Add Lansweeper On-Prem

Task List

Task 1: Review the SQL Server that hosts the Lansweeper SQL DB

You need to review the SQL Server Version and SQL Server Edition to ensure it is supported by (and optimal) for CI Sync.  Check the following:

• CI Sync does not support the LocalDB version of SQL (i.e. the free SQL which is sometimes used as the default during the installation of certain products (e.g. Lansweeper).  If your Lansweeper is using the LocalDB version of SQL you will need to upgrade to SQL Express Edition or preferably SQL Standard Edition (see next point).

• Syncfish highly recommend using Microsoft SQL Standard Edition (or SQL Enterprise Edition though that edition is typically overkill/not required). SQL Standard (or above) supports SQL Maintenance Plans and other housekeeping jobs.

• Check you are using SQL Server Version 2016 or later.

• Validate the database compatibility level of the Lansweeperdb is set to SQL Server 2016 (130) or later.

Task 2: Understand the CI Sync RecVer Database

This “task” is solely about understanding the purpose of the CI Sync RecVer database and making decisions on where to host it and how the CI Sync Agent will authenticate to it.

You may also need to make a decision on which database technology to use for the RecVer Database. The CI Sync Agent supports both MS SQL and MongoDB for the RecVer database (however there are some restirctions on which database technology you can use depending on the source system itself).

Understanding the above topics and making the relevant decisions before you create the source system connection (via the CI Sync Agent Config Utility) will make it quicker/easier to execute the remaining tasks in this guide.

Task 3 (SQL): Create a Source System Connection using the CI Sync Agent Config Utility with a SQL RecVer DB

As explained in the preceding “task” there are two options to facilitate the creation of the RecVer database and assigning permissions to it for the CI Sync (Agent). The table below elaborates the two options.

Expand the instructions below for either Option 1 or Option 2.

Option 1: Use the Config Utility to automatically create the RecVer database

Expand the instructions below to let the CI Sync Config Utility automatically create the CI Sync RecVer database (and set the required permissions to both the RecVer and Lansweeper SQL DBs).

Click to expand the instructions to setup the source connection with a SQL RecVer using Option 1

1. Run the “CISynchronizerAgent Config Utility” from the Windows Start Menu.

2. Within the CI Sync Agent Configuration Utility, navigate to the Source Systems tab, select Lansweeper and click the Add button.

3. The “Add Connection” form is shown (specific to the source system).

4. In the section titled “Settings for the CI Sync Windows Service” update the values as follows:

   1. Name: Enter a friendly name that describes this source system connection.
      If you have only one Lansweeper instance “Lansweeper” will suffice, if you have multiple enter a name that identifies the specific Lansweeper instance.

   2. SQL Server: Enter the SQL Server instance path in the format: server\instance.

   3. Integrated Security:

      1. Check this checkbox if you want the CI Sync Agent to authenticate to the SQL Server using the Windows User Account you setup for the CI Sync Agent Windows Service (i.e. the account you setup in Task 1: Create Windows Service Account for the CI Sync Agent to use during S4 - Install the On-Prem Multi-Source Agent.

      2. Otherwise, uncheck this checkbox and enter the User ID and Password for a Native SQL Login provided to you by the DBA. (Note: Syncfish do not recommend the SQL Login have sysadmin rights).

   4. Database: The name of the Lansweeper database. This will default to “lansweeperdb”, only change this value if your Lansweeper database has a non-standard name.

   5. Bypass setup, I have manually setup the databases: Do NOT check this checkbox (because the Config Utility will be creating the RecVer database for you).

   6. Existing RecVer Database: Do NOT check this checkbox (as the Config Utility will create the RecVer database for you).

   7. RecVer Database: Ignore as it will be greyed out.

   8. DB Timeout (Secs):  Sets the connection and statement execution timeouts. Syncfish recommend 60.

5. Locate the “Setup & Test” button

6. Do the following:

   1. Click the “Setup & Test” button.

   2. When the button “Setup & Test” is pressed, the CI Configuration utility will prompt if the user running the utility wants to use Integrated Security or SQL Server security to perform the automated SQL setup and configuration steps.

Informational Note

• The above values do not control the ongoing running of the CI Sync Agent, they are solely used by the CI Sync Config UI to perform the RecVer setup.

