Monitoring Server Deployment Guide for PerformancePoint Server 2007

Monitoring Server Deployment Guide for PerformancePoint Server 2007 Microsoft Corporation Published: June 2010 Author: Microsoft Office System and Servers Team (o12itdx@microsoft.com) Abstract This book provides prescriptive information for deploying Microsoft PerformancePoint Monitoring Server. This includes planning single and distributed deployments, configuring PerformancePoint Server features, and configuring PerformancePoint security settings to mitigate threats. The audience for this book includes IT generalists, security specialists, IT operations, help desk, and deployment staff, network architects and planners and consultants. The content in this book is a copy of selected content in the Office PerformancePoint Server 2007 technical library (http://go.microsoft.com/fwlink/?linkid=105040&clcid=0x409) as of the publication date above. For the most current content, see the technical library on the Web.

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, email address, logo, person, place or event is intended or should be inferred. 2010 Microsoft Corporation. All rights reserved. Microsoft, Access, Excel, Outlook, PerformancePoint, SharePoint, SQL Server, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. ii

Contents Getting Help... vii Deployment Guide for Monitoring Server...1 Download this book...2 Monitoring Server prerequisites...3 Download this book...3 Monitoring Server hardware prerequisites...4 Download this book...5 Monitoring Server software prerequisites...6 Microsoft ProClarity Analytics Server...11 Download this book...14 Configure the Monitoring Server application pool identity...15 Choosing an account type to use with the Monitoring Server application pool identity account...15 Network Service account...15 Domain user account...15 Monitoring Server application pool identity account considerations...16 Download this book...16 Deploying Monitoring Server securely...17 Download this book...18 Enabling Secure Sockets Layer for Monitoring Server...19 Download this book...19 Kerberos authentication and delegation for Monitoring Server...20 Download this book...20 Configure Monitoring Server for Kerberos delegation...21 Configuring Windows SharePoint Services for Kerberos authentication...22 Configuring Internet Information Services...22 Configuring Kerberos delegation on Windows Server 2008 with Internet Information Services 7.0.24 Configuring Service Principal Names...25 Configuring application pool accounts...26 Configuring client computers...27 Configuring constrained delegation (recommended)...28 Download this book...29 Troubleshooting Kerberos delegation for Monitoring Server...31 III

SPN issues...31 SharePoint Products and Technologies issues...31 Internet Explorer issues...31 Download this book...32 Video demo: Configuring Kerberos delegation for Monitoring Server...33 Monitoring Server best practices...34 Monitoring Server application pool identity account...34 Configuration of external data sources...34 Minimum version for Internet Explorer...34 Memory management...34 Download this book...35 Monitoring Server log files...36 Download this book...36 Configuring SharePoint Products and Technologies for Monitoring Server...37 Download this book...38 Installing and configuring required Monitoring Server software...39 Permissions and accounts...39 Download this book...40 Installing Monitoring Server...41 Download this book...41 Monitoring Server deployment topology...43 Download this book...44 Install Monitoring Server on a single computer...45 Procedures...45 Install Monitoring Server in a distributed environment...48 Procedures...49 Install Monitoring Server by using the command line...52 Syntax...52 Examples...55 Install all features...55 Install a specific feature...55 Remove a specific feature...55 Download this book...56 Dashboard Designer deployment overview and considerations...57 Procedures...57 IV

Installing Dashboard Designer using an MSI Installer file...59 Create a new MSI Project in Visual Studio 2008...59 Building the MSI project into a new MSI file...59 Download this book...60 Troubleshooting PerformancePoint Server...61 Download this book...61 Troubleshoot PerformancePoint Monitoring Server...62 Procedures...63 Monitoring Server and component versions...64 Download this book...67 Service Pack 3 for Microsoft Office PerformancePoint Server 2007...68 Scenario 1: Update PerformancePoint Server with SP3 only...68 Scenario 2: Update SQL Server 2005 to SQL Server 2008 and update PerformancePoint Server to SP3...68 Scenario 3: Install PerformancePoint Server RTM and SQL Server 2008 in a new environment and update PerformancePoint Server to SP3...69 Download this book...69 Update SQL Server 2005 client components with Cumulative Update 9...70 Downloading and installing SQL Server 2005 CU9...70 Download this book...72 Update Monitoring Server with Service Pack 3...73 Updates for client software in PerformancePoint Server 2007 SP3...73 PerformancePoint Monitoring Server Service Pack 3 updates...73 Update PerformancePoint Monitoring Server 2007 or PerformancePoint Monitoring Server SP2 to SP3...74 Uninstall SP3...74 Download this book...74 Upgrade SQL Server 2005 to SQL Server 2008 with PerformancePoint Monitoring Server...75 Upgrade SQL Server 2005 to SQL Server 2008...75 Step 1: Update Microsoft.NET Framework to version 3.5 SP1...75 Step 2: Install Hotfix for Windows X64 (KB942288-V4)...75 Step 3: Upgrade SQL Server 2005 to SQL Server 2008...76 Download this book...77 Install PerformancePoint Monitoring Server with SQL Server 2008...78 Installing SQL Server 2005 Cumulative Update 9 on computers hosting PerformancePoint Monitoring Server...78 Download SQL Server 2005 Service Pack 3...80 V

Installing SQL Server 2008...80 Install PerformancePoint Server 2007 RTM...80 Install PerformancePoint Server 2007 SP3...80 Download this book...81 Install PerformancePoint Server 2007 SP3 on Windows Server 2008...82 Download this book...83 Technical reference for Service Pack 3 for PerformancePoint Server...84 Validation of PerformancePoint Server 2007 SP3...85 Download this book...85 Silent command-line installation of PerformancePoint Server 2007 SP3...86 Command-line mode and silent mode...86 Upgrade mode...86 New supporting parameter...86 Download this book...86 Upgrade log files for PerformancePoint Server 2007 SP3...87 Download this book...87 PerformancePoint Server in a Hyper-V virtual environment...88 Plan for using PerformancePoint Server 2007 in a Hyper-V virtual environment...89 Support statement...89 Hyper-V prerequisites...89 Architecture recommendations...89 PerformancePoint Server 2007 recommendations for Hyper-V...89 Other resources...90 Conclusion...92 Download this book...92 Windows Server 2008 Power Savings...93 Whitepaper download: Windows Server 2008 Power Savings...93 PerformancePoint Server 2007 Hyper-V recommendations guide...94 VI

Getting Help Every effort has been made to ensure the accuracy of this book. This content is also available online in the Office System TechNet Library, so if you run into problems you can check for updates at: http://technet.microsoft.com/office If you do not find your answer in our online content, you can send an e-mail message to the Microsoft Office System and Servers content team at: o12itdx@microsoft.com If your question is about Microsoft Office products, and not about the content of this book, please search the Microsoft Help and Support Center or the Microsoft Knowledge Base at: http://support.microsoft.com vii

Deployment Guide for Monitoring Server Monitoring Server consists of four server components and a system database. The following list describes each of the components. Monitoring Server (IIS component) Represents the Internet Information Services (IIS) component of Monitoring Server, and is also known as the Monitoring Server component. Installing this component installs the Monitoring Web site in IIS along with four virtual directories, each of which serves specific functions. The following list describes these components. Monitoring Server Web Service Facilitates the communication between the Dashboard Designer client application and the Monitoring System Database. Dashboard Designer Preview site Provides the capability to deploy and preview dashboards as ASP.NET Web pages. Dashboard Designer installation site The central download location for Dashboard Designer. Monitoring Central Provides the user interface for end users to download and use Dashboard Designer on demand. After Monitoring Server setup is complete, users can connect to Monitoring Central by using the following link: http://<monitoring_server_name>:<port_number>/central. In a Secure Sockets Layer (SSL) environment, use https://<monitoring_server_name>:<port_number>/central. PerformancePoint Dashboard Viewer for SharePoint Services A Web Part that Monitoring Server provides for Windows SharePoint Services technology that enables the deployment and viewing of dashboards on a particular SharePoint site. This component can only be installed on a computer that has the following products and technologies installed: Windows SharePoint Services 3.0 or Microsoft Office SharePoint Server 2007 AJAX ASP.NET 1.0 Note: The Dashboard Viewer for SharePoint Services contains all the rendering capabilities. The Dashboard Viewer for SharePoint Services Web Part reads from the Monitoring System Database and renders the dashboard. The Dashboard Viewer for SharePoint Services does not need to communicate with the Monitoring Server IIS component. Publishing a dashboard to the database and deploying the dashboard to a SharePoint site give the Dashboard Viewer for SharePoint Services all it needs to display the dashboard. PerformancePoint Dashboard Viewer for Reporting Services An interface that Monitoring Server provides for Microsoft SQL Server 2005 Reporting Services that enables the viewing of scorecards in Report Definition Language (RDL) format. This component can only be installed on a computer that has Reporting Services installed. PerformancePoint Monitoring Plug-in for Report Designer Installs a data processing extension (DPE) for Reporting Services Report Designer in Microsoft Visual Studio 2005. This DPE enables the customization of Monitoring Scorecards that are saved as RDL files. This component 1

