Systems Manager discovery and deployment allows you to find and install the MicroAgent, the Systems Manager core technology, on systems within your network. This process consists of the following steps:
Note: The current deployment process supports Microsoft Windows NT, Windows 2000, Windows Server 2003, Windows XP, and Windows Vista endpoints. Because of the lack of remote network access to required resources on Windows 95, Windows 98, and Windows ME, you must install these platforms manually.
Video: Discovery & Deployment (4:41)
Video: Deployment Best Practice - Clearing the Endpoint Table (3:47)
To get started with discovery and deployment quickly, you can run the Discovery and Deployment Wizard. This wizard displays automatically when you log in to Systems Manager if you have only one system with a MicroAgent installed, if you have admin rights, and if you subscribe to the Assets solution.
Discovery is the process of scanning a network, domain, or other namespace for endpoints on which Systems Manager can install the MicroAgent. When Systems Manager invokes a discovery operation, the discovery agent can scan the following items:
After Systems Manager discovers the systems in your network, you can then select these systems for MicroAgent deployment.
Note: If you want to view all of the devices on your network, not just the machines on which you can deploy a MicroAgent, you can run a discovery using Network Mapper (NMAP) and then view a report.
You can access the following pages from the Discovery subtab menu:
The Configure Namespaces page displays the namespaces that have been discovered or manually configured. Systems Manager then uses these namespaces to discover endpoints. Each namespace can be configured with its own set of credentials. You can also discover each namespace at any time, on demand.
Note: You can find namespaces or refresh this list at any time.
Follow these steps to display the Configure Namespaces page:
The Configure Namespaces page displays the following details:
The default sort order for the Configure Namespaces page is determined by the Type field.
You can complete the following tasks on the Configure Namespaces page:
to scan the namespace on demand.
to display the Edit Namespace page and modify the namespace.
to remove the namespace.The Edit Namespace page allows you to complete the following tasks:
Systems Manager uses these credentials to access the endpoint for any future operations.
Follow these steps to complete the Edit Namespace page:
or the link in the Credentials column next to a namespace to display the Edit Namespace page.
to test the credentials on the endpoint you specified in the previous step. For example, if you are having problems with an endpoint, you can quickly test multiple sets of credentials without saving them.
indicates that the credentials are valid for the endpoint.
indicates that the credentials are invalid; you must enter another set.
The Scan Namespaces page allows you to manually initiate an on-demand discovery.
Follow these steps to complete the Scan Namespaces page:
After the agent has been successfully invoked, the status for each selected namespace changes to "Discovering" and will remain in that state until the discovery process is complete. Then, the status changes back to "None" or "Failed" and any errors display in the Activity Status column. Also, as namespace discovery progresses, the status field displays the progress of the discovery by displaying a string of the form X/Y, where Y is the total number of endpoints calculated to be discovered for that namespace, and X is the number that have been discovered at that time. The status can be one of the following:
The Disable Namespaces page allows you to mark a namespace as disabled. Disabling a namespace prevents it from being discovered if the discovery agent is configured to auto-discover.
Follow these steps to display the Disable Namespaces page:
Follow these steps to enable a disabled namespace:
The Define Namespaces page allows you to create a namespace anytime. Typically, you only create namespaces for subnets that you want to scan (no domain covers the machines). You can also define a namespace for a domain if the endpoints are part of a domain alias.
Follow these steps to create a namespace:
The Find Namespaces page allows you to locate an existing namespace.
Follow these steps to find a namespace:
Systems Manager returns namespaces it finds on the proxy file cache.
At some point, it may be desirable to clear all the discovered endpoints and/or namespaces and rediscover the network. You can accomplish this task using the Reset Discovery page.
Follow these steps to remove all endpoints and/or namespaces from the system in order to rediscover the network:
Note: These actions do nothing to the endpoints or namespaces themselves, they only delete the discovered information from the database.
If you want to discover all of the devices on your network, not just those that are candidates for MicroAgent deployment, you can run a discovery process using Network Mapper (NMap). NMap is a free, open source utility for network discovery. You can read more about NMap at http://nmap.org/.
If you have the Software Distribution service, follow these steps to run a network discovery using NMap:
next the namespace on the Configure Namespaces page. This action displays the Edit Namespace page; the discovery system displays in the Run Discovery on field.
If you do not have the Software Distribution service, follow these steps to download and install NMap:
next the namespace on the Configure Namespaces page. This action displays the Edit Namespace page; the discovery system displays in the Run Discovery on field.
