Using Discovery & Deployment

Systems Manager discovery and deployment allows you to find and install the MicroAgent, the Systems Manager core technology, on systems within your network. This process consists of the following steps: 

Note: The current deployment process supports Microsoft Windows NT, Windows 2000, Windows Server 2003, Windows XP, and Windows Vista endpoints. Because of the lack of remote network access to required resources on Windows 95, Windows 98, and Windows ME, you must install these platforms manually.

Video: Discovery & Deployment (4:41)

Video: Deployment Best Practice - Clearing the Endpoint Table (3:47)

 

To get started with discovery and deployment quickly, you can run the Discovery and Deployment Wizard. This wizard displays automatically when you log in to Systems Manager if you have only one system with a MicroAgent installed, if you have admin rights, and if you subscribe to the Assets solution.

Initiating Discovery

Discovery is the process of scanning a network, domain, or other namespace for endpoints on which Systems Manager can install the MicroAgent. When Systems Manager invokes a discovery operation, the discovery agent can scan the following items:

 

After Systems Manager discovers the systems in your network, you can then select these systems for MicroAgent deployment.

 

Note: If you want to view all of the devices on your network, not just the machines on which you can deploy a MicroAgent, you can run a discovery using Network Mapper (NMAP) and then view a report.

 

You can access the following pages from the Discovery subtab menu:

Configure Namespaces

The Configure Namespaces page displays the namespaces that have been discovered or manually configured. Systems Manager then uses these namespaces to discover endpoints. Each namespace can be configured with its own set of credentials. You can also discover each namespace at any time, on demand.

 

Note: You can find namespaces or refresh this list at any time.

 

Follow these steps to display the Configure Namespaces page:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
    The Configure Namespaces page displays by default.

 

The Configure Namespaces page displays the following details:

 

The default sort order for the Configure Namespaces page is determined by the Type field.

 

You can complete the following tasks on the Configure Namespaces page:

Edit Namespace

The Edit Namespace page allows you to complete the following tasks:

Systems Manager uses these credentials to access the endpoint for any future operations.

 

Follow these steps to complete the Edit Namespace page:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
    The Configure Namespace page displays by default.
  3. Click the edit button or the link in the Credentials column next to a namespace to display the Edit Namespace page.
  4. Complete the following fields for a MS-Domain namespace:
    1. Modify the domain name.
    2. Enter a description.
    3. Enter the number of discovery threads.
      For example, if you have a domain with 100 systems, you can enter 20 in the Discovery Threads field, you can discover 20 systems at one time.
      Note: The more threads you use at one time, the higher the load it places on the system.
  5. Complete the following fields for a subnet namespace:
    1. Modify the subnet name.
    2. Modify the address.
    3. Modify the net mask.
      Note: If you enter a net mask, it overrides the IP start and end range.
    4. Enter IP range start and end addresses.
      Note: If you do not enter an IP range, Systems Manager infers the range from the net mask.
    5. Enter a description.
    6. Enter the number of discovery threads.
      For example, if you have a subnet with 256 addresses, you can enter 20 in the Discovery Threads field to scan 20 addresses at one time.
      Note: The more threads you use at one time, the higher the load it places on the system.
    7. Select the Perform NMap scan with the subnet scan check box to enable NMap discovery.
      For more information about NMap and its options, refer to http://nmap.org/.
  6. Complete the following fields for a Wins server namespace:
    1. Modify the Wins server name.
    2. Modify the address.
    3. Enter a description.
    4. Enter the number of discovery threads for the namespace.
  7. Enter your username, password, and password confirmation.
  8. Enter a domain for the namespace.
  9. Optional: From the Test Endpoint drop-down list, select an endpoint on which to test the credentials. This list includes all endpoints on which a MicroAgent is installed.
  10. Optional: Click the Test Credentials button to test the credentials on the endpoint you specified in the previous step. For example, if you are having problems with an endpoint, you can quickly test multiple sets of credentials without saving them.
    A green checkmark indicates that the credentials are valid for the endpoint.
    A red X indicates that the credentials are invalid; you must enter another set.
  11. Select a gateway for the namespace.
    Note: This field displays only when you have multiple gateways.
  12. Click Save to save your changes and return to the Configure Namespaces page.
    Systems Manager tests the credentials one more time.