can only be installed on a computer that has Visual Studio 2005 with the Report Designer extension enabled. PerformancePoint Monitoring System database Stores the metadata information for Monitoring Server. Note: Either Office SharePoint Server 2007 or Windows SharePoint Services must be installed in order to successfully install and use Monitoring Server. The terms Windows SharePoint Services and SharePoint Services are used collectively in PerformancePoint Server documentation to refer to Office SharePoint Server 2007 and Windows SharePoint Services 3.0. Caution ProClarity Analytics Server (PAS) runs only in 32bit mode. It can be installed and run on Windows Server 2003 64bit operating system but it alters the way some components run to accommodate its 32bit coding. PAS does not support Windows Server 2003 64bit operating system directly. PAS can be installed to Windows Server 2003 64bit, but it will configure Internet Information Services (IIS) to run in 32bit mode. This means that any other 64bit applications that require IIS to run in 64bit mode on a 64bit server will conflict with PAS and will cause errors in PAS and or the other 64bit applications. PerformancePoint Monitoring server can be installed to either Windows Server 2003 32bit or 64bit and will support each version natively. When installing Monitoring server to Windows Server 2003 64bit it requires that IIS be set to 64bit mode. This means that PerformancePoint Monitoring server and ProClarity Analytics Server cannot run on the same Windows Server 2003 64bit server. In some deployments PAS and Monitoring server are deployed together to aid in reporting for both PerformancePoint Server and ProClarity. In cases where only one server license is available to run both PAS and Monitoring servers it is recommended that Windows Server 2003 32bit OS be used. Note that you can install and run PerformancePoint Monitoring server and ProClarity Analytics Server on the same computer if you use Windows Server 2008. This deployment will work only if you use Windows Server 2008, IIS 7.0, PerformancePoint Server 2007 Service Pack 1, and ProClarity Analytics Server 6.3 Service Pack 2. Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 2

Monitoring Server prerequisites Before deploying Monitoring Server, ensure that your topology meets all hardware and software requirements. For information, see the following articles: Monitoring Server hardware prerequisites Monitoring Server software prerequisites Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 3

Monitoring Server hardware prerequisites Following are the minimum and recommended hardware requirements for PerformancePoint Monitoring Server. Clients Component PerformancePoint Dashboard Designer PerformancePoint Add-In for Report Designer PerformancePoint Dashboard Client Processor type Minimum: one Pentium 3 CPU Recommended: one Dual Core 32-bit CPU (x86) Minimum: one Pentium 3 CPU Recommended: one Dual Core 32-bit CPU (x86) n/a Processor speed Minimum: 1 gigahertz (GHz) Recommended: 2.5 GHz Minimum: 1 GHz Recommended: 2.5 GHz n/a Available hard disk space Minimum: 512 MB Recommended: 2 gigabyte (GB) Minimum: 512 MB Recommended: 2 GB n/a RAM Minimum: 1.5 GB Minimum: 1.5 GB n/a Recommended: 2 GB Recommended: 2 GB Network interface 100 megabits per second (Mbps) 100 Mbps 100 Mbps Server and Services Component PerformancePoint Monitoring Server Configuration Manager PerformancePoint Monitoring Server PerformancePoint Dashboard Server Web Part for Windows SharePoint Services PerformancePoint Scorecard Viewer for Reporting Services PerformancePoint Monitoring System Database Processor type Minimum: one Pentium 4 Minimum: one Pentium 4 Minimum: one Pentium 4 Minimum: one Pentium 4 Minimum: one Pentium 4 Recommended: one Pentium 4 Recommended: two dual-core 64- bit CPUs Recommended: two dual-core 64- bit CPUs Recommended: two dual-core 64- bit CPUs Recommended: two dual-core 64- bit CPUs Processor speed Minimum: 2.5 GHz Minimum: 2.5 GHz Minimum: 2.5 GHz Minimum: 2.5 GHz Minimum: 2.5 GHz 4

Component PerformancePoint Monitoring Server Configuration Manager PerformancePoint Monitoring Server PerformancePoint Dashboard Server Web Part for Windows SharePoint Services PerformancePoint Scorecard Viewer for Reporting Services PerformancePoint Monitoring System Database Recommended: 2.8 GHz Recommended: 2.8 GHz Recommended: 2.8 GHz Recommended: 2.8 GHz Recommended: 2.8 GHz Available hard disk space Minimum: 1 GB Recommended: 5 GB + 7200rpm hard disk drive Minimum: 1 GB Recommended: 5 GB + 7200rpm hard disk drive Minimum: 1 GB Recommended: 5 GB + 7200rpm hard disk drive Minimum: 1 GB Recommended: 5 GB + 7200rpm hard disk drive Minimum: 1 GB Recommended: 5 GB + 7200rpm hard disk drive RAM Minimum: 2 GB Minimum: 2 GB Minimum: 2 GB Minimum: 2 GB Minimum: 2 GB Recommended: 4 GB Recommended: 4 GB Recommended: 4 GB Recommended: 4 GB Recommended: 4 GB Network interface 100 Mbps 100 Mbps 100 Mbps 100 Mbps 100 Mbps Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 5

Monitoring Server software prerequisites Either Office SharePoint Server 2007 or Windows SharePoint Services must be installed in order to successfully install and use Monitoring Server. Monitoring Server supports Excel Services as a report type and data source, but is supported only with Office SharePoint Server 2007 installed instead of Windows SharePoint Services 3.0. To review the difference between these SharePoint Products and Technologies, see Which SharePoint technology is right for you (http://go.microsoft.com/fwlink/?linkid=131553&clcid=0x409). The terms "Windows SharePoint Services" and "SharePoint Services" are used collectively in PerformancePoint Server documentation to refer to Office SharePoint Server 2007 and Windows SharePoint Services 3.0. Important: Office Web Components are not supported on PerformancePoint Server 64-bit deployments. These components are 32-bit only and are not compatible with the 64-bit implementation of PerformancePoint Server even though these components may run on a 64-bit computer when 32-bit Internet Explorer hosts the Office Web Components. This is a known issue and is not supported. Important PerformancePoint Monitoring Server supports 32-bit and 64-bit operating system environments. The following are the supported Monitoring Server and operating system combinations. All other combinations are not recommended and are unsupported. Tip Following are essential questions and answers about using Strategy Maps and reports with PerformancePoint Monitoring Server and clients. Clients Product Supported operating Additional Supported browsers system requirements PerformancePoint Dashboard Designer Windows Server 2003 (SP2 and R2), 32-bit and 64-bit Windows Server 2008, 32-bit and 64- bit Windows XP (excluding XPe), SP2 Microsoft Vista (Business, Business N, Enterprise) 32-bit and 64-bit ADOMD.NET 9.0 MSXML 6.0 + updates SQL Server 2005 SP2 Analysis Services server OLE DB 9.0 Provider + Cumulative Update 9.00.3186 (kb939537) SQL Server 2000 Analysis Services server Service Pack 4 - Build 2174 for Client Systems (to use SQL Not applicable 6

