Devolutions Server User Manual

Below you will find brief information for Devolutions Server. Devolutions Server is a self-hosted repository for storing and sharing remote connections, credentials and sensitive information. Used in conjunction with a compatible Client application, it extends the client application capabilities to create an Enterprise wide high-end data store. The greatest advantage that Devolutions Server offers is a full Active Directory (AD) integration, whereas a user accessing the system would be granted permissions based on his/her membership in specific AD groups, making user management a much lighter task.

PDF

Document

v.4

Contents

| 3

Part I Overview

What is Devolutions Server?

Features

System Requirements

Part II Getting Started

Security Checklist

Small Business Edition

Topologies

Part III Installation

Web role - Install 2012R2

Web role - Install pre 2012R2

Database Instance

Create Devolutions Server instance

Part IV Upgrading Devolutions Server

Upgrading to 3.0

Upgrading to 3.2

Part V Management

Devolutions Server Console

Authentication

Automatic User Account Creation

Security

Web Interface

Server Settings

General

Database

.......................................................................................................................................................... 61

.......................................................................................................................................................... 62

Yubikey

SafeNet

......................................................................................................................................................... 67

Duo ......................................................................................................................................................... 67

AuthAnvil ......................................................................................................................................................... 67

4 |

Devolutions Server

SMS

......................................................................................................................................................... 68

Azure MFA ......................................................................................................................................................... 68

Radius

Vasco

Security

......................................................................................................................................................... 69

.......................................................................................................................................................... 71

IIS

Em ail

.......................................................................................................................................................... 73

Session State

.......................................................................................................................................................... 74

.......................................................................................................................................................... 75

User Interface

.......................................................................................................................................................... 76

Logging

.......................................................................................................................................................... 78

Notifications

.......................................................................................................................................................... 79

Part VI How-To

How to Configure Client Data Source

How to Configure Devolutions Server to use integrated security

How to Configure SSL

How to Activate Your Renewal Subscription

How to Configure Two-factor Authentication (2FA)

SMS Free ......................................................................................................................................................... 107

How to Configure Security Groups and Roles with AD Integration

How to Configure Notifications

Part VII Support/Resources

151

FAQ (Frequently Asked Questions)

Follow Us

Technical Support

Knowledge Base

User Agent

.......................................................................................................................................................... 154

Troubleshooting

IIS Logging

.......................................................................................................................................................... 173

Contents

| 5

Login failed

.......................................................................................................................................................... 180

Overview

Part I

8 |

Devolutions Server

1 Ov erv iew

1.1 What is Devolutions Server?

Description

Devolutions Server is a self-hosted repository for storing and sharing remote connections, credentials and sensitive information. Used in conjunction with a compatible Client application, it extends the client application capabilities to create an Enterprise wide high-end data store.

The greatest advantage that Devolutions Server offers is a full Active Directory (AD) integration, whereas a user accessing the system would be granted permissions based on his/her membership in specific AD groups, making user management a much lighter task.

Since Devolutions Server is a repository, you must use one of our clients in order to use it. These are:

1) Remote Desktop Manager a) Remote Desktop Manager Enterprise - Windows Edition b) Remote Desktop Manager Enterprise - Mac Edition c) Remote Desktop Manager Enterprise - Android Edition d) Remote Desktop Manager Enterprise - iOS Edition e) Remote Desktop Manager Enterprise - Amazon FireOS Edition

2) Password Vault Manager a) Password Vault Manager Enterprise - Windows Edition b) Password Vault Manager Enterprise - Mac Edition c) Password Vault Manager Enterprise - Android Edition d) Password Vault Manager Enterprise - iOS Edition e) Password Vault Manager Enterprise - Amazon FireOS Edition

Highlights

Although it offers a web interface, most of the features in Devolutions Server are offered through web services. The web interface is intentionally limited and does NOT allow for remote access technologies (RDP, SSH, etc) through a browser.

· High-end security server for your company;

· Share your sessions, credentials, and sensitive data with multiple users while adhering to selfassigned permissions;

· Implemented as a Web application so it can be deployed to the Web or only to your Intranet if you prefer;

· Support Windows authentication and Active Directory integration;

· Client and server side caching;

Usage scenarios

There are five scenarios to use Devolutions Server within an organization:

Contents

| 9

1. Full Active Directory (AD) integration, the assignment of rights and permissions are based on a user's membership in AD Groups. This allows management exclusively by assigning users in AD groups (after the initial setup).

2. A middle layer is required in order to isolate the client applications from the database. This may be required in order to be compliant with a security regulation at the corporate or legal level. (HIPAA, PCI, etc.)

3. Email notification system for various operations on sessions, users, security groups, etc.

4. Widest choice of two-factor Authentication (2FA) devices.

Two-factor authentication

Installation

Please consult

Installing Devolutions Server

to get your system up and running.

1.2 Features

Compare editions

Features

Maximum user allowed

Data source count

Maximum session count

Database connection

Connection logs

Connection history

Password history

Documents and attachments: Word, PDF, etc

Email notifications and event subscription

Caching

· Server caching

· Client-side caching

User management

· Built-in Database user support

· Security group

· Role management

· Per session security access (view, edit, delete)

· Custom database encryption with passphrase

· Per machine setting / credential custom values

10 users

Unlimited

Note 1

Behind server

Unlimite d

Note 1

Behind server

Unlimite d

Note 1

Behind server

10 |

Devolutions Server

2-Factor authentication

SMS (Free or Twilio)

Duo

Google authenticator

LastPass

Yubikey

AuthAnvil

Database driven policy

User change history

Security

Geo restriction

IP restriction

Syslog integration

Active directory integration

Windows authentication

Group integration

Single domain authentication

Role based access control

Multi-domain authentication

Notes

Note 1

Although we do not limit the number of sessions that you will store in your instance, there comes a point where the performance is severely impacted by the sheer volume of data that must be exchanged between the client and server. This is made worse by using Custom images and storing sizable notes within the sessions. The solution is to balance sessions between multiple data sources, thereby making each data source easier to handle.

1.3 System Requirements

Minimum Requirements

The Devolutions Server needs Microsoft .Net Framework 4.5.2 features to function, but Remote Desktop Manager 12.0 requires version 4.6. Please adapt your environment depending on which version you are running.

Microsoft .Net Framework 4.5.2

Please refer to the requirements for the .Net Framework for operating systems, as it is the driving force behind the requirements of our applications.

500+ MB hard drive capacity.

64-bit Support

Devolutions Server is compatible with all 64-bit versions of Windows.

Dependencies

Contents

| 11

Microsoft SQL Server 2012/2014/ 2016 (including the Express editions!)

Internet Information Services (IIS) 7.0 or better.

Remote Desktop Manager Enterprise - Windows Edition installed on the server to better manage the Devolutions Server instance(s).

Server sizing

Many customers often ask how to properly customize their servers for various topologies. This is essentially unfeasible because of the way the system is used has a significant impact on the resource usage of each node within your chosen

Topology .

For a proper estimate, one must take the the following into account: o

Number of entries stored in your instance (server details, credentials, etc. Essentially, everything that you will store in Remote Desktop Manager).

Churn of these entries; do you create entries daily or are they quite static?

Number of concurrent users that hit the Devolutions Server instance during peak times.

Way that the users are using the information. Are they launching 10 sessions at a time, doing a batch operation that takes a few minutes, then repeating the cycle, or are they opening only a few sessions but working within them all day long. This results in write operations to our logs, therefore the former case is more intensive then the latter.

That being said, the great majority of setups that we have seen work well with nodes of 4GB RAM and a dual CPU. Most of these are virtualized environments, so granting more resources is relatively simple.

Getting Started

Part II

2

14 |

Devolutions Server

Getting Started

Description

This topic is for Devolutions Server - Corporate Edition. If rather you have purchased Devolutions Server - Small Business Edition, please consult

Getting

Started - Small Business Edition

After completing your purchase of the Devolutions Server - Corporate Edition, an email will be sent with

three serial licenses keys. Each license provides access of Devolutions Server.

Devolutions Server can be installed through different topology types. Please consult

Topologies for

additional information

Domain requirements

These requirements apply only if you intend to use

Automatic User Account Creation and/or

Roles

to manage your instance.

Create Active Directory groups to manage your instance. Typical examples are: RDM

Admins, RDM Operators, RDM Users

Add domain users to the Active Directory groups;

Check list for installing and running Devolutions Server

Software requirements on the server hosting the instance

Install Microsoft .Net Framework 4.5.2 (It can be installed through the Microsoft Web

Platform Installer );

If you intend to host the solution on a single server, install Microsoft SQL Server (see

Database Instance

);

Install Internet Information Services (IIS) 7.0 or better (see https://technet.microsoft.com/enca/library/hh831475.aspx#InstallIIS );

Install Remote Desktop Manager Enterprise - Windows Edition

Installation steps

Create a new instance of Devolutions Server (see

Create Devolutions Server instance );

Create a Devolutions Server administrator account on the

User Management ;

Create Security Groups and Roles (see

Security Group Management and

Role Management

and Security - Best practices )

Add domain users or built-in users (see

User Management

)

Contents

| 15

2.1 Security Checklist

Description

To achieve the highest level of security, you should adhere to the following guidelines.

These recommendations are valid ONLY if you will make the Devolutions Server instance on your Intranet EXCLUSIVELY. You must involve a person with knowledge of internet security to safely host any application on the Internet. You need to protect the site from Denial Of Service attacks using an appliance or a security module that is external to Devolutions Server.

General

· Uses Windows Authentication exclusively.

SQL Server

Enable only the Windows Authentication Mode

Create a domain account that will be used to create the database (RDMOwner), as well as another account that will be used by the web server to connect to the database (RDMRunner).

Communicate ONLY through an encrypted connection.

Web Server

· Configure the application pool to use domain credentials. This account will be added to the SQL

Server as a login and be granted only the permissions that are needed (RDMRunner).

· Serve content through SSL (https). See

Configure SSL

2.2 Small Business Edition

Description

After the purchase of the Devolutions Server - Small Business Edition, an email is sent with the serial license key. This key allows you to create a new instance of Devolutions Server.

The installation procedure is available at

Devolutions Server Installation

Please check your junk/spam mail folder if you do not see an email in your inbox.

Domain requirements

These requirements apply only if you intend to use

Automatic User Account Creation and/or

Roles

to manage your instance.

Create Active Directory groups to manage your instance. Typical examples are: RDM

Admins, RDM Operators, RDM Users

Add domain users to the Active Directory groups;

16 |

Devolutions Server

Check list for installing and running Devolutions Server

Software requirements on the server hosting the instance

Install Microsoft .Net Framework 4.5.2 (It can be installed through the Microsoft Web

Platform Installer );

If you intend to host the solution on a single server, install Microsoft SQL Server (see

Database Instance

);

Install Internet Information Services (IIS) 7.0 or better (see https://technet.microsoft.com/enca/library/hh831475.aspx#InstallIIS );

Install Remote Desktop Manager Enterprise - Windows Edition

Installation steps

Create a new instance of Devolutions Server (see

Create Devolutions Server instance );

Create a Devolutions Server administrator account on the

User Management ;

Create Security Groups and Roles (see

Security Group Management and

Role Management

and Security - Best practices )

Add domain users or built-in users (see

User Management

)

For more detailed information about Devolutions Server, please consult the others sections of this online help.