Scan Namespaces

The Scan Namespaces page allows you to manually initiate an on-demand discovery.

 

Follow these steps to complete the Scan Namespaces page:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
    The Configure Namespaces page displays by default.
  3. Point to the Discovery menu and choose Scan Namespaces to display the Scan Namespaces page.
  4. Select the check box(es) next to the namespace(s) you want to scan.
  5. Click Apply.
  6. Click OK in the confirmation dialog box to return to the Configure Namespaces page.

 

After the agent has been successfully invoked, the status for each selected namespace changes to "Discovering" and will remain in that state until the discovery process is complete. Then, the status changes back to "None" or "Failed" and any errors display in the Activity Status column. Also, as namespace discovery progresses, the status field displays the progress of the discovery by displaying a string of the form X/Y, where Y is the total number of endpoints calculated to be discovered for that namespace, and X is the number that have been discovered at that time. The status can be one of the following:

Disable Namespaces

The Disable Namespaces page allows you to mark a namespace as disabled. Disabling a namespace prevents it from being discovered if the discovery agent is configured to auto-discover.

 

Follow these steps to display the Disable Namespaces page:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
  3. Point to the Discovery menu and choose Disable Namespaces to display the Disable Namespaces page.

 

Follow these steps to enable a disabled namespace:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
    The Configure Namespaces page displays by default.
  3. Click the Enable link in the Disabled column for the desired namespace.

Define Namespaces

The Define Namespaces page allows you to create a namespace anytime. Typically, you only create namespaces for subnets that you want to scan (no domain covers the machines). You can also define a namespace for a domain if the endpoints are part of a domain alias.

 

Follow these steps to create a namespace:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
  3. Point to the Discovery menu and choose Define Namespaces to display the Define Namespace page.
  4. Select a namespace type. You can manually define the following namespaces:
    1. MS domain: The discovery agent can only discover namespaces that have been discovered from the "network neighborhood" on the discovery agent. The purpose for defining a new MS domain namespace is as a placeholder for credentials. In the case where the domain COMPANY exists, sometimes the actual domain name on the endpoints is COMPANY.COM. In order for subsequent operations to be invoked where credentials are inherited for COMPANY.COM, an MS domain namespace must be defined to hold the credentials.
    2. Subnet: You can manually define any subnet or segment thereof for discovery. You can specify a name, subnet address, subnet mask, and an optional start and end IP address range, and you can apply specific credentials.
    3. Wins server: If a Wins server exists but is not defined for Wins resolution on the discovery endpoint, you can define a new Wins server namespace with the IP address of the Wins server you enter.
  5. Click Save to display the Edit Namespace page.
  6. Complete the Edit Namespace page.
  7. Click Save.

Find Namespaces

The Find Namespaces page allows you to locate an existing namespace.

 

Follow these steps to find a namespace:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
  3. Point to the Discovery menu and choose Find Namespaces.

Systems Manager returns namespaces it finds on the proxy file cache.

Reset Discovery

At some point, it may be desirable to clear all the discovered endpoints and/or namespaces and rediscover the network. You can accomplish this task using the Reset Discovery page.

 

Follow these steps to remove all endpoints and/or namespaces from the system in order to rediscover the network:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
  3. Point to the Discovery menu and choose Reset Discovery to display the Reset Discovery page.
  4. Select the Clear Namespaces check box to delete all of the namespace definitions from the database.
    Note: Deleting the namespace definitions also deletes the associated credentials. You must know the administrator's credentials in order to re-create the namespaces.
  5. Select the Clear Endpoints without MicroAgents check box to delete all of the unlocked endpoint definitions.
    Note: This action clears only those endpoints that do not have MicroAgents installed and are unlocked.
  6. Select the Invoke Discovery check box to invoke a discovery immediately after the reset.
  7. Click Save.