Product Supported operating system Additional requirements Supported browsers Windows 7, 32-bit and 64-bit Server 2000 Analysis Services server as a data source) Microsoft.NET Framework 2.0 Report Viewer for SQL Server 2005, 2005 SP1, or SQL Server 2008 depending on your configuration Microsoft Office Visio Standard 2007 or Visio 2010 for creating Strategy Map reports PerformancePoint Add-in for Report Designer Windows Server 2003 (SP2 and R2), 32-bit and 64-bit Windows Server 2008, 32-bit and 64- bit Microsoft.NET Framework 2.0 Microsoft Visual Studio.NET 2005 with SQL Server 2005 SP2 Report Designer Not applicable Windows XP (excluding XPe), SP2 Microsoft Vista (Business, Business N, Enterprise) 32-bit and 64-bit Windows 7, 32-bit and 64-bit The Report Designer component can be found on the SQL Server 2005 CD by installing Business Intelligence Development Studio (BIDS) PerformancePoint Dashboard Client Windows Server 2003 (SP2 and R2), 32-bit and 64-bit Windows Server 2008, 32-bit and 64- bit Windows XP (excluding XPe), SP2 Microsoft Vista Viso Viewer 2007 or Visio Viewer 2010 for viewing Strategy Map reports Microsoft Internet Explorer 6, 7, and 8 Note If you use Internet Explorer 8 with PerformancePoint Server 2007 Service Pack 3, then you must set a security option in your 7

Product Supported operating system Additional requirements Supported browsers (Business, Business N, Enterprise) 32-bit and 64-bit Windows 7, 32-bit and 64-bit browser. You must set the Allow script-initiated windows without size or position constraints option as Enabled. See To enable security options in Internet Explorer 8 for more information. Server and services Product Supported operating systems Additional requirements Supported browsers PerformancePoint Monitoring Server Configuration Manager Windows Server 2008, 32-bit and 64-bit Windows Server 2003 (SP2 and R2), 32-bit and 64- bit Microsoft.NET Framework 2.0 Microsoft ASP.NET 2.0 SQL Native Client 9.0 SP2 Not applicable PerformancePoint Monitoring Server Windows Server 2008, 32-bit and 64-bit Windows Server 2003 (SP2 and R2), 32-bit and 64- bit Internet Information Services (IIS) 5.1 (XP) 6.0, or IIS 7.0 with IIS Metabase and IIS 6 configuration compatibility, and IIS 6.0 Isolation Mode Install Microsoft.NET Framework 2.0 first, and then Microsoft.NET Framework 3.5 Microsoft ASP.NET 2.0 Microsoft ASP.NET AJAX 1.0 SQL Server 2005 Analysis Management Objects 9.0 SP2 Microsoft Internet Explorer 6, 7, and 8 Note If you use Internet Explorer 8 with PerformancePoint Server 2007 Service Pack 3 then you must set a security option in your browser. You must set the Allow script-initiated windows without size or position constraints option as Enabled. 8

Product Supported operating systems Additional requirements Supported browsers SQL Server 2005 Native Client 9.0 SP2 SQL ADOMD.NET 9.0 MSXML6.msi + updates SQL Server 2005 SP2 Analysis Services OLE DB 9.0 Provider + Cumulative Update 9.00.3186 (kb939537) See To enable security options in Internet Explorer 8 for more information. SQL Server 2000 Analysis Services Service Pack 4 Build 2174 for Client Systems (to use SQL Server 2000 Analysis Services as a data source) Microsoft Office Visio Standard 2007 or Office Visio 2010 required for rendering Strategy Maps PerformancePoint Dashboard Server Web Part for Windows SharePoint Services Windows Server 2008, 32-bit and 64-bit Windows Server 2003 (SP2 and R2), 32-bit and 64- bit Internet Information Services (IIS) 6.0, or IIS 7.0 with IIS Metabase and IIS 6 configuration compatibility, IIS 6.0 Isolation Mode Microsoft Office SharePoint Server 2007 or Windows SharePoint Services 3.0 (SP1 for Windows Server 2008) Microsoft.NET Framework 2.0 Microsoft ASP.NET 2.0 Microsoft ASP.NET AJAX 1.0 SQL Server 2005 Analysis Management Objects 9.0 SP2 SQL Server 2005 Native Client 9.0 SP2 Microsoft Internet Explorer 6, 7, and 8 Note If you use Internet Explorer 8 with PerformancePoint Server 2007 Service Pack 3 then you must set a security option in your browser. You must set the Allow script-initiated windows without size or position constraints option as Enabled. See To enable security options in Internet Explorer 8 for more 9

Product Supported operating systems Additional requirements Supported browsers SQL ADOMD.NET 9.0 information. MSXML6.msi + updates SQL Server 2005 SP2 Analysis Services OLE DB 9.0 Provider + Cumulative Update 9.00.3186 (kb939537) SQL Server 2000 Analysis Services Service Pack 4 Build 2174 for Client Systems (to use SQL Server 2000 Analysis Services as a data source) PerformancePoint Scorecard Viewer for Reporting Services Windows Server 2008, 32-bit and 64-bit Microsoft Office PerformancePoint Monitoring Server 2007 Not applicable Windows Server 2003 (SP2 and R2), 32-bit and 64- bit Microsoft SQL Server 2005 SP2 Reporting Services Server PerformancePoint Monitoring System database Windows Server 2008, 32-bit and 64-bit Windows Server 2003 (SP2 and R2), 32-bit and 64- bit Microsoft SQL Server 2005 SP2 Standard Edition + Cumulative Update 9.00.3186 (kb939537) Not applicable To enable security options in Internet Explorer 8 1. Click the Tools button, and then click Internet Options. 2. Click the Security tab. 3. Click the Internet icon. 4. In the Security level for this zone section, click Custom level. 5. Find Allow script-initiated windows without size or position constraints and click Enabled. 6. When you are finished making changes to the security settings, click OK. 10

Microsoft ProClarity Analytics Server The hardware and software prerequisites for ProClarity Analytics Server 6.3 Service Pack 3 is provided with the PerformancePoint Monitoring Server prerequisites for ease of use for customers. The Microsoft ProClarity Analytics Server 6.3 Service Pack 3 (SP3) is a cumulative patch release that includes all fixes made to ProClarity Analytics Server 6.3 and ProClarity Professional 6.3 since the General Availability (GA) release of these products. Note: This service pack is not a full product build. Before you can install this service pack, you must install the full products, ProClarity Analytics Server 6.3 and ProClarity Desktop Professional (Build 6.3.129.200). Similarly, before installing a localized version of this service pack, you must install the corresponding, full-version ProClarity Analytics Server 6.3 language pack. For more information, see the ProClarity Analytics Server 6.3 SP3 (http://office.microsoft.com/search/redir.aspx?assetid=am103875331033&ctt=5&origin=ha1 02422371033) Readme file. Product Hardware Requirements Supported Operating Systems Software Requirements Supported browser ProClarity Analytics Server 6.3, including ProClarity Analytics Server 6.3 languages packs Minimum: Pentiumclass processor 512 MB RAMRecommended: Server-class processor 4 GB RAMHard-drive requirements: 60 MB free space on hard drive (C:)Minimum color depth: 32-bit Microsoft Windows Server 2003 with Service Pack 2 (SP2), 32-bit or 32-bit on x64microsoft Windows Server 2008 with Service Pack 2 (SP2), 32-bit or 32-bit on x64microsoft Windows Server 2008 R2, 32-bit or 32-bit on x64 Microsoft Internet Information Services (IIS) 6.0 or IIS 7.0Microsoft SQL Server 2005 Analysis Services with Service Pack 3 (SP3), Standard or Enterprise OR Microsoft SQL Server 2008, Standard or EnterpriseInstalled with product: Microsoft.NET Framework 2.0 redistributable Internet Explorer (IE) 7.0 or IE 8.0 MDAC 2.8, with Service Pack 1 (SP1) PivotTable Service for SQL Server 2005 (PTS 9.0) MSXML 11