• The user will be required to have admin role in SQL Server to be able to setup the RecVer

Guidance Notes

In the background the Config Utility performs the following SQL setup and configuration steps:

1. The utility creates a SQL Login for the Windows User Account you setup for the CI Sync Agent Windows Service if you selected “Integrated Security” in the section “Settings for the CI Sync Windows Service”, the Config Utility. Or, if instead you are using Native SQL Login (instead of “Integrated Security”) then Config Utility uses the Native SQL Login details you have supplied and performs the following step to grant the Login access to the relevant databases with the permissions noted below.

2. The utility creates a SQL user in the Lansweeper database for the Login used by the CI Sync Agent and grants the user the db_datareader role to the Lansweeper database.
   Note: Depending on whether you selected “Integrated Security” or not, the SQL user is either (a) the Windows User/Service Account (created as a SQL Login in point 1 above) or (b) the native SQL login account.

3. The utility creates the RecVer database, creates a SQL user in the RecVer database for the Login used by the CI Sync Agent and grants the SQL user db_owner via a custom “agent_role”.
   Note: Depending on whether you selected “Integrated Security” or not, the SQL user is either (a) the Windows User/Service Account (created as a SQL Login in point 1 above) or (b) the native SQL login account.

Note: If you are using a Native SQL Login (not Integrated Security) with higher privileges than noted above (e.g. if the account had SQL sysadmin) then the Config Utility will not be able to set the SQL roles noted above.  Instead, the Config Utility will not touch the permissions and instead will leave the existing/higher privileges as is.  This is not required and not recommended by Syncfish.

7. If all is setup correctly you will see “Ok” against each of the setup tasks.  If you see errors recheck the values you entered on the form.

8. After a successful test has been completed, click the Save button.

9. Finally, click Yes to register this new connection (via your CI Sync Agent) with your customer specific CI Sync SaaS instance.

10. Assuming no errors you will see a confirmation message. Click OK and the new connection will appear in the Connections List of the CI Sync Agent.

11. You have now completed the setup of the source connection in the CI Sync Configuration Utility and registered it as a source connection in the CI Sync SaaS application. 

Informational Note

The above process grants the SQL User credential (i.e. the Windows Service Account or the SQL Login) db_datareader at the database level (i.e. grants the credential access to all tables in the Lansweeper database schema).

This approach grants the CI Sync Agent access to Lansweeper tables that are not needed or in-scope for CI Sync.  A good example is the tblADusers table in Lansweeper.  The default CI Sync configuration rules do require the CI Sync Agent to access tblADusers which may contain firstname, surname, email address etc values about your users (subject to whether you have configured Lansweeper to read from your Active Directory or not).

Syncfish recommends you review the Lansweeper system documentation (and system itself) to understand the permissions these roles provide to your CI Sync Agent. 

Syncfish provide further details on this topic in the document titled “CI Sync - Overview of Source and Destination Fine Grain Permission Option for Personal Data”.  The document also includes non-authoritative guidance on how to assess and potentially apply fine-grain permissions to further restrict CI Sync’s access within the Lansweeper database if your organization has concerns about Personal Data.

Option 2: Use your SQL Database Administrator (DBA) to manually create the RecVer database in advance

Expand the instructions below if your SQL DBA will manually setup the RecVer database (and set the required permissions to both the RecVer and Lansweeper SQL DBs).

Click to expand the instructions to setup the source connection with a SQL RecVer using Option 2