Note: These actions do nothing to the endpoints or namespaces themselves, they only delete the discovered information from the database.

Running Discovery via NMap to Discover All Network Devices

If you want to discover all of the devices on your network, not just those that are candidates for MicroAgent deployment, you can run a discovery process using Network Mapper (NMap). NMap is a free, open source utility for network discovery. You can read more about NMap at http://nmap.org/.

 

If you have the Software Distribution service, follow these steps to run a network discovery using NMap:

  1. To identify the system on which discovery is running, click the edit button next the namespace on the Configure Namespaces page. This action displays the Edit Namespace page; the discovery system displays in the Run Discovery on field.
  2. Import the NMap package from the Community.
  3. Select the NMap package and distribute it to the system you determined in the first step.
  4. Scan the subnet namespace.
    Note: You must enable NMap on the Edit Namespace page.
  5. Import the Network Devices Report from the Community to display all discovered devices in your network.

 

If you do not have the Software Distribution service, follow these steps to download and install NMap:

  1. To identify the system on which discovery is running, click the edit button next the namespace on the Configure Namespaces page. This action displays the Edit Namespace page; the discovery system displays in the Run Discovery on field.
  2. Download the NMap.msi package from the Systems Manager FTP server: http://www.triactive.com/downloads/NMap.msi.
  3. Manually install NMap on the system you in the first step.
  4. Scan the subnet namespace.
    Note: You must enable NMap on the Edit Namespace page.
  5. Import the Network Devices Report from the Community to display all discovered devices in your network.

Discovery and Deployment Wizard

The Discovery and Deployment Wizard assists you in discovering systems and deploying MicroAgents. You must have Admin: Discovery rights to run this wizard, and you must be subscribed to the Assets solution.

Note: The Discovery and Deployment Wizard displays by default when you log in to Systems Manager if you have only one endpoint with a MicroAgent installed.

Domain Membership

The Domain Membership page allows you to determine whether you want to manage systems that are members of a Microsoft domain.

 

Follow these steps to complete the Domain Membership page:

  1. Select Yes if most of your systems are in a Microsoft domain.
    —OR—
    Select No to perform a subnet scan to discover systems you can manage.
  2. Click Next to continue with the wizard.

Subnet Scan

The Subnet Scan page performs a subnet scan to discover systems you can manage.

 

Click Next to perform the scan and continue with the wizard.

Domain Name

The Domain Name page allows you to enter a domain name and description.

 

Follow these steps to complete the Domain Name page:

  1. Select a domain from the drop-down list.
  2. Enter a description of your domain.
  3. Click Next to continue with the wizard.

Subnet Definition

The Subnet Definition page allows you to define the subnet scan parameters.

 

Follow these steps to complete the Subnet Definition page:

  1. Select IP Address with Subnet Mask to specify a valid IP address and subnet mask. The Discovery and Deployment Wizard uses this combination to determine which IP addresses to scan.
    —OR—
    Select Range of IP Addresses to define a range of IP addresses. The Discovery and Deployment Wizard uses this range to determine which IP addresses to scan.
  2. Click Next to continue with the wizard.

IP Address with Subnet Mask

The IP Address with Subnet Mask page allows you to enter the details for your subnet mask.

 

Follow these steps to complete the IP Address with Subnet Mask page:

  1. Enter a subnet name.
  2. Enter a description for the subnet.
  3. Enter an address for the subnet.
  4. Enter a subnet mask.
  5. Click Next to continue with the wizard.

Range of IP Addresses

The Range of IP Addresses page allows you to enter the details for your IP range.

 

Follow these steps to complete the Range of IP Addresses page:

  1. Enter a subnet name.
  2. Enter a description for the subnet.
  3. Enter the IP range start address.
  4. Enter the IP range end address.
  5. Click Next to continue with the wizard.