Product Hardware Requirements Supported Operating Systems Software Requirements 6.0Windows Installer 3.1 v2 Supported browser Important ProClarity Analytics Server 6.3 notes For more details and step-by-step instructions, see ProClarity Analytics Server 6.3 SP3 Readme (http://office.microsoft.com/search/redir.aspx?assetid=am103875331033&ctt=5&origin=ha1 02422371033A) Product Hardware Supported Operating Software Requirements Supported Requirements Systems browser Analytics Server 6.3 database and ProClarity Administration Tool 6.3 (if installed separately, not with ProClarity Analytics Server) Pentium-class processor 128 MB RAM Microsoft Windows XP with Service Pack 3 (SP3) (excluding Windows XPe) Microsoft Windows Vista (Business, Business N, or Enterprise) with Service Pack 2 (SP2) 32-bit, 32-bit on x64 (excluding Vista Starter) Windows 7 Professional, Enterprise or Ultimate Microsoft SQL Server 2005 Analysis Services with SP3, Standard or EnterpriseORMicrosoft SQL Server 2008, Standard or Enterprise NA ProClarity Web Standard 6.3 Pentium-class processor 128 MB RAM Windows XP SP3 (excluding XPe) Windows Vista (Business, Business N, or Enterprise) SP2 32-bit, 32-bit on x64 (excluding Vista Starter) Windows 7 Professional, Enterprise or Ultimate Required for ProClarity Web Standard Export to Excel feature: Microsoft Office XP Microsoft Office 2003 Microsoft Office 2007 IE 7.0 or IE 8.0 ProClarity Professional 6.3 Pentium-class processor 512 Windows XP SP3 Windows Server 2003 For ProClarity Professional Export to 12

Product Hardware Requirements Supported Operating Systems Software Requirements Supported browser MB RAM SP2 Windows Vista (Business, Business N, or Enterprise) SP2 32-bit, 32-bit on x64 (excluding Vista Starter) Windows 7 Professional, Enterprise, Ultimate Note: If you are installing ProClarity Professional 6.3 on Windows Vista, you must first install MSXML 6.0 and Windows Installer 3.1 v2. Outlook, Export To Excel, and Export to PowerPoint features: Microsoft Office XP Microsoft Office 2003 Microsoft Office 2007 Installed with product: MDAC 2.8, SP1 PivotTable Service for SQL Server 2000 (PTS 8.0) PivotTable Service for SQL Server 2005 (PTS 9.0) MSXML6.0 Windows Installer 3.1 v2 ProClarity Dashboard Server 6.3 See ProClarity Analytics Server 6.3 requirements, listed earlier. The ProClarity Analytics Server 6.3 SP3 release does not include fixes for ProClarity Dashboard Server 6.3. For the latest ProClarity Dashboard Server 6.3 fixes, install ProClarity Dashboard Server 6.3 SP2. ProClarity SharePoint Viewer 6.3 ProClarity SharePoint Viewer 6.3 supports Microsoft Office SharePoint Server 2007 SP1. See: The 2007 Microsoft Office Server Service Pack 1 (SP1) (http://www.microsoft.com/downloads/details.aspx?familyid=ad59175c-ad6a- 4027-8C2F-DB25322F791B&displaylang=en) For additional information, see the Microsoft Support article 934074: Frequently asked questions about interoperability between ProClarity products and Microsoft SharePoint products (http://support.microsoft.com/kb/934074) Service Pack 3 for ProClarity Analytics Server 6.3 does not include fixes for ProClarity SharePoint Viewer 6.3. The latest version of SharePoint Viewer 6.3 is available on the Microsoft Download Center (http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=a6ee7f46-d625-4a49- b717-cefc11f1232a). 13

Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 14

Configure the Monitoring Server application pool identity This topic provides details about configuring the application pool identity for Monitoring Server. During Monitoring Server setup, when the Monitoring Server Internet Information Services (IIS) component is installed, you specify an identity account for the Monitoring Server application pool. Note: Planning Server also requires an application pool identity account. However, because Planning Server runs in a separate application pool, you can specify a separate account. The interaction points for the application pool identity account are the following: On computers on which the Monitoring Server IIS component is installed, permissions for the Monitoring Server application pool identity account are automatically configured during installation. The following IIS application pools are created during installation and run under the Monitoring Server application pool identity: PPSMonitoringWebService PPSMonitoringPreview On servers that run Microsoft SQL Server 2005 Analysis Services, the Monitoring Server application pool identity account must be granted read access to the catalogs and cubes that are to be monitored. Read access must be provided to create a data source in Dashboard Designer. Choosing an account type to use with the Monitoring Server application pool identity account You can configure the PerformancePoint Monitoring Server application pool identity account to use either of two account types: the Network Service account and a domain user account. The type of account you use should fit the needs of your domain and security model. Each account type offers separate features that will enable you to secure and maintain your Monitoring Server deployment. Network Service account The Network Service account is a built-in account that has fewer access rights on the system than the LocalSystem account, but is still able to interact throughout the network by using the computer account credentials. A service that runs as the Network Service account accesses network resources by using the credentials of the computer account in the same manner as a LocalSystem service does. The actual name of the account is NT AUTHORITY\NetworkService, and it does not have a password that an administrator needs to manage. Domain user account Domain user accounts include accounts that you create in the domain for example, by using the Active Directory Users and Computers management console. Domain user accounts have limited 15

access rights in the domain unless you specifically grant them access or add them to groups that already possess those access rights. Monitoring Server application pool identity account considerations The identity account that you use for the Monitoring Server application pool must be a member of the BpmDeveloper and BpmViewer group on each computer that runs Microsoft SQL Server 2005 to which Monitoring Server connects. In addition, the application pool identity account cannot be a group account. It must be a unique account that has been granted local and domain access. The Monitoring Server application pool identity account must have the following user rights: Access computer from the network Log on as a batch job Log on as a service Monitoring Server Configuration Manager adds the application pool identity account to: The IIS_WPG group. A local security policy on the computer. SQL Server security logins Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 16

Deploying Monitoring Server securely We recommend that you use Secure Sockets Layer (SSL) security to help to secure your PerformancePoint Monitoring Server deployment. Monitoring Server uses the following security methods: Internet Information Services (IIS) security File and folder security SSL security Each of the security methods in the list can be configured to allow only the required level of access for both client computers and server computers. Caution Dashboard Designer uses a preview folder located here: C:\Program Files\Microsoft Office PerformancePoint Server\3.0\Monitoring\PPSMonitoring_1\Preview. All users who need to publish to the preview site in Dashboard Designer require both write and create folder level permissions on the Preview folder. When installing Dashboard Designer with SSL enabled, you will see the name of the computer that Dashboard Designer is being installed to in the installation address box. This might need to be changed if the SSL certificate address is that of a different computer. This should be configured by using the following syntax in the installation address text box: https://<name_on_certificate>:<port>/central. On the Web server computer the following access rights are required: Administrators group: The person installing PerformancePoint Monitoring Server must be a member of the Administrators group on the Web server where Monitoring Server is being installed. The administrator user who installs Monitoring Server automatically becomes a Global Administrator of PerformancePoint Server. Note: The PerformancePoint Server installer must be a member of the Administrators group or have the requisite permissions granted explicitly by an Administrator of the server computer. Without these permissions you cannot install PerformancePoint Server on a Windows server computer. PerformancePoint Server setup and configuration interacts with the registry, files within the system drive, the Program Files area, as well as with supported versions and editions of SQL Server. A regular user cannot make changes to any of these areas. The Administrator permission can be decreased or revoked from the PerformancePoint Server installer when the installation is complete. Administrator rights for SQL Server: The person installing the Monitoring Server must have local or domain Administrator rights for the computer where SQL Server and the PerformancePoint monitoring database are installed.. 17

Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 18

Enabling Secure Sockets Layer for Monitoring Server We recommend that you use Secure Sockets Layer (SSL) security for HTTP communication with Internet Information Services (IIS). Each site hosted in IIS must have an SSL certificate installed to enable this security. For more information about SSL and how to set up a certificate server or use an existing certificate server with Microsoft Office PerformancePoint Server 2007, see Configuring SSL on a Web Server or Web Site (IIS 6.0) (http://go.microsoft.com/fwlink/?linkid=100210&clcid=0x409). Note: To help prevent denial of service attacks on PerformancePoint Server, use the maxrequestlength attribute in the <httpruntime> element to specify a maximum file upload size that can help to prevent the servers from being maliciously overwhelmed. Additional ways to use IIS to avoid a denial of service attack include not changing the default value of 120 seconds for the time-out setting, and specifying a value of 10 for the MaxSesionPerUser setting. Microsoft SQL Server database software also has time-out settings that you can use. For more information, see your IIS documentation and SQL Server Books Online. Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 19

