Sensitive Content Manager

Transcription

1 Sensitive Content Manager Installation Guide July

2 Copyright 2018 Meta l ogi x Interna ti ona l GmbH Al l ri ghts res erved. No pa rt or s ecti on of the contents of thi s ma teri a l ma y be reproduced or tra ns mi tted i n a ny form or by a ny mea ns wi thout the wri tten permi s s i on of Meta l ogi x Interna ti ona l GmbH. Sens i ti ve Content Ma na ger i s a tra dema rk of Meta l ogi x Interna ti ona l GmbH. Wi ndows Sha repoi nt Servi ces i s ei ther a regi s tered tra dema rk or a tra dema rk of Mi cros oft Corpora ti on i n the Uni ted Sta tes a nd/or other countri es. Other product a nd compa ny na mes menti oned herei n ma y be the tra dema rks of thei r res pecti ve owners. Technical Support For i nforma ti on a bout Meta l ogi x Techni ca l s upport vi s i t l ogi x.com/s upport. Techni ca l s upport s peci a l i s ts ca n be rea ched by phone a t The l evel of techni ca l s upport provi ded depends upon the s upport pa cka ge tha t you ha ve purcha s ed. Conta ct us to di s cus s your s upport requi rements. info@metalogix.com

3 Contents Sensitive Content Manager... 4 System Requirements... 4 Install Instructions info@metalogix.com

4 Sensitive Content Manager Sensitive Content Manager (SCM) provides a highly accurate and flexible out of the box solution for detecting sensitive information such as Personally Identifiable Information (PII), Protected Health Information (PHI) and Payment Card Industry (PCI) within enterprise content management systems. With on-demand scanning, administrators can flag specific libraries, sites, or site collections for content discovery, or enable real-time content shield by analyzing files as they are created, modified, moved, or destroyed. Sensitive Content Manager uses the Content Analysis service. This guide contains instructions for the on-premise installation of Sensitive Content Manager and the Content Analysis service. Integration with ControlPoint Sensitive Content Manager Server can leverage the existing security, compliance and administration capabilities of ControlPoint to enforce policies using the full range of SharePoint permissions management, auditing and user activity reporting. The combination of Sensitive Content Manager Server and ControlPoint offers a powerful Data Loss Prevention (DLP) solution that enables clients to identify, track, and secure documents using advanced neural network powered machine learning, which ensures a more robust level of information governance inside increasingly complex enterprise environments. System Requirements The table below lists the components required to install and use the Sensitive Content Manager and the Content Analysis service. Component Type Component Operating System Windows Server 2012 Database SQL Server 2012 upto SQL Server 2014 Application Windows Powershell 2.0 or later with unrestricted execution policy. Windows Server Roles Application Server, Web Server (IIS) 4

5 Additional Software Microsoft.NET Framework or later Microsoft SQL Server Transact-SQL ScriptDom Microsoft System CLR Types for Microsoft SQL Server 2012 Microsoft Web Deploy 3.5 NOTE: If these applications have not been pre-installed, they will be automatically installed by the Sensitive Content Manager installer. Browser Chrome (recommended) Firefox Internet Explorer 11 NOTE: Safari is not supported. Installation Account The account used to install Sensitive Content Manager must be: a Domain Administrator a member of the local Administrators group on the Server where Sensitive Content Manager will be installed a Sysadmin on the SQL instance where the Sensitive Content Manager Database will reside System Setup Steps The following system setup instructions are presented below: 1. Steps to change the Windows PowerShell Script Execution Policy 2. Steps to install the following roles and features on Windows Server 2012 Web Server (IIS) role Application Server role Active Directory module for Windows PowerShell NOTE: The roles and features required for SCM are installed when you install SCM. You may install these roles and features manually, if you wish. 3. Steps to explicitly add the installation account as a user in SQL Server 5