2.3 Topologies

Description

Devolutions Server can be installed through different topology types. The following are examples of different topologies serving various purposes.

Same Server Topology

The Devolutions Server and the SQL Server can be installed on the same machine for a small team up to

20 users. Having Devolutions Server and SQL Server on the same machine could result in certain performance issues.

Contents

| 17

Sam e server installation

Recommended Basic Topology

A recommended basic topology consists of two servers, one for the Devolutions Server and one for the

SQL Database. By doing so, resources from the machine are all available for the application and performance is certainly more effective than installing Devolutions Server and SQL Server on the same machine.

Basic topology

18 |

Devolutions Server

High Availability Topology

Database layer only

For a high availability of the Database, Database Mirroring can be used which replicates data to a partner server. The fail over partner server will be ready at anytime when the main server becomes unavailable.

This ensures that the Devolutions Server is still accessing the Data Source and is transparent for

Remote Desktop Manager users.

High availability topology

Load Balancing Topology

To ensure maximum performance of the Devolutions Server, it can be deployed as a load balancing

Devolutions Server topology as illustrated in the image below. It can either be a physical or software load balancing system.

Contents

| 19

Load balancing Devolutions Server topology

Devolutions Server Instance Manual Failover

To those customers that do not wish to purchase a load balancer, or are seeking a more simplified topology to their system, can simply utilize two Devolutions Server Instances on two different web servers, but direct them to the same SQL Server database. By registering both instances as separate data sources in the client applications, users can manually toggle between servers in the scenario that one becomes unresponsive.

Manual failover w ith tw o Devolutions Servers

Installation

Part III

3

22 |

Devolutions Server

Installation

Topology

If you have received your serial licenses keys, please refer to the

Getting Started topic.

A Devolutions Server instance is in fact a Web application. This allows for exposing its services on the

Internet or on your Intranet.

The recommended topology is the use of two servers: a Database server and a Web server. For smaller installations, a single server can be used, but resources will be shared between the two roles, thereby minimizing performance.

Remote Desktop Manager Enterprise - Windows Edition must be installed on the web server in order to manage the Devolutions Server instance.

Please ensure before starting the installation that you have .NET 4.5.2 installed on your machine.

It's highly recommended to enable SSL Encryption to protect communication with the instance of the SQL Server. Please follow the instructions on http:// support.microsoft.com/kb/316898 Note that we recommend this be done after the initial setup is complete.

For full active directory integration, the application pool uses a domain identity, both servers need to be joined to the domain.

How to install the server

Web Server pre-requisites

Please refer to the appropriate topic depending on the operating system of the web server.

Web role - Install pre 2012R2

Web role - Install 2012R2

After you have installed the pre-requisites, test the IIS installation by navigating to http:// localhost . Do not proceed further if you do not see the IIS welcome screen. There are issues that must be resolved.

Database server pre-requisites

Contents

| 23

Please refer to

Database Instance

Create Devolutions Server Instance

Please refer to

Create Devolutions Server instance

3.1 Web role - Install 2012R2

Description

Configuration of the Web server in Windows 2012 R2 is a significant departure from previous versions.

These steps are primarily manual at this time. They were performed on a Windows 2012 R2 image that had been installed from the DVD image with the Windows Updates applied.

Install the Web Server Role

Using the Roles and Features wizard, add the Web Server Role.

Add missing Role services

In the Security branch, enable the following authentication services: Basic, Digest, and Windows.

Web Server services

24 |

Devolutions Server

Install ASP.Net

We recommend using the web platform installer to install the .NET framework. .NET 4.5 is an "in-place" upgrade of the framework and is complex to determine which version is install.

Make sure that ASP.Net 4.5 is installed on your Windows server.

Register ASP.NET in IIS

This is best achieving using the Web Platform Installer. In IIS Manager, when the server node is selected, you will notice "Get New Web Platform Components". Use this to install the Web Platform Installer.

IIS Manager w ith Com m and to install WPI

When you launch the WPI, highlight the Products category and browse for Asp.net registration, Add it, and select Install.

Install URL Rewrite module 2

This is best achieving using the Web Platform Installer. Search for URL Rewrite in WPI, add it and select install.

Contents

| 25

You can also download it on this web page https://www.iis.net/downloads/microsoft/url-rewrite .

Allow for Configuration Personalization by Web Applications.

New to this IIS release, certain configuration settings are locked down at the root of the web site. Since

Devolutions Server requires specific directives, we need to allow for web applications to adapt the configuration at their level.

This is easiest when using the APPCMD executable. Open an elevated command prompt (Run As

Administrator). Set the working folder to %windir%\system32\inetsrv\ and run the following two commands.

appcmd.exe unlock config -section:system.webServer/handlers appcmd.exe unlock config -section:system.webServer/modules

3.2 Web role - Install pre 2012R2

Description

This section illustrates the first version instructions applicable to a server running Windows 2008 up to

2012 (R1)

We recommend using the web platform installer to install the .NET framework. .NET 4.5 is an "in-place" upgrade of the framework, and can be rather complex to determine which version is installed.

Web Server Pre-requisites

Make sure "Internet Information Services" is installed with all the ASP.NET requirements.

26 |

Devolutions Server

Window s features

3.3 Database Instance

Description

Install SQL Server Express or Standard. Download SQL Server 2016 Express from Microsoft's site .

If full integration with Active Directory is required, you can decide to activate Windows Authentication solely. Please refer to the MSDN online help for full details.

Under Windows authentication, you must set the Application Pool identity to an account from the

domain. We recommend creating a dedicated account for this purpose. Please refer to Configure

Devolutions Server to use integrated security for instructions that need to be performed AFTER creating

the Devolutions Server instance.

Devolutions Server has no requirements that would dictate which communication protocol is used, as well as many of the options offered to you by the SQL Server instance. As long as the client workstation

Contents

| 27 can connect to the SQL Server instance, Devolutions Server will run effectively. Please refer to the

Microsoft Documentation in order to allow connectivity to the instance.

3.4 Create Devolutions Server instance

Description

If you have recently received your serial licenses keys, please refer to the

Getting

Started topic.

The Devolutions Server product can host multiple instances that will each reside in their own Web

Application within IIS. The following steps are carried out using the Remote Desktop Manager Enterprise

- Windows Edition.

Procedure

1. Install Remote Desktop Manager Enterprise - Windows Edition on the web server. It is available from the Download page

2. Execute Remote Desktop Manager Enterprise - Windows Edition with elevated privileges (run as administrator). This is performed by right clicking on the application, and selecting Run as

administrator.

Run Rem ote Desktop Manager Enterprise - Window s Edition w ith elevated privileges

3. Open the console by selecting Tools > Devolutions Server Console.

Tools toolbar

28 |

Devolutions Server

All operations performed through the console are done with the credentials used to launch Remote Desktop Manager. If you must use other credentials, you will need to launch another window session. The RunAs command does not offer the option of starting a process with elevated privileges.

4. Deploy a new server instance.

Devolutions Server Console

5. The first dialog shows if the IIS Server has all the necessary prerequisites installed, and is ready to run Devolutions Server. If any error appears with the red X, please resolve this issue before proceeding.

IIS Prerequisites

Contents

| 29

6. Configure the instance by personalizing the name and description to your liking. Enter the serial license key that was sent by email, or you may Request a trial

Devolutions Server Installation Wizard

7. Select a zip file or use the automatic download function. Choose a destination folder, and an IIS virtual directory name. The process to run Web sites has been granted the proper permissions under

c:\inetpub\wwwroot. We recommend you create a new folder beneath it, and create the Devolutions

Server instance under that folder.

30 |

Devolutions Server

Source and Destination

Create and select folder

8. Enter the Server and Database settings, and create the database. If you wish to use integrated security to connect to the database please consult

How to Configure Devolutions Server to use

Contents

| 31

integrated security . It is also possible to create a database directly from this form when the user

account that you are using has sysadmin privileges in the SQL Server instance.

Create a database

Database

Settings

Server

User

Integrated security

Password

Test Server

Database

Create Database

Test Database

Update Database

Use SQL Server encrypted connection

Description

Name of the server.

Username to access the database.

Use the current windows session security to connect to the database. Disables the User and Password fields.

Password used to access the database.

Test the connection with the server to validate if the proper information has been provided.

Name of the database to access.

Create a new database on your server.

Test the connection with the database to validate if the proper information has been provided.

Update the database on the server.

Will use the SQL encrypted connection.

32 |

Devolutions Server

Trust Server certificate

Caching mode

Failover partner

Email Schema to Support

Will always trust the specify server certificate used for the authentication.

Disabled: No client caching.

Simple: Simple caching is the legacy caching mode.

Performance may suffer when connected to data sources containing many sessions.

Intelligent: Intelligent cache has the ability to handle many more sessions without experiencing performance degradation.

Enter the initial principal server and database in the connection string and the failover partner server.

Helper to send your database schema to the Devolutions Support team.

Will show you what is your database version.

View database version

9. You must choose the authentication options. For the initial setup, we recommend enabling

Authenticate with Devolutions Server custom user. This guarantees connectivity for the first steps, that can be later disabled. If you are connected to a domain, refer to the

Authentication server settings for further information.

Authentication settings

10. Make sure the Internet Information Services (IIS) is installed in order to proceed with the installation of Devolutions Server.

Contents

| 33

IIS Settings

11. Ensure the ASP.NET State service has begun or set to automatically start. The State Service is required to maintain the web session information between each call. If you select "Start ASP.NET

State Service and receive a response of "Service is not installed", this means that ASP.NET has not been installed correctly.

34 |

Devolutions Server

ASP.Net State Service configuration

12. Configure the email settings. You can decide to disable this feature by using the check box.

SMTP Configuration page

13. Once all the steps are completed, click Install.

Contents

| 35

36 |

Devolutions Server

Installation sum m ary report

14. Once the installation is complete, a window will open to confirm that the deployment of the server has been performed.

Contents

| 37

Installation com pleted

15. You can test the server installation by opening the URL (e.g.: http://localhost/DVLS ) or by clicking on the globe icon in the Devolutions Server Console.

Devolutions Server Console

16. Create at least one administrator user account.

You must create an administrator account if you've enabled the Devolutions Server

Authentication model. In other cases, the account name must match with the chosen authentication model. If you are unsure of the result, also enable Devolutions Server authentication, create an administrator account and grant the Administration privilege to the account. Please refer to

User Management for further information about creating

user accounts.

