. To do so, follow these steps:

113

114

1. Click the plus button to open the credentials dialog box.

115

1. Under //Domain name (FQDN)//, enter the “Fully Qualified Domain Name” of the domain whose Clients are to be scanned.

116

1. Under //User Name//, enter the username. This must be formatted as “User@FQDN” (User Principal Name, UPN).

117

118

1. {{aagon.infobox}}The domain name specified first and the user's FQDN do not have to be identical. The domain name acts as a filter for the client data that is passed. This ensures that only clients that belong to the corresponding domain according to the ACMP Database are scanned.{{/aagon.infobox}}

119

1. In the “Password” field, enter the user password.

120

1. Click the OK button to confirm your entries and close the dialog box.

121

122

[[Enter Domain Credentials>>image:Agentless Scanner - Domain Credentials.png||alt="Domain Credentials hinterlegen"]]

123

124

You can now add additional domains with the corresponding user credentials as needed.

== XML Importer ==

While clients running the Windows operating system can be inventoried using the steps described above with the help of AD, Linux and macOS clients are inventoried using XML files. The following steps are performed for the inventory:

129

130

1. Execution of a local Python script on all Linux and macOS clients using the “Linux and macOS Inventory” Client Command.

131

1. Automatic generation of XML files (one file per client) on a specific network share by the script, each containing all the collected client information.

132

1. The generated XML files are read by the XML Importer; the information they contain is captured and finally added to the ACMP Database.

133

134

Since only the XML import (step 3) is performed within the Agentless Scanner itself, only the configuration of the XML Importer is described here. For more information on executing the Python script and generating the XML files (Steps 1 and 2), please refer to the section on Linux and macOS Inventory.

135

136

In the //XML Importer// section, you must specify the network shares under //Reader// where the XML files to be imported are stored for the inventory of Linux and macOS Clients. When using the XML Importer, you must observe the following notes:

137

138

* If two Clients save their data to the same XML file, the second Client will overwrite the first Client’s data.

139

* After importing, the XML files are deleted.

140

* Corrupted files or files not intended for the XML Importer are also deleted. Therefore, only files intended for the XML Importer may be stored on the network share.

141

* It is not possible to store the XML files in a subdirectory of the network share

142

* Software inventorying using the “dpkg” package manager may take some time (15–20 min). However, software inventorying can be disabled under “Options” in the ClientCommand interface.

143

* Linux software is hidden by default in License Management, as it is generally assumed to be open-source software. However, it can be made visible again.

144

145

You can choose between three different reader types (FTP, SCP, and Share Reader). The configuration of the various readers follows the same basic structure:

146

147

* Path to the directory where the XML files are stored

148

149

* {{aagon.infobox}}Please note that the FTP reader does not support the FTP root directory. You must therefore specify a subdirectory.{{/aagon.infobox}}

150

* User who has permissions for the directories

151

* Domain in which the user is created

152

* Password for the user account

153

* Path to the directory where all files are temporarily stored locally as a backup before import

154

* Maximum number of inventory files that can be imported from the directory at the same time

155

* Time in seconds that the Reader should wait after a scan before scanning the directory again for new XML files

156

157

[[Configurate Reader>>image:Agentless Scanner_XML Importer_Share Reader.png||alt="Reader konfigurieren"]]

158

159

In the //Max queue length// entry, you can limit the maximum number of XML files to be processed simultaneously. Additionally, in the //Wait every n cycles// entry, you can specify that the processing should be paused after a certain number (n) of XML files have been processed. You can set the duration of the wait time in the //Wait time// entry. This allows you to reduce the load on the database.

== Services ==

In the “Services” section, you can start and stop the individual services of the Agentless Scanner.

164

165

166

Please note that before starting or stopping a service, you must save all changes by clicking “Save” before you can start or stop the service.

= Additional Customizations to the AD Connector Configuration File =

172

173

In addition to the settings you can customize in the Configuration Manager interface, you can also make continuing customizations in the AD Connector configuration file.

174

175

To do this, first save the entries you entered in Configuration Manager. Now open the Configuration.xml file, which you can find in the //Aagon/Configuration// directory.