1. Ask you SQL DBA to perform the tasks listed in the table below.

Task	DBA Task (in SQL Server)	Additional Notes
Task 1	Either register a Login (which represents the Windows User Account used by the CI Sync Agent Windows Service) Or create a SQL Login (for the CI Sync Agent to use).	If you are using Windows “Integrated Security” between the CI Sync Agent and the SQL Server, then the CI Sync Agent Windows Service account needs to be registered within SQL Server as a Login.  Note: The CI Sync Agent Windows Service account you setup in Task 1: Create Windows Service Account for the CI Sync Agent to use during S4 - Install the On-Prem Multi-Source Agent. Alternatively, if you are using Native SQL authentication between the CI Sync Agent and the SQL Server, then a Login will need to be created. In this case your DBA will need to provide you with the SQL User ID and password details so you can enter them into the Config Utility UI as explained further below.
Task 2	Map the Login as a user in the Lansweeper database and grant the user the db_datareader role.	Map the user and grant the role to the “lansweeperdb” (this is the default name for the Lansweeper database).
Task 3	Edit then Execute the SQL Create Script provided by Syncfish located here. This script creates the Syncfish RecVer database. The script is: cisee-recver-create-script.sql	Notes for the DBA when running the script: The script has a placeholder called $(source_database_name) as the replacement for the Lansweeper database name. The script has a placeholder called $(recver_database_name) as the replacement for the RecVer database name. For Lansweeper On-Prem Syncfish recommend “cisee_recver_lansweeperdb” as the RecVer database name. To run the setup script using the sqlcmd utility, the database_name parameter needs to be passed in using the -v switch: > sqlcmd -I -S localhost -v source_database_name="lansweeperdb" recver_database_name="cisee_recver_lansweeperdb" -i "cisee-recver-create-script.sql" Or, if running the script in SSMS, the value $(source_database_name) (including the $ and brackets) needs to be replaced with the name for the lansweeper database and $(recver_database_name) (including the $ and brackets) needs to be replaced with the name for the recver database.
Task 4	Edit then Execute the SQL Upgrade Script provided by Syncfish located here. This script will upgrade the CISync recVer database schema to version 3.1.1 The script is: cisee-recver-upgrade-script-3.1.1.sql	Notes for the DBA when running the script: The script has a placeholder called $(recver_database_name) as the replacement for the RecVer database name. For this Lansweeper On-Prem Syncfish recommend “cisee_recver_lansweeperdb” as the RecVer database name. To run the setup script using the sqlcmd utility, the database_name parameter needs to be passed in using the -v switch: > sqlcmd -I -S localhost -v recver_database_name=" cisee_recver_lansweeperdb" -i "cisee-recver-upgrade-script-3.1.1.sql" Or, if running the script in SSMS, the value $(recver_database_name) (including the $ and brackets) needs to be replaced with the name for the recver database.
Task 5	Map the Login as a user in the RecVer database and grant the user the role_agent role.	Map the user and grant the role to the RecVer database created by the SQL script above.

Informational Note

The above process grants the SQL User credential (i.e. the Windows Service Account or the SQL Login) db_datareader at the database level (i.e. grants the credential access to all tables in the Lansweeper database schema).

This approach grants the CI Sync Agent access to Lansweeper tables that are not needed or in-scope for CI Sync.  A good example is the tblADusers table in Lansweeper.  The default CI Sync configuration rules do require the CI Sync Agent to access tblADusers which may contain firstname, surname, email address etc values about your users (subject to whether  you have configured Lansweeper to read from your Active Directory or not).

Syncfish recommend you review the Lansweeper system documentation (and system itself) to understand the permissions these roles provide to your CI Sync Agent. 

Syncfish provide further details on this topic in the document titled “CI Sync - Overview of Source and Destination Fine Grain Permission Option for Personal Data”.  The document also includes non-authoritative guidance on how to assess and potentially apply fine-grain permissions to further restrict CI Sync’s access within the Lansweeper database, in particular if your organization has concerns about Personal Data.

Once your DBA has completed the steps in the table above, use the CI Sync Agent Configuration Utility to setup the source connection and pointing to the RecVer database created by the DBA. See below for instructions on using the CI Sync Agent Configuration Utility.

2. Run the “CISynchronizerAgent Config Utility” from the Windows Start Menu.

3. Within the CI Sync Agent Configuration Utility, navigate to the Source Systems tab, select Lansweeper and click the Add button.

3. The “Add Connection” form is shown (specific to the source system).

4. In the section titled “Settings for the CI Sync Windows Service” update the values as follows:

   1. Name: Enter a friendly name that describes this source system connection.
      If you have only one Lansweeper instance “Lansweeper” will suffice, if you have multiple enter a name that identifies the specific Lansweeper instance.

   2. SQL Server: Enter the SQL Server instance path in the format: server\instance.

   3. Integrated Security:

      1. Check this checkbox if you want the CI Sync Agent to authenticate to the SQL Server using the Windows User Account you setup for the CI Sync Agent Windows Service (i.e. the account you setup in Task 1: Create Windows Service Account for the CI Sync Agent to use during S4 - Install the On-Prem Multi-Source Agent.

