Configuring Active Directory based discovery rules for Veeam Endpoint
Active Directory discovery rules allow you to discover computers being part of an AD domain.
Steven Panovski
Active Directory discovery rules allow you to discover computers being part of an AD domain.
This method is recommended for client environments with Active Directory domains of any size. Active Directory discovery rules target AD containers, which helps perform dynamic discovery: if new computers join a domain, a new run of an AD-based rule will discover these computers.
Prerequisites
Before you configure an Active Directory discovery rule:
- Deploy a master agent on a machine in the client infrastructure. The machine must be included in a domain within which computers will be discovered.
Make sure you have an account with local Administrator permissions on all computers that you want to discover.
This prerequisite is not required if you have specified a discovery account in the master agent configuration settings.
- Make sure that client computers are powered on and configured to allow discovery: the Remote Scheduled Tasks Management (RPC and RPC-EPMAP) firewall rules must allow inbound traffic.
- On client computers that run a Windows desktop OS, the Windows Management Instrumentation (WMI-In) firewall rule must be configured allow inbound traffic.
- If you plan to install Veeam backup agents as part of the discovery procedure, make sure that client computers are configured to allow installation: the File and Printer Sharing (SMB-In) firewall rule must allow inbound traffic.
If you plan to assign a backup policy as part of the discovery procedure, create a new backup policy or check and if necessary customize one of the predefined policies.
Configuring Active Directory Discovery Rule
To configure an Active Directory discovery rule:
- Log in to Veeam Service Provider Console.
- In the menu on the left, click Discovery.
- On the Rules tab, click New.
Veeam Service Provider Console will launch the New Rule wizard.
4.At the Rule Name step of the wizard, specify a discovery rule name.
- At the Companies step of the wizard, choose one or more companies for which the discovery rule is configured. Use the search field at the top of the list to find the necessary companies.
You can select more than one company at this step. In this case, after you complete the wizard steps, Veeam Service Provider Console will create a separate discovery rule for each company.
- Click a link in the Locations column, then click a link in the Master Agent column, and select a management agent that will be used as the master agent for discovery in each company location.
By default, discovery is performed in all company locations where you deployed a master agent. If you choose to perform discovery in multiple locations, after you complete the wizard steps, Veeam Service Provider Console will create a separate discovery rule for each location. If you do not want to perform discovery in some company locations, clear check boxes next to these locations.
7.At the Discovery Method step of the wizard, select Microsoft Active Directory discovery.
- At the Active Directory Discovery step of the wizard, select the necessary method for Active Directory discovery:
- Select Search through all Active Directory containers to discover all computers that are included in the Domain Controllers and Computers organizational units.
- Select Select from organizational units to discover computers that are included in selected organizational units only.
If this option is selected, the Organizational Units step will become available in the wizard.
- Select Run custom query to discover computers based on results of a custom query. In the text field at the bottom, specify a LDAP query that must return a list of computers to scan.
In the Exclusion mask field, specify a mask for names of computers that must be excluded from discovery. The mask can contain an asterisk (*) that stands for zero or more characters. You can specify multiple masks separated with commas.
Select the Ignore offline computers check box to exclude from discovery computers that did not contact a domain controlled for 30 days or longer.
- At the Access Account step of the wizard, specify credentials of an account that the master agent will use to connect to computers within the discovery scope. The account must have local Administrator permissions on all discovered computers.
If you have specified a discovery account in the master agent configuration settings, select the Use credentials specified in the master agent configuration check box. For details on specifying master agent configuration settings.
Credentials specified in the master agent configuration take precedence over credentials specified in the discovery rule. For discovery, the master agent will use an account specified in its configuration settings. In case this account is not valid or not set, the master agent will use an account specified in the discovery rule.
- At the Organizational Units step of the wizard, select organizational units that must be scanned for discovered computers.
This step of the wizard is available if at the Active Directory Discovery step you have selected the Select from organizational units option.
- Click a link in the Locations column for the necessary company.
- In the Locations window, click an organizational unit link for the necessary company location.
- In the Organizational Units window, select check boxes next to units that must be included to the discovery scope.
If you want to include a folder and all underlying subfolders to the discovery scope, right-click the check box and click Select all..
- In the Organizational Units window, click OK.
- In the Locations window, click OK.
- At the Discovery Filters step of the wizard, choose what filters you want to enable for discovery.
- To filter computers by OS type, select By OS type in the list and click Edit. In the Operating System window, select the type of OS that must run on discovered computers (Server operating system, Client operating system). Click OK.
- To filter computers by application, select By application in the list and click Edit. In the Application window, select applications that must run on discovered computers (Microsoft Exchange Server, Microsoft SQL Server, Microsoft Active Directory, Microsoft SharePoint, Oracle, and Other Applications). Click OK.
