With the SDP 11300 release, agent-based scanning for Windows, Linux, and Mac machines is introduced. This feature is provided by ManageEngine Endpoint Central (formerly Desktop Central). As ME Endpoint Central is already installed in your environment, the same installation can be used for scanning Windows, Linux and Mac machines in your environment for the number of nodes purchased in SDP.
Note for customers already using any other UEMS products other than ME Endpoint Central
If any of the following ME products are installed and used in your environment, we recommend you contact our support before proceeding with this installation for configuring changes in asset inventory.
Patch Manager Plus On-Premise/Cloud
Remote Access Plus On-Premise/Cloud
Device Control Plus
Vulnerability Manager Plus
Patch Manager Plus Cloud
Endpoint Central (formerly Desktop Central) Cloud
Support for scanning Windows machines using WMI has been removed.
Support for scanning Linux and Mac machines using SSH/Telnet has been removed.
All Windows, Linux, and Mac machines can be scanned only by installing DC agents in remote machines.
Endpoint Central (formerly Desktop Central) is a robust unified endpoint management system. It comprises features like Patch Management, Software Deployment, Endpoint security, OS imaging, and deployment, etc. Agents from Endpoint Central improve AssetExplorer' asset scanning functionality by fetching complete hardware details during the scan as well as maintaining the uniformity of data fetched across Windows, Linux, and Mac machines. Endpoint Central agent integration also avoids the need to have two agents for users who already have integration between AssetExplorer and Endpoint Central.
i. Agent-based inventory of Windows, Mac, and Linux machines
ii. Warranty information for devices
iii. Remote control for Windows, Mac, and Linux machines
iv. Auto upgrade of agents to newer versions
i). Chat *
ii). Wake-on-LAN *
iii). Announcement (supported in ServiceDesk Plus and not supported in AssetExplorer) *
iv). System manager *
Does Endpoint Central (formerly Desktop Central) come for free for existing SDP customers?
No, the inventory and remote control functionalities for Windows, Linux, and Mac machines and warranty information of devices are the only features provided for SDP customers through Endpoint Central (formerly Desktop Central) after deployment of Endpoint Central (formerly Desktop Central) agents.
Ports used in Endpoint Central (formerly Desktop Central)
|
Port |
Purpose |
Type |
Connection |
|
8383 |
For communication between the agent and the Endpoint Central (formerly Desktop Central) server
Source: Agent
Destination: Endpoint Central (formerly Desktop Central) server
|
HTTPS |
In bound to server |
|
8027 |
The notification server port is responsible for communicating on-demand operations from the server to the agent. |
TCP |
In bound to server |
|
Port |
Purpose |
Type |
Connection |
|
8444 |
For Sharing remote desktops, System Manager, Chat, and transferring files |
HTTP |
In bound to server |
|
8443 |
For Sharing Remote Desktops, System Manager, Chat, and transferring files |
HTTPS/UDP (for voice & video chat) |
In bound to server |
Database supported by Endpoint Central (formerly Desktop Central)
By default, Endpoint Central (formerly Desktop Central) gets installed with bundled PGSQL. Endpoint Central (formerly Desktop Central) also supports MSSQL. Please check here for MSSQL versions supported by Endpoint Central (formerly Desktop Central).
Click here for detailed steps for moving Endpoint Central (formerly Desktop Central) to MSSQL.
OS supported by Endpoint Central (formerly Desktop Central) agents
Endpoint Central (formerly Desktop Central) agents can be installed on machines with the following OS
Agent - Server communication in Endpoint Central (formerly Desktop Central)
The Endpoint Central (formerly Desktop Central) agent communicates with the Endpoint Central (formerly Desktop Central) server immediately after its installation in the remote machine and posts the inventory data. The Endpoint Central (formerly Desktop Central) agent communicates with the Endpoint Central (formerly Desktop Central) server through HTTPS during system startup and every 90 minutes thereafter till the system is shut down, gets the actions to be performed in the remote machine, and executes it. This 90 minutes policy is majorly used for any asynchronous operations like schedule scan, any agent configuration changes, etc.
Endpoint Central (formerly Desktop Central) agents also establish a session with the Endpoint Central (formerly Desktop Central) server through TCP for getting notified for actions that have to be executed on demand like Scan Now or remote control.
By default, the Agent-Server communication will happen through HTTPS (Encrypted) communication. These steps enforce trusted HTTPS communication between agent and server. These configurations can be enabled under Agent security settings
Enable certificate-based authentication for agent-server communication
Enabling this option would have the agent-server communication with client certificate authentication. Enabling this option in AE would in turn enable this setting in Endpoint Central (formerly Desktop Central) too. Click here for more details on the procedure.
