Control Compliance Suite

Refer attachment, I’ve connected the CCSAD domain to WORKGROUP via the installed MQE manually and the checked connection that work for WORKGROUP MQE and WORKGROUP computers.

But, I try to import the asset on CCS Console/Report that can import only the WORKGROUP MQE to CCS asset, for other computer in WORKGROUP cannot.

Please advise, if you have any solution to import the WORKGROUP computers to CCS asset.

Ps. now, I'm trying to import by CSV collector, but still not work. Due to CCS environment have installed on Windows 2008 R2

that difficult to open something to support Workgroup and Share solution.

Thank you for your advance.

plai

Attachment(s)

CCS diagram (WORKGROUP connection).pdf   32 KB 1 version

Normally for workgroup computers you will need to use a CSV and you need to replace the workgroup name with the name of the machine with the MQE on it.  In addition to that you need to have a shared administrative account that has the same account name and pwd on all of the Workgroup machines and use this account to start the Query Engine Service.   Then when you import the machines the Query Engine name becomes the "Domain" in this scenario.   For example if you have WSRV1 - WSRV6 in the Workgroup WINSERV.  Then you would create an account on each server called something like (CCS-Admin) and give is admin rights on each of the servers.  Then install the MQE on WSRV1 and use the CCS-Admin Account you just installed to start the QE Service.   Then in the CSV file you would make it look like the following:

Wnt.Machine.DomainWorkgroup,Wnt.Machine.Hostname......

WSRV1,WSRV1

WSRV1,WSRV2

WSRV1,WSRV3

...

Hope this helps.  Here are some links as well:

http://www.symantec.com/docs/TECH113909 

If you are using CCS 11, then you can install an agent on the workgroup computers which may be a cleaner solution.  CCS 11 give you the ability to choose an agent-based or agent-less approach.  Since there is no central location that has all of the information about the workgroup like a Domain gives you, using agentless in a Workgroup scenario takes a few extra steps.

Thank you for your advance,

I've already configured for following this link http://www.symantec.com/docs/TECH113909  that it's work for RMS machine connect to the workgroup computer.

However, I try to connect the CCS console to the workgroup coputer via RMS and MQE (workgroup) that still not work.

Ps. My CCS system run on version. 10.5 that have pre-config CSV to import asset function (one-time import asset)

Hi Plai,

Request you to add hostname and IP addresses in RMS, CCS as well as in the MQE machine of the host file.  It should work.

Location of the hostfile on servers: C:\WINDOWS\system32\drivers\etc

File name: Hosts (Open with Notepad)

Plai,

What is/are the error(s) you are getting?

Also, what type of machine(s) are in the Workgroup you are trying to import? 

I just found out that for Windows 2008 Servers and Windows Vista (and later) computers not joined to a domain have UAC (User Account Control) remote restrictions enabled by default.  This will not allow RMS/CCS to be able to query those servers properly (or at all) as well as not allow a workgroup machine to be imported into Reporting & Analytics (R&A) as an Asset until UAC remote restrictions are disabled. 
As a side note, for machines joined to a domain, UAC is not in effect. 
Microsoft reference article:  http://technet.microsoft.com/en-us/library/ee844186(v=ws.10).aspx

To disable UAC remote restrictions, on each Windows 2008/Vista/7 machine in the Workgroup you are having problems with, create/import the following DWORD registry key/value:
_____
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"LocalAccountTokenFilterPolicy"=dword:00000001
_____

A value of 1 = disable UAC remote restrictions
A value of 0 = enable UAC remote restrictions.

Another characteristic of this issue is if you try to do a net use from a remote machine command prompt to connect to a default admin share (C$ for example), you enter the correct credentials of a local account with administrative rights on the Workgroup machine, and receive an error:
System error 5 has occurred.
Access is denied.

Hope this may help depending on what error(s) you are getting.

Aaron Humphries