      2. Otherwise, uncheck this checkbox and enter the User ID and Password for a Native SQL Login provided to you by the DBA. (Note: Syncfish do not recommend the SQL Login have sysadmin rights).

   4. Database: The name of the Lansweeper database. This will default to “lansweeperdb”, only change this value if your Lansweeper database has a non-standard name.

   5. Bypass setup, I have manually setup the databases: Check this checkbox (because your SQL DBA has already manually created the RecVer database and set the relevant permissions for you).

   6. Existing RecVer Database: Check this checkbox (because your SQL DBA has already manually created the RecVer database for you).

   7. RecVer Database: Enter the name of the RecVer database your DBA created. If the used the suggested name (described on the previous page) it will be called cisee_recver_lansweeperdb.

   8. DB Timeout (Secs):  Sets the connection and statement execution timeouts. Syncfish recommend 60.

5. Locate the “Setup & Test” button

6. Do the following:

   1. Click the “Setup & Test” button.

   2. If all is setup correctly you will see “Ok” against each of the setup tasks.  If you see errors recheck the values you entered on the form.

7. After a successful test has been completed, click the Save button.

8. Finally, click Yes to register this new connection (via your CI Sync Agent) with your customer specific CI Sync SaaS instance.

9. Assuming no errors you will see a confirmation message. Click OK and the new connection will appear in the Connections List of the CI Sync Agent.

10. You have now completed the setup of the source connection in the CI Sync Configuration Utility and registered it as a source connection in the CI Sync SaaS application. 

Task 3 (Mongo): Or, Create a Source System Connection using the CI Sync Agent Config Utility with a MongoDB RecVer DB (if supported)

Task 4: Finalise Settings in the CI Sync SaaS UI

1. Login to your CI Sync SaaS instance at https://YourCo.syncfish.app

2. In the CI Sync UI, navigate to Settings > Connections.

3. Find the new source system connection you just added in the list of Source Connections (the screen shot above is a sample only).

4. Find your specific Source System Connection in the list and click the Update hyperlink (on the right hand side of the screen).

5. The connection Settings Form is presented. Update as follows:

   1. Enter an Alias (optional) - the alias is only used in the CI Sync SaaS UI to show a friendly name in various UI forms.

   2. Set the Environment/s the new source connection can be used for. 

      1. In most cases a Source System Connection is used for both Test and Production sync jobs (as distinct from the Destination Connections which can only be either Test or Production).

      2. The Environment value is used to filter the connections dropdown list when you are creating a sync job.

6. While you are on this page you can/should check whether there are any connection specific settings you may want to adjust either now or at some point in the future. Connection specific settings (or just Connection Settings) allow you to override the default data sync rules for your CI Sync instance.

7. Read the following details to understand more about CI Sync Connection Settings:

   1. Scroll further down to the Additional Settings section on the page to see any available Connection Settings. Below is an example of the sorts of settings you might notice.

   2. The settings are specific to each source connection so the screen shot is an example only.

      

      
      

   3. Syncfish recommend you read the following documentation before overriding any of the default settings:

      1. Read the CI SyncDefault Configuration Guides. The pages in that tree provide comprehensive information about the default behaviour of the CI Sync data sync rules, the options available for overriding those rules and typical reasons why you might want to do this.

      2. Read Understanding the use of CI Sync Connection Settings. This page explains how the Connection Settings should be used, how to modify settings via the CI Sync UI and how to test any setting changes in non-production prior to production.

   4. Finally, if you are ready to modify any of the Connection Settings, visit Connection Setting Guides and locate the specific Source System page/s in that tree. The individual pages in that tree provide detailed information about each setting.

      

8. After making any changes on this page, scroll to the bottom of the page, Check the consent checkbox and Click the Save connection button.

You have now completed all tasks to add your new Source Connection in the CI Sync Agent. 

Please do one of the following:

• Either add any additional source connections (using the relevant pages under Add Source Systems to On-Prem Agent)

• Or if you haven’t do so already, then follow the instructions inS6 - Configure your ServiceNow for CI Sync.