The Discovery and Deployment Wizard assists you in discovering systems and deploying MicroAgents. You must have Admin: Discovery rights to run this wizard, and you must be subscribed to the Assets solution.
Note: The Discovery and Deployment Wizard displays by default when you log in to Systems Manager if you have only one endpoint with a MicroAgent installed.
The Domain Membership page allows you to determine whether you want to manage systems that are members of a Microsoft domain.
Follow these steps to complete the Domain Membership page:
The Subnet Scan page performs a subnet scan to discover systems you can manage.
Click Next to perform the scan and continue with the wizard.
The Domain Name page allows you to enter a domain name and description.
Follow these steps to complete the Domain Name page:
The Subnet Definition page allows you to define the subnet scan parameters.
Follow these steps to complete the Subnet Definition page:
The IP Address with Subnet Mask page allows you to enter the details for your subnet mask.
Follow these steps to complete the IP Address with Subnet Mask page:
The Range of IP Addresses page allows you to enter the details for your IP range.
Follow these steps to complete the Range of IP Addresses page:
The Domain Credentials page allows you to enter the credentials required to continue the discovery and deployment process. These credentials must match an account with administrative rights in the specified domain.
Follow these steps to complete the Domain Credentials page:
The Subnet Credentials page allows you to enter the credentials required to continue the discovery and deployment process. These credentials must match a local administrator account on every system you want to discover.
Follow these steps to complete the Subnet Credentials page:
The System Discovery page indicates that the Discovery and Deployment Wizard is ready to begin discovering systems in your environment.
The System Discovery Progress page allows you to view the progress of the discovery process. This process can last a few minutes.
Note: If the system discovery takes more than about five minutes, the Discovery and Deployment Wizard displays a dialog box, allowing you to wait until the process finishes or to view the systems discovered so far.
When Systems Manager completes the discovery process, the System Discovery Progress page displays a list of the systems in your environment that you can manage. To manage these systems, you must install the MicroAgent.
Follow these steps to complete the System Discovery Progress page:
Note: If Systems Manager discovers no endpoints and you think that is incorrect, click the Previous button to go back and modify the information you entered.
The MicroAgent Deployment page displays the status of your MicroAgent deployment. The deployment process can last a few minutes.
After the Discovery and Deployment Wizard completes this final step, the MicroAgents register with the Systems Manager servers. You can confirm this registration by viewing the systems as they display on the Assets System Names report.
The Continue/Start Over page displays when you return to the Discovery and Deployment Wizard after leaving it unfinished.
Click Start Over to start at the beginning.
—OR—
Click Continue to begin where you stopped during your previous attempt.
After the discovery process is complete, the next step is to deploy MicroAgents to the discovered machines. Upon installation of the initial agent components, Systems Manager defines and starts the MicroAgent service.
You can access the following reports from the Deployment subtab menu:
The Deploy Agents report includes endpoints on which the MicroAgent is not yet installed.
Follow these steps to deploy a MicroAgent to an endpoint:
Systems Manager invokes the MicroAgent installer on the endpoint.
Note: If no data displays on the Deploy Agents report, Systems Manager displays an error dialog box and redirects you to the Discovered Endpoints report.
You can export data from the Deploy Agents report.
The Discovered Endpoints report on the Deployment subtab displays the endpoints that have been discovered and whether the MicroAgent has been installed. It also displays the endpoints for which the MicroAgent status has not been determined. This unknown status happens when the credentials used (if any) to query the status of the MicroAgent are not valid for that endpoint.
Follow these steps to display the Discovered Endpoints report:
The Discovered Endpoints report displays the following information:
- agent is running
- agent is not running, or access is blocked
- ready to install agent
- discovery specific error
You can export data from the Discovered Endpoints report.
The Credentials page allows you to specify credentials for a specific endpoint. Systems Manager uses these credentials to access the endpoint for any future operations.
Follow these steps to set credentials for an endpoint:
to test the credentials on the endpoint you specified in the previous step.
indicates that the credentials are valid for the endpoint.
indicates that the credentials are invalid; you must enter another set.The Remove Agents report allows you to select endpoints on which the MicroAgent is installed and remove the MicroAgent from those endpoints.
Follow these steps to remove a MicroAgent from an endpoint:
Systems Manager deletes both the MicroAgent and the asset records.
You can export data from the Remove Agents report.
The Lock Agents report allows you to select endpoints to lock. Locking an agent prevents installation or removal.