Kerberos authentication and delegation for Monitoring Server The articles in this section outline the changes that are required to get PerformancePoint Monitoring Server working using delegation. Delegation enables a Web application or service to use the caller s identity to access remote network resources. Delegation operates based on Integrated Windows authentication and the Kerberos protocol. Scenarios that require the use of delegation are commonly referred to as double-hop scenarios. In the case of PerformancePoint Monitoring Server, this would include scenarios where Internet Information Services is located on a different computer from the target data source. Configuring delegation for PerformancePoint Monitoring Server may require changes to the application pool identity user accounts, the service principal names (SPNs) registered in the Active Directory directory service, and the client and middle-tier servers. Based on the environment, different configuration options are explained, including constrained delegation. Before you deploy Monitoring Server, you must ensure that your environment meets the following prerequisites: All users must be part of the same Active Directory domain. Active Directory must be configured in at a Windows 2000 Native functional level or higher. For more information about domain functional levels, see Active Directory Functional Levels (http://go.microsoft.com/fwlink/?linkid=99679). Note: If you choose to deploy constrained delegation, Active Directory must be configured at a Windows Server 2003 functional level. Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). See Also Configure Monitoring Server for Kerberos delegation Troubleshooting Kerberos delegation 20

Configure Monitoring Server for Kerberos delegation To help implement a more secure deployment, we recommend that non-performancepoint Monitoring Server services not share the same set of credentials, nor have access to the resources that the Monitoring Server Configuration Manager sets up for example, the application database. Note: Where Windows SharePoint Services 3.0 is mentioned in this article, the same information and procedures apply to Microsoft Office SharePoint Server 2007. To configure Kerberos delegation for Monitoring Server, you will need to perform the following basic steps: Configure Windows SharePoint Services for Kerberos authentication Any Windows SharePoint Services Web applications that host a Web site where you publish PerformancePoint Monitoring Server data must be configured for Kerberos authentication. Configure Internet Information Services For each Web site associated with PerformancePoint Monitoring Server, including Windows SharePoint Services Web sites, you must modify the Web.config file and make sure the Web site is configured to work with Kerberos. Configure Kerberos delegation on Windows Server 2008 with Internet Information Services 7.0 You must follow specific steps to configure Kerberos delegation when you install the Monitoring server on Windows Server 2008 and use IIS 7.0. Configure Service Principal Names (SPNs) Both the service accounts for Web sites associated with PerformancePoint Monitoring Server and the service accounts for data sources containing your PerformancePoint Monitoring Server data require SPNs. Configure application pool accounts You must update the configuration for the domain accounts used to run the application pools associated with PerformancePoint Monitoring Server and Windows SharePoint Services Web sites to be trusted for delegation. Configure client computers On each client computer that will access PerformancePoint Monitoring Server data, confirm that Internet Explorer is configured to allow Integrated Windows authentication, and add the needed sites to the Trusted Sites list. Optional - Configure constrained delegation For best security, you can restrict which services are trusted for delegation. The following sections will walk you through each of these steps in detail. Important: Once Kerberos configuration is completed, remember to grant the needed user permissions for your data sources. Note: While you can use standard service accounts such as Network Service to run the application pools for your Internet Information Services (IIS) Web sites, this is not a secure configuration and should only be used in test or pre-production environments. The procedures in the following sections assume that you are using domain accounts to run the application pools. 21

The following table lists the permissions you need for the procedures described in this article. Task SharePoint Products and Technologies configuration Service Principal Name configuration Internet Information Services configuration Permission Farm Administrator Domain Administrator Local Administrator Configuring Windows SharePoint Services for Kerberos authentication In order for Kerberos delegation to function correctly, you must configure the Windows SharePoint Services Web application that hosts the Web site associated with PerformancePoint Monitoring Server for Kerberos delegation. Perform the following procedure for each Windows SharePoint Services Web application hosting a site where you publish PerformancePoint Server data. Configure Windows SharePoint Services for Kerberos authentication 1. Open the SharePoint Central Administration Web site. 2. On the Application Management tab, under Application Security, click Authentication Providers. 3. Select the Web application associated with the PerformancePoint Monitoring ServerWindows SharePoint Services site from the Web Application menu. 4. Under Zone, click Default. 5. On the Edit Authentication page, in the IIS Authentication Settings section, select the Integrated Windows authentication check box, and then select the Negotiate (Kerberos) option. 6. Click OK on the information dialog box. Note: The additional configuration referenced in the information dialog box will occur when you create SPNs for the service account in a later procedure. 7. Click Save. For more information about configuring Kerberos for Office SharePoint Server 2007, see Configure Kerberos authentication (Office SharePoint Server) (http://technet.microsoft.com/library/f136c3bd-14e6-4f3f-b7ef-36581e515c6f.aspx). Configuring Internet Information Services During PerformancePoint Monitoring Server configuration, the NT Authentication Provider property value is changed from the default value of Negotiate,NTLM to NTLM. This value must be reset to the default, otherwise Kerberos authentication will fail. 22

Both the Web site used by PerformancePoint Monitoring Server (PPSMonitoring) and the Windows SharePoint Services Web site you configured to work with PerformancePoint Monitoring Server must have an NT Authentication Provider property value of Negotiate,NTLM. You can check the current value by using the following procedure. Check the NT Authentication Provider property value 1. Click Start, click Administrative Tools, and then click Internet Information Services (IIS) Manager. 2. Expand the local computer node, and then click Web Sites. Note the number listed in the Identifier column in the right pane for the Web site that you want to check. Note: For a computer running PerformancePoint Monitoring Server, this will be the PPSMonitoring Web site. For a computer running Windows SharePoint Services, this will be the Windows SharePoint Services site that you created to use with PerformancePoint Monitoring Server. PerformancePoint Monitoring Server and Windows SharePoint Services may or may not be installed on the same computer depending on your configuration. 3. Open a Command Prompt window and change to the following directory: %systemdrive%\inetpub\adminscripts 4. Type the following command, where SiteNumber is the site identifier number you noted in step 2: cscript adsutil.vbs GET w3svc/sitenumber/root/ntauthenticationproviders If the value returned from the procedure above is (STRING) "Negotiate,NTLM", then the Web site is properly configured. If the value returned is (STRING) "NTLM", then you must reconfigure the NT Authentication Provider property. Use the following procedure to set the NT Authentication Provider property value to Negotiate,NTLM. Configure the NT Authentication Provider property value 1. Open IIS Manager and determine the Identity number of the site that you want to change as described in the procedure "Check the NT Authentication Provider property value," above. 2. Open a Command Prompt window and navigate to the following directory: %systemdrive%\inetpub\adminscripts 3. Type the following command, where SiteNumber is the site identifier number you noted in step 1: cscript adsutil.vbs SET w3svc/sitenumber/root/ntauthenticationproviders "Negotiate,NTLM" Important: Make sure that there is no space character in Negotiate,NTLM. In order to force the Web application to delegate the current user s identity, it is necessary to modify the Web.config file for the WebService, Preview, and Windows SharePoint Services Web sites. In most applications, the Web.config setting of <Identity Impersonate=true> forces the Web application to 23

delegate the user s identity. PerformancePoint Monitoring Server behaves differently in that the application explicitly forces a revert to the process user when making external calls unless the setting Bpm.ServerConnectionPerUser property has been enabled. Perform the following procedure for each of the PerformancePoint Monitoring Server Web sites (WebService and Preview) and the Windows SharePoint Services site. Configure the Web.config file 1. Click Start, click Administrative Tools, and then click Internet Information Services (IIS) Manager. 2. Expand the local computer node. 3. Right-click the site, and then click Explore Note: The Preview and WebService sites for PerformancePoint Monitoring Server are located under the PPSMonitoring site. 4. In the right pane, right click the Web.config file, and then click Open. 5. Search for the Bpm.ServerConnectionPerUser property in the document. 6. Change the value to true. 7. Save the changes to the Web.config file. 8. Restart IIS. For more information about configuring IIS to work with Kerberos, see How to troubleshoot Kerberosrelated issues in IIS (http://support.microsoft.com/kb/326985) in the Microsoft Knowledge Base. Configuring Kerberos delegation on Windows Server 2008 with Internet Information Services 7.0 If you are using Windows Server 2008 with IIS 7.0, you must configure Kernel Mode Authentication to use the application pool credentials or disable Kernel Mode Authentication. There are two ways of configuring Kernel Mode Authentication to use the application pool credentials. Note: We recommend that you disable Kernel Mode Authentication in Office SharePoint Server 2007 to support a variety of different Internet browsers. Command-line method 1. Open a Command Prompt window and navigate to the following directory: %windir%\system32\inetsrv\ 2. Type and execute the following command: appcmd set config "SharePoint - 80" /section:windowsauthentication /useapppoolcredentials:true /commit:machine/webroot/apphost Manual method 1. Open the applicationhost.config file, usually located in: %systemroot%\system32\inetsrv\config\ 2. Locate the SharePoint location - <location path="sharepoint - 80"> 3. Locate the code entry - <windowsauthentication enabled="true"> and replace it with the following:<windowsauthentication enabled="true" useapppoolcredentials="true"> 24