Task 5: Perform Updates in ServiceNow (if required)

In this section your ServiceNow SME will assess various updates to ServiceNow to support this CI Sync connector:

• Task 5a: Assess if the CMDB CI Class Models plug-in is required

• Task 5b: Assess if additional permissions are required

• Task 5c: (Optional though recommended) Assess your ServiceNow CI forms and update to include additional Related Lists

Task 5a: Assess if the CMDB CI Class Models plug-in is required

Context

A number of record sets (asset types/resource types) available to sync using the Lansweeper On-Prem Connector rely upon CMDB CI Classes that are only available via the CMDB CI Class Models plug-in. 

You therefore need to install the CMDB CI Class Models plug-in to your ServiceNow instance.

If you already have the plug-in you may want to upgrade it to the latest version (as ServiceNow occasionally updates the plug-in to include extra CI Classes/tables).

Instructions

Follow these steps to add this plug-in (and similar steps to locate it and upgrade it if required):

1. Assess the use/inclusion of this plug-in within your ServiceNow (ensure you are comfortable installing this plug-in).

2. Search for Plugins via the ServiceNow navigation menu.

3. Locate the CMDB CI Class Models plug-in.

4. Click Add -> Install and follow the instructions provided.

Task 5b: Assess if additional permissions are required

Use Case - If you are planning to use CI Sync to create Application Service Mapping relationships in ServiceNow

Context

CI Sync needs additional permissions to create/update Application Service relationships in ServiceNow.

The ServiceNow out-of-the-box role described in the instructions below provides the required permissions and therefore this role needs to be applied to your CI Sync Integration User if you intended to use CI Sync’s Application Service Mapping feature.

Instructions

1. Navigate to the cisync user account (e.g. “cisync.integration” or the name you used earlier in this page).

2. Select the Roles tab and click the Edit… button

3. Filter/Select the roles below and click the Save button

   1. app_service_admin

4. Click Save. Then use the “Roles” tab to check the above role has been applied.

Task 5c: (Optional though recommended) Assess your ServiceNow CI forms and update to include additional Related Lists

Context

CI Sync populates various child tables (related lists) associated with parent CIs. The following table shows the Related Lists (per CI Class) populated by the CI Sync Lansweeper On-Prem Connector.

Instructions

Below are the steps to modify a ServiceNow CI form to expose a new Related List.

1. Login to your ServiceNow instance with Admin permissions.

2. Navigate to any CI in the relevant CI Class (i.e. one/all of those listed in the table in the Context section above). For example, navigate to a Windows Server CI).

3. Right-click in the heading area of the form, then click Configure and then Related Lists from the sub-menus.

4. Identify the Related List you want to expose on the CI form using the table in the Context section above.

5. Find the Related List in the left hand column which lists all Available Related Lists.

6. Click the Related List and then click add (the selection arrow) to move the item to the Selected column and then click Save.

7. Repeat for each additional CI Class listed in the table in the Context section above.

Task 6: (Optional) Topics to be aware of if you plan to synchronize Software Licence Keys from Lansweeper to ServiceNow

General Overview

Lansweeper includes a feature to discover Software Licence Keys. You can read about this capability here: https://community.lansweeper.com/t5/managing-licenses/view-and-scan-software-license-keys-on-windows-computers/ta-p/64351

CI Sync includes an option to synchronize the Lansweeper discovered Software Licence Keys into ServiceNow. Customers can include Software Licence Keys as part of a Sync Job by selecting the “Licence Keys” selection on Step 2 of creating a CI Sync job (see below).

Customers may wish to use the results of this Lansweeper and CI Sync data in their ServiceNow for a number of targetted Software Asset Management (including audit or compliance) and/or Software Reclaimation initatives.

This Task (section of the guide) explains key topics to customers planning on using the above feature of Lansweeper and CI Sync. This section includes the following topics:

• Topic 1: The ServiceNow tables used by CI Sync.

• Topic 2: The ServiceNow permissions (role) required.

• Topic 3: Suggested ServiceNow UI updates to show the Licence Key data.

Topic 1: The ServiceNow tables used by CI Sync

The following ServiceNow tables are used by CI Sync when “Licence Keys” are included in the scope of a CI Sync job.

Topic 2: The ServiceNow permissions (role) required by CI Sync

By default the CI Sync Integration User account will not have access to the alm_* tables mentioned above.