6 Steps to change the Windows PowerShell Script Execution Policy By default, Windows PowerShell scripts are restricted. To change the execution policy: 1. Log in with the credentials of the domain administrator. 2. Open Windows PowerShell. 3. At the command prompt, enter and run the following command Set-ExecutionPolicy Unrestricted 4. Enter Y at the prompt and press Enter. A confirmation message appears. 5. Enter Exit at the prompt and press Enter to close Windows PowerShell. Steps to install roles and features on Windows Server Log in with the credentials of the domain administrator. 2. Open Server Manager. 3. Under Manage menu, select Add Roles and Features. Th Add Roles and Features Wizard appears. 4. If you see the Before you begin page, click Next. 5. Select Role-based or Feature-based Installation. Click Next. 6. Select the appropriate server (the local server is selected by default). Click Next. The Select Server Roles page appears. 7. Select the Application Server check box. The Application Server role is added to the navigation list. 8. Select the Web Server (IIS) checkbox. The Web Server (IIS) features window appears. 6

7 9. Accept the default and click Add Features. The Web Server Role (IIS) is added to the navigation list. 10. Click Next. The Select Features page appears. 11. From the list of features, select the following features or verify that the feature is already installed: a..net Framework 4.5 b. Message Queuing c. Remote Server Administration Tools. The feature window for Remote Server Administration Tools appears. Accept all the defaults and click Add Features. d. Remote Server Administration Tools > Role Administration Tools > AD DS and AD LDS Tools > Active Directory module for Windows PowerShell. 7

8 e. User Interfaces and Infrastructure f. Windows PowerShell g. Windows Process Activation Service 12. From the navigation list, click Application Server > Role Services. 13. Select the the following features: a..net Framework 4.5 b. Web Server (IIS) Support. The feature window for Web Server (IIS) Support appears. Accept all the defaults and click Add Features. 14. From the navigation list, click Web Server Role (IIS) > Role Services. 15. Customize your installation of IIS, or accept the default settings that have already been selected for you. 16. Click Next. The Confirm installation selections page appears. 8

9 17. [Optional] Select the Restart the destination server automatically if required check box. Accept the confirmations. 18. Click Install. The Installation progress page appears. 19. When the installation completes, the wizard displays the installation status. 20. Click Close to exit the wizard. Steps to explicitly add the installation account as a user in SQL Server 1. Log in with the credentials of the domain administrator either directly or through a remote desktop connection. Sample values are as shown below. Property Sample Value Domain SCMSRVR User Name mydomain\administrator Password P@ssw0rd1 2. Start the SQL Server Management studio. The Connect to Server dialog appears. 9

10 3. Enter the values as shown in the sample below. Property Sample Value Server Type Database Engine Server Name SCMSRVR Authentication Windows Authentication 4. Click Connect. Verify that the connection was successful in the Object Explorer pane. 5. In the Object Explorer pane, expand the Security node. 6. Right click on the Login node and select the New Login option. The Login - New dialog appears. 7. Click the Search button next to the Login Name field. The Select User or Group dialog appears. 8. In the Enter the object name to select text box, enter the value Administrator. 9. Click Check Names. Verify that the domain administrator account appears as shown in the sample below. 10

11 10. Click OK. Verify that the local administrator account appears in the Login Name field in the Login - New dialog. 11. In the Select a page pane, click Server Roles. The Server Roles list page appears. 12. Select the sysadmin check box. 13. Click OK to complete the New Login process and assign the server role to the domain administrator. 11

12 Install Instructions This topic provides instructions for installing the Sensitive Content Manager using a Windows Installer for an on-premise installation. In this topic 1. Planning your install 2. Before you begin 3. Steps to retrieve a certificate's thumbprint 4. About licensing and registration 5. Downloading the install files 6. Steps to install the Sensitive Content Manager Server 7. Steps to install the Content Analysis service on a different server 8. Steps to verify the installation 9. Troubleshooting Planning your install The scenarios described below are simple estimates to provide some guidance about how to think about load sizing and analysis server distribution. Since processing efficiencies are heavily dependent on your server configurations, some research and verification will be necessary necessary to arrive at optimum server load configurations. It is recommended that you contact your representative to assist you in this process. SCENARIO 1: You have several hundred kilobytes of files (but less that a gigabyte) on a single Windows SharePoint server that needs analysis. The suggested approach for this scenario would be to install the SCM database, portal and analysis services on a separate physical or virtual machine (the SCM server). You would then install ControlPoint on the SharePoint machine so that the files to be analyzed can be efficiently submitted through ControlPoint. SCENARIO 2: You have several terabytes of files spread across a Windows SharePoint server farm, and about a gigabyte of these files need to be analyzed per day. The suggested approach for this scenario would be to install the SCM database and portal on a separate physical machine (the SCM server) and install the analysis services on multiple physical or virtual machines. You would then install ControlPoint on a separate server so that the files to be analyzed can be efficiently submitted and distributed through ControlPoint. The distributed nature of the Analysis servers ensures efficient retrieval and processing of the files required for analysis. 12