4. Save your changes and then refresh the page. Note: In some situations, setting useapppoolcredentials to True may cause issues. See this Microsoft Knowledge Base article (http://go.microsoft.com/fwlink/?linkid=152330&clcid=0x409) for details. Follow the steps listed in the section titled Configuring Internet Information Services to complete the PerformancePoint Monitoring Server configuration. There are no additional configuration steps for Windows Server 2008 and Internet Information Services 7.0. Disable Kernel Mode Authentication 1. Open IIS Manager and navigate to the level you want to manage. 2. On the Authentication page, select Windows Authentication. 3. In the Actions pane, select Advanced Settings. The Advanced Settings dialog box appears. 4. Clear the check box to disable Kernel Mode Authentication. Configuring Service Principal Names Service principal names (SPNs) are associated with the security principal (user or groups) in whose security context a service executes. SPNs are used to support mutual authentication between a client application and a service. An SPN is assembled from information that a client knows about a service. Or, it can obtain information from a trusted third party, such as the Active Directory directory service. A service principal name is associated with an account, and an account can have many service principal names. When a client wants to connect to a service, it locates an instance of the service, composes an SPN for that instance, connects to the service, and presents the SPN for the service to authenticate. Each domain account used to run an application pool must have an SPN associated with it. Perform the following procedure for each application pool identity. Important We highly recommend that the PPSMonitoringPreview application pool and the PPSMonitoringWebService application pool run under the same domain account. If Windows SharePoint Services is running on the same server, then the Windows SharePoint Services application pool should also use the same account. If you use different accounts, then you must specify a port number when you create the SPN. Additionally, make sure the root site is configured to use the same application pool identity as the subsites: PPSMonitoringPreview and PPSMonitoringWebService. Configure an SPN for PerformancePoint Web services 1. On the domain controller, install the Manipulate Service Principal Names for Accounts tool (http://go.microsoft.com/fwlink/?linkid=125730). 2. Open a Command Prompt window. 3. For each application pool domain account, run the following commands: setspn -A HTTP/<ServerName>.<Fully qualified domain name> <Account> 25

setspn -A HTTP/<ServerName> <Account> where ServerName is the name of the computer where the Web site is hosted and Account is the domain account running the application pool. Data sources must also have SPNs associated with them in order for Kerberos delegation to work. Note: Though you can run application pools using the Network Service account rather than a domain account, this is not considered secure and is not recommended. Configure Monitoring Server data sources by setting SPNs for the services 1. Log on to the domain controller. 2. Download the Manipulate Service Principal Names for Accounts (Setspn.exe) tool (http://go.microsoft.com/fwlink/?linkid=82039). 3. Add an SPN for each of the associated services. For example: For Microsoft SQL Server 2005 Analysis Services running under a domain account, run the following commands: setspn -A MSOLAPSvc.3/<Server Name>.<Fully qualified domain name> <domain\username> setspn -A MSOLAPSvc.3/<Server Name> <domain\username> For Microsoft SQL Server 2000 Analysis Services running under a domain account, run the following commands: setspn -A MSOLAPSvc/<Server Name>.<Fully qualified domain name> <domain\username> setspn -A MSOLAPSvc/<Server Name> <domain\username> Note: Though you can run the Analysis Services service using the Network Service account rather than a domain account, this is not considered secure and is not recommended. For more information about setting SPNs, see the following articles: Setspn Overview (http://go.microsoft.com/fwlink/?linkid=125730) (in the TechNet Library) Registration of Service Principal Name (http://go.microsoft.com/fwlink/?linkid=144656) (in the TechNet Library) Configuring application pool accounts Each domain account used to run an application pool associated with a user accessible PerformancePoint Monitoring Server Web site must be trusted for delegation. In a typical PerformancePoint Monitoring Server deployment, these are: The PPSMonitoringPreview application pool 26

The PPSMonitoringWebService application pool The Windows SharePoint Services application pool for the site associated with PerformancePoint Monitoring Server If you are unsure which account is used to run each application pool, use the following procedure to find the application pool account. Determine the application pool account 1. Click Start, click Administrative Tools, and then click Internet Information Services (IIS) Manager. 2. Expand the local computer node, and then expand Application Pools. 3. Right-click the application pool that you want to check, and then click Properties. 4. Click the Identity tab and note the account shown in the User name field. Note: If the application pool is running under a predefined account, then you will need to create and assign a domain account. 5. Click Cancel. For each application pool account being used to run the application pools listed above, use the following procedure to configure account delegation. Configure the application pool account 1. On the domain controller, open Active Directory Users and Computers, and then click Users. 2. Right-click the application pool account, and then click Properties. 3. On the Account tab, select the Account is trusted for Delegation check box. 4. Verify that the Account is sensitive and cannot be delegated check box is cleared. 5. Click OK. The application pool account must also be a member of the IIS_WPG group on the computer running IIS. If you specified the application pool account when you set up PerformancePoint Monitoring Server, this will have been done automatically. If you have changed the application pool account since you installed PerformancePoint Monitoring Server, you must manually add it to the IIS_WPG group on the computer running IIS. Configuring client computers Each client computer that needs to access data using Kerberos delegation must allow Integrated Windows authentication. Depending on your organization s standards, this may already be enabled. If this is not enabled, perform the following procedure on each client computer that needs to access data using Kerberos delegation. Configure client computers 1. In Internet Explorer, on the Tools menu, click Internet Options. 2. On the Advanced tab, ensure that the Enable Integrated Windows Authentication check 27

box is selected. 3. Close the Internet Options dialog box. You will also want to confirm that the appropriate SharePoint Products and Technologies URLs have been added to the Trusted Sites list in Internet Explorer. For more information, see Security zones: adding or removing Websites (http://go.microsoft.com/fwlink/?linkid=144657). Configuring constrained delegation (recommended) The most secure implementation of Kerberos delegation is to prevent the usage of delegation by any services that you do not explicitly enable. This is known as constrained delegation. Constrained delegation is not required for Kerberos to work with Microsoft Office PerformancePoint Server 2007, but it is highly recommended. Constrained Delegation restricts which services are allowed to delegate user credentials. This prevents unauthorized applications from logging into remote services on behalf of the user. If you choose to configure constrained delegation, we recommend that you test your Kerberos configuration with unconstrained delegation and resolve any issues you might encounter prior to configuring constrained delegation. Note: Kerberos constrained delegation is not supported in a Windows 2000 Mixed or Native functional level domain. Though constrained delegation is more secure, you can still use Kerberos with a Windows 2000 Mixed or Native functional level domain without constrained delegation. To configure constrained delegation, you must specify which services trust the application pool identity to present credentials. For constrained delegation to work properly, each application pool identity (both Windows SharePoint Services and Microsoft Office PerformancePoint Server 2007) must be trusted for delegation for the specific services associated with the data source. For example, the following table shows a Microsoft Office PerformancePoint Server 2007 deployment with Microsoft Office PerformancePoint Server 2007 running on Server1, Windows SharePoint Services running on Server2, and SQL Server Analysis Services (the data source) running on Server3. Server Name Service/Application Pool ServiceClass Service Account Server1 PPSMonitoringPreview and PPSMonitoringWebService application pools HTTP contoso\pps-svc Server2 Windows SharePoint Services application pool HTTP contoso\wss-svc Server3 SQL Server 2005 Analysis Services MSOLAPSvc.3 contoso\as-svc For constrained delegation to work in this example, the following trust relationships must be established: 28