- To filter computers by platform, select By platform in the list and click Edit. In the Platform window, select platforms on which discovered computers must run (Microsoft Hyper-V and VMware vSphere, Physical computers, Microsoft Azure, Amazon Web Services, Other). Click OK.
- If you want to perform discovery among accessible computers only, select the Do not show inaccessible computers check box.
NOTE
Different types of filter conditions are joined using Boolean AND operator. For example, if you enable filters Server operating system, Microsoft SQL Server and VMware vSphere, the list of discovered computers will include only VMware vSphere VMs that run Windows Server OS and Microsoft SQL Server.
- At the Email Notification step of the wizard, you can enable notifications about discovery results by email.
- Select the Send notifications check box and specify a schedule according to which email notifications must be sent.
- In the Subject field, specify the subject of the notification.
- In the To field, specify an email address at which the email notification must be sent.
- Select the Send notification email after the first run check box if a notification about discovery results must be sent after the first run of the discovery rule, regardless of the specified schedule.
- At the Backup Agent Deployment step of the wizard, specify whether you want to install Veeam backup agents on discovered computers:
- If you do not want to install Veeam backup agents as part of the discovery process, leave the Discover remote computer without installing backup agent option selected.
- If after discovery Veeam backup agents must be installed automatically, select the Discover remote computer, install backup agent and assign the selected backup policy option.
From the Backup policy to apply list, choose a backup policy that must be assigned immediately after installation. To view the selected policy details, click the Show link. If you do not want to assign any backup policy after installation, choose No policy from the list.
If you do not have the necessary backup policy configured yet, you can click the Create New link to create a new policy, without exiting the New Rule wizard. For details on backup policies
By default, the read-only access mode is enabled for all Veeam backup agents installed as part of discovery. To disable the read-only access mode for Veeam backup agents on discovered computers, set the Enable read only UI access for the backup agent toggle to off.
For details on the read-only access mode for Veeam backup agents To push global settings for Veeam backup agents, click Configure and specify default global settings for Veeam backup agents.
- At the Summary step of the wizard, review discovery rule settings.
- To start discovery after you save the rule, select the Launch the discovery rule when I click Finish check box.
If you do not select this check box, you will need to launch discovery later.
Click Finish.
Once discovery rule completed, Management agent and Backup agent deployment will completed as per defined policy. All status are viewable in Managed Computer menu in VSPC Portal.
Related Posts
All posts
How Our People, Combined With Our Security Bundle, Guard Against Cyber Threats
The nature of cybersecurity threats is that there is no standard nature to them. They constantly evolve because they are the work of determined criminals who don’t give up.
So any cybersecurity bundle has to be dynamic and not static. It has to not only defend effectively against known threats, it also has to be on the lookout for emerging threats and have the ability to adapt.
At UBX Cloud, we protect our clients’ data and systems with our security bundle. It not only springs into action when an attack looms, it also keeps an eye out for vulnerabilities it can address ahead of time – and lets us know when we need to take immediate direct action in regard to a given situation.
Here are some of the elements of our security bundle, and how we utilize it to protect our clients:
• Advanced Threat Protection guards both endpoints and servers so they’re ready before a threat even shows up, and can shut down any attempt to access your system. • When a threat is present, the security bundle automatically deploys a combination of predefined and custom response actions across your entire system infrastructure to stop the threat cold. We are familiar with a wide variety of attack methods, so we’ve programmed in the most effective responses for those – while still leaving the system capable of conceiving a custom response when necessary. • The bundle constantly scans for vulnerabilities and sends alerts so we know what requires patching or any other sort of action well in advance of a threat. • Managing access permission is critical, so when an account’s access permission changes, the system detects it and alerts us so we can react quickly if the change has a suspicious origin. • Whenever critical data is accessed or changed, the system will know, so we move rapidly in the event of a potential problem. • If any malware or other type of attack hits your system, the XDR function detects it quickly and initiates a strong response. • We keep an eye on the Dark Web as well, so we know if your organization is producing compromised users or PII data.
Of course, all of this comes under the guise of our own team’s close watch on your system and your data. The security bundle is excellent, but we don’t expect it to do our job for us. It helps us to do the job of protecting you better.
The members of our team tightly monitor your system and your data on a continual basis to make sure it is safe and secure.
Cyberattackers don’t stop looking for new ways to hit you. But with our knowledge, experience and tools, we know how to stay several steps ahead of them – so that when they do show up looking for trouble, they find that they’ve got trouble.
And you don’t.
It’s True: We Provide Carrier-Grade Private Cloud on a 48U Cabinet (And It’s Way Better Than What Big Cloud Will Ever Do For You)
If you’re in telecom or any industry that demands carrier-grade cloud, it’s easy to assume that the only real options are AWS and Azure. After all, the Big Cloud giants have built their reputations on capacity and scale.
But here’s the truth: What you gain in “scale,” you lose in control, transparency, and value.