13 Before you begin 1. The machine on which you are installing Sensitive Content Manager must meet the System Requirements. 2. The machine on which you are installing Sensitive Content Manager should have access to the Internet, which is necessary to download the files needed for a successful install. 3. If an integration with ControlPoint or another software is planned, the machine on which you are installing Sensitive Content Manager must be on a domain in a full trust relationship with the domain on which ControlPoint (or other client application) is installed. Specifically, verify that the machine on which you are installing Sensitive Content Manager is reachable by the server on which ControlPoint (or other client application) is installed. 4. You have the following information ready (sample values are provided here as a guidance). Field Description Sample Value SQL Server Name The SQL server instance name. scmsrvr SQLIntegrated Authentication Checkbox that indicates whether SCM will use Windows or mixed-mode authentication to log into the SQL server. When checked, SCM will use Windows authentication and the fields for SQL Server Administrative User, SQL Server Administrative User Password, and Password for SCM SQL User are disabled. When unchecked, SQL or mixed-mode authentication is used, and you must complete the other fields as well. For more information, see the Microsoft article about authentication mode configuration. SQL Server Administrative User The SQL server user account with sysadmin rights. sa SQL Server Administrative User Password Password for the SQL Server sysadmin user. Pass@w0rd1 Password for SCM SQL User The password for the user registered in the database who will use the Sensitive Content Manager functionality. Pass@w0rd1 13

14 Create Service Account The Windows user account that will be used by SCM to execute the Analysis services and application pools. By default, the checkbox is checked and the installer automatically creates its own Service Account with the login <domain>\mx-cloud-svc, during installation. You can uncheck this box and enter an alternate account (in the domain\user_name format). Password for SCM Windows Account The password for the administrator who has access to the windows machine on which you are installing Sensitive Content Manager. Working Storage Path Full path of the folder that will contain the files to be analyzed. C:\FileStorageSystem. You could specify a network path as well such as \\myserver\mypath. Protocol Internet protocol to access the portal. http or https Portal URL Fully qualified domain name and a unique port number. The port number should not be a reserved port number scmsrvr.mydomain.com Port: port:result Service Fully qualified domain name and a unique port URL number. The port number should not be a reserved port number scmsrvr.mydomain.com Port: File Upload URL Fully qualified domain name and a unique port number. The port number should not be a reserved port number scmsrvr.mydomain.com Port: SSL Certificate Thumbprint SSL certificate that the service binds with. Can be specified at time of install or can be setup later with IIS Manager. see Steps to retrieve a certificate's thumbprint NOTE: The installer creates an Active Directory group called CloudOperators if it does not already exist. All accounts that interface with the SCM server must be in the CloudOperators Active Directory group. If you specify a custom login for the Create Service Account property, it must be added to the CloudOperators group. 14