The Analysis Services service on Server3 must trust credentials presented by the service account running the Web service on Server1 (contoso\pps-svc). This is accomplished by adding the Analysis Services service on Server3 to the list of specified delegation services in the contoso\pps-svc account settings. The Analysis Services service on Server3 must trust credentials presented by the service account running the Web service on Server2 (contoso\wss-svc). This is accomplished by adding the Analysis Services service on Server3 to the list of specified delegation services in the contoso\wss-svc account settings. Specifying these trust relationships is done using Active Directory Users and Computers to modify the user account settings for each application pool identity account. Perform the following procedure for each application pool account associated with your Microsoft Office PerformancePoint Server 2007 deployment. Configure a service account for Kerberos constrained delegation 1. Log on to the domain controller. 2. On the domain controller, click Start, click Administrative Tools, and then click Active Directory Users and Computers. 3. Expand the domain node, and then click Users. 4. Right-click the application pool identity user account, and then select Properties. 5. On the Delegation tab, verify that the Trust this user for Delegation to specified Services only option is selected. 6. Select Use Kerberos Only. 7. Click Add. 8. Click Users or Computers. 9. Enter the domain and user name of the account running the service that you want to have accept Kerberos credentials, and then click OK. 10. The Available Services values will appear for the account that you selected. Select the appropriate service and click OK. Note: This will normally be the Web service associated with the application pool identity that you are modifying or any services associated with data sources that you want to be able to access using Kerberos authentication. 11. Repeat steps 8 through 10 for each service that you want to accept credentials from this account. 12. Click OK to close the account properties dialog box. For more information about constrained delegation, see Configuring Constrained Delegation for Kerberos (IIS 6.0) (http://go.microsoft.com/fwlink/?linkid=144659). Download this book This topic is included in the following downloadable book for easier reading and printing: 29

Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). See Also Deploying a Business Intelligence Solution Using SharePoint, Reporting Services, and PerformancePoint Monitoring Server with Kerberos (http://sqlcat.com/technicalnotes/archive/2009/10/13/deploying-a-business-intelligence-solution-usingsharepoint-reporting-services-and-performancepoint-monitoring-server-with-kerberos.aspx) 30

Troubleshooting Kerberos delegation for Monitoring Server There are several common issues that can arise when deploying Kerberos. These include: Service printipal name (SPN) issues, including duplicate SPNs. Windows SharePoint Services 3.0 issues, including permissions issues. Internet Explorer issues This article describes some of these issues and offers guidance to help troubleshoot them. For more information, see Troubleshooting Kerberos Delegation (http://go.microsoft.com/fwlink/?linkid=99662) SPN issues Duplicate SPNs can prevent Kerberos from functioning correctly. To determine if you have duplicate SPNs, run the Setspn command-line tool with the following syntax: setspn l <servername> To remove a duplicate SPN, run the Setspn command-line tool with the following syntax: setspn d <SPN> For example: Setspn d http/servername.domain.com account For more examples of using the Setspn command-line tool, see Setspn Examples (http://technet.microsoft.com/en-us/library/cc755413.aspx). SharePoint Products and Technologies issues If a "You do not have permission to view this data" message appears when you try to view dashboard elements in Windows SharePoint Services, check the "Properties" tab of the report view and the associated data source to make sure that the user or group who will be viewing the report through Windows SharePoint Services has Reader permissions on both. If the data source is connecting to a back-end server such as SQL Server or Analysis Services, make sure that the user whose permissions are being delegated has permission to view the data. For information about configuring Kerberos with Microsoft Office SharePoint Server 2007, see Configure Kerberos authentication (Office SharePoint Server) (http://technet.microsoft.com/library/f136c3bd-14e6-4f3f-b7ef-36581e515c6f.aspx). Internet Explorer issues If you want to specify a Web site by its port, the service principal name (SPN) needs to reflect that. This issue can be addressed by making a registry modification on the computer running Internet Explorer 6.0. 31

For more information, see the following article in the Microsoft Knowledge Base: Internet Explorer 6 cannot use the Kerberos authentication protocol to connect to a Web site that uses a non-standard port on Windows XP, Windows Server 2003 or Windows Vista (http://go.microsoft.com/fwlink/?linkid=99681). Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 32

Video demo: Configuring Kerberos delegation for Monitoring Server This video demonstration walks through the steps necessary to configure Kerberos delegation for PerformancePoint Monitoring Server. This includes: Configuring SharePoint Products and Technologies for Kerberos delegation Setting the NT Authentication Provider property value Updating the Web.config files for the associated Web sites Configuring the application pool accounts to be trusted for delegation Setting Service Principal Names Enabling Integrated Windows authentication in Windows Explorer on client computers To watch the video, click View: Configuring Kerberos Delegation with PerformancePoint Monitoring Server (http://go.microsoft.com/fwlink/?linkid=168590). To download the video, click Download: Configuring Kerberos Delegation with PerformancePoint Monitoring Server (http://go.microsoft.com/fwlink/?linkid=168597). Note: We recommend configuring constrained delegation for best security. While the video demonstration does not cover the steps to configure constrained delegation, the required procedures are covered in Configure Monitoring Server for Kerberos delegation. 33

Monitoring Server best practices The following are best practices for Monitoring Server. Note: Either Office SharePoint Server 2007 or Windows SharePoint Services must be installed in order to successfully install and use Monitoring Server. The terms Windows SharePoint Services and SharePoint Services are used collectively in PerformancePoint Server documentation to refer to Office SharePoint Server 2007 and Windows SharePoint Services 3.0. Monitoring Server application pool identity account We recommend that the Monitoring Server application pool identity account is a domain user account and has the identity of the SharePoint site on which Dashboard Viewer for SharePoint Services is installed. This account must be assigned read permissions to any of the external data sources that are monitored through dashboards that are deployed to this SharePoint site. Configuration of external data sources Monitoring Server can be used to monitor various types of data sources. To read data from these data sources, appropriate permissions need to be granted to these data sources. To create these data sources or preview the data in Monitoring Server using Dashboard Designer, the application pool identity account of the Monitoring Server Web Service and Dashboard Web Preview must be granted login and read permissions to each of the data sources. To view dashboards that pull data from the data sources, the application pool identity account must be granted login and read permissions to each of the data sources. Minimum version for Internet Explorer Monitoring Server requires Internet Explorer 6.00.2600.0000 or later. We recommend that you install the most recent version with all current updates. Memory management When running multiple Monitoring Server application pools on a single server, the ASP.NET cache should be limited to prevent performance degradation. The following lines should be added to the <system.web> section of the Web.config file for the SharePoint, WebService, and Preview Web applications: <caching> <cache percentagephysicalmemoryusedlimit="30" /> </caching> The WebService and Preview Web applications typically share the same application pool. On a standalone server, there are typically two application pools that can have large ASP.NET caches: SharePoint 34

and WebService/Prevew. On a server with only one large-cache Web application, this action is unnecessary because the default ASP.NET cache sizing will be correct that is, approximately 60 percent of the available physical memory. Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 35

Monitoring Server log files Monitoring Server produces the following two installation log files: MonitoringStatus%date%.log MonitoringVerbose%date%.log The log files are created in the following directory: %temp%. Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 36

Configuring SharePoint Products and Technologies for Monitoring Server When installing the Dashboard Viewer for SharePoint Services component on a computer that is running Windows SharePoint Services 3.0 or Microsoft Office SharePoint Server 2007, ensure that the following requirements are met: The SharePoint site collection that will be used for installing this component has at least one document library available for use with PerformancePoint Monitoring. The administrator installing this component is a site collection administrator on the selected SharePoint site collection. If the user installing this component is not a site collection administrator, the installation of this component fails because access is denied. By default, neither members of the SharePoint Farm Administrators group nor members of the Administrators group on the local server computer are site collection administrators. They must specifically take ownership of a site collection by adding themselves as site collection administrators. You can specify site collection administrators for a particular SharePoint site collection in either of the following two ways: By using the Site Collection Administrators page on the SharePoint Central Administration Web site. (In Central Administration, click Application Management, and then in the SharePoint Site Management section, click Site collection administrators.) By using the Site Actions menu on the top-level site. (On the Site Actions menu, point to Site Settings, click Modify All Site Settings, and then in the Users and Permissions section, click Site collection administrators.) In the configuration manager, the Dashboard Viewer for SharePoint Services component can only be installed on a single SharePoint site collection. If you want other site collections on the computer that runs SharePoint Products and Technologies to access the SharePoint Web Part, you must manually change the Web.config file of each of the site collections. These manual changes are not recommended or supported. We will add support for the ability to install to multiple site collections in a future release. To install the Dashboard Viewer for SharePoint Services on a SharePoint Products and Technologies farm, you must install the Dashboard Viewer for SharePoint Services component on each computer in the farm. The application pool identity account of the SharePoint site collection can access the Monitoring System Database to render the dashboards. If the application pool of the SharePoint site collection is running as Network Service, you can perform either of the following actions: Change the application pool identity account of the SharePoint site to a domain user account, which is more secure. Select a different SharePoint site that has the application pool identity already configured to use a domain user account. If you do not want to perform either of the previously listed actions to enable the Dashboard Viewer for SharePoint Services component to render scorecards, you must grant the computer account of the computer running SharePoint Products and Technologies access to the Monitoring System Database by adding the computer account to the BPMDeveloper database role. 37