Enable agent-server trusted communication
Before enabling this setting, it is required that a valid third-party SSL certificate is applied in Endpoint Central (formerly Desktop Central). Click here for steps to configure SSL certificate in Endpoint Central (formerly Desktop Central), this has to be done only from the Endpoint Central (formerly Desktop Central) console.
Note: Once this setting is enabled it cannot be disabled again as the agents will fail to communicate with the server again.
Enabling this setting would enable it in Endpoint Central (formerly Desktop Central) too and have the agent-server communication to be trusted. Click here for a detailed procedure.
All the below data are predicted from a single agent machine. Disk space will be consumed up to 1GB (approximately) from the agent installed drive.
|
Agent Process |
Running application name |
Bandwidth consumption(approximately) |
CPU consumption(approximately) |
Memory (RAM) consumption (approximately) |
|
At Agent Idle state |
dcagentservice.exedcondemand.exedcagenttrayicon.exe(Running separateapplication for eachlogged on user)(For windows andMac)[ Above 3 are everrunning processes ] |
1 Kbps |
0-2% |
11 MB |
|
Refresh policy(90 mins once -without any deployment) |
dcconfig.exe |
4KB |
0-2% |
6MB |
|
Inventory scan(At Scheduled time in server) |
dcinventory.exe |
2MB |
17-20% |
14MB |
|
Agent Upgrade(Applying PPMand If agentversionchanges) |
dcconfig.exe AgentUpgrader.exe |
20MB |
2-5% |
3MB |
Previously, AE agents were supported only for Windows OS, from the 11.3 version of SDP, Endpoint Central is being used for agent-based scan for Windows, Linux, and Mac OS. Therefore, users are requested to switch to Endpoint Central agents.
Step 1: Configuring the Agent settings
Before downloading the agents and deploying them on the machines, it would be appropriate to configure certain agent settings so that these configurations are bundled into the agents. These settings can be configured from under Admin > Agent configurations.
Certain users in the organization will be traveling periodically and their laptops may not be available in the corporate network for scanning. In order to scan such laptops which have the agent installed, public IP has to be configured for agents in these devices to reach the Desktop Central server. Click here for more details on how to configure public IP for scanning.
Click here for more details on how to configure public IP for scanning.
By default, the Agent-Server communication will happen through HTTPS (Encrypted) communication. These steps enforce trusted HTTPS communication between agent and server. These configurations can be enabled under Agent security settings.
Enable certificate-based authentication for agent-server communication
Enabling this option would have the agent-server communication with client certificate authentication. Enabling this option in SDP would in turn enable this setting in Endpoint Central (formerly Desktop Central) too. Click here for more details on the procedure.
Enable agent-server trusted communication
Before enabling this setting, it is required that a valid third-party SSL certificate is applied in Endpoint Central. Click here for steps to configure SSL certificate in Endpoint Central, this has to be done only from the Endpoint Central console.
Note: Once this setting is enabled it cannot be disabled again as the agents will fail to communicate with the server again. Enabling this setting would enable it in Endpoint Central too and have the agent-server communication to be trusted. Click here for the detailed procedure.
Step 2: Ensure ports used by Endpoint Central are open
The ports used by Endpoint Central are mentioned above in the document. All the ports are inbound to the server and would be used by the agents residing in the remote client machines to reach the server. These ports have to be opened up in the firewall where ever required.
Step 3: Downloading Endpoint Central agents for Windows, Linux, and Mac machines
Once Endpoint Central is successfully installed and integrated with AE, then Endpoint Central agents for Windows, Linux, and Mac will be available for download from Admin > Agent configuration page.
Step 4 : Replacing AE agents with DC agents in Windows machines
Uninstallation of AE agents and installation of DC agents for Windows machines can be performed as a single step by configuring a GPO in Active Directory. DC agent for Windows can be downloaded from Admin > Agent Configuration. It would be in zip format and contains DesktopCentralAgent.msi and DesktopCentralAgent.mst files.
You can replace the existing Windows Agents with Desktop Central Agents by executing the ReplaceAgents.vbs as a GPO in Active Directory. The Agents will be replaced once the machines boot up.
i.Create a network share (e.g,\MyServerMyShare).
ii. Download and extract the Windows Agent zip file.
iii. Save the DesktopCentralAgent.msi and DesktopCentralAgent.mst files in the network share.
iv. From your Domain Controller, click Start >> run >> enter gpmc.msc and click OK. If gpmc is not installed in your Active Directory, install gpmc and proceed.
v. Right-click the domain and select Create and Link a GPO and specify a name for GPO.
vi. To install Agents in only select client computers, follow these steps:
Select the GPO and click the Scope tab.
Click Add in the Security Filtering section.
Click Object Types in the Select User, Computer, or Group dialog box.
Select the specific computer Object Types and click OK.