176

177

Using the XML tags <OuAllowList>, <OuDenyList>, and <OuRuleOrder>, you can specify from which OUs computer objects should be imported. The various XML tags have the following functions:

178

179

* <OuAllowList> - List of all OUs to be read

180

* <OuDenyList> - List of all OUs not to be read

181

* <OuRuleOrder> - Order in which the two lists are evaluated

182

** 0 (default value) = All OUs are read, and any OUs that are not to be included must be entered in the <OuDenyList>. Recursively nested OUs are then also excluded. If these are to be included, they must be entered in the OuAllowList

183

** 1 = No OUs are read, and all OUs to be included must be explicitly specified in the OuAllowList. If certain nested OUs are not to be included, they must be entered in the OuDenyList.

184

185

186

OUs must be specified using the Distinguished Name (DN) notation (see example). When editing the Configuration.xml file, be sure to use the correct case; otherwise, the entire configuration file will be considered invalid, and the service will exit immediately after starting.

187

188

189

The following example illustrates this behavior:

<OuAllow>OU=Aagon,dc=aagon,dc=local</OuAllow>

</OuAllowList>

<OuDeny>OU=Marketing,OU=Aagon,dc=aagon,dc=local</OuDeny>

</OuDenyList>

[[image:1729693841810-329.png]]

(% class="box" %)

(((

**Explanation of the example:** By default, all OUs are prohibited because RuleOrder is set to 1. Specifying an OU in the OuAllowList allows the OU “Aagon” and all OUs under it. Specifying the OU “Marketing” excludes this specific OU again.

)))

= Update the Agentless Scanner =

218

219

After installing an ACMP Update, you may need to update the Agentless Scanner

220

221

222

You can check the ACMP Release Notes to see if you need to update any additional components, and if so, which ones.

223

224

225

If a new version of the Agentless Scanner is available in the ACMP update, you can update your existing installation as follows:

226

227

1. Navigate to the ACMP Server's installation directory and open the Installers/AgentlessScan folder, which contains the installation file ACMP Agentless Scanner_Installer.exe.

228

1. Follow the [[installation instructions>>doc:ACMP.610.ACMP-Solutions.Client-Management.Agenteninstallation.WebHome||anchor="HConfiguringtheAgentlessScanner"]] and install all five components.