After the successful authentication with the other model, the Devolutions Server user account will have been created and you will be able to see how to format your account names. You can then disable the Devolutions Server authentication model. Please see

Automatic User Account Creation

38 |

Devolutions Server

Upgrading Devolutions Server

Part IV

4

40 |

Devolutions Server

Upgrading Dev olutions Serv er

Upgrade

It is highly recommended as a best practice to first deploy the new version of Devolutions Server to a staging instance and verify its stability before deploying it to your whole organization. If you do not have a staging instance we then recommend a limited roll-out to ensure the work flow is supported to your satisfaction prior to impacting your whole team.

Some new releases will have additional steps, please consult these topics as appropriate.

Upgrading to 3.0

Upgrading to 3.2

Workflow

· Ensure that the instance users have the offline mode enabled and that they all perform a full refresh of the cache (CTRL+F5)

· Have your team switch to the offline mode, allowing them to work while the system is down

· Perform a full backup of the database, take precautions against that backup file being deleted by a maintenance plan.

· Archive the content of the folder containing the Devolutions Server instance (zip)

· Update the Maximal version of RDM in Administration - Data Source Settings - Version

Management - Maximal version, if this option was set before the upgrade.

· Install the desired version of Remote Desktop Manager Enterprise - Windows Edition

· Run with elevated privileges in order to access the Devolutions Server Console

· Choose the Devolutions Server instance in the console, then press the upgrade button and follow the procedure below.

· Upon success, have a user upgrade his workstation with the same version of Remote Desktop

Manager and test connectivity with the server instance.

· When you are satisfied, have the rest of the staff upgrade to the same version of Remote

Desktop Manager.

Wizard Steps

1. Open the

Devolutions Server Console .

2. Select the instance that you wish to upgrade.

3. Click the Upgrade server button.

Upgrade source

4. Select upgrade source. You can either use the latest General Availability release that is available online automatically, or specify the path to a zip file that you have downloaded yourself. Use this for beta releases or for earlier versions.

Select upgrade source

5. Press Next.

6. Review the summary and press Upgrade if you are satisfied.

Contents

| 41

42 |

Devolutions Server

Upgrade com pleted successfully

4.1 Upgrading to 3.0

Description

Please contact the support team for an appointment. We will perform the upgrade with you in a remote session.

4.2 Upgrading to 3.2

Description

Please contact the support team for an appointment. We will perform the upgrade with you in a remote session.

Errors

After upgrading Devolutions Server to version 3.2.0.0, it is possible that none of the users can authenticate on the server.

Error dialog from Data Source login attem pt

Contents

| 43

Error from Web interface login attem pt

Cause 1

Please note that if the user name format used is only the Username instead one of

NETBIOS (Domain\Username) or UPN ([email protected]), it will be impossible to authenticate on Devolutions Server version 3.2. A DB Script will need to be run in order to prefix the domain name in the user name field. We can send the script upon request, but we would prefer to perform this task with you in a remote session.

Cause 2

The account authentication type is not specified, follow these steps:

1. On the computer that is hosting the Devolutions Server instance, launch Remote Desktop Manager with elevated privileges and open the Devolutions Server Console from the Tools menu.

44 |

Devolutions Server

Rem ote Desktop Manager Enterprise - Window s Edition Tools m enu

2. Select the Devolutions Server instance and click on the User Management button.

Devolutions Server - Console

3. Edit each user and check if the Authentication type is editable. This means that the authentication type is not specified and it was guessed by the application. Please DO NOT CHANGE THE

AUTHENTICATION TYPE and click on the OK button to save the Authentication type.

User Managem ent dialog

Contents

| 45

4. Or you can use the Batch edit button in the User Management dialog to modify two or more users at the same time. Select all users with the same Authentication type and click on the Batch Edit button.

5. Check the second Override check box, select the correct Authentication type form the drop down list and click on the OK button.

46 |

Devolutions Server

6. If the Authentication type is currently saved in the database, then it is impossible to modify it to another authentication type. Be sure to select the correct Authentication type before saving any modifications.

Management

Part V

48 |

Devolutions Server

5 Management

5.1 Devolutions Server Console

Description

Because Devolutions Server is in fact a web application, the management interface is provided by

Remote Desktop Manager Enterprise - Windows Edition. The management interface is called the

Devolutions Server Console.

Console

1. Because the Devolutions Server Console manages the IIS metabase, Remote Desktop Manager must be started with elevated privileges when the console needs to be used. Elevated privileges are granted when you use "Run as Administrator" to launch the application. You can modify the shortcut to always start it in this manner if you prefer.

2. Select Tools - Devolutions Server Console

Ribbon-Tools

Devolutions Server Console

Actions

New

Modify

Delete

Refresh

View Logs

Explore Content of web site directory

Server Diagnostic

5.2 Authentication

Description

Devolutions Server supports multiple authentication models.

Contents

| 49

Authentication tab

Settings

Domain Authentication

The server hosting the instance must be joined to a domain in order to achieve domain authentication. (This will be improved in our next release).

The domain is used to authenticate the user. This is the most secure, flexible and easiest to manage. No need to sync users between the domain and Devolutions Server. On first use of the

Devolutions Server data source, the user will be created and be given access rights according to their role in the organization as defined on the domain. You simply need to grant appropriate permissions to your roles in Devolutions Server, upon authentication we will validate the AD groups

50 |

Devolutions Server to which the user belongs, and for any that have a corresponding role we will grant the permissions to the user.

Option

Authenticate with domain user

Domain

Domain controller

Test

Use inherited AD group

Auto create domain users in database

Trusted domains

Description

The domain is used to authenticate the user.

Specify the remote computer domain name.

Specify the name of the Domain Controller.

Test the users login and verify which group your user belongs to in

Remote Desktop Manager Active Directory.

Use the Active Directory group configured in the parent AD Group.

Automatically create the domain user in the the database.

Add your trusted domains.

Other Authentication Modes

Option

Authenticate with

Devolutions Server custom user

Authenticate with local machine user

Authenticate with database user

Description

The Devolutions Server is used to authenticate the user. You must create the initial user through the console.

The application allows a local user to be authenticated on the server.

The database is used to authenticate the user.

Settings

Option

Use legacy authentication mode

Description

Authentication mode for users created in a previous version of

Devolutions Server and that has been updated to version 3 or more.

5.3 Automatic User Account Creation

Description

When using authentication models other then Active Directory, obviously a user account needs to be created beforehand in order to grant access to the system.

When you are using Active Directory authentication, two choices are offered to you:

1. You can choose to create the user account manually, just as with the other authentication models; or

2. Enable Automatic Account Creation, and let Devolutions Server create user accounts as soon as they are authenticated by the domain you've linked the instance to.

Contents

| 51

After the account is created, rights and permissions are assigned either manually to the user account, or through membership in AD groups for which you have created a role mapping.

User accounts created by the server have no rights other then logging on the system.

They will be able to see and edit the objects that have no security defined. You must ensure that all sessions are protected, typically this is achieved by ensuring that all root level folders have a security group assigned to them.

Depending on the authentication mode used, the user name may be prefixed by the domain name, and the exact naming convention is controlled by the domain. For instance, for a WINDJAMMER domain that is registered as windjammer.loc, we have no way of knowing beforehand what form will be reported by the AD services. It is recommended to always enable both Devolutions Server authentication initially and create an Administrator account for the initial phase of implementation.

5.4 Security

Description

The Security section of the Devolutions Server Console allows you to manage your instance. These management features are exactly the same as the one offered under the Administration tab of the various Desktop Clients, when they are connected to that instance through a Data source.

Since the latter is the one you will spend most of your time using, whenever a new instance is created, we recommend creating an administrative user, then register the instance as a data source in your

Desktop Client of choice. This will bring you in a more familiar territory and will help you get around more quickly.

If you are indeed using full AD integration, whereas the assignment of permissions comes mostly from

AD Group membership, then the roles are the mechanism that make this work.

The sections below are to cover the basic management features if you cannot use a desktop client.

Security Group Management

User Management

Role Management

5.4.1

Security Group Management

Description

Security Groups are used to assign a security scheme to all entries, but we recommend you set them only on folders which will result in the child entries to inherit the security group. There is no direct

relationship between Active Directory and Security Groups. By default, every session is created without a security group, and is visible to all connected users. You can grant permissions against a group to a user account or to a role.

All sessions without security groups are considered public.

52 |

Devolutions Server

Managing Security Groups

Security groups are managed from the Security Groups button of the Devolutions Server Console or from Administration - Security Groups.

Manage Security Groups from Devolutions Server Console

Manage Security Groups from Adm inistration

Security groups have no significant properties of their own, they carry a name and a description. They are simply a linking mechanism between an entry and a security matrix (from the users or roles permissions). A Security group can be interpreted as a container of sessions.

Contents

| 53

Security Groups Managem ent dialog

For more information, please consult

How to Configure Security Groups and Roles with AD Integration .

5.4.2

User Management

Description

With the Devolutions Server data source, you can create users and grant them permissions. You must be administrator of the database to create users and assign rights. The users management is available from the menu Users - Add User or from the Devolutions Server Console when executed locally on the server.

Edit the data source users

Adding a User

If you wish, you can create a user linked to a domain account or a built-in user. If the option Auto create

domain users in database has been set in the Authentication tab of the Devolutions Server settings,

54 |

Devolutions Server domain users are created automatically the first time they log-on. They don't have any rights except what is public.

User m anagem ent dialog

Linking a Security Group to a User

You can manage the rights and groups in the Permissions tab. A user with administrator rights has access to all of the configured sessions from all groups.

Contents

| 55

User Perm issions tab

Linking a Role to a User

Roles are assigned when the user is authenticated from the Domain. For more information, please consult

How to Configure Security Groups and Roles with AD Integration .

5.4.3

Role Management

Description

Active Directory groups must be created before creating Roles.

Role management is only available when the Domain authentication is enabled. This allows the server to link an Active Directory (AD) group to a role in Devolutions Server. All the role settings are applied to the users that are member of the AD group.

56 |

Devolutions Server

Edit the data source roles

Roles can be edited from the Devolutions Server Console locally on the server or from a remote data source by using the menu Roles.

Role editor dialog

For more information, please consult

How to Configure Security Groups and Roles with AD Integration .

5.4.4

LDAP over SSL

The LDAP over SSL (LDAPS) is a method to secure LDAP communications.

By default, LDAP communications between client and server are not encrypted. In some organizations, this could lead to a security breach.

To securize this protocole, the LDAP over SSL must be set on the server and for the client authentication.

Follow this link for further information http://social.technet.microsoft.com/wiki/contents/ articles/2980.ldap-over-ssl-ldaps-certificate.aspx

Contents

| 57

5.5 Web Interface

Description

Because of documented vulnerabilities of web browsers, particularly their extensions, we do not perform any password decryption in a web browser. The web interface is feature-limited purposefully and you must use the client to perform any modification to entries.

Home page

Open a browser to the URL that you have chosen for your Devolutions Server instance. If you have followed the default settings for a first installation, it should normally be available at http://localhost/dvls .

