...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
Introduction
| Easy heading | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
This document outlines the system requirements and prerequisites necessary for installing the GYTPOL dsRequester component. This component facilitates the retrieval of data from CIS/NIST (only GYTPOL on-prem) and Active Directory / Group Policy Security and Operational sources (both on-prem and SaaS).
Checklist
Ensure that the following GYTPOL requirements are satisfied before initiating the installation of the GYTPOL Validator software:
Server sizing and OS – Verify compatibility with the GYTPOL dsRequester server.
Users and Groups – Validate configurations in Active Directory and the GYTPOL dsRequester server for seamless integration.
Ports – Confirm that the required ports are open on both the server and client sensor sides to facilitate proper communication.
Antivirus – Take precautions to prevent any interference from antivirus software that could impede the GYTPOL Validator's correct execution.
Server Sizing
A dedicated server is not mandatory; any existing domain-joined server can be utilized (and an installation on a Domain Controller isn’t necessary).
...
| Info |
|---|
dsRequester is installed once per domain. A single domain-joined server will run the dsRequester tasks in each domain you wish to monitor. |
OS
The GYTPOL Validator software is compatible with Windows Server 2016 Standard and later versions.
Windows Server language settings:
The Windows Server operating system must be set to use the English (United States) language.
The Windows Server language for non-Unicode programs must be set to use the English (United States) language.
Users and Groups
Create a domain user within your Active Directory and allocate the specified permissions as outlined in the table. Feel free to adopt your preferred naming convention; the names in the table are merely suggestions.
Ensure that the passwords for GYTPOL users exclude the characters ‘ “ ~ ; or spaces.
Permissions
Refer to the table to configure the permissions for both the user and the group (consult the hyperlinks for detailed instructions):
Type | Name | Permission set |
AD User | GytpolSvc (or any other suitable naming convention) | Domain level: Member of Domain Group: “Performance Log Users” |
GYTPOL Server local settings:
|
Ports
From | To | Port number | Purpose |
GYTPOL dsRequester server | DC’s | 389, 9389, 636, 135, 138-139, 445, 464, 53, 3268, 3269 + Dynamic ports (49152-65535) | Group Policy PowerShell queries + Group Policy modeling queries |
GYTPOL dsRequester server | GYTPOL AWS Cloud During the onboarding process, GYTPOL team will supply the URLs for reference. | 443 | Group Policy PowerShell reporting + Group Policy modeling reporting |
Antivirus
If whitelisting is required, ensure that the following paths and their subfolders and files are included:
C:\Program Files\Gytpol(subfolders and files)C:\Program Files\WindowsPowershell\modules\gytpolServer(subfolders and files)
Detailed Configuration Instructions
How to Verify PowerShell Version and Review Restriction Mode
Navigate to the GYTPOL dsRequester server, select the "Start" menu, and enter "PowerShell" in the search bar. Subsequently, click on "Windows PowerShell" from the search results.
...
In the same PowerShell window, enter the following command:
Get-ExecutionPolicy -List. Confirm that the PowerShell scripts are not set to "Restricted" in any of its categories. The desired results include "RemoteSigned", "AllSigned", or "Undefined" for the execution policies.
...
Include the GYTPOL user in the Domain group "Performance Log Users"
On a computer with RSAT (Remote Server Administration Tools), open a command prompt (cmd).
Launch Active Directory Users and Computers by entering
dsa.mscand pressing ENTER.Search for the "Performance Log Users" group within Active Directory.
Double-click on the group, navigate to Members, click on Add, input the name of the GYTPOL user created earlier, and press OK.
Confirm the changes by clicking OK in the group properties window.
Adding a local admin
Open the command prompt on the GYTPOL dsRequester server.
Type
lusrmgr.mscand press ENTER.In the left pane, select "Groups."
In the right pane, double-click on "Administrators."
...
Ensure that "From this location" is configured to the domain name rather than the GYTPOL dsRequester server.
Confirm that "From this location" is set to the domain name.
In the "Enter the object names to select" field, type
gytpoSvc.Click on "Check Names" and wait until you see the name underlined and associated with the domain name.
Press OK to complete the addition of the specified user (
gytpoSvc) to the local Administrators group.
Logon as a batch job
If there are no Group Policies imposing "logon as a batch job" restrictions, you can leave the configuration unchanged. Follow these steps:
...
Go to a computer with the Group Policy Management Console (GPMC) installed (typically available on all Domain Controllers).
Open the command prompt as an administrator and enter
gpmc.msc.Navigate to the policy containing the restriction and right-click to edit.
Go to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Right Assignment.
Double-click on "Log on as a batch job."
Click on "Add User or Group."
Type
GytpolSvcand click on "Check Names."Confirm that this is the correct user and click OK.
Network access: Do not allow storage of passwords and credentials for network authentication
If there are no Group Policies imposing "Network access: Do not allow storage of passwords and credentials for network authentication" restrictions, you can leave the configuration unchanged.
...
This PowerShell command retrieves and displays the value of the "disableDomainCreds" registry key under the specified path. If the output is 0, it confirms that the setting is disabled.
...
Windows Features installation
Launch Server Manager on the GYTPOL server and follow these steps:
...
Proceed by clicking "Next" and then "Install." Wait patiently until the installation process concludes.
Automatic pre-checker tool
Download the automatic pre-checker tool from the https://gytpol.com/dschecker and transfer it to the GYTPOL dsRequester server.
...
Pay attention to the results:
Red X sign (error): Indicates a critical error that requires resolution before proceeding with the installation. Hover over the question mark (?) for guidance on the necessary actions.
Yellow Exclamation mark (warning): Represents a failed check that is not critical for immediate resolution. However, consider addressing warnings for optimal performance.
Defender icon: Denotes a successful check, confirming that the specific aspect has passed verification.
...
Please restart the server before the installation.
Here’s a video that demonstrates the Checker running its tests during the check process.
If you cannot see the results screen at the end or if the Checker is "killed" during execution, please ensure there are no EDR restrictions or other interferences affecting the Checker’s flow.
...
dsRequester installation / update
You can obtain the dsRequester MSI file directly from the GYTPOL console. Navigate to Settings in the left pane, then select System Health (only UI2 Customers). Alternatively, feel free to contact the GYTPOL team for a direct download link.
Place the downloaded MSI file on the server.
Open an elevated Command Prompt:
Right-click on CMD.
Select "Run as Administrator."
...
The presence of gytpolServer tasks in the Task Scheduler Library indicates a successful installation.
| Info |
|---|
Please note, that the tasks will run as the GYTPOLSVC user that was created earlier. |
...