Domain Credentials

The Domain Credentials page allows you to enter the credentials required to continue the discovery and deployment process. These credentials must match an account with administrative rights in the specified domain.

 

Follow these steps to complete the Domain Credentials page:

  1. Enter your user name.
  2. Enter your password.
  3. Enter your password again to confirm.
  4. Click Next to continue with the wizard.

Subnet Credentials

The Subnet Credentials page allows you to enter the credentials required to continue the discovery and deployment process. These credentials must match a local administrator account on every system you want to discover.

 

Follow these steps to complete the Subnet Credentials page:

  1. Enter your user name.
  2. Enter your password.
  3. Enter your password again to confirm.
  4. Click Next to continue with the wizard.

System Discovery

The System Discovery page indicates that the Discovery and Deployment Wizard is ready to begin discovering systems in your environment.

System Discovery Progress

The System Discovery Progress page allows you to view the progress of the discovery process. This process can last a few minutes.

Note: If the system discovery takes more than about five minutes, the Discovery and Deployment Wizard displays a dialog box, allowing you to wait until the process finishes or to view the systems discovered so far.

 

When Systems Manager completes the discovery process, the System Discovery Progress page displays a list of the systems in your environment that you can manage. To manage these systems, you must install the MicroAgent.

 

Follow these steps to complete the System Discovery Progress page:

  1. Select the systems you want to manage.
  2. Click the Install MicroAgent button.
    MicroAgent deployment begins immediately.

 

Note: If Systems Manager discovers no endpoints and you think that is incorrect, click the Previous button to go back and modify the information you entered.

MicroAgent Deployment

The MicroAgent Deployment page displays the status of your MicroAgent deployment. The deployment process can last a few minutes.

 

After the Discovery and Deployment Wizard completes this final step, the MicroAgents register with the Systems Manager servers. You can confirm this registration by viewing the systems as they display on the Assets System Names report.

Continue/Start Over

The Continue/Start Over page displays when you return to the Discovery and Deployment Wizard after leaving it unfinished.

 

Click Start Over to start at the beginning.

—OR—

Click Continue to begin where you stopped during your previous attempt.

Conducting Deployment

After the discovery process is complete, the next step is to deploy MicroAgents to the discovered machines. Upon installation of the initial agent components, Systems Manager defines and starts the MicroAgent service.

 

You can access the following reports from the Deployment subtab menu:

Deploy Agents

The Deploy Agents report includes endpoints on which the MicroAgent is not yet installed.

 

Follow these steps to deploy a MicroAgent to an endpoint:

  1. Click the Admin tab.
  2. Click the Deployment subtab.
    The Deploy Agents report displays by default.
  3. Select the endpoint(s) to which you want to deploy the MicroAgent and click Apply.

 

Systems Manager invokes the MicroAgent installer on the endpoint.

Note: If no data displays on the Deploy Agents report, Systems Manager displays an error dialog box and redirects you to the Discovered Endpoints report.

 

You can export data from the Deploy Agents report.

Discovered Endpoints

The Discovered Endpoints report on the Deployment subtab displays the endpoints that have been discovered and whether the MicroAgent has been installed. It also displays the endpoints for which the MicroAgent status has not been determined. This unknown status happens when the credentials used (if any) to query the status of the MicroAgent are not valid for that endpoint.

 

Follow these steps to display the Discovered Endpoints report:

  1. Click the Admin tab.
  2. Click the Deployment subtab.
  3. Point to the Deployment menu and choose Discovered Endpoints to display the Discovered Endpoints report.

 

The Discovered Endpoints report displays the following information:

You can export data from the Discovered Endpoints report.

Set Credentials

The Credentials page allows you to specify credentials for a specific endpoint. Systems Manager uses these credentials to access the endpoint for any future operations. 