Dashboard

Web interface

58 |

Devolutions Server

Connections

Dashboard

View

Modify Account

View /Modify sessions

Modify Users

My Account

Modify Security Groups

View /Modify users

Modify Roles

View /Modify Security Groups

Contents

| 59

60 |

Devolutions Server

Reports

Connected users

View /Modify Roles

Login attempts

Reports - Connected User List

Login history

Reports - Login Attem pt

Configuration

Reports - Login History

5.6 Server Settings

5.6.1

General

Description

Configuration

Contents

| 61

62 |

Devolutions Server

General tab

Settings

General

Option

Name

Description

Registration

Option

Serial

Request trial

5.6.2

Database

Overview

Description

Enter the name for your server, it will be displayed in the Content area.

Enter a short description or additional information.

Description

Insert your serial registration number.

This will redirect you to our Devolutions Server page to request a free 30 days trial.

Contents

| 63

Database tab

Settings

Database

Note that the User/Integrated Security settings affect how the Devolutions Server Console communicates with the database, NOT the instance itself.

Option

Server

User

Integrated security

Password

Test Server

Database

Create Database

Test Database

Description

Name of the server where the database will be stored.

Enter the username to access the database.

Specify to use Windows Integrated Authentication for authenticating to the database. In order for

integrated security to be used to connect

to the database, you must set a domain account as the Application pool identity.

Enter the password to access the database.

Test the connection with the server to validate if the proper information has been provided.

Name of the database on the server for the utilization of Remote

Desktop Manager.

If the database doesn’t already exist you can create one directly from here. In order to use integrated security correctly, the database must be created with db_owner rights.

Test the connection with the database to validate if the proper information has been provided.

64 |

Devolutions Server

Update Database

Use SQL Server encrypted connection

Trust server certificate

Caching mode

Failover partner

Email Schema to Support

View database version

5.6.3

Authentication

Overview

Update the database on the server, if required to use Remote

Desktop Manager.

Use SSL to encrypt communication with the database.

Always trust the server certificate.

The caching mode will determine how the instance will re-load entries when changes are detected. On large data sources caching is a must and will increase performance significantly.

The name of the failover partner server if database mirroring is configured. This is used only for the initial connection as the principal server will return a name which will replace the configured value when different.

Directly sends your schema to the Devolutions Support team.

View what is your current database version.

Select the type of authentication method used by your users to connect to the Devolutions Server. As best practice we would strongly recommend the use of Domain Authentication method as it can be integrated with Active Directory Group and makes it easier to manage.

Authentication tab

Contents

| 65

Settings

Domain Authentication

Option

Authenticate with domain user

Domain

Domain controller

Test

Use inherited AD group

Auto create domain users in database

Trusted domains

Description

The domain is used to authenticate the user.

Specify the remote computer domain name.

Specify the name of the Domain Controller.

Test the users login and verify which group your user belongs to in

Remote Desktop Manager Active Directory.

Use the Active Directory group configured in the parent AD Group.

Automatically create the domain user in the the database.

Add your trusted domains.

Other Authentication Modes

Option

Authenticate with

Devolutions Server custom user

Authenticate with local machine user

Authenticate with database user

Description

The Devolutions Server is used to authenticate the user. You must create the initial user through the console.

The application allows a local user to be authenticated on the server.

The database is used to authenticate the user.

Settings

Option

Use legacy authentication mode

5.6.4

2-Factor Authentication

Overview

Description

Authentication mode for users created in a previous version of

Devolutions Server and that has been updated to version 3 or more.

This feature is only available when using a Devolutions Server Corporate license

The Two-factor authentication (2FA) provides unambiguous identification of users by means of the combination of two different components. These components may be something that the user knows or something that the user possess.

The use of two-factor authentication is used to prove one's identity is based on the premise that an unauthorized actor is unlikely to be able to supply both factors required for access. If, in an authentication attempt, at least one of the components is missing or supplied incorrectly, the user's

66 |

Devolutions Server identity is not established with sufficient certainty and then access to the asset being protected by twofactor authentication will remain blocked.

2-Factor Authentication

2FA supported by Devolutions Server

For more information on how to configure the 2FA on the Devolutions Server, please follow this

link

5.6.4.1

Google Authenticator

Description

Devolutions Server supports Google Authenticator to provide an additional security layer when opening a selected data source.

Settings

Before you start the configuration, make sure you have installed the Google

Authenticator application on your Android device, Blackberry or on your Apple product

(iPhone, iPad or iPod Touch).

See Google Authenticator for more information on the settings.

Contents

| 67

5.6.4.2

Yubikey

Description

Devolutions Server allows you to configure Yubikey to provide an additional security layer when opening a selected data source.

Settings

Before you start the configuration, make sure you have a Yubikey in your possession.

See Yubikey for more information on the settings.

5.6.4.3

SafeNet

Description

The 2FA Email setting is only available for the Devolutions Server. It allows to configure SafeNet to provide an additional security layer when opening a selected data source.

Settings

Before you start the configuration, make sure you have a SafeNet device (eToken, iKey or Smart Card) in your possession.

Please consult our Online Help on

SafeNet settings .

Please consult the SafeNet website for more information about it.

5.6.4.4

Duo

Description

Devolutions Server allows you to configure Duo to provide an additional security layer when opening a data source.

Settings

Before you start the configuration, make sure you have created and configured your Duo account. For more information about Duo authentication, please consult Duo web page.

See Duo for more information on the settings.

5.6.4.5

AuthAnvil

Description

Devolutions Server allows you to use AuthAnvil Authenticator to provide an additional security layer when opening a selected data source.

68 |

Devolutions Server

Settings

Before you start the configuration in Devolutions Server, make sure you have created and configured your AuthAnvil account. For more information on AuthAnvil installation please consult http://www.scorpionsoft.com/tour/intro .

See AuthAnvil for more information on the settings.

5.6.4.6

Overview

The 2FA Email setting is only available for the Devolutions Server. It will request the user's email account as its second component to access the data source.

If you have selected the option Required in the 2FA usage option every user will automatically have a

2FA request when logging in, it will not be necessary to edit each and every one of your users as long as they have an email address set in their User setting.

If you select the option Optional per User in the 2FA usage option you will have to proceed to a set up for each user you wish to use the 2FA.

For this option to be valid you will have to configure the Server and the User.

Please see

2FA Email for more information on the settings.

5.6.4.7

SMS

Overview

The 2FA SMS setting is only available for the Devolutions Server. It will request the user to enter a code he has received on his mobile phone as its second component to access the data source.

If you have selected the option Required in the 2FA usage option every user will automatically have a

2FA request when logging in, it will not be necessary to edit each and every one of your users as long as they have an mobile phone number set in their User setting.

If you select the option Optional per User in the 2FA usage option you will have to proceed to a set up for each user you wish to use the 2FA.

For this option to be valid you will have to configure the Server and the User.

There are two possible configurations with 2FA SMS.

2FA SMS Free

2FA SMS Twilio

5.6.4.8

Azure MFA

Overview

Contents

| 69

The 2FA Azure MFA setting is only available for the Devolutions Server. It will request the user to reply a code he has received on his mobile phone or by answering a phone call from Azure.

The Azure Multi-Factor Authentication (included in Azure AD Premium and

Enterprise Mobility Suite) is required in order to be able to download the SDK file needed for the Devolutions Server configuration.

For more information Azure Multi-Factor Authentication, please consult this web site https:// azure.microsoft.com/en-us/documentation/articles/multi-factor-authentication/ .

For more information on how to configure the Azure MFA, please consult the

Azure MFA settings topic.

5.6.4.9

Radius

Description

Devolutions Server supports Radius authentication to provide an additional security layer when opening a selected data source.

Settings

Before you start the configuration, make sure you have a properly configured Radius server available in your organization.

5.6.4.10 Vasco

Description

Devolutions Server supports Vasco authentication to provide an additional security layer when opening a selected data source.Vasco’s two-factor authentication ensures only authenticated users gain access.

Settings

Before you start the configuration process in Devolutions Server, make sure you have created and configured your Vasco account. For more information on Vasco installation please consult https://www.vasco.com/two-factor-authentication.html

1. Select Vasco from the list of available 2-Factor Authentication types.

70 |

Devolutions Server

2-Factor Authentication - Vasco

2. Configure your Vasco settings. An example is provided below.

Option

Url

Component

Type

Password

Format

Vasco soap Settings - Configuration Screen

Description

Website of the server.

The instance name created in Vasco.

One-Time Password (OTP): One-time passwords can only be used once, during a very short time e.g. 10 seconds. They offer superior security to static passwords which are more vulnerable to unauthorized use because they remain the same.

Static Password: Most conventional method of password authentication. It is also the least secure method of preserving your password. Your password essentially remains the same from the moment it is created, until it is changed or updated for that specific account.

Contents

| 71

5.6.5

Security

Overview

The Security tab is used for added security by controlling access to the Devolutions Server with IPs addresses.

Security tab

Settings

Option

Allowed Single IPs

Allowed Masked IPs

Denied Single IPs

Denied Masked IPs

Description

If you wish to restrain the access to the Devolutions Server to only certain IPs address enter those here. If nothing is entered in this field all IPs address will be allowed to connect to the Devolutions Server.

If you wish to restrain the access to only certain Masked IPs (dividing the host part of an IP address into a subnet and host address) on the

Devolutions Server, enter those Masked IP address here.

If you wish to deny access to the server from certain IPs address enter those in this field.

If you wish to deny access to the server from certain Masked IPs address (dividing the host part of an IP address into a subnet and host address) enter those in this field.

72 |

Devolutions Server

Auto Lock

Option

Enabled auto lock

Description

Automatically locks down the access to the Server after a predetermine number of failed attempt.

Enter the number of failed attempts before locking down the Server.

Attempt Count

5.6.6

GeoIP Security

Overview

The GeoIP refers to the method of locating a computer terminal's geographic location by identifying that terminal's IP address.

Settings

Option

GeoIP Mode

GeoIP Security tab

Description

Choose your method of GeoIP between:

None: Will not be using GeoIP security

Free GeoIP: Use the GeoLite database to look up the city, AS number and other information for an IP address and then select the countries you wish to grant access to your Devolutions Server.

Contents

| 73

MaxMind: Use the MaxMind's GeoIP database to look up the city,

AS number and other information for an IP address. Connect to your account by entering your User ID and License Key in the appropriate field and then select the countries you wish to grant access to your

Devolutions Server.

5.6.7

IIS

Overview

The IIS settings are part of your prerequisite at the installation level. Most of what is found in this tab is automatically filled in by the information given while setting up your Devolutions Server, the IIS Settings tab is used more as informative than configuring.

IIS Settings tab

Settings

Option

Force https

Encrypt web.config file

Description

Force the use of the https instead of the http.

Activate this option if you wish to add an extra layer of security to your configuration by encrypting your file.

