1E 9.x (on-premises)

The 1E URL will be sent in an email on completion of the provisioning process.

On navigating to the 1E URL you will be presented with some additional sign in screens that integrate with your IdP.

As the principal 1E user you will have access to all licensed applications.

From here you should navigate to Settings > Permissions > Users and Groups and start adding the Users and Groups from your IdP that you want permission in 1E. For more information, please refer to Users and Groups page.

If you have implemented 1E Server on an IIS server that has previously been or is currently used by other applications then there may be other Web Server certificates in the Local Computer's Personal Certificates store in addition to the 1E Web Server certificate. In earlier versions of 1E, it was possible under these circumstances for the 1E Server installer to bind to the wrong certificate. The current version contains improved logic for avoiding this problem, but it is still good practice to verify that the configuration is indeed as expected.

To select the correct certificate for the HTTPS binding see the troubleshooting steps for Server installation issues.

If you want to optionally remove the HTTP binding, please refer below to the optional task Removing the HTTP binding from the 1E website.

Immediately after installation, you can only access the 1E portal and the Settings application using the server installation account, until additional users have been added and assigned to their roles.

The installation account is assigned the Installer role and cannot be modified because it is a System Principal.

This means that one of your first steps after the installation is to connect to the Portal using the installation account and add other 1E users with necessary roles as described in the Users and Groups page and the Roles page.

1E functionality is based on Instructions, until these are added to the system you will not be able to ask questions or perform actions. 1E provides instructions in zip files called DEXPacks. A collection of DEXPacks necessary for zip files is available in the 1E Server Setup zip (available on the https://support.1e.com/ and from the 1E Exchange. Each DEXPack contains a related collection of Instruction Definitions. DEXPacks and Instruction Definitions can be added by a Full Administrator.

When added, Instructions are immediately allocated to the built-in Unassigned Instruction set. Instruction sets provide a way of determining the permissions for the Instructions they contain, but the Unsassigned Instruction set is only intended as a staging area for newly loaded Instructions - and Instructions in this set cannot be used directly. An Instruction can only belong to a single Instruction set, so after loading it, and before it can be used, it must be moved to another Instruction set - one created by a Full Administrator.

Instruction sets created by a Full Administrator can be used as the basis for custom roles created by a Full Administrator or Group Administrator. These custom roles determine the permissions for the Instruction sets and all the Instructions they contain. This enables the administrator to complete the assignment of specific Instruction set roles to users and determine which Instructions they can action, approve, question, or view.

You can either load instructions and create Instruction Sets for them automatically from 1E Server Setup by using the 1E product pack deployment tool, as described in Uploading with the 1E product pack deployment tool. Or, you can load the DEXPacks and create their associated instruction sets by hand.

The tool is included in the 1E platform zip file under the ProductPacks folder.1E platform zip

The ProductPacks folder contains two directories, Classic and Integrated.

1E DEXPacks reference provides full details of all the product packs included in the 1E platform zip.1E platform zip

The account used to run the Tachyon.ProductPackDeploymentTool.exe must:

You will need to deploy the 1E Client (with Tachyon enabled) to at least one device in order to use any instructions. You will need to do this in order to fully verify the installation of your 1E Platform.

Please refer to Deploying Tachyon clients for guidance on deploying clients to Windows and non-Windows devices.

The Export all feature is displayed on the responses page for a question once it has finished retrieving all its responses. To enable this to work you need to configure the following:

Error: Header-row missing in .tsv file export	1E Consumer has no access to share folder
Error: Contents missing in .tsv file export	1E Core(s) has no access to share folder
Successful: Both header-row and contents correctly included in .tsv file export	1E Consumer and 1E Core(s) have access to share folder

You can add an inventory connector to 1E that will sync data from a data source to an inventory repository. Typically, this connector would be to another system such as Configuration Manager or to Tachyon itself. For more details please refer to the Connectors page. At least one configured inventory connector is required to support management groups.

You can create Management groups to partition your estate into groups of devices that can be managed separately. This is done by creating a management group in the Settings application, please refer to Management Groups page and Management Groups - tutorial for more details. To synchronize the management groups with Endpoint Troubleshooting you'll need to add a 1E connector, please refer to 1E connector for more details.

After the databases have been created, the best practice is to change the owner of each database to sa, to avoid issues if the owner's Windows account is deleted in the future.

The following script can be used to change the owner of each database to sa. This will work even if the sa login has been disabled, which is also best practice.

Change owner to 'sa' Expand source

ALTER AUTHORIZATION ON DATABASE::TachyonMaster To "sa"
GO
ALTER AUTHORIZATION ON DATABASE::TachyonResponses To "sa"
GO

Grant db_owner Expand source

USE [TachyonMaster]
GO
CREATE USER [ACME\TCNinstaller01] FOR LOGIN [ACME\TCNinstaller01];
ALTER ROLE [db_owner] ADD member [ACME\TCNinstaller01];
GO
USE [TachyonResponses]
GO
CREATE USER [ACME\TCNinstaller01] FOR LOGIN [ACME\TCNinstaller01];
ALTER ROLE [db_owner] ADD member [ACME\TCNinstaller01];
GO

The server installer does not support configuration of SMTP credentials, but these can be configured post-installation. By default, 1E assumes port 25 and anonymous authentication.

Tachyon stores its SMTP configuration in

After any changes reboot the server or restart the 1E Tachyon Coordinator service.