Specify the computer names, click Check Names, and click OK.
vii. Right-click the GPO and click Edit.
viii. Select Computer Configuration>>Windows Settings>>Scripts and right-click Startup and click Properties.
ix. Click Show Files and drag and drop the ReplaceAgent.vbs(downloaded above) to this location and close.
x. In the Startup Properties dialog box, click <strong>Add.</strong>
Browse and select the ReplaceAgent.vbs script.
xi. Specify the script parameters as mentioned below and click OK
DesktopCentralAgent.msi DesktopCentralAgent.mst
xii. Click OK to close the Add a Script dialog box and the Startup Properties dialog box
xiii. Close the Group Policy Object Editor and Group Policy Management dialog box.
The agent will be installed automatically when the client computers start.
Step 5 : Uninstalling Windows AE agents
If step 3 above is not followed and step 5 is followed during the installation of Windows agents, then the old AE agents will still remain in the remote client machines. Follow the below method to uninstall the AE agents.
You can uninstall the ServiceDesk Plus Windows Agents by executing the UnInstallAgent.vbs as a GPO in Active Directory. The agents will be removed once the machines boot up.
Create a network share (e.g,\MyServerMyShare).
Download and place UninstallAgent.vbs
From your Domain Controller, click Start >> run >> enter gpmc.msc and click OK. If gpmc is not installed in your Active Directory, install gpmc and proceed.
Right-click the domain and select Create and Link a GPO and specify a name for GPO.
Right-click the GPO and click Edit.
Select Computer Configuration>>Windows Settings>>Scripts and right-click Startup and click Properties.
Click Show Files and drag and drop the UninstallAgent.vbs(downloaded above) to this location and close.
In the Startup Properties dialog box, click <strong>Add.</strong>
Browse and select the UninstallAgent.vbs script.
Click OK to close the Add a Script dialog box and the Startup Properties dialog box
Close the Group Policy Object Editor and Group Policy Management dialog box.
The agent will be uninstalled automatically when the client computers start.
Step 6 : Other methods for deploying Endpoint Central agents in Windows
Below are the other methods to deploy Windows agents through the Active directory and for machines in a workgroup. To be followed if Step 3 is not performed.
Installing Windows agents using GPO Scheduler (Note: This step will be helpful in WFH environments where the agents get deployed after the users get their laptops connected through VPN in a corporate network.
Installing Windows agents using startup script in ActiveDirectory
Installing Windows agents through GPO lightweight tool
Step 7: Imaging a Windows computer with a Endpoint Central agent
Endpoint Central Agent has a unique ID that represents the machine with its name and system details. If more than one Endpoint Central Agent is identified with the same ID, the details listed in ServiceDesk Plus will be overwritten. This will end up listing details of only one computer though there are several computers with the same ID. So, in order to avoid this issue, follow the steps mentioned below to image a computer with Endpoint Central Agent on it.
a). Install Desktop Central Agent on the computer which is to be used for imaging.
b). Download Agent by accessing the Assets module and selecting Download Windows Agent (or) go to Admin > Agent Configuration > Download Windows Agent.
c). Save and Download this script and store it in the system that is supposed to be imaged.
(running this script will block the Endpoint Central Agent from communicating with the Endpoint Central Server)
d). Rename the .txt file as .vbs file
i. Open the command prompt as administrator and navigate to the folder where the above script is stored.
ii. Execute the script as: cscript.exe dcagentPreImage.vbs
(example : E:Downloads>cscript.exe dcagentPreImage.vbs)
Now your computer is ready to be imaged with Endpoint Central Agent, for deployment.
Endpoint Central (formerly Desktop Central) Agent in the newly imaged computers will contact the Endpoint Central Server only if they are renamed.
Step 8: Deploying Endpoint Central agents in Linux
Below are methods of agent deployment in Linux machines and for imaging a Linux machine
Installing Linux agent using Linux agent installation tool
Step 9: Deploying Endpoint Central agents in Mac
Below are methods of agent deployment in Mac machines and for imaging a Mac machine
Step 10: What if Remote SDP servers are used?
Remote SDP servers are used in WAN environments wherein all the remote machines are not reachable from the central SDP server. From SDP 11.3 version, Endpoint Central has to be downloaded and installed on the SDP remote servers for scanning Windows, Linux, and Mac machines. A separate Endpoint Central installation would not be required if the Endpoint Central agents deployed on the remote sites are reachable with the central SDP server. It is highly recommended not to install Endpoint Central on SDP remote servers as remote control and other tools will not work for machines managed on remote servers from the central server. Only inventory of these machines will be pushed from the remote server to central servers. Please check here for the ports that need to be configured in the firewall for agent-server communication.
Step 11: Procedure for SDP running with Fail Over Service(FOS) enabled
If FOS is configured for SDP, it will work for Endpoint Central too but only if it's installed in the same folder as SDP and that the SDP is installed on a Windows machine.
Click here for more details on FOS with Endpoint Central installation.