74 |

Devolutions Server

5.6.8

Session State

Overview

Devolutions Server by default will use the State Server mode which holds your information until logging off the server or when being inactive for a period of more than 20 minutes. You may choose other Session

State modes if you are inclined to do so, but since they are not required for proper operation, Devolutions will not provide support on how to put them in place. Please refer to Microsoft's documentation on the subject.

Session State tab

Settings

Option

Mode

Auto start Start

Service

State Connection

String

Description

You can choose your Session state mode between:

State Server: Devolutions Server strongly recommend the use of the State

Server, by default this will be the chosen method.

Off: No information will be kept.

Automatically starts the Start Service when logging into your Devolutions

Server.

If you wish to specify the State Connection String, this could be useful when using the SQL Server Mode or when not using the default path of the

Connection String.

Contents

| 75

Start ASP.NET State

Service

Manually start the ASP.NET State Service.

Stop ASP.NET State

Service

Manually stop the ASP.NET State Service.

5.6.9

Overview

Emails are sent by our Notification engine and by some of our 2 factor authentication providers.

Em ail tab

Settings

General

Option

Email enabled

Description

It is mandatory to enable this option to send notifications or for some 2FA providers.

SMTP Configuration

Option

Host

Description

Enter the host for the SMTP server.

76 |

Devolutions Server

Port

Enable SSL

Set the SMTP server port.

Specifies whether to use Secure Sockets Layer (SSL) to encrypt the connection. Please see

Note 1 for important information.

Enter your username to connect to your SMTP server.

Username

Password

Send email as

Enter your password to connect to your SMTP server.

Enter the display name.

Email administrator Logs and errors will be sent to the email address entered in this field.

Test Email Test your email settings.

Note 1

Devolutions Server only supports the SMTP Service Extension for Secure SMTP over Transport

Layer Security as defined in RFC 3207. In this mode, the SMTP session begins on an unencrypted channel, then a STARTTLS command is issued by the client to the server to switch to secure communication using SSL.

An alternate connection method is where an SSL session is established up front before any protocol commands are sent. This connection method is sometimes called SMTP/SSL, SMTP over SSL, or

SMTPS and by default uses port 465. This alternate connection method using SSL is not currently

supported.

5.6.10 User Interface

Overview

The User Interface tab enables the user to customize the interface according to the preference of the user. The three facets of the User Interface tab consists of Logo, Grid page size, and Date and time format. The settings table below lists all possible options that can be tailored to the user's specifications.

Settings

Option

Logo

Grid page size

Description

- None

- URL

- File

- 10

- 20

- 50

Date and time format - Default

- US

- Custom

Date

Year

Month

Day

Time

Hours

Date/Tim e Form at

Date/Time Format

- yyyy = 2016

- yy = 16

- MMMM = September

- MMM = Sep

- MM = 09

- M = 9

- dddd = Sunday

- ddd = Sun

- dd = 09

- d = 9 (If applicable, 25 can not be 5).

Date/Time Format

- h = 1

- hh = 01

- H = 1 (If applicable, 11 can not be 1).

- HH = 13

Contents

| 77

78 |

Devolutions Server

Minutes

Seconds

TimeZone

- mm = 05

- m = 5 (If applicable, 25 can not be 5).

- ss = 08

- s = 8 (If applicable, 25 can not be 5).

- tt = PM or AM

- zzz or zz or z = EDT

5.6.11 Logging

Overview

Devolutions Server already manages log, however if using a Syslog Server you might also wish to connect your Devolutions Server logs to it to centralize all your logs in one place and on a web interface.

Logging tab

Settings

Option Description

Log to Syslog server Enable the Syslog Server.

Host Enter your Syslog Server host to connect.

Port

Protocol

Enter your Syslog Server port to connect.

Select your preferred Protocol mode between:

TCP

Contents

| 79

UDP

5.6.12 Notifications

Overview

The

Email settings must be configured in the Devolutions Server instance in order for

notifications to be sent.

The Notifications settings is used to send email notifications to specific users. These notifications include any activities on sessions, security groups, roles, users, etc.

Settings

Notification settings

Categorie

Allow notification subscription

Time Zone

Notifications Dashboard

Description

If checked, enable the notifications for the Devolutions Server instance.

Time zone used to display the time stamp in the notification email.

80 |

Devolutions Server

Notifications Dashboard

Settings

Users list

This list contains all users from your Devolutions Server instance. One or more users can be configured in a Notifications scenario. Each configured user must have their email set on the Information tab of the User Management settings.

Events

This is the categorized list of each Notifications type available. If none of the Events is selected, all type of Notifications is showed on the right pane of the Notifications Dashboard.

Notifications Types

Categorie

Connection

Connection opened

Description

If enabled, will send notification about modifications on Connections.

It is possible to set more than one Connection Notifications.

If enabled, will send notification when a user open a Connection. It is possible to set more than one Connection Opened Notifications.

Data Source Settings

Group

Role

User

User Locked Out

Enabling Notifications

Contents

| 81

If enabled, will send notification about modifications on the Data

Source Settings.

If enabled, will send notification about modifications on Security

Groups.

If enabled, will send notification about modifications on Roles.

If enabled, will send notification about modifications on Users.

If enabled, will send notification when a user is locked.

Setting

Enabled

Add

Edit

Delete

Notifications settings

Description

If checked, it enables this Notifications type.

If checked, will send notification when a user add an item.

If checked, will send notification when a user edit an item.

If checked, will send notification when a user delete an item.

Allow to select All Sessions or a specific Group Folder.

Allow to add or delete Notifications settings for the Connection and the Connection Opened types.

For an example of Notifications settings, please refer to

How to Configure Notifications .

Notification email

Here is a example of an email notice sends by Devolutions Server Notifications.

82 |

Devolutions Server

Notification em ail notice

How-To

Part VI

84 |

Devolutions Server

6 How-To

6.1 How to Configure Client Data Source

Create Devolutions Server data source

1. Select File - Data Sources.

Files - Data Sources

2. New Data Source.

Add a New Data Source

3. Select the Devolutions Server data source.

Contents

| 85

Select Devolutions Server Data Source

4. Specify settings.

If you specify %USERDOMAIN%\%USERNAME% in the user text area, the value of the corresponding environment variables will be used.

86 |

Devolutions Server

Data source settings

Notes

If the server is configured to only allow SSL, ensure you specify the protocol by using https:// as the protocol.

6.2 How to Configure Devolutions Server to use integrated security

Description

In order for integrated security to be used to connect to the database, you must set the Application pool to use a domain account to run under.

Steps

To make these instructions simpler, we will name the domain account RDMRunner, please adapt to your requirements.

· Create the RDMRunner account in the domain;

· Grant access to the

SQL Server instance

to RDMRunner;

· Grant access to the database to RDMRunner;

· In IIS Manager, expand the Application pool section and locate the application pool used by your

Devolutions Server site. By default it has the same name as the name of the web application;

· In the advanced settings, edit the Identity setting to set the RDMRunner account.

Contents

| 87

Application pool Identity

6.2.1

How to Grant access to SQL Server instance

Description

In order to use Integrated Security you will need to grant access and specific permissions to the domain account used to connect to the SQL Server Instance.

Steps

To make these instructions simpler, we will name the domain account RDMRunner, please adapt to your requirements.

1. Using Microsoft SQL Server Management Studio, right-click on the Security branch and select New -

Login.

88 |

Devolutions Server

2. In the dialog, click on Search.

MSSQL

Contents

| 89

Login - New

3. Change the location to your domain and then select the RDMRunner user account.

90 |

Devolutions Server

Select User or Group

4. In the User Mapping Section, find your database and check the Map checkbox.

User Mapping

5. In the Database role membership, grant the db_datareader role and then click OK to save the login.

Contents

| 91

Database role m em bership

Permissions

The permissions described below allow for ALL management operations to be performed through the

Devolutions Server instance.

Some may desire to harden the system. Hardening the system means to disallow certain operations from the Devolutions Server instance, which would make using a SQL Server data source, bound to the

same database, necessary for these operations. For instance you could decide to not allow to create users through the instance, but only through a direct SQL connection. Please contact us to discuss these scenarios.

Please note that these instructions were valid for version 258 of the database schema. If you run into issues and the schema is of a higher version please contact us.

To identify the current schema version, run

SELECT [DatabaseVersion] FROM

[DatabaseInfo]

At the Database level you will need to grant these permissions:

GRANT INSERT, DELETE, UPDATE ON Attachment TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON ConnectionHistory TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON ConnectionLog TO [DOWNHILL\RDMRunner];

92 |

Devolutions Server

GRANT INSERT, DELETE, UPDATE ON Connections TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON DatabaseInfo TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON DataSourceSettingHistory TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON GroupInfo TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON GroupInfoHistory TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON LoginAttempt TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON LoginHistory TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON Todo TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON TodoUsers TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON UserAccount TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON UserInfo TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON UserGroupInfo TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON UserInfoHistory TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON UserProfile TO [DOWNHILL\RDMRunner];

GRANT INSERT, DELETE, UPDATE ON UserSecurity TO [DOWNHILL\RDMRunner];

6.3 How to Configure SSL

Description

Please perform these steps only after you have configured the Devolutions Server instance and that you have indeed connected through a client application. Performing these steps right from the start may add a layer of complexity that may prevent you from succeeding in the initial configuration.

Import Certificate or Create Self-Signed Certificate

1. Select the server node in the tree view and double-click the Server Certificates feature in the list view:

Server certificates

Contents

| 93

2. Click Import Certificate... in the Actions pane Or Click Create Self-Signed Certificate... in the Actions pane.

Create a SSL Binding

1. Select the web site in the tree view.

Follow the w izard

IIS Tree view

2. Click Bindings... in the Actions pane. This brings up the bindings editor that lets you create, edit, and delete bindings for your Web site. Click Add... to add your new SSL binding to the site.

Add binding

3. Select https in the Type drop-down list. Select the self-signed certificate you created in the previous section from the SSL Certificate drop-down list and then click OK.

94 |

Devolutions Server

Define https binding

4. Now you have a new SSL binding on your site.

The new binding

Configure SSL Settings in IIS

1. Select a Devolutions Server application in the tree view.

IIS Tree view

2. Click on SSL Settings

Contents

| 95

Web site icons

3. Configure SSL settings if you want your site to require SSL, or to interact in a specific way with client certificates. Click the site node in the tree view to go back to the site's home page. Double-click the

SSL Settings feature in the middle pane. Select Require SSL and click Apply.

SSL Settings

Modify the Devolutions Server configuration

1. Start any text editor (notepad) using right click Run as Administrator

2. Open the file "web.config" found in the Devolutions Server install directory

3. locate this line in the file

4. Modify value from false to true

5. Save the file

Configure SSL Settings in the Client applications

1. Edit the Devolutions Server data source

2. Change the server URL to use the https:// protocol

96 |

Devolutions Server

6.4 How to Activate Your Renewal Subscription

Description

The Devolutions Server subscription is a yearly subscription. Every year, you need to renew your

Devolutions Server subscription to continue using it. With the renewal, a new license key is provided and needs to be entered in your instance configuration.