<configuration>
  ...
  <appSettings>
    ...
    <add key="smtpHost" value="ACME-EXC01.acme.local"/>
    <add key="TachyonEmail" value="Tachyon@acme.local"/>
    ...
    <add key="2FAEnabled" value="true" />
    ...
  </appSettings>
  ...
  </entityFramework>
  <!-- The settings in the following section can be modified to provide custom port and authentication options for SMTP -->
  <system.net>
    <mailSettings>
      <smtp deliveryMethod="Network">
        <network
          port="25"
          defaultCredentials="true"
          userName=""
          password=""
        />
      </smtp>
    </mailSettings>
  </system.net>
</configuration>

By default, a Switch will temporarily blacklist the IP addresses of devices that "misbehave" - that is, if an external device, browser or other endpoint, sends a message other than Online when it first connects. This is to handle denial-of-service attacks or other malicious attempts to connect to the Switch.

However, you may wish to disable this feature in some circumstances. For example, if you are using a load balancer that sends a probe which triggers the block on its IP address, potentially blocking all clients using the load balancer.

You can configure this feature by editing the TACHYON_SWITCH_DOSBLOCK_OFF setting in the <INSTALLDIR>\Tachyon\Switch\Tachyon.Switch.Host.exe.config file.

For a change of setting to take effect, restart the Switch Host service.

  <switchEnvironment>
    <settings>
      <setting name="TACHYON_SWITCH_DOSBLOCK_OFF" value="0" />
      ...
    </settings>
  </switchEnvironment>

You can test this by using a browser to go to:

http://tachyon.acme.local:4000

if the blocking is enabled this will be blocked for a few seconds, and if you refresh the browser you will see the connection is immediately rejected, but if the blocking is disabled you will see these are not rejected.

Blocking: On

When the blocking is on you will see Agent blocked warning messages in the Switch log when a device misbehaves:

Blocking: Off (default)

When the blocking is off, the first time it would have triggered you will see an INFO message saying it is disabled.

Please refer to the Device Deduplication page for further information about how the process works, and how to configure the settings.

1E stores its Device Deduplication configuration in the <INSTALLDIR>\Tachyon\Coordinator\Tachyon.Server.Coordinator.exe.config file.

After any changes reboot the server or restart the 1E Tachyon Coordinator service.

The time and frequency of when the Device Deduplication process runs is changed by adding and editing the DeviceDeduplication setting.

<module assemblyName="Tachyon.Server.Coordinator" providerName="Tachyon.Server.Coordinator.Scheduling.SchedulingModule">
  <settings>
    <add key="Crontab1" value="50 23 * * * LogDevicesSeenInTheLast7Days" />
    <add key="Crontab2" value="15 * * * * MaintainPolicyRulePartitioning" />
    <add key="Telemetry" value="40 23 * * 5 SendTelemetryStats" />
    <add key="DeviceDeduplication" value="0 1 * * 0 DeviceDeduplication {DeleteDevices:'false',UpdateDeviceData:'false',DeleteOrphanedDeviceData:'false',DeviceIdentifier:['FQDN']}" />
  </settings>
</module>

The numbers that you see after value is a crontab schedule expression. The schedule 0 1 * * 0 means "at 01:00 hours, any day of the month, any month of the year, on weekday 0 (Sunday)". In other words, this configuration runs the Device Deduplication process at 1AM UTC every Sunday night.

You can use an online tool such as https://crontab.guru/ to verify your crontab schedule expression.

Telemetry helps 1E to continually improve your experience. Only summarized statistical information is collected, which enables 1E to see how customers use features of the application. No personally identifiable data is collected. 1E use this information to:

Server telemetry reports how the platform is used and data is compressed, encrypted and sent to 1E through email on a configurable schedule. Full details of the Server telemetry data sent to 1E is provided in Server telemetry data.

User Interface telemetry reports how the user interface is used, and data is sent directly from administrator browsers to the 1E Cloud.

<module assemblyName="Tachyon.Server.Coordinator" providerName="Tachyon.Server.Coordinator.Scheduling.SchedulingModule">
  <settings>
    <add key="Crontab1" value="50 23 * * * LogDevicesSeenInTheLast7Days" />
    <add key="Crontab2" value="15 * * * * MaintainPolicyRulePartitioning" />
    <add key="Telemetry" value="40 23 * * 5 SendTelemetryStats" />
  </settings>
</module>

User interface telemetry

In this version of the platform, you must edit the User interface telemetry configuration in the Master database.

Connect to the TachyonMaster database and edit the GlobalSetting table. Locate the entry whose Name is UITelemetryLevel and change the Value to 0, 1, 2 or 3, to reflect the type of data that is reported to 1E.

0 - Off

1 - Anonymous

2 - License Name

3 - License Name and Unique user ID

The change takes effect for each user when they close and reopen their browser to connect to the portal.

Note

License Name is Customer name as it appears in the license file and License information page.

Unique user ID is a random ID number representing an individual user.

2FA is optionally disabled (enabled by default) in the Email configuration screen. If you need to change this after installation, then you need to edit the setting <add key="2FAEnabled" value="true" /> in the <INSTALLDIR>\Tachyon\Coordinator\Tachyon.Server.Coordinator.exe.config file.

If enabling 2FA, please refer to Email and 2FA requirements.

You can optionally remove the HTTP binding from the 1E website on any 1E server (Master, Response, DMZ or other server). You can do this by simply deleting the HTTP binding in IIS Manager.

The table below lists 1E products and apps that may depend on the website HTTP binding, which you should consider before removing it from the Master Stack.

The following apps have no dependency on HTTP.