Wiki source code of Agentless Scanner

Navigation

author	version	line-number	content
		1	{{aagon.floatingbox/}}
		2
		3	The Agentless Scanner allows you to inventory Windows clients through Active Directory (AD) without having to run or install any software on the Clients. In addition, you can also inventory Linux and MacOS Clients from the Agentless Scanner Configuration Manager using the integrated XML Importer.
		4
		5	= Functionality =
		6
		7	The Agentless Scanner consists of three main components: the AD connector, the AD agent and the WMI scanner. The basic data of a client is collected from the AD, compared with the data available in ACMP, and finally stored if it does not already exist. Once set up, Clients that are newly connected to the AD are automatically inventoried. This eliminates the need to trigger an inventory manually.
		8
		9	{{aagon.infobox}}
		10	Because the agentless scanner cannot read all the data due to the way it works, it provides less data than the ACMP agent.
		11	{{/aagon.infobox}}
		12
		13	The following section explains how each component works in detail.
		14
		15	\|=(% scope="row" %)AD Connector\|(((
		16	The AD Connector is responsible for collecting data from the Active Directory. The AD is scanned for new Clients in fixed intervals. It is also triggered by certain AD events, such as adding a new machine to the AD. The read data is collected and then passed to the AD Agent.
		17
		18	{{aagon.infobox}}
		19	In multi-domain environments, the NetBios name may not be resolved correctly when read by the AD Connector. To avoid this error, an additional attempt is made to reach the clients via FQDN.
		20	{{/aagon.infobox}}
		21	)))
		22	\|=AD Agent \|The AD Agent is responsible for comparing the received data with the data already present in ACMP. If a new client or an existing client with new data is found in AD, the client's basic data (name, description, domain and address) is stored or modified in the ACMP database. This allows the client to be found in the agent installation and its basic data to be processed normally (e.g. in queries or client commands).
		23	\|=WMI Scanner \|(((
		24	The WMI scanner is required so that continuing data of the Client can be inventoried which go beyond the basic data. A scan of the WMI of the Client is triggered. This data is then stored in the ACMP Database. This means that Clients which are not accessible via NetBIOS (e.g. due to certain network guidelines) and therefore do not appear in the Agent Installation can also be inventoried.
		25	)))
		26
		27	= Installation requirements =
		28
		29	Before you can perform the installation, check the following requirements:
		30
		31	* The services are installed on the server on which ACMP is also installed.
		32	* At least .Net Framework version 4.7.2 is installed.
		33	* Message Queuing is installed.
		34
		35	{{aagon.infobox}}
		36	If Message Queuing is not yet installed, it can be installed via the Control Panel under Windows Components (for workstation systems) or via the Server Manager under Features (for server systems).
		37	{{/aagon.infobox}}
		38
		39	== Run installation ==
		40
		41	To use the Agentless Scanner, you must first install its services. To do this, run the ACMP Agentless Scanner_Installer.exe installation file located in the ACMP Server installation directory in the Installers/AgentlessScan folder. Follow the installation instructions and install all the components.
		42
		43	[[Installation of the Agentless Scanner>>image:Agentless Scanner_Installer.png\|\|alt="Installation des Agentless Scanners"]]
		44
		45	{{aagon.infobox}}
		46	The XML Importer is only required for inventorying Linux and macOS Clients and can be installed separately at a later date if necessary.
		47	{{/aagon.infobox}}
		48
		49	= Configuring the Agentless Scanner =
		50
		51	Now open the Configuration Manager to begin configuring the agentless scanner. The Configuration Manager is divided into six sections.
		52
		53	{{aagon.infobox}}
		54	You can find the application in your specified installation directory or through Windows Quick Search under the name Configuration Manager.
		55	{{/aagon.infobox}}
		56
		57	== General ==
		58
		59	The connection string to the ACMP database is entered by default in the General area. If this is not available or if a different connection string is entered, click on Get database connection string from ACMP configuration to have the connection string to the ACMP database entered automatically.
		60	Now click on Test connection string to test the connection. If you receive the message Connection successful, the connection to the database has been established. If you receive the message Failed to connect instead, the connection string must be customized.
		61	To customize the connection string, click Edit connection string and enter the correct connection string. Then repeat the test process until the connection has been successfully established.
		62	If you encounter any problems, Aagon Support will be happy to help you. Alternatively, you can find further information on general adjustments to the connection string here.
		63
		64	[[Establish connection to ACMP database>>image:Agentless Scanner_General.png\|\|alt="Verbindung zur ACMP Datenbank herstellen"]]
		65
		66	== AD Connector ==
		67
		68	In the AD Connector area, you can define the settings for AD access:
		69
		70	1. Under //Domain Controller//, enter the name or IP address of the server on which the AD is installed.
		71	1. Under //User Name//, enter a user who has read access to the domain from which the client data is to be read.