Settings

Remote Desktop Manager Enterprise - Windows Edition must be started with elevated privileges in order to use the Devolutions Server Console.

Click on Tools -> Devolutions Server Console menu and edit your Devolutions Server instance.

Edit

Replace the existing license key by the new one that you have received by email in the General -

Registration section.

Contents

| 97

General

6.5 How to Configure Two-factor Authentication (2FA)

Steps

This feature is only available when using a Devolutions Server Corporate license

In the Server Settings, select the Two-Factor tab

98 |

Devolutions Server

General

Option

2FA usage

Send reset email to

Tw o-Factor tab

Description

None: Will not be using the two factor authentication

Optional: Only users with 2FA configured in their profile will be prompted with a 2FA validation.

Required: Every users will need 2FA to connect to the Devolutions

Server instance.

Administrator: Sends reset email to all users that have the

Administrator check-box checked. Note that this does NOT include those that get the privilege through belonging to a role. If using full AD integration, this is not the recommended value.

Specific email: Sends reset email to the email address specified in the Specific email control that appears only when Specific email value is selected.

Email address which will receive reset emails.

Specific email

2FA supported

Contents

| 99

Each of our client applications will support one or multiple 2FA providers.

Default

Option

Default

Description

The Default option will only be activated when selecting Required in the 2FA usage option. If choosing more than one 2FA mode you will then be able to select the Default 2FA method for your users.

Configure Users

If Optional is set in Two-factor usage, the users that will require 2FA have to be configured.

1. On the Devolutions Server console, click on the Users icon to configure the users that should use the

2FA if the option Optional per User is set.

Devolutions Server console

2. Select the user and click on the Edit User button.

User and Security Managem ent

3. In General - Two factor click on Configure.

100 |

Devolutions Server

User m anagem ent

4. In the Two factor Configuration window select Change.

2-Factor Configuration

5. In the drop down menu select the two factor configuration (we have chosen Google Authenticator for this example) and click on Save.

Contents

| 101

2-Factor Configuration

6. You can select Configure later by user or configured it immediately with your user.

Google Authenticator Setup

102 |

Devolutions Server

Email

SMS Free is chosen as one of the Two Factor Supported, the SMTP server must be

configured and also the user email address or mobile phone number must be filled in.

See the

Server settings - Email for more information on how to configure it.

6.5.1

Summary dialog

To be completed.

6.5.2

Email settings

Settings

1. In the Email tab, configure your

SMTP Server

Em ail settings

2. On the Two-Factor tab, select Email as your 2FA mode.

Contents

| 103

104 |

Devolutions Server

Tw o-Factor Settings

3. Once the SMTP server is configured click on Save. A window will pop up warning you to configure your User.

Warning m essage for 2FA

4. In the Devolutions Server Console click on Users to configure the email account for your 2FA user.

Devolutions Server console - Users m enu

Contents

| 105

5. Select the User to Edit and in the General tab enter the user's email address. If you have selected

Required in the 2FA Usage you have completed all the steps as they will have to set up their own account when logging in for the first time. If you have selected Optional per User click on Configure to activate the 2FA for those users and continue with the following steps.

6. Click on Change to choose the 2FA

User Managem ent - General

106 |

Devolutions Server

2FA Configuration

7. Select your 2FA mode, if you have selected more than one option when setting up the 2FA all the selected options will appear in the drop down menu. Once you have selected your 2FA type click on

Save.

2FA Configuration

8. The Email setup window will appear, select the option Configure later by user. Every time the User connects to the data source he will be prompted with the Validation email window, the user can then click on Send email validation code and an email containing the validation code will be sent. If after a few minutes you still haven't received the validation code please verify the SMTP settings as if one of the

SMTP settings isn't correctly set up the email will never be sent and there will not be any error message.

When receiving the validation code, enter it in the appropriate field and click on Save. Your user is now set up and ready to access the Devolutions Server data source.

Contents

| 107

Em ail Setup

6.5.3

SMS settings

Description

There are two possible configurations with 2FA SMS.

2FA SMS Free

2FA SMS Twilio

6.5.3.1

SMS Free

Description

This 2FA SMS configuration use the free method to send SMS from a computer through an e-mail address composed by the mobile phone number and the domain of the Cellular carrier (e.g.:

[email protected]) . Please take note that not all Cellular carrier provide this type of SMS sendind method.

Settings

1. In the Email tab, configure your

SMTP Server .

108 |

Devolutions Server

Em ail settings

2. In the Two-Factor tab, select SMS as your 2FA mode.

Contents

| 109

Server Settings

3. After clicking on the Save button, it will display a message to fill in the mobile number of each user and to configure the Devolutions Server instance with the Service type set to Web API.

Configuration advice

4. On the Devolutions Server console, click on the Users icon to configure the users that should use the

2FA if the option Optional per User is set.

110 |

Devolutions Server

Devolutions Server console

5. Fill in the Mobile phone number in the Information tab of the User management window.

User Managem ent - Inform ation tab

6. The SMS 2FA can be configured directly through the User Management window. Click on Configure on the General tab.

User m anagem ent - General tab

7. Click on Change to set the 2FA Type.

2FA Configuration

8. After setting the 2FA Type to SMS, click on Save.

Contents

| 111

112 |

Devolutions Server

2FA Configuration

9. Check the Configure later by the user check box to let the user authenticate his connection to the

Datasource.

SMS setup

10. On the first connection to the Datasource, choose the Cellular carrier of the mobile phone and click on Send sms validation code.

Contents

| 113

SMS user authentication

11. A message box inform that the SMS code has been sent.

SMS sent

12. Enter, in the proper field, the SMS Validation code and click on the Save button to complete the authentication.

114 |

Devolutions Server

Fill in the Validation code

13. For all of subsequent connection to the Datasource, the SMS Validation code will be sent automatically and the user will have to fill in the Validation code field and click on the Connect button. If the Validation code was not received, click on Resend validation code.

Fill in the Validation code

Contents

| 115

6.5.3.2

SMS Tw ilio

Description

The SMS Twilio use the Twilio SMS platform to send SMS to the mobile phone. The configuration needs a working Twilio SMS account .

Settings

1. Select SMS as your 2FA mode and click on Configure.

Server settings - 2FA configuration

2. Fill in the information for the Twilio account and click the Check button to validate it. A Success message box appear if all parameters match with the Twilio account settings.

116 |

Devolutions Server

Tw ilio settings

Succes m essage

3. After clicking on the Save button of the Server settings window, it will display a message to fill in the mobile number of each user and to configure the Devolutions Server instance with the Service type set to Web API.

Configuration advice

4. On the Devolutions Server console, click on the Users icon to configure the users that should use the

2FA if the option Optional per User is set.

Contents

| 117

Devolutions Server console

5. Fill in the Mobile phone number in the Information tab of the User management window.

User Managem ent - Inform ation tab

6. The SMS 2FA can be configured directly through the User Management window. Click on Configure on the General tab.

118 |

Devolutions Server

User m anagem ent - General tab

7. Click on Change to set the 2FA Type.

2FA Configuration

8. After setting the 2FA Type to SMS, click on Save.

Contents

| 119

2FA Configuration

9. Check the Configure later by the user check box to let the user authenticate his connection to the

Datasource.

10. On connecting to the Datasource, it will ask for the Validation code sent to the mobile phone. Click the Connect button to connect to the Datasource.

120 |

Devolutions Server

SMS Tw ilio validation code

11.

6.5.4

SafeNet settings

Prerequisite

1. The complete SAS-SDK provided by SafeNet.

2. Hostname provided by SafeNet.

3. The Key file related to the SafeNet Authentication Service Manager account provided by SafeNet.

Settings

1. Install the BlackShield ID .Net Authentication API on the hosting machine of Devolutions Server.

Depending on the hosting server, it can be the x86 or the x64 version.

BlackShield ID .Net Authentication API

2. When this installer ask for the hostname or IP Address of your BlackShield ID Authentication Server, please fill in the information provided by SafeNet for this hostname and check the Connect using

SSL option.

Contents

| 121

BlackShield ID Authentication Server Address

3. Copy the Key file in the BlackShield installation folder of the hosting computer of Devolutions Server.

In this case, it is the C:\Program Files\CRYPTOCard\BlackShield ID\API\KeyFile folder.

Key file folder

4. Connect to the SafeNet Authentication Service Manager .

122 |

Devolutions Server

SafeNet Authentication Service Manager

5. Create each user from DVLS in the SafeNet Authentication Service Manager. It is very important that the user names in DVLS and SafeNet must be identical.

Contents

| 123

6. Next, click on the Provision button.

Creating user - SafeNet

User Detail - SafeNet

7. Select the authentication type and click on the Provision button. In this example, we choose the

MobilePASS authentication type.

Select Authentication Type - SafeNet

8. An email is sent to the user and a task have been added to the list of the Provisioning Tasks.

124 |

Devolutions Server

Provisioning Tasks - SafeNet

9. When the email is received by the user, he has to click on the link to start the token enrollment.

SafeNet self-enrollm ent em ail

10. In this example, if the MobilePASS application is not installed on the device or the computer, please install it by clicking on the download link. After it is correctly installed, click on the Enroll your

MobilePASS token link.

Contents

| 125

SafeNet Self Enrollm ent

11. Then, accept the token in the MobilePASS application by clicking on the Activate button. Follow the instructions to activate the SafeNet token.

126 |

Devolutions Server

12. On the Devolutions Server console, select and edit the instance. Then go on the Two-Factor tab and check the SafeNet checkbox and click on the Save button.

Contents

| 127

Tw o-Factor tab

13. On the Devolutions Server console, click on the User Management dialog, edit each user that will use the SafeNet two factor authentication.

128 |

Devolutions Server

User Managem ent

14. Change the Two Factor type for SafeNet and click on Save.

Tw o Factor Configuration dialog

15. Enter the Validation code from the MobilePASS application and click on the Save button.

Contents

| 129

SafeNet Setup

6.5.5

Azure MFA settings

Prerequisite

1. The Azure MFA SDK zip file which contains the client certificate and the private key. For more information, please consult this link https://azure.microsoft.com/en-us/documentation/articles/multifactor-authentication-sdk/#download-the-azure-multi-factor-authentication-sdk .

Settings

1. On the Devolutions Server console, in the Two-Factor tab, check the Azure MFA option and click on

Configure.

130 |

Devolutions Server

Tw o-Factor tab

2. Click on the Read Azure MFA SDK zip file to select the file.

Azure MFA Settings dialog

3. Please select the file previously downloaded from the Azure Portal.

Select the Azure MFA SDK file

4. When the file is correctly read, it will show a Success dialog.

Contents

| 131

132 |

Devolutions Server

Azure MFA SDK zip file success

5. Each field are now filled with the information from the Azure MFA SDK file. The IP Address field is used to allow a range of addresses and the Host name field is for a given name chosen by the administrator.