 

Follow these steps to set credentials for an endpoint:

  1. Click the Admin tab.
  2. Click the Deployment subtab.
  3. Identify the endpoint you want to edit and click the link in the Credentials column to display the Credentials page.
  4. Enter a username.
  5. Enter the password, password confirmation, and domain.
  6. Optional: From the Test Credentials drop-down list, select an endpoint on which to test the credentials. This list includes all endpoints on which a MicroAgent is installed.
  7. Optional: Click the Test Credentials button to test the credentials on the endpoint you specified in the previous step.
    A green checkmark  indicates that the credentials are valid for the endpoint.
    A red X indicates that the credentials are invalid; you must enter another set.
  8. Click Save.

Remove Agents

The Remove Agents report allows you to select endpoints on which the MicroAgent is installed and remove the MicroAgent from those endpoints.

 

Follow these steps to remove a MicroAgent from an endpoint:

  1. Click the Admin tab.
  2. Click the Deployment subtab.
  3. Point to the Deployment menu and choose Remove Agents to display the Remove Agents report.
  4. Select the endpoint(s) from which you want to remove the MicroAgent and click Apply.

 

Systems Manager deletes both the MicroAgent and the asset records.

 

You can export data from the Remove Agents report.

Lock Agents

The Lock Agents report allows you to select endpoints to lock. Locking an agent prevents installation or removal.

 

Follow these steps to lock an endpoint:

  1. Click the Admin tab.
  2. Click the Deployment subtab.
  3. Point to the Deployment menu and choose Lock Agents to display the Lock Agents report.
  4. Select the endpoint(s) to lock and click Apply.

 

After you lock an endpoint, it cannot be deleted during a reset discovery operation nor can it be selected for a Remove or Deploy operation without first unlocking it.

 

You can export data from the Lock Agents report.

Unlock Agents

The Unlock Agents report allows you to select endpoints to unlock. Unlocking an agent allows installation or removal.

 

Follow these steps to unlock an endpoint:

  1. Click the Admin tab.
  2. Click the Deployment subtab.
  3. Point to the Deployment menu and choose Unlock Agents to display the Unlock Agents report.
  4. Select the endpoint(s) to unlock and click Unlock Agents.

 

You can export data from the Unlock Agents report.

Discovery & Deployment Terminology

The following list identifies some common terms in discovery and deployment:

Endpoints

An endpoint is a device on the network such as a workstation, server, printer, router, or any other device that has an address on the network. The discovery agent discovers all of the endpoints on a network even though only a subset of these endpoints are candidates for MicroAgent installation.

Namespaces

A namespace is a server or subnet specification from which information about individual endpoints can be discovered. Systems Manager can discover endpoints from the following namespaces:

Wins Server

A Wins server is similar to a Domain Naming Service (DNS) server. It is a central repository for device name and address mapping. When a Microsoft Windows endpoint logs on to a network, it registers its name and address with the Wins server. This provides for a dynamic and self-updating namespace.

 

The discovery agent detects the Wins server configuration for the endpoint on which it is running.

 

Follow these steps to configure the discovery agent to scan a Wins server:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
  3. Point to the Discovery menu and choose Define Namespaces to display the Define Namespaces page.
  4. Select the Wins Server option and click Save to display the Edit Namespace page.
  5. Enter the address of the Wins server. For example: 192.168.0.0
  6. Enter a descriptive name for the Wins server.
  7. Enter a short description.
  8. Enter the credentials to be used for accessing endpoints on this subnet.
  9. Select a gateway.
  10. Click Save.

MS Domain

The MS domain namespace uses a domain controller to discover endpoints that it knows about.

 

Follow these steps to configure the discovery agent to scan an MS domain:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
  3. Point to the Discovery menu and choose Define Namespaces to display the Define Namespaces page.
  4. Select the MS-Domain option and click Save to display the Edit Namespace page.
  5. Enter a descriptive name for the domain.
  6. Enter a short description.
  7. Enter the credentials to be used for accessing endpoints on this subnet.
  8. Select a gateway.
  9. Click Save.

Subnet

The discovery agent can be configured to scan an entire subnet, or range of IP addresses to locate endpoints on which the MicroAgent might be installed.