Too often, businesses assume they must accept whatever terms Big Cloud puts in front of them – limited bandwidth, shared platforms, premium-priced “top-tier” hardware, storage performance capped around 60,000 IOPS, and extra fees for every essential service like managed support, firewalls, backups, OS licensing, and network speed.
The more you think about it, the more you wonder why you associate Big Cloud with high capacity. They may have it, but they don’t provide much of it to you unless you pay a veritable extortion. And when you add up those costs, it’s not capacity you’re getting, it’s extortion disguised as infrastructure.
The UBX Cloud Difference
UBX Cloud delivers true carrier-grade private cloud – all within a single 48U cabinet – and we do it without the fine print or hidden fees.
Here’s what comes standard:
• Top-quality hardware • Unlimited bandwidth • Four ways to access support • Dedicated Juniper vSRX firewall • Veeam enterprise backup • 100 percent uptime guarantee • OS licensing • 24/7 monitoring and managed security support • 100GE private network • 500,000 IOPS of storage performance • Tier 4 data facility • Private, non-shared resources for data storage
All of it in one comprehensive package and a fair price.
How Do We Do It?
By now you’re wondering how we provide all that when Big Cloud can’t (or won’t) even come close to offering it to you. There are several reasons.
First, we have excellent strategic partners who give us access to expansive storage capacity, including storage partners Pure Storage and Zadara Storage.
Second, we don’t oversell our capacity on the theory that all our subscribers won’t use it at the same time. We assume you need everything you’re paying for and we make sure there’s room for you to take full advantage.
Third, we recognize that providing top-quality data management makes the rest of our jobs easier, and it makes your operation more secure and more likely to continue operating without glitches.
Transparent Pricing. No Surprises. Real People.
At UBX Cloud, everything’s included upfront. No tiered pricing traps. No “add-ons.”’ No nickel-and-diming.
And because we operate efficiently, our clients typically pay about 50 percent less than what Big Cloud would charge for equivalent (or often inferior) performance.
When you need support, you won’t get lost in a ticket queue – you’ll get a real person who knows your name, understands your setup, and actually cares about solving your issue.
Big Cloud’s Biggest Myth
Big Cloud has done a good job of one thing, though: They’ve convinced a lot of businesses that only the biggest players can deliver carrier-grade cloud. But it’s just not true.
Not only can independent providers like UBX Cloud provide carrier-grade cloud, we can do it more economically, more reliably, and with better performance all-around.
We care about the value you receive because we care about the relationship we have with every customer.
Experience the Difference
If you’re ready for carrier-grade performance without the Big Cloud baggage, give us a call.
We’ll show you just how much better it feels to have the power, transparency, and support you’ve always deserved.
Microsoft and Amazon Don’t Care About Outages, So Here’s What You Can Do About It
For those who are affected by the Microsoft and Amazon outages today – and who isn’t in some way? – you might expect both corporate giants would be trying to move heaven and earth to get the outages solved.
If you know anything about how these companies operate, you’ll know better than to have such luck.
The truth is, both of these companies are complete garbage when it comes to outages, and that’s because there is no economic incentive for them to care.
Microsoft and Amazon save money through multitenancy and oversubscribing. Multitenancy is when a single application serves multiple customers, or “tenants,” so each tenant’s data is supposedly kept private, but all the tenants have to share the available bandwidth.
Everyone accesses the same resources. It’s cost-efficient in theory, but it puts everyone at risk of an outage in the event of a single point of failure.
To top it off, they make it worse by oversubscribing, which is to say they allocate resources to more clients than they could actually accommodate if everyone tried to use the resources all at once.
It works out great for Microsoft and Amazon because they sell way more capacity than they could actually provide – and way more than they actually have to pay to maintain.
Have you ever bought tickets for a flight and were later told they were “oversold”? You sit there and wonder why they would sell more seats than they have, and they end up having to ask people to give up their seats. It sounds insane because it is, but it’s the same theory. They don’t think everyone will actually show up and they can just keep the money for the unused tickets.
If this theory holds and they never really get more users than they can handle, they’re fine. But when you have an outage, lots more people are affected.
You could probably get a 10 percent credit from Amazon or Microsoft if you work yourself to the bone, but it wouldn’t be worth the time and effort. No one expects you can get ahold of anyone at either company about the outage, so people just shrug it off and figure it’s a fact of life.
As a private company, if we did this poor a job providing service to our clients – and took this cavalier an attitude toward outages – our clients would leave us.
And we would deserve it.
We know that, of course, and we actually care about our clients, so we do everything to make sure their service is reliable. But Microsoft and Amazon don’t. Because they don’t have to. And because it’s not in their nature to.
Solution? Let UBX handle your cloud storage and data management needs. We actually care. Email me today at steven.panovski@ubxcloud.com. I’ll respond and everything.