Azure MFA Settings dialog

6. In the User Management, select and edit a user. Then click on Configure in the Two factor section.

User Managem ent dialog

7. Change the Two Factor Type for AzureMFA and click on Save.

2-Factor Configuration

Contents

| 133

134 |

Devolutions Server

8. Fill in the phone number and set the communication method to SMS or Phone call. Then, click on the Save button.

Azure MFA Setup

9. When the user will connect to the Devolutions Server, he will received either a phone call, the user will have to answer and then press on the pound key (#), or a SMS and will be asked to reply a code to this SMS.

6.5.6

Radius settings

Prerequisite

1. A Radius server must be available in the organization.

2. All parameters for this configuration must be already configured on the Radius server.

Settings

1. On the Server Settings dialog from the Devolutions Server console, on the Two-Factor tab, check the

Radius and click on Configure.

Contents

| 135

Tw o-Factor tab

2. Fill in the appropriate information provided by the administrator of the Radius server in each fields of the Radius Settings dialog.

136 |

Devolutions Server

Radius Settings dialog

3. Next, click on the Test button in the Radius Settings dialog and provide the Username and the

Passcode. Then click on the Check button to validate the information.

Radius Settings dialog - Usernam e

4. It is possible to configure a Failover partner for the primary Radius server. Select the Failover tab in the Radius Settings dialog. Check the Enable failover RADIUS server and fill in the information.

Contents

| 137

Radius Settings dialog - Failover

5. In the User Management, select and edit a user. Then click on Configure in the Two factor section.

138 |

Devolutions Server

User Managem ent dialog

6. Select the Radius 2FA in the Type list and click on Save.

Contents

| 139

6.6 How to Configure Security Groups and Roles with AD

Integration

Description

These steps provide information on how to implement user security on Devolutions Server through

Security Groups and Roles with Active Directory integration. For more information, please follow this link on our Online Help about Security Best Practices .

Steps

Create Security Groups

1. Open the Security Groups Management from the Devolutions Server console.

Devolutions Server console

2. Add a Security Group by clicking on the Add Security Group button.

User and Security Managem ent dialog

3. Add a Name and a Description for this new Security Group and click on the OK button.

140 |

Devolutions Server

Security Group Managem ent dialog

4. On the Security Group Rights dialog, don't change anything and click on the Save button.

Security Group Rights dialog

5. Apply this Security Groups on the Group Folder of the Tree View.

Contents

| 141

Group Folder Properties dialog

6. Please consult our Online Help on how to Identify Security Groups .

Create Roles from the Active Directory Groups

7. Open the Roles Management dialog from the Devolutions Server console.

Devolutions Server console

8. Add a new Role.

User and Security Managem ent dialog

9. On the Role Management dialog, click on the ellipsis button on the right of the Name field to select the Active Directory Group.

142 |

Devolutions Server

10. Select the Domain location and the Active Directory Group.

Contents

| 143

Select Active Directory Group dialog

11. On the Privileges tab of the Role Management dialog, as a best practice, leave all of these options unchecked.

144 |

Devolutions Server

Privileges tab - Role Managem ent dialog

12. On the Permissions tab of the Role Management Dialog, assign correct permissions on each

Security Group.

Perm issions tab - Role Managem ent dialog

Evolution of the creation of Security Groups and Roles on the Tree View

1. Tree View before creating Security Groups and assigning them to Group Folder for a user without

administrator rights.

Contents

| 145

Sessions w ithout Security Groups

2. Tree View after Security Groups are assigned to Group Folders and before creating Roles for a user

with administrator rights.

Sessions w ith Security Groups

3. Tree View after Security Groups are assigned to Group Folders and before creating Roles for a user

without administrator rights.

Sessions w ithout Roles perm issions on Security Groups

4. Tree View after Security Groups are assigned to Group Folders and after creating Roles for a user

without administrator rights.

146 |

Devolutions Server

Sessions w ith Roles perm issions on Security Groups

6.7 How to Configure Notifications

Description

These steps provide information on how to configure Notifications of activities on a Devolutions Server instance.

Steps

1. In the Server settings, select the Notifications tab. To activate the notifications, check the Allow

notification subscription option and change the Time Zone for the appropriate time zone. Click on the Save button.

Contents

| 147

Notification settings

2. On the Administration menu, click on the Notifications icon.

Adm inistration ribbon - Notifications

3. On the left column, select the user that will receive the email notifications and check all notifications type the user should receive.

148 |

Devolutions Server

Notifications Dashboard

4. Click on the Save button to save the configuration.

Notifications console

Configure more than one Connection or Connection Opened Notifications

1. On the Notifications Dashboard, select the user on the left column.

Contents

| 149

2. Enable a Connection Notification.

Users list

Connection Notification

3. Click on the plus icon at the right to add a new Connection Notification.

Connection Notification

4. Enable a second Connection Notification. It can be set on a particular Group Folder like this example.

The first Notification will be send when a user add a session anywhere in the Data Source. The second Notification will occur when someone deletes a session in the Windjammer\Corporate Group

Folder.

150 |

Devolutions Server

Tw o Connection Notifications

Support/Resources

Part VII

152 |

Devolutions Server

7 Support/Resources

7.1 FAQ (Frequently Asked Questions)

What is Devolutions Server?

Devolutions Server is a specialized data source for our various client applications of the Remote

Desktop Manager and Password Vault Manager platforms.

Why buy Devolutions Server?

Ideal for businesses that would prefer to store their data in-house, want to deploy their own SSL certificate or firewall, or who need Active Directory integration with role management.

What are the key benefits of Devolutions Server?

Devolutions Server is installed on your hardware, in your environment, or with your ISP to give you total control of everything, including:

Active Directory integration

Role management

Hardware

Operating System)

Firewall / Application Deliveryd

Load Balancing / Fault tolerant environment for the web server layer.

Database, including clustering / failover capabilities.

Backups

SSL certificates

Devolutions Server also offers an improved security model, as database access is limited to the server and no direct connection is established. This secure architecture is a significant improvement over standard client-server architecture. (SQL Server data source)

Can I get a trial of Devolutions Server?

Yes - Request a trial

Does Devolutions Server include a client license of Remote Desktop Manager?

Devolutions Server does not include any client licenses.

Is Devolutions Server subscription based?

Yes, Devolutions Server is subscription based. You can subscribe for one (1) year or three (3) years at a time. Giving you unlimited client connectivity for that period of time.

What if I no longer want/need a Devolutions Server? Is my data still accessible?

Yes, once your Devolutions Server subscription is expired you can still access the data using one of our applications. However the Devolutions Server data source will no longer be accessible. You will need to reconfigure your clients to connect directly to the database using a SQL Server data

Contents

| 153 source. Since Active Directory integration will not be allowed anymore, you will need to reassign user permissions.

Can I upgrade from a SQL Server data source to Devolutions Server?

Yes, the underlying SQL server database structure for the SQL Server data source is a subset of the Devolutions Server database structure. When installing/configuring the Devolutions Server simply specify the existing database and choose upgrade.

Note: Before executing any database modification it is always a good idea to make sure you have a proper backup of the database.

Can I downgrade from a Devolutions Server down to SQL Server data source?

Yes, since the database for Devolutions Server is a superset of the SQL Server data source.

Simply connect to the database using the SQL Server data source and your sessions will all be available. Keep in mind that not all Devolutions Server features will be accessible when using the

SQL Server data source, you will need to review all security permissions.

7.2

Overview

Get the hottest information about our products - tips and tricks, case studies and new release announcements!

This is not a marketing newsletter. We focus on the issues that matter to you, whether you're looking for up-to-the-minute software tutorials, additional outside resources, or a peek at how others are using our products.

Links

Facebook http://facebook.remotedesktopmanager.com

RSS feeds

Twitter

YouTube

Blog

Google+

Spicework

Forum http://linkedin.remotedesktopmanager.com

http://rss.remotedesktopmanager.com

http://twitter.remotedesktopmanager.com

http://youtube.remotedesktopmanager.com

http://blog.remotedesktopmanager.com

http://plus.remotedesktopmanager.com/ http://spice.devolutions.net

http://forum.devolutions.net

154 |

Devolutions Server

7.3 Technical Support

Standard Support plan

Support is solely through our online forums at http://forum.devolutions.net/ .

Extended and Premium support plans

Subscribers of a paid support plan receive an email address and a plan ID. You should send your support requests to the appropriate email address and provide your plan ID in the subject line.

You are also encouraged to find information and ask questions in our forums at http:// forum.devolutions.net/ . They contain years of relevant information and have the benefit of being enriched for the whole community when we post an answer.

Please consult our Support Policy for more information.

7.4 Knowledge Base

7.4.1

User Agent

User Agent of Remote Desktop Manager Enterprise - Windows Edition

The User Agent used by Remote Desktop Manager Enterprise - Windows Edition when it connects to

Devolutions Server is :

Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+4.0.30319.42000)

7.4.2

Ports And Firewalls

Description

Devolutions Server in itself does not dictate which ports to use for any of the resources that it accesses.

You must consult with your system administrator to ascertain which adjustments need to be made in order for the system to inter-operate with your infrastructure.

Two technologies are in play for proper operation of Devolutions Server : SQL Server, LDAP.

SQL Server

Depending on the choice of Default Instance or Named Instance that was made during the installation, the SQL Server instance will listen on different ports.

Using SQL Server Configuration Manager, you can see the details in the Protocols section

Contents

| 155

Sql Server Configuration Manager - Protocol details

In most cases, TCP/IP will be used for remote connections. You will be able to see what ports are in use. If you see that TCP Dynamic Ports are in play, they will change upon every restart of the SQL

Server instance and therefore are not a good fit for a hardened installation.

156 |

Devolutions Server

TCP/IP Properties

For more information please consult SQL Server Configuration Manager on Technet

LDAP/LDAPS

As indicated in LDAPS on Technet , LDAP communications are by nature insecure under certain conditions:

By default, LDAP communications between client and server applications are not encrypted.

This means that it would be possible to use a network monitoring device or software and view the communications traveling between LDAP client and server computers. This is especially problematic when an LDAP simple bind is used because credentials (username and password) is passed over the network unencrypted. This could quickly lead to the compromise of credentials.

Follow the instructions for your operating system in order to establish LDAPS. It will involve deploying certificates generated using your of Certification Authority (CA).

LDAP by default uses port 389. Even when you enable LDAPS, it may use plain LDAP therefore it needs to be disabled.

LDAPS by default uses port 636 for typical domains, but will use port 3269 when communicating with a

Global Catalog Server (basically when you have a Forest). You domain administrator should be able to provide you with details of your domain infrastructure, especially if custom ports were used.

Contents

| 157

7.4.3

Enforcing usage of LDAPS

Description

To require that a directory server rejects simple binds which occur on a clear text connection. you must apply a policy.

