Just Enough Administration (JEA) for Windows Discovery

SNowUser11 · ‎08-20-2020

Hello,

Has anyone implemented JEA for Discovery its new from Orlando but if please let me know the steps to be performed.I was going through this link but if anyone has proper step by step procedure what from servicenow has to be done and what an windows SME has to perform

https://docs.servicenow.com/bundle/orlando-it-operations-management/page/product/discovery/concept/m...

Thanks

Florian Zemsky · ‎08-28-2020

Hi,

for me personally the best documentation I've found so far on this is the official one that you linked in your question. I've started writing on a community article on this but it will still take some time...

Here's a highlevel guide on how I got it working:

First of all - make sure general Discovery prerequisites are met (e.g. MID Server & Network Communication Requirements)
Then make sure all the JEA specific prerequisites from docs are met - at least at your MID Server Host, the Domain Controller and the Target you want to discover via JEA.
Create the domain user group and add the notadmin user that you will eventually use for JEA Disco
Make sure all the machines that you want to discover via JEA are defined as trusted hosts
Extend / adapt the list of cmdlets in the role capabilities file (.psrc) to match your requirements. A starting point on this might be documented here, but this is one of the things I still need to look into in more detail: Here

Check the attachments to see how I got this working.

HTH Florian

View solution in original post

Florian Zemsky · ‎01-14-2022

Hi Mark,

sorry for the late reply! That machines need to be defined as trusted hosts lies in the nature that JEA relies on Powershell + WinRM. You should define the discovery targets as trusted host on the mid and the mid as trusted host on the discovery target. Otherwise, you may most likely encounter errors when communicating between the two sides.

Best Regards,

Florian

Mark113 · ‎01-16-2022

Thanks Florian, issue turned out to be a DNS problem