Follow these steps to lock an endpoint:
After you lock an endpoint, it cannot be deleted during a reset discovery operation nor can it be selected for a Remove or Deploy operation without first unlocking it.
You can export data from the Lock Agents report.
The Unlock Agents report allows you to select endpoints to unlock. Unlocking an agent allows installation or removal.
Follow these steps to unlock an endpoint:
You can export data from the Unlock Agents report.
The following list identifies some common terms in discovery and deployment:
An endpoint is a device on the network such as a workstation, server, printer, router, or any other device that has an address on the network. The discovery agent discovers all of the endpoints on a network even though only a subset of these endpoints are candidates for MicroAgent installation.
A namespace is a server or subnet specification from which information about individual endpoints can be discovered. Systems Manager can discover endpoints from the following namespaces:
A Wins server is similar to a Domain Naming Service (DNS) server. It is a central repository for device name and address mapping. When a Microsoft Windows endpoint logs on to a network, it registers its name and address with the Wins server. This provides for a dynamic and self-updating namespace.
The discovery agent detects the Wins server configuration for the endpoint on which it is running.
Follow these steps to configure the discovery agent to scan a Wins server:
The MS domain namespace uses a domain controller to discover endpoints that it knows about.
Follow these steps to configure the discovery agent to scan an MS domain:
The discovery agent can be configured to scan an entire subnet, or range of IP addresses to locate endpoints on which the MicroAgent might be installed.
Follow these steps to configure the discovery agent to scan a subnet:
IP Addresses identify the location of a device on a network. They are in the form xxx.xxx.xxx.xxx, where xxx is an integer from 0 to 255 (e.g. 10.0.1.65). A subnet is a logical group of IP addresses. A subnet uses a specific range (10.0.1.1 - 10.0.1.255) or a subnet mask (255.255.255.0) to define the range of IP addresses in a subnet.
For the purposes of Systems Manager, and especially if you are not familiar with how network addresses and subnet masks work, it is easier to use absolute IP address ranges when specifying subnets. The rest of this section gives a very high level description of subnets, subnet masks and how ranges are calculated from them.
The subnet mask is combined with the IP address using a logical AND operation.
There are three major classes of subnets, Class A, Class B and Class C. A "Class C" subnet is defined by a subnet mask of 255.255.255.0, which defines 255 addresses, a "Class B" subnet (subnet mask 255.255.0.0) defines 255 x 255 addresses, or 65,025 addresses. A "Class A" network (255.0.0.0) defines 255 x 255 x 255, or 16,581,375 addresses. The number of addresses for a given subnet mask can be calculated by performing a logical "NOT" operation on the mask. For example:
Class C subnet mask = 255.255.255.0
255.255.255.0 = 0xFFFFFF00
NOT 0xFFFFFF00 = 0x000000FF
0x000000FF = 255 in decimal, so there are 255 available addresses
Other subnet masks can be used to define smaller segments of a network. For example, consider the subnet mask 255.255.255.248. Using the NOT operator in the same manner as above, the number of available addresses for this subnet mask can be determined:
Arbitrary subnet mask = 255.255.255.248
255.255.255.248 = 0xFFFFFFF8
NOT 0xFFFFFFF8 = 0x00000007
0x00000007 = 7 in decimal so there are seven available addresses
The actual addresses that are defined by a subnet mask can be determined by using the subnet mask in conjunction with the network address. A logical "AND" operation of these two items determines the first address in the range, and adding the number of available addresses allowed with the subnet mask determines the last number in the range. Example:
Network address = 10.10.10.0
10.10.10.0 = 0x0A0A0A00
Subnet mask = 255.255.255.248
255.255.255.248 = 0xFFFFFFF8
0x0A0A0A00 AND 0xFFFFFFF8 = 0x0A0A0A00
0x0A0A0A00 = 10.10.10.0 in decimal
So, by using the result from above, this subnet mask was determined to have 7 available addresses, thus the range of available addresses would be 10.10.10.0 to 10.10.10.7 inclusive.
Credentials refer to the domain, username, and password used to connect and manipulate the information on the endpoint. In the discovery phase, the discovery agent requires remote access to the endpoint to determine the status of the MicroAgent. In the installation phase, the deployment agent requires administrative access to the endpoints shared file systems, the service control manager and registry to install or remove the MicroAgent.
In most cases, it is sufficient to specify the credentials at the namespace level (MS domain, Wins server, or subnet, but in some cases where access to the endpoint has been modified in a non-standard way, specific credentials can be required.