		72	1. Under //Password//, enter the password for the user you entered previously.
		73	1. Enter the name of the domain from which the client data is to be read in //NT Domain Name//.
		74	1. Enter the AD path under which the clients whose data is to be read can be found in //BaseDN//. This can be the main directory, for example, but you can also specify a specific group (OU) within the AD.
		75	1. If you want to filter Clients that have not been on the network for a certain number of days and have not logged on to the domain controller, assign a value for the number of days in the //Ignore Objects that haven't changed for X days// option.
		76
		77	[[Configuring the Active Directory Connector>>image:Agentless Scanner_AD Connector.png\|\|alt="Active Directory Connector konfigurieren"]]
		78
		79	{{aagon.infobox}}
		80	In addition to configuration through the Configuration Manager, you can make additional settings in the AD Connector configuration file. For more information, see the section Additional customizations in the AD Connector configuration file.
		81	{{/aagon.infobox}}
		82
		83	== AD Agent ==
		84
		85	The settings in the AD Agent section are required for the internal processes of the Agentless Scanner. This includes the message queue path and the number of internal IP scanner threads.
		86
		87	{{aagon.warnungsbox}}
		88	You should only change these settings if requested to do so by Aagon Support.
		89	{{/aagon.warnungsbox}}
		90
		91	In addition to the two settings mentioned above, you can specify in the “Client Import Destination” entry how the detected clients and the collected data should be handled. You can choose from the following options:
		92
		93	* //Inventory// – The Inventory is populated with the clients, including the collected data
		94	* //AgentDistribution// – The detected clients are added to the ACMP Agent Installation
		95	* //Inventory and AgentDistribution// – Both processes are executed
		96
		97	[[Configure the Active Directory Agent>>image:Agentless Scanner_AD Agent.png\|\|alt="Active Directory Agent konfigurieren"]]
		98
		99
		100	== WMI Scanner ==
		101
		102	In the WMI Scanner section, just as with the AD Agent, you can customize the settings for the message queue path and the number of internal IP scanner threads for the WMI Scanner.
		103
		104	{{aagon.warnungsbox}}
		105	You should only change these settings if instructed to do so by Aagon Support.
		106	{{/aagon.warnungsbox}}
		107
		108	[[Configure the WMI Scanner>>image:Agentless Scanner_WMI Scanner.png\|\|alt="WMI Scanner konfigurieren"]]
		109
		110	In addition to the two settings mentioned above, you can use the //Database Request Frequency// entry to specify the interval (in hours) at which the ACMP Database should be checked. During this check, all Clients that have been detected by the //AD Connector// but for which no data is yet available are identified. These clients are then passed to the WMI Scanner, which initiates a scan of the clients’ WMI to retrieve their advanced data and properties.
		111
		112	Under //Domain Credentials//, you can specify user accounts that have administrator rights on the clients to be scanned. You must enter at least one user here. To do so, follow these steps:
		113
		114	1. Click the plus button to open the credentials dialog box.
		115	1. Under //Domain name (FQDN)//, enter the “Fully Qualified Domain Name” of the domain whose Clients are to be scanned.
		116	1. Under //User Name//, enter the username. This must be formatted as “User@FQDN” (User Principal Name, UPN).
		117
		118	1. {{aagon.infobox}}The domain name specified first and the user's FQDN do not have to be identical. The domain name acts as a filter for the client data that is passed. This ensures that only clients that belong to the corresponding domain according to the ACMP Database are scanned.{{/aagon.infobox}}
		119	1. In the “Password” field, enter the user password.
		120	1. Click the OK button to confirm your entries and close the dialog box.
		121
		122	[[Enter Domain Credentials>>image:Agentless Scanner - Domain Credentials.png\|\|alt="Domain Credentials hinterlegen"]]
		123
		124	You can now add additional domains with the corresponding user credentials as needed.
		125
		126	== XML Importer ==
		127
		128	While clients running the Windows operating system can be inventoried using the steps described above with the help of AD, Linux and macOS clients are inventoried using XML files. The following steps are performed for the inventory:
		129
		130	1. Execution of a local Python script on all Linux and macOS clients using the “Linux and macOS Inventory” Client Command.
		131	1. Automatic generation of XML files (one file per client) on a specific network share by the script, each containing all the collected client information.
		132	1. The generated XML files are read by the XML Importer; the information they contain is captured and finally added to the ACMP Database.
		133
		134	Since only the XML import (step 3) is performed within the Agentless Scanner itself, only the configuration of the XML Importer is described here. For more information on executing the Python script and generating the XML files (Steps 1 and 2), please refer to the section on Linux and macOS Inventory.
		135
		136	In the //XML Importer// section, you must specify the network shares under //Reader// where the XML files to be imported are stored for the inventory of Linux and macOS Clients. When using the XML Importer, you must observe the following notes:
		137
		138	* If two Clients save their data to the same XML file, the second Client will overwrite the first Client’s data.