During setup, the Monitoring Server Configuration Manager prompts you if the SharePoint application pool is detected to be running under a built-in account and the Monitoring System Database is on a remote computer. You can select one of the following options: Have the Monitoring Server Configuration Manager configure the computer account automatically. Manually grant permissions and role membership after the Monitoring Server Configuration Manager completes configuration. Note: Either Office SharePoint Server 2007 or Windows SharePoint Services must be installed in order to successfully install and use Monitoring Server. The terms Windows SharePoint Services and SharePoint Services are used collectively in PerformancePoint Server documentation to refer to Office SharePoint Server 2007 and Windows SharePoint Services 3.0. Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 38

Installing and configuring required Monitoring Server software Monitoring Server Setup happens in two stages: software installation, and then software configuration. First, you install Monitoring Server software on the computer by running PSCSrv.msi. After the software is installed, you must configure the server components by running Monitoring Server Configuration Manager. You can think of this configuration step as turning on or turning off the components on the local computer. The following two configuration options are available in Monitoring Server Configuration Manager: Stand-alone configuration Selects all the Monitoring Server components that meet the prerequisites to be configured on one computer including the Monitoring System Database. Distributed configuration Enables you to selectively configure Monitoring Server components on the local computer. Choose this option if you want to have a customized topology. Note: Monitoring Server Configuration Manager configures components only on the local computer. Distributed configuration means that you have selected to have a customized topology and want to selectively configure components on this computer. To completely set up your distributed or customized topology, you must run Monitoring Server Setup on each separate computer in your distributed topology. Monitoring Server Configuration Manager automatically runs after the initial server installation. By using Monitoring Server Configuration Manager, you choose the components that you want to configure on the local computer for example, the Monitoring Server Internet Information Services (IIS) component, or the Monitoring System Database. You can run Monitoring Server Configuration Manager multiple times to add or remove Monitoring Server components on the local computer. Note: When you uninstall Dashboard Designer, all published content in the %ProgramFiles%\Microsoft Office PerformancePoint Server\3.0\Monitoring\PPSMonitoring_1\Preview directory is deleted. Before you uninstall Monitoring Server, ensure that the information in this directory is no longer needed. During the removal process, a backup of all information is copied to the following temporary directory: %TEMP%\MonitoringPreview_<Timestamp>. Note: Dashboard Designer does not support Microsoft SQL Server 2000 Analysis Services as a data source in 64-bit installations of PerformancePoint Monitoring. Monitoring Server will not install on a Windows 2000 Server domain controller or a Windows Server 2003 domain controller. Permissions and accounts When deploying Monitoring Server, you need to specify an account to run IIS application pools for Monitoring Server and SharePoint Products and Technologies. Use a domain account with no 39

permissions. Monitoring Server and SharePoint Products and Technologies add the required permissions as part of the server configuration. When installing Monitoring Server, log on with an account that has the following permissions: A member of the Local Administrators group on the computer where you are installing Monitoring Server. A member of the dbcreator and securityadmin server roles on the computer running SQL Server. When configuring data sources, use the following guidelines: Assign "read" permissions to the application pool identities for each data source. Assign the minimum permissions needed by SQL Server and Analysis Services for the data source user. This will vary depending on the data sources you use. As a best practice, we recommend that you use the Monitoring Server Admin role rather than the Local Administrators group on the computer to give users administrative access to Monitoring Server. For information about planning SharePoint Products and Technologies security, see Plan for and design security (Office SharePoint Server) (http://technet.microsoft.com/library/3df68222-235b-45de- 82fa-b89166c5c6bd.aspx). Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 40

Installing Monitoring Server You configure Monitoring Server software components during the second stage of setup. You can configure one component at a time or multiple components by using Monitoring Server Configuration Manager. You must configure the following five components: Monitoring System Database Monitoring Server Internet Information Services (IIS) component Dashboard Viewer for SharePoint Services Scorecard Viewer for Reporting Services Monitoring Plug-in for Report Designer (Microsoft Visual Studio 2005) Monitoring Server Configuration Manager installs the selected components on the local computer. If you want to install components in a distributed fashion, you must separately configure each computer. You can select either of the following two options that Monitoring Server Configuration Manager provides: Distributed Configuration Specify which Monitoring Server components to install on multiple computers. This option enables you to select the components that are installed on each computer. Standalone Configuration Install all Monitoring Server components on a single computer. All the components will be installed, and you cannot customize the configuration. Note: if there are missing software prerequisites on the local computer, you will not be able to install the components that depend on them Important: When Monitoring Server Configuration Manager is run, there might be a disruption to IIS services and sites. We recommend that you disconnect all critical IIS services and sites until after Monitoring Server Configuration Manager completes. Note: Either Office SharePoint Server 2007 or Windows SharePoint Services must be installed in order to successfully install and use Monitoring Server. The terms Windows SharePoint Services and SharePoint Services are used collectively in PerformancePoint Server documentation to refer to Office SharePoint Server 2007 and Windows SharePoint Services 3.0. Download this book This topic is included in the following downloadable book for easier reading and printing: Monitoring Server Deployment Guide for PerformancePoint Server 2007 (http://go.microsoft.com/fwlink/?linkid=147665) See the full list of available books at Downloadable content for PerformancePoint Server 2007 (http://technet.microsoft.com/library/0b7352bb-99f5-4df1-9409-6a9733f8099f(office.12).aspx). 41

See Also Monitoring Server Deployment Topology Install Monitoring Server on a single computer Install Monitoring Server in a distributed environment Install Monitoring Server by using the command line Dashboard Designer deployment overview and considerations Installing Dashboard Designer using an MSI Installer file Publishing PerformancePoint Server in extranet scenarios (white paper) (http://technet.microsoft.com/library/6407c818-954e-4b2e-8c01-90568e338244(office.12).aspx) 42

Monitoring Server deployment topology The following figure illustrates the PerformancePoint Monitoring components working together Monitoring Server, Monitoring System Database, Dashboard Designer, and Dashboard Viewer for SharePoint Services as part of the dashboard life cycle. The computer running Monitoring Server contains a single Web site. Dashboard Designer is launched from the Monitoring Central Web site. Dashboard Designer communicates to Monitoring Server to save and retrieve the dashboard to the Monitoring System Database. Dashboard Designer can deploy the dashboard to the Dashboard Web Preview Web site on Monitoring Server to preview the dashboard. Dashboard Designer can deploy the dashboard to the server running SharePoint Products and Technologies with the Dashboard Viewer for SharePoint Services installed. After the dashboard is deployed to the server running SharePoint Products and Technologies, the dashboard can be viewed. When viewing the dashboard through the Dashboard Viewer for SharePoint Services, the user browses to the SharePoint site, clicks the dashboard document, and the dashboard starts to render. The Dashboard Viewer for SharePoint Services connects to the Monitoring System Database, reads the dashboard definitions that were published to the database, and then renders the dashboard. The data in the views is obtained by the Dashboard Viewer for SharePoint Services connecting to the data source, gathering the data and rendering the view. Note that Monitoring Server is not involved in this process. After the dashboard is published to the database and deployed to the server running SharePoint Products and Technologies, Monitoring Server is not needed to render the dashboard. When viewing the dashboard, users can export to Microsoft Office Excel 2007 and Microsoft Office PowerPoint 2007. 43