4.2.8 Prerequisites for agentless management

When using agentless management, setup must be completed on both the management server and user computer to collect device information. The range of information that can be acquired depends on the authentication method. The range of information that can be acquired depends on the authentication method. A limited range of information may result in unknown security states and missing data in reports, causing risks to system operation. Select the best authentication method for your security needs.

Setup to collect most of the available device information is easy if you are using Active Directory to manage the computers in your organization. If you are thinking of using agentless management, first make sure that your computers are managed in Active Directory.

For differences between the types of device information that can be collected, see 2.6.2 Collecting device information.

Important: Agentless management is not supported in a NAT environment.

Important: Do not delete the discovery range or authentication information for any agentless managed device discovered in a network search. Likewise, do not delete the Active Directory setting for any agentless managed device discovered by an Active Directory search. Deleting this setting information prevents device information from being collected. If you mistakenly delete the discovery range, authentication information, or Active Directory setting, add them and then re-execute the network search or Active Directory search to discover the devices.

Important: In a DHCP environment, if a device's IP address changes, moving outside the discovery range, no information will be collected about that device.

When using Windows administrative shares to perform agentless management

All the following conditions must be satisfied:

Windows firewall is disabled on the user's computer^#1.
Simple file sharing is disabled on the user's computer.
File and Printer Sharing is enabled on the user's computer.
Windows Administrative Share (ADMIN$) is enabled on the user's computer.
Access to the Interprocess Communications share (IPC$) is enabled on the user's computer.
The information used for logging in to the target computer by using Windows administrative shares is set on the management server as authentication information for network searches.^#2

#1: Even if Windows Firewall is enabled, the condition is still satisfied if TCP (port 445) is open for traffic.

#2: The authentication information for logging in to the target computer by using Windows administrative shares must satisfy either of the following conditions:

The built-in Administrator account and password of the user's computer is used.
The UAC function is disabled on the user's computer.

How to make Windows administrative shares accessible to a management server varies depending on the OS on the user's computer. The following settings are required to make Windows administrative shares accessible:

OS	Setting
Windows 10	Disable UAC or enable the Administrator account.^#1 Enable File and Printer Sharing in the Network and Sharing Center window.
Windows 8.1
Windows 8
Windows 7
Windows Vista	Disable UAC or enable the Administrator account. Enable File sharing in the Network and Sharing Center window.
Windows XP^#2	Disable simple file sharing. Add file shares.
Windows Server 2019	Enable File sharing or File and Printer Sharing in the Network and Sharing Center window.
Windows Server 2016
Windows Server 2012
Windows Server 2008
Windows Server 2003	Setup unnecessary (enabled by default).
Windows 2000	Add file shares.
Computer other than Windows	Not supported (cannot be configured).
Network device	Not supported (cannot be configured).

#1: If you are using Windows 8.1 or Windows 8 (no edition), perform this setup by executing the net user command at the command prompt. You cannot enable the Administrator account from the Windows Control Panel.

#2: In Windows XP Home Edition (Service Pack 2 and 3), Windows administrative shares cannot be used.

If these conditions are satisfied, you can acquire most of the available device information. The information collected hardly differs from that collected via agents installed on the managed computers.

When using SNMP to perform agentless management

The following conditions must be satisfied:

SNMP can be used.
The community name can be authenticated.

The following table describes the setup required to acquire device information using SNMP:

OS	Setting
Windows 10	Install an SNMP agent. Set up the SNMP agent.
Windows 8.1
Windows 8
Windows 7
Windows Vista
Windows XP
Windows Server 2019
Windows Server 2016
Windows Server 2012
Windows Server 2008
Windows Server 2003
Windows 2000
Computer other than Windows
Network device

When using Active Directory to perform agentless management

Both the following conditions must be satisfied:

Windows firewall is disabled on the user's computer.^#
Using the Active Directory linkage feature, the management server can acquire device information managed by Active Directory.

#: If Windows firewall is enabled, the condition is still satisfied if connection via a port number specified in Active Directory settings view accessed from General view in the Settings module is open for traffic.

When using ICMP to perform agentless management

ICMP must be available for use.

The following table describes the setup required to acquire device information using ICMP:

OS	Setting
Windows 10	Allow incoming ICMP echo requests.^#
Windows 8.1
Windows 8
Windows 7
Windows Vista
Windows XP
Windows Server 2019
Windows Server 2016
Windows Server 2012
Windows Server 2008
Windows Server 2003
Windows 2000
Computer other than Windows
Network device

#: In Windows XP or later, you must configure the Windows Firewall to allow ICMP traffic or disable Windows Firewall.

Related Topics:

To Page Top