The following steps explain how to assign a ServiceNow out-of-the-box role to your CI Sync integration user account so it has sufficient permissions to the noted tables.

1. Navigate to the cisync user account (e.g. “cisync.integration” or the name you used during Task 3: Create a User Account (to be used by your CI Sync SaaS instance) withinS6 - Configure your ServiceNow for CI Sync).

2. Select the Roles tab and click the Edit… button

3. Filter/Select the roles below and click the Save button

   1. sam

4. Click Save. Then use the “Roles” tab to check the above role has been applied.

Topic 3: Suggested ServiceNow UI updates to show the Licence Key data

Syncfish recommend adding the “License Entitlement->Allocated to” related list to the “Computer” [cmdb_ci_computer] and also to the “Windows Server” [cmdb_ci_win_server] Forms in ServiceNow.

Follow these steps to add for a Windows Server (and then repeat for a Windows Computer):

1. Login to your ServiceNow instance with Admin permissions.

2. Navigate to any Windows CI and open the form (e.g. navigate to a Windows Server CI form).

3. Right-click in the heading area of the form, then click Configure and then Related Lists from the sub-menus.

4. Locate the Licence Entitlement->Allocate to Related List in the Available column, then click Add button (i.e. the “>” selection arrow) to move the item to the Selected column and then click Save.

5. The Licence Entitlements Related List will now appear on each “Windows Server” [cmdb_ci_win_server] CI (as shown below).

6. Repeat the above steps using a “Computer” [cmdb_ci_computer] CI form to expose the same Related List on Windows Computer CIs.

Syncfish also recommend making the Licence Key field visible on the Licence Entitlements Related List (i.e. on the Related List added in the steps above).

Follow these steps to make the field visible on a Windows Server (and then repeat for a Windows Computer):

1. Right-mouse click on the header row of the License Entitlement related list and select Configure / List Layout

2. In the Related List fields editor

   1. Highligh the Entitlement field group (indicated in green and with a [+] symbole) from the Available fields list (lefthand side)

   2. Then click the “Expand selected reference field” button in the middle of the form.

3. The expanded fields from the Entitlement field group now appears in the Available fields list (lefthand side again).

   1. Select the field License Key field from the Available field list.

   2. Click the Add button (“>”) to add the field to the Selected list.

4. Finally,

   1. Notice the Selected list now includes “Entitlement.LicenceKey”).

   2. To avoid confusion, Syncfish recommend removing the Licence Key field from the Selected list (righthand side).

      1. Highligh the Licence Key field

      2. Click the Remove button (“<“)

   3. Click the Save button (to save the above changes and exit the page).

5. The License Key (i.e. the Entitlement.Licence Key field) will now be visible in the Related List.

Task 7: Do Not Synchronize Installed Software from two different source systems

Customers should be aware that if you synchronize Installed Software (i.e. the installed software applications for the same IT asset) from two different source systems (e.g. from Intune and Defender, or from Lansweeper and Defender, or InTune and SCCM, etc etc) for the same device you will end up with duplicate software instance records in your CMDB.

The cause of this issue is the naming convention of Installed Software is inconsistent between different source systems, and therefore CI Sync cannot reliably correlate the Installed Software per CI within the CMDB. By way of example:

• In InTune, “Microsoft Teams” is stored as “MSTeams” (and there is no Manufacturer attribute in InTune).

• However, in Defender for Endpoint, “Microsoft Teams” is stored as “Teams”.

Below are some notes to action this in advice in the CI Sync Web UI:

• When you are creating a sync job via the CI Sync UI and reach the Selections page, do not select “Software” or “Software Installs” from a given source system if you have already selected Installed Software on another source system sync job.

The screen shot below shows a sample of the Selection page for InTune as the source system for a CI Sync job. If you have selected Software Installs for InTune you should not select Software Installs for a Microsoft Defender for Endpoint sync job (as shown on the subsequent screen shot below)

The screen shot shows the Selection page for Microsoft Defender for Endpoint as the source system for a CI Sync job. You should NOT select Software Installs via Microsoft Defender for Endpoint because you have selected Software Installs via the InTune source system.

The same logic/approach applies to any other source system that offers Installed Software, such as SCCM or Lansweeper. The key message is: do NOT recommend synchronizing Installed Software from two different source systems.