ManageEngine EventLog Analyzer. Installation of agent via Group Policy Objects (GPO)

Transcription

1 ManageEngine EventLog Analyzer Installation of agent via Group Policy Objects (GPO)

2 Document Summary This document briefly describes the steps to install EventLog Analyzer agent software via Group Policy Objects (GPOs). The document is intended for system administrators who have a basic knowledge of Windows operating system, Active Directory, and enterprise software deployment. About EventLog Analyzer EventLog Analyzer is a web- based log management solution that helps you to centrally collect, monitor, analyze, correlate, and archive logs from sources across your network. This solution also provides out- of- the- box reports and alert criteria that help you to easily meet various compliance regulatory requirement and SIEM needs. It also provides you an option to conduct forensic analysis over the archived log data with its simple, yet powerful search engine. This solution employs both agentless and agent based log collection mechanism to collect log data from sources across your network infrastructure. It supports over 700+ log sources across 30+ vendors. Apart from this, it also has Universal Log Parsing and Indexing (ULPI) technology that helps you to parse, analyze, and monitor any log data that are in human readable format. EventLog Analyzer also helps you to protect confidential files or folders with its File Integrity Monitoring feature. It provides detailed predefined reports that provide answer to the Ws of audit trail viz., who made the change, what was changed and when it was changed. System Requirements Hardware Requirements For 32 Bit Installation The minimum hardware requirements for installing and working with EventLog Analyzer are given below. 1GHz, 32-bit (x86) Pentium Dual Core processor or equivalent 2GB RAM* 5GB Hard disk space for the product For 64 Bit Installation The minimum hardware requirements for EventLog Analyzer to start running are listed below GHz, 64-bit (x64) Xeon LV processor or equivalent 2 GB RAM* 5 GB Hard disk space for the product Operating System Requirements EventLog Analyzer can be installed and run on the following operating systems and versions: Windows 8, Windows 7, Vista, 2000, XP, & NT and Windows Server 2000/2003/2008/2008 R2/2012 Copyright 2015 ManageEngine Page 1

3 Steps for installing EventLog Analyzer agent via GPO Note: Before starting, place the following files in a network- shared folder of the server: InstallEventLogAgent.vbs EventLogAgent.msi The above said files are available in the lib\native directory of the EventLog Analyzer installation folder. (Default Location C:\ManageEngine\EventLog\lib\native) Best Practice: Create a group and add all the computers in which you want to install the agent software. Then, create a GPO and apply it to this group. Follow the below steps in the same sequence for a successful installation Step 1: Create a GPO and name it as below: a. For Windows Server 2003 i. Open Active Directory users and computers console ii. Right- click the parent container of all the computer objects (which are added to a group as said in the Best Practice section above.) and select Properties Copyright 2015 ManageEngine Page 2

4 iii. In the Properties dialog box, select Group Policy tab and then click on New to create a Group Policy Object. For Windows 2008 Server and Later 1. Open Group Policy Management console. 2. In the left pane, right click on the Group Policy Objects container and select New Copyright 2015 ManageEngine Page 3

5 3. Give a descriptive name to the GPO and then click Ok. Step 2: Configure Script Settings 1. Now, right- click the Group Policy Object that you have just created and click Edit to open the GPO Editor. Copyright 2015 ManageEngine Page 4

6 2. In the right pane of the GPO editor, double click on Computer Configuration - > Windows Settings - >Scripts (Startup/Shutdown) - > Startup. For Windows Server 2008 and later, Computer Configuration - > Policies - > Windows Settings - > Scripts (Startup/Shutdown) - > Startup 3. Right click on Startup and select Properties 1. In the Startup Properties dialog box, click Add 2. In the Add Script dialog box, do the following i. Click Browse option found corresponding to the Script Name field and select InstallEventLog.vbs script ii. In the Script Parameters field, enter the parameters as specified below and then click Ok. Copyright 2015 ManageEngine Page 5