		139	* After importing, the XML files are deleted.
		140	* Corrupted files or files not intended for the XML Importer are also deleted. Therefore, only files intended for the XML Importer may be stored on the network share.
		141	* It is not possible to store the XML files in a subdirectory of the network share
		142	* Software inventorying using the “dpkg” package manager may take some time (15–20 min). However, software inventorying can be disabled under “Options” in the ClientCommand interface.
		143	* Linux software is hidden by default in License Management, as it is generally assumed to be open-source software. However, it can be made visible again.
		144
		145	You can choose between three different reader types (FTP, SCP, and Share Reader). The configuration of the various readers follows the same basic structure:
		146
		147	* Path to the directory where the XML files are stored
		148
		149	* {{aagon.infobox}}Please note that the FTP reader does not support the FTP root directory. You must therefore specify a subdirectory.{{/aagon.infobox}}
		150	* User who has permissions for the directories
		151	* Domain in which the user is created
		152	* Password for the user account
		153	* Path to the directory where all files are temporarily stored locally as a backup before import
		154	* Maximum number of inventory files that can be imported from the directory at the same time
		155	* Time in seconds that the Reader should wait after a scan before scanning the directory again for new XML files
		156
		157	[[Configurate Reader>>image:Agentless Scanner_XML Importer_Share Reader.png\|\|alt="Reader konfigurieren"]]
		158
		159	In the //Max queue length// entry, you can limit the maximum number of XML files to be processed simultaneously. Additionally, in the //Wait every n cycles// entry, you can specify that the processing should be paused after a certain number (n) of XML files have been processed. You can set the duration of the wait time in the //Wait time// entry. This allows you to reduce the load on the database.
		160
		161	== Services ==
		162
		163	In the “Services” section, you can start and stop the individual services of the Agentless Scanner.
		164
		165	{{aagon.infobox}}
		166	Please note that before starting or stopping a service, you must save all changes by clicking “Save” before you can start or stop the service.
		167	{{/aagon.infobox}}
		168
		169
		170
		171	= Additional Customizations to the AD Connector Configuration File =
		172
		173	In addition to the settings you can customize in the Configuration Manager interface, you can also make continuing customizations in the AD Connector configuration file.
		174
		175	To do this, first save the entries you entered in Configuration Manager. Now open the Configuration.xml file, which you can find in the //Aagon/Configuration// directory.
		176
		177	Using the XML tags <OuAllowList>, <OuDenyList>, and <OuRuleOrder>, you can specify from which OUs computer objects should be imported. The various XML tags have the following functions:
		178
		179	* <OuAllowList> - List of all OUs to be read
		180	* <OuDenyList> - List of all OUs not to be read
		181	* <OuRuleOrder> - Order in which the two lists are evaluated
		182	** 0 (default value) = All OUs are read, and any OUs that are not to be included must be entered in the <OuDenyList>. Recursively nested OUs are then also excluded. If these are to be included, they must be entered in the OuAllowList
		183	** 1 = No OUs are read, and all OUs to be included must be explicitly specified in the OuAllowList. If certain nested OUs are not to be included, they must be entered in the OuDenyList.
		184
		185	{{aagon.infobox}}
		186	OUs must be specified using the Distinguished Name (DN) notation (see example). When editing the Configuration.xml file, be sure to use the correct case; otherwise, the entire configuration file will be considered invalid, and the service will exit immediately after starting.
		187	{{/aagon.infobox}}
		188
		189	The following example illustrates this behavior:
		190
		191	{{code}}
		192	<OuAllowList>
		193
		194	<OuAllow>OU=Aagon,dc=aagon,dc=local</OuAllow>
		195
		196	</OuAllowList>
		197
		198	<OuDenyList>
		199
		200	<OuDeny>OU=Marketing,OU=Aagon,dc=aagon,dc=local</OuDeny>
		201
		202	</OuDenyList>
		203
		204	<OuRuleOrder>1</OuRuleOrder>
		205	{{/code}}
		206
		207
		208	[[image:1729693841810-329.png]]
		209
		210	(% class="box" %)
		211	(((
		212	Explanation of the example: By default, all OUs are prohibited because RuleOrder is set to 1. Specifying an OU in the OuAllowList allows the OU “Aagon” and all OUs under it. Specifying the OU “Marketing” excludes this specific OU again.
		213	)))
		214
		215
		216
		217	= Update the Agentless Scanner =
		218
		219	After installing an ACMP Update, you may need to update the Agentless Scanner
		220
		221	{{aagon.infobox}}
		222	You can check the ACMP Release Notes to see if you need to update any additional components, and if so, which ones.
		223	{{/aagon.infobox}}
		224
		225	If a new version of the Agentless Scanner is available in the ACMP update, you can update your existing installation as follows:
		226
		227	1. Navigate to the ACMP Server's installation directory and open the Installers/AgentlessScan folder, which contains the installation file ACMP Agentless Scanner_Installer.exe.
		228	1. Follow the [[installation instructions>>doc:ACMP.610.ACMP-Solutions.Client-Management.Agenteninstallation.WebHome\|\|anchor="HConfiguringtheAgentlessScanner"]] and install all five components.