15 Steps to retrieve a certificate's thumbprint 1. Open IIS Manager and navigate to the level you want to manage. This would typically be the node with your machine name. 2. In Features view, double-click Server Certificates. 3. In the Server Certificates list, if you already have a certificate that is valid, go to step In the Actions pane, click Create Self-Signed Certificate. 5. On the Create Self-Signed Certificate page, type a friendly name for the certificate in the Specify a friendly name for the certificate box, and then click OK. 6. In the Server Certificates list, double-click the certificate you just created. 7. In the Certificate dialog box, click the Details tab. 8. Scroll through the list of fields and click Thumbprint. 9. Copy the hexadecimal characters from the box to a text editor such as Notepad. Remove the spaces between the hexadecimal numbers. For example, the thumbprint "4 d 1 9 d c 9 a 4 3 a d 6 2 a d a 2 4 d e f d 3 " should be converted to 4d19d8969c9a43a94116d62ad948a24def0634d Enter the thumbprint value in the SSL Certificate Thumbprint field of the installer. 11. Close an exit from IIS Manager. About licensing and registration The first time you install Sensitive Content Manager, you will be granted a free 30-day evaluation license. If you wish to purchase a production license, contact. For more information see the topic about License in the Content Analysis Admin section of this administration guide. Downloading the install files 1. From your browser, navigate to the page. 2. Scroll down to the Sensitive Content Manager - 30 day free trial section. 3. Click the Free Trial button. 4. Fill the Download a Free Trial registration form and click the Submit button. The file download window appears, or check your default download folder. 5. Ensure that the files are available locally on the machine on which you are planning to install the Sensitive Content Manager. Steps to install the Sensitive Content Manager 1. Unzip the files. 2. Click the windows installer file SCM Installer.exe. The SCM installer window appears. NOTE: Do not start the Sensitive Content Management Server.msi executable because the installation 15

16 will not succeed. 3. Click Install. The Sensitive Content Manager Server welcome page appears in a new window. 16

17 4. Click Next. The End-User License Agreement (EULA) window appears. 5. Should you wish to proceed, click the checkbox I accept the terms in the LIcense Agreement. 6. [Optional] Click the Print button if you choose to print the EULA. 7. Click the Next button. The SCM Components Selection window appears. 17

18 8. Click the Install All Components button. The Database and Portal Configuration window appears. 9. Fill in the values as you have determined in the table of values in the Before you begin section. 18

19 10. Click Install. The Sensitive Content Manager Server installation completion page appears. 11. Click Finish. The SCM Installer completion page appears. 12. Click Finish to close the installer. 19

20 Steps to install the Content Analysis Service on a different server You can choose to install just the Content Analysis Service on a different server. You should have already installed all the components on your primary SCM server before you attempt this action. 1. Unzip the downloaded file. NOTE: If your file is blocked, see the section about Troubleshooting. 2. Right-click the windows installer file SCM Installer.exe and select Run as administrator. The SCM installer welcome window appears. 3. Click the Install button. The Sensitive Content Manager Server installer dialog appears. 4. Click the Next button. The End-User License Agreement (EULA) window appears. 5. Should you wish to proceed, click the check box I accept the terms in the License Agreement. 6. [Optional] Click the Print button if you choose to print the EULA. 7. Click the Next button. The SCM Components Selection window appears. 8. Click the Analysis Service button. The Analysis Service setup window appears. 20

21 9. Fill in the values as you have determined in the table of values in the Before you begin section. NOTE: You may click the Test Connection button to verify the values you have entered are valid and present in the database. 10. Click the Install button to complete the installation, or click Cancel to terminate the installer. 21

22 Steps to verify the installation 1. Open a browser such as Chrome, on the local machine. 2. Enter the SCM Portal URL you had previously specified during the install configuration. For example enter a. If you are using a self-signed certificate, you may get a browser error as shown in the image from a Chrome browser below - b. Click ADVANCED. The link to the SCM Portal appears. For example, the link Proceed to scmsrvr.mydomain.local (unsafe) appears. c. Click the link. 3. In the Sign in dialog that appears, enter the credentials of the domain administrator. 4. Click Sign In. 22

23 5. Verify that the Dashboard appears appears as shown in the image below NOTE: A lightweight text file called SystemTestJob.txt is automatically installed and used by the Content Analysis service to test the system. The numbers indicated in the Scan and Files Analyzed tiles should be more than zero indicating that the Content Analysis service is working as desired and has scanned the text file multiple times. If you refresh the page, the Files Analyzed value should increase. 23

24 Troubleshooting Downloaded zip file is blocked 1. The downloaded zip file may be blocked with the message "This file came from another computer and might be blocked to help protect this computer". 2. Right-click the file and select Properties. The File Properties dialog appears. 3. Open the Security tab. 4. Click the Unblock button. You can also try using Powershell command Unblock-File at Install Fails 1. If the installer fails at any step, you will see the error dialog. 2. Click the log file link to see the error logs and take steps to to correct the problem or contact Support. 24