7 Script Parameters /MSIPATH:"< share path of msi file >" /SERVERNAME:" <ELA installed Server Name> " /SERVERDBTYPE:"< DataBase of Server >" /SERVERIPADDRESS:" < Ip Address of Server > " /SERVERPORT:" <Port Occupied by server >" /SERVERPROTOCOL:" <Protocol (http/https) >" /SERVERVERSION:" <ELA VERSION>" /SERVERINSTDIR:" < ELA Installed Directory >" Example /MSIPATH:"\\admin\EventLog\lib\native\EventLogAgent.msi" /SERVERNAME:"vivek- 2122" /SERVERDBTYPE:"postgres" /SERVERIPADDRESS:" " /SERVERPORT:"8400" /SERVERPROTOCOL:"http" /SERVERVERSION:"10072" /SERVERINSTDIR:"C:\\ManageEngine\\EventLog\\" Note: In Windows 2003, the parameters of the script should be enclosed within double quotes to support the multiple parameter values. 3. Now you will be back to the Startup Properties dialog box. Click Apply first and then click on Ok to complete the procedure. Step 3: Configuring Administrative Template Settings Once you have completed the above- mentioned steps, configure the Administrative Template Settings as specified in the below steps. Administrative Template Settings Copyright 2015 ManageEngine Page 6

8 1. On the left pane of GPO Editor window, go to Computer Configuration - > Administrator Templates - > System 2. Under System, configure the below settings a. Scripts i. In the right pane of the GPO editor, double- click Run logon scripts synchronously and Enable it. Now, click Apply and then Ok. ii. Double click Maximum wait time for Group policy scripts, and Enable it. Now click on Apply and then OK. Copyright 2015 ManageEngine Page 7

9 b. Logon i. Double click on Always wait for the network at startup and logon and Enable it. Now click on Apply and then OK. Copyright 2015 ManageEngine Page 8

10 c. Group Policy i. Double click Group Policy slow link detection and Enable it. Now click on Apply and then OK. Copyright 2015 ManageEngine Page 9

11 Step 4: Applying the GPO Once the Administrative Template Settings are configured, apply the GPO to the desired computers in the network. 1. On the left pane of the GPO Editor, right- click on the GPO you are working on (GPO list is available on the top left corner of the GPO editor), and then select Properties. 2. Click the Security tab, in the properties dialog box. Note: In the Security Tab, remember to uncheck Apply Group Policy permission for Authenticated Users before proceeding further 3. Now, click on Add to open the Select Users, Computers or Groups dialog box. There, click Object Types button and make sure Groups is checked, and then click OK. Copyright 2015 ManageEngine Page 10

12 4. Enter the name of the group (that has all the computers in which EventLog Analyzer agent is to be installed) and then click Check Names. Highlight the desired group and then click OK to return to the Security tab. 5. The group will now be added to the list of Group or User Names under Security tab. 6. With the newly added group highlighted, apply the following permissions: a. Read - > Allow b. Apply Group Policy - > Allow Click Apply and then click OK Copyright 2015 ManageEngine Page 11

13 7. Reboot the computers to apply the GPO and wait till the Reset Password / Account Unlock Account link to appear on the Windows logon screen. To apply GPO directly to computers: In case you prefer to apply the GPO directly to computers instead of the group, please follow the below steps: a. Follow the steps 1 and 2 in the above section b. Click Object Types button and make sure that the computer is checked. Click OK. c. Use the Check Names button to find the required computers. Select the desired computers and then click OK to return to the Security tab. d. Set Read and Apply Group Policy permissions Allow for every computer that you just added. Note: After performing all these steps, remember to uncheck Apply Group Policy permission for Authenticated Users. e. Restart all the client machines Testing and Diagnostics To test whether the installation was successful, a. In the command prompt of your client machines, type gpresult /v b. Check whether The group policy object you configured appears under the subheading Applied Group Policy Objects InstallEventLogAgent.vbs appears under the subheading Startup scripts Diagnostics Please check the EventLogScriptlog.txt in the WINDOWS directory or Start - > Run - > Type in %windir\eventlogscriptlog.txt% Copyright 2015 ManageEngine Page 12