 

Follow these steps to configure the discovery agent to scan a subnet:

  1. Click the Admin tab.
  2. Click the Discovery subtab.
  3. Point to the Discovery menu and choose Define Namespaces to display the Define Namespace page.
  4. Select the Subnet option and click Save to display the Edit Namespace page.
  5. Enter a descriptive name for the subnet.
  6. Enter the address of the subnet. For example: 192.168.0.0
  7. Enter the mask specifying the scope of the subnet, for example 255.255.255.0
    Note: You specify either the netmask or the start/end IP addresses; you do not have to specify both.
  8. Enter the IP address of the start of the range, for example 192.168.0.1
  9. Enter the IP address of the end of the range, for example 192.168.0.100
  10. Enter a short description of the subnet.
  11. Enter the credentials to be used for accessing endpoints on this subnet.
  12. Select a gateway.
  13. Click Save.

IP Addresses and Subnets

IP Addresses identify the location of a device on a network. They are in the form xxx.xxx.xxx.xxx, where xxx is an integer from 0 to 255 (e.g. 10.0.1.65). A subnet is a logical group of IP addresses. A subnet uses a specific range (10.0.1.1 - 10.0.1.255) or a subnet mask (255.255.255.0) to define the range of IP addresses in a subnet.

 

For the purposes of Systems Manager, and especially if you are not familiar with how network addresses and subnet masks work, it is easier to use absolute IP address ranges when specifying subnets. The rest of this section gives a very high level description of subnets, subnet masks and how ranges are calculated from them.

 

The subnet mask is combined with the IP address using a logical AND operation.

 

There are three major classes of subnets, Class A, Class B and Class C. A "Class C" subnet is defined by a subnet mask of 255.255.255.0, which defines 255 addresses, a "Class B" subnet (subnet mask 255.255.0.0) defines 255 x 255 addresses, or 65,025 addresses. A "Class A" network (255.0.0.0) defines 255 x 255 x 255, or 16,581,375 addresses. The number of addresses for a given subnet mask can be calculated by performing a logical "NOT" operation on the mask. For example:

 

Class C subnet mask = 255.255.255.0

255.255.255.0 = 0xFFFFFF00

NOT 0xFFFFFF00 = 0x000000FF

0x000000FF = 255 in decimal, so there are 255 available addresses

 

Other subnet masks can be used to define smaller segments of a network. For example, consider the subnet mask 255.255.255.248. Using the NOT operator in the same manner as above, the number of available addresses for this subnet mask can be determined:

 

Arbitrary subnet mask = 255.255.255.248

255.255.255.248 = 0xFFFFFFF8

NOT 0xFFFFFFF8 = 0x00000007

0x00000007 = 7 in decimal so there are seven available addresses

 

The actual addresses that are defined by a subnet mask can be determined by using the subnet mask in conjunction with the network address. A logical "AND" operation of these two items determines the first address in the range, and adding the number of available addresses allowed with the subnet mask determines the last number in the range. Example:

 

Network address = 10.10.10.0

10.10.10.0 = 0x0A0A0A00

Subnet mask = 255.255.255.248

255.255.255.248 = 0xFFFFFFF8

0x0A0A0A00 AND 0xFFFFFFF8 = 0x0A0A0A00

0x0A0A0A00 = 10.10.10.0 in decimal

 

So, by using the result from above, this subnet mask was determined to have 7 available addresses, thus the range of available addresses would be 10.10.10.0 to 10.10.10.7 inclusive.

Credentials

Credentials refer to the domain, username, and password used to connect and manipulate the information on the endpoint. In the discovery phase, the discovery agent requires remote access to the endpoint to determine the status of the MicroAgent. In the installation phase, the deployment agent requires administrative access to the endpoints shared file systems, the service control manager and registry to install or remove the MicroAgent.

 

In most cases, it is sufficient to specify the credentials at the namespace level (MS domain, Wins server, or subnet, but in some cases where access to the endpoint has been modified in a non-standard way, specific credentials can be required.