7.5 Troubleshooting

7.5.1

After Upgrading Server the Devolutions Server Console is Empty

Description

You have attempted to upgrade your Devolutions Server instance and the upgrade was not completed correctly. Now, your instance is not present in the Devolutions Server Console and your data source is not connected.

Devolutions Server Console em pty

Instructions

1. Navigate to the %temp%\RDM folder and copy the content of the folder.

2. Navigate to the folder where your Devolutions Server was deployed originally and paste the content of %temp%\RDM inside.

3. If you close and reopen your Devolutions Server Console, your instance should be present.

4. You can now proceed again with the upgrade of your server.

158 |

Devolutions Server

If the files are not present or the solution doesn't work, you will need to restore the backup that you have created in the preparation phase as described in

Upgrading Devolutions Server

7.5.2

Failed Request Tracing with IIS

Description

This topic will present how to install and configure a Failed Request Tracing Log rule for troubleshooting

HTTP 500 error issues on the IIS site.

Enable Failed Request Tracing in IIS

A detailed step by step to add the role on a Windows Server 2012R2.

Configure Failed Request Tracing

Configuration needed for troubleshooting HTTP 500 error issues.

Consult the Failed Request Tracing log

Where and how to look at the Failed Request Tracing logs.

For more information about Failed Request Tracing, please visit https://www.iis.net/configreference/ system.webserver/tracing/tracefailedrequests .

7.5.2.1

Enable Failed Request Tracing in IIS

Enable Failed Requests Tracing in IIS

The following steps are applicable on Windows Server 2012R2.

1. Open the Server Manager. Choose Add Roles and Features from the Manage menu.

Server Manager - Add Roles and Features

2. Select the installation type and then click Next.

Select installation type

3. Select the destination server and then click Next.

Contents

| 159

160 |

Devolutions Server

Select destination server

4. On the Select server role page, expand the Web Server (IIS) role, expand Web Server and expand

Health and Diagnostics. Then select Tracing and click Next.

5. On the page Select features, click Next.

Select server roles

Contents

| 161

162 |

Devolutions Server

Select features

6. On the page Confirm installation selections, click Install.

7. On the Results page, click Close.

Confirm installation selections

Contents

| 163

164 |

Devolutions Server

Installation progress

7.5.2.2

Configure Failed Request Tracing

Configure Failed Requests Tracing

The following steps are applicable on Windows Server 2012R2.

1. In the Server Manager, click on the Tools menu and open the Internet Information Services (IIS)

Manager

Contents

| 165

Server Manager

2. In the IIS Manager, expand the Web site (VWINDSRV-RDMS2), expand Sites and then select Default

Web Sites.

Internet Inform ation Services (IIS) Manager

3. On the right, in the Actions pane, select Failed Requests Tracing....

166 |

Devolutions Server

Actions pane

4. Select the Enable check box and then click OK. The Directory target and the Maximum number of trace files can be modified.

Edit Website Failed Request Tracing Settings

5. Expand Default Web Site and select the Web site to be traced.

Contents

| 167

Internet Inform ation Services (IIS) Manager

6. Double click on the Failed Request Tracing Rules icon of the selected Web Site.

168 |

Devolutions Server

Internet Inform ation Services (IIS) Manager

7. In the Actions pane on the right, click on Add... to add a new rule.

Failed Request Tracing Rules

8. Select ASP.NET (*.aspx) and click Next.

Contents

| 169

Specify Content to Trace

9. Select the Status Code(s) check box. Enter the type of the status code to be traced, in this case type in the status code 500, and click Next.

170 |

Devolutions Server

Define Trace Conditions

10. The last setting is to select the providers of the tracing. Select ASPNET and WWW Server. For each of them, set the Verbosity to Verbose. Finally, check all Areas settings for these two providers and click Finish.

11. The tracing rule is now defined.

Select Trace Providers

Failed Request Tracing rule defined

7.5.2.3

Consult the Failed Request Tracing log

Consult the Failed Request Tracing log

Contents

| 171

172 |

Devolutions Server

With Failed Request Tracing enabled, the logs files are created and populated in the directory set up on step

Edit Website Failed Request Tracing Settings . By default, the path is %SystemDrive%\inetpub\logs

\FailedReqLogFiles. In this place, a folder typically named W3SVC1 will be created when the first case happen.

There will be an XSL file (freb.xsl) for the display style in an XML viewer like Internet Explorer. Also, the most important, the XML files (fr######.xml). Open an XML file to view the log triggered by the tracing rule.

Failed Request Tracing log folder

Here is an example of a Failed Request Tracing log :

Failed Request Tracing log

Contents

| 173

7.5.3

IIS Logging

Description

Here is the description of desired settings when we troubleshoot a performance/connectivity issue related to the client application.

IIS Web Site Logging

1. Open IIS Manager and go in the Logging settings.

2. Click on Select Fields

IIS Manager

174 |

Devolutions Server

Logging panel

3. We recommend that AT LEAST the following fields be selected:

Contents

| 175

Field selection dialog

Application pool recycle

The application pool that is in fact running the instance can be restarted for a multitude of reasons. It may be useful to know when those recycles occur as well as the reasons. Go in the Application pools section of the IIS manager, then open the Advanced settings for your application pool. Enable all of the Recycle events, it will create a log entry in the Windows Event Log.

176 |

Devolutions Server

Advanced settings for an Application Pool.

7.5.4

Server Diagnostic

Description

The server diagnostic validates if all the necessary IIS features are enabled to run Devolutions Server properly.

Settings

Remote Desktop Manager Enterprise - Windows Edition must be started with elevated privileges when the Devolutions Server Console needs to be used.

The server diagnostic is available from the Tools -> Devolutions Server Console menu

Devolutions Server Console

Contents

| 177

This diagnostic will verify if all the IIS features are installed properly.

ASP.NET 3.5 is not required anymore, you can ignore the warning safely.

Server Diagnostic

7.5.5

Web interface content looks wrong

Description

If you have completed your Devolutions Server installation and it's Web interface isn’t displaying properly

(as shown below), here are some steps to follow to resolve the issue.

178 |

Devolutions Server

Devolutions Server Web interface

Steps

1. Proceed to an

IIS Features Diagnostic

and verify if all the ISS features are on and installed properly. If you see that your Static Content hasn't been properly installed you will need to enable that Windows

Feature.

Contents

| 179

IIS Features Diagnostic

2. In Windows Features, under World Wide Web Features - Common HTTP Features verify if the option Static Content is turned on.

180 |

Devolutions Server

Window s Features

7.5.6

Description

When trying to log in with the web interface of the Devolutions Server, you can possibly get a Login failed error.

Cause 1

The Login failed for user 'Domain\ServerName$ error with a '$' at the end of the server name is caused by a wrong setting of the Application Pool Identity in Internet Information Services Manager (IIS). The

Application Pool Identity must be set with a specific account when activating the Integrated Security option in the

Server Settings

of Devolutions Server. For more information about Integrated security, please refer to

How to Configure Devolutions Server to use integrated security .

Contents

| 181

Login failed for user 'Dom ain\ServerNam e$'

Steps

1. Please open the IIS Manager and select the Application Pools in the Connections pane. Then, select the Application of your Devolutions Server and click on the Advanced Settings from the Actions pane.

IIS Manager - Application Pools

2. On the Advanced Settings dialog, select Identity and click on the ellipsis button on the right.

182 |

Devolutions Server

Application Pools - Advanced Settings

3. Select Custom account and click on the Set... button.

Contents

| 183

Application Pool Identity

4. Fill in the credentials and click on the OK button. This account must have the proper rights in order to run the web interface of the Devolutions Server.

Set Credentials

5. Now the Application Pool Identity is set with an account with proper rights for running this application.

184 |

Devolutions Server

Advanced Settings

Cause 2

The Login failed for user 'IIS APPPOOL\ApplicationPoolName' error is related to insufficient permissions for the ApplicationPoolIdentity or inexisting user ApplicationPoolName on the SQL database. I when the

SQL Server and Devolutions Server are hosted on the same machine.

Contents

| 185

Login failed for user 'IIS APPPOOL\ApplicationPoolNam e'

Steps

1. Using Microsoft SQL Server Management Studio, right-click on the Security branch and select New -

SQL Server Managem ent Studio

2. For the login, type IIS APPPOOL\AppPoolName and DO NOT CLICK SEARCH (If a search is executed, it will resolve to an account with ServerName\AppPoolName and SQL will be unable to resolve the account’s SID since it is virtual).

186 |

Devolutions Server

Create SQL User

3. Please follow the instructions from step 4 of the online help page

How to Grant access to SQL Server instance .

Index

- A -

Application pool identity 180

- H -

high availability 16

- L -

load balancing 16

- T -

topology 16

Contents

| 187

Key features

Self-hosted repository
Share remote connections, credentials & sensitive data
Full Active Directory (AD) integration
Windows authentication support
Client & server side caching
Database-driven policy
Geo restriction & IP restriction
Syslog integration
Two-factor authentication

Frequently asked questions

Devolutions Server offers a full Active Directory (AD) integration, Windows authentication support, client & server side caching, database-driven policy, geo restriction & IP restriction and two-factor authentication.

You can install Devolutions Server through different topology types, such as same server, basic, high availability and load balancing.

Devolutions Server requires Microsoft .Net Framework 4.5.2, Microsoft SQL Server 2012/2014/2016 (including the Express editions!), Internet Information Services (IIS) 7.0 or better and Remote Desktop Manager Enterprise - Windows Edition installed on the server.

You can manage user accounts through the Devolutions Server Console, which allows you to create, edit and delete user accounts as well as manage security groups and roles.

Devolutions Server supports Windows authentication and Active Directory integration, as well as two-factor authentication with options like SMS, email, Google authenticator, Yubikey, AuthAnvil, Duo and SafeNet.

Table of Contents

Part I Overview

Part II Getting Started

Part III Installation

Part IV Upgrading Devolutions Server

Part V Management

Part VI How-To

Part VII Support/Resources

Overview

Part I

1

Ov erv iew

1.1

What is Devolutions Server?

1.2

Features

1.3

System Requirements

Getting Started

Part II

2

Getting Started

2.1

Security Checklist

2.2

Small Business Edition

2.3

Topologies

Installation

Part III

3

Installation

3.1

Web role - Install 2012R2

3.2

Web role - Install pre 2012R2

3.3

Database Instance

3.4

Create Devolutions Server instance

Upgrading Devolutions Server

Part IV

4

Upgrading Dev olutions Serv er

4.1

Upgrading to 3.0

4.2

Upgrading to 3.2

Management

Part V

5

Management

5.1

Devolutions Server Console

5.2

Authentication

5.3

Automatic User Account Creation

5.4

Security

5.5

Web Interface

5.6

Server Settings

How-To

Part VI

6

How-To

6.1

How to Configure Client Data Source

6.2

How to Configure Devolutions Server to use integrated security

6.3

How to Configure SSL

6.4

How to Activate Your Renewal Subscription

6.5

How to Configure Two-factor Authentication (2FA)

6.6

How to Configure Security Groups and Roles with AD