Auditing with Microsoft Assessment and Planning (MAP) Toolkit 5.0 – Part 2

The following screen gives you the option of querying the whole Active Directory forest or only part of it: like a domain or even an OU. In this example, I have chosen to target the Database Servers OU.

MAP 5

The next screen allows you to specify the accounts for the machines MAP is going to discover. This account needs to be a member of the Local Administrator groups in the target machines. Remember, the first account credentials you specified was for querying the Active Directory domain controller. This one is for the machines. SQL Discovery is going to use WMI as well as SQL Server native and integrated security to connect to the database machines and if you have a common database account that you know to have Local Administrator privileges in all the boxes, it is here you specify that. Just click on “Create…” button and you can specify a user account and its password along with what inventorying technology it is going to be associated with. For example, you can specify a Local Administrator account for WMI while a different account for SQL integrated security.

MAP 5

MAP 5

In the next screen, you can specify the order in which the accounts you specified will be used, for each connection / discovery method:

MAP 5

The next screen is the summary screen where you can have a look at any errors reported. If everything is okay, the Finish button will be enabled. Just click on Finish.

A progress screen like the following will be shown as MAP goes across the network to first query the Active Directory to find the list of computers and inventories them.

MAP 5

Note that the screen does not merely show you a progress bar; it dynamically updates it with the number of computers discovered and inventoried. If you click on the Close button, the status screen will be hidden. You can still see the inventory process is running just by looking at the status bar of the application. Clicking on the rotating icon and choosing “view progress…” will bring back the status screen again.

MAP 5

Once the process is complete, the detailed pane will show a graphical representation of the findings. This is titled SQL Server Discovery Summary Result. In this screen, you will have an overall view of the SQL Servers and SQL Server components running in the machines that were inventoried. The following figures show each subsection of the report:

MAP 5

MAP 5

As you can see, MAP has tallied the total number of SQL Server machines and presented them broken down by version, edition, components and operating system.

If you now click on say, the Windows server 2008 Readiness item in the navigation pane, you will see that MAP has also tallied the operating systems running on the database servers. It has automatically provided a list showing how many servers can be upgraded to Windows 2008 and has the recommended hardware requirements, how many servers meet the minimum system requirements and how many cannot be upgraded with the present configuration. The report also shows the different number of Windows servers running in the network segment scanned.

MAP 5

Compared to the Windows 2008 readiness, we can see a lot of servers are not ready for Windows Server 2008 R2:

MAP 5

Finally, if you look under the Inventory Summary Results node on the navigation pane, you will see two items: All Computers and All Products.

Clicking on the All Computers items changes the detail pane and you will be able to see the servers audited listed by their operating system. The same report can be broken down by physical and virtual machine.

MAP 5

When you click on the All Products item, MAP shows the list of software products it found in each of the servers monitored.

The inventory process is cumulative. If you run the inventory and assessment wizard on the same computers again, the database will not be updated. However, if you are running it again on different set of computers in your network, new inventory data will be added to the database. This means if you have a number of domains in your Active Directory or different OUs in the same domain, you can run the discovery method more than once until you are satisfied that most, if not all, SQL Servers have been covered.

 

Continues…

Leave a comment

Your email address will not be published.