1E 8.1 (on-premises)

If you have implemented Tachyon Server on an IIS server that has previously been or is currently used by other applications then there may be other Web Server certificates in the Local Computer's Personal Certificates store in addition to the Tachyon Web Server certificate. In earlier versions of Tachyon, it was possible under these circumstances for the Tachyon Server installer to bind to the wrong certificate. The current version contains improved logic for avoiding this problem, but it is still good practice to verify that the configuration is indeed as expected.

To select the correct certificate for the HTTPS binding see the troubleshooting steps for Server installation issues.

If you want to optionally remove the HTTP binding, please refer below to the optional task Removing the HTTP binding from the Tachyon website.

Immediately after installation, you can only access the Tachyon portal and the Settings application using the server installation account, until additional users have been added and assigned to their roles.

The installation account is assigned the Installer role and cannot be modified because it is a System Principal.

This means that one of your first steps after the installation is to connect to the Portal using the installation account and add other Tachyon users with necessary roles as described in the Users and Groups page and the Roles page.

Tachyon functionality is based on Instructions, until these are added to the system you will not be able to ask questions or perform actions. 1E provides instructions in zip files called Product Packs. A collection of Product Packs necessary for zip files is available in the Tachyon Setup zip (available on the https://support.1e.com/ and from the Tachyon Exchange. Each Product Pack contains a related collection of Instruction Definitions. Product Packs and Instruction Definitions can be added by a Full Administrator.

When added, Instructions are immediately allocated to the built-in Unassigned Instruction set. Instruction sets provide a way of determining the permissions for the Instructions they contain, but the Unsassigned Instruction set is only intended as a staging area for newly loaded Instructions - and Instructions in this set cannot be used directly. An Instruction can only belong to a single Instruction set, so after loading it, and before it can be used, it must be moved to another Instruction set - one created by a Full Administrator.

Instruction sets created by a Full Administrator can be used as the basis for custom roles created by a Full Administrator or Group Administrator. These custom roles determine the permissions for the Instruction sets and all the Instructions they contain. This enables the administrator to complete the assignment of specific Instruction set roles to users and determine which Instructions they can action, approve, question, or view.

You can either load instructions and create Instruction Sets for them automatically from Tachyon Setup by using the Tachyon Product Pack Deployment Tool, as described in Uploading with the Tachyon Product Pack Deployment Tool. Or, you can load the Product Packs and create their associated instruction sets by hand.

The tool is included in the Tachyon Platform zip file under the ProductPacks folder.

The ProductPacks folder contains two directories, Classic and Integrated.

Tachyon Product Packs reference provides full details of all the product packs included in the Tachyon Platform zip.

The account used to run the Tachyon.ProductPackDeploymentTool.exe must:

You will need to deploy the 1E Client (with Tachyon enabled) to at least one device in order to use any instructions. You will need to do this in order to fully verify the installation of your Tachyon Platform.

Please refer to Deploying Tachyon clients for guidance on deploying clients to Windows and non-Windows devices.

The Export all feature is displayed on the responses page for a question once it has finished retrieving all its responses. To enable this to work you need to configure the following:

Error: Header-row missing in .tsv file export	Tachyon Consumer has no access to share folder
Error: Contents missing in .tsv file export	Tachyon Core(s) has no access to share folder
Successful: Both header-row and contents correctly included in .tsv file export	Tachyon Consumer and Tachyon Core(s) have access to share folder

You can add an inventory connector to Tachyon that will sync data from a data source to an inventory repository. Typically, this connector would be to another system such as Configuration Manager or to Tachyon itself. For more details please refer to the Connectors page. At least one configured inventory connector is required to support management groups.

You can create Management groups to partition your estate into groups of devices that can be managed separately. This is done by creating a management group in the Settings application, please refer to Management Groups page and Management Groups - tutorial for more details. To synchronize the management groups with Explorer you'll need to add a Tachyon connector, please refer to Tachyon connector for more details.

After the databases have been created, the best practice is to change the owner of each database to sa, to avoid issues if the owner's Windows account is deleted in the future.

The following script can be used to change the owner of each database to sa. This will work even if the sa login has been disabled, which is also best practice.

Change owner to 'sa' Expand source

ALTER AUTHORIZATION ON DATABASE::TachyonMaster To "sa"
GO
ALTER AUTHORIZATION ON DATABASE::TachyonResponses To "sa"
GO

Grant db_owner Expand source

USE [TachyonMaster]
GO
CREATE USER [ACME\TCNinstaller01] FOR LOGIN [ACME\TCNinstaller01];
ALTER ROLE [db_owner] ADD member [ACME\TCNinstaller01];
GO
USE [TachyonResponses]
GO
CREATE USER [ACME\TCNinstaller01] FOR LOGIN [ACME\TCNinstaller01];
ALTER ROLE [db_owner] ADD member [ACME\TCNinstaller01];
GO

The server installer does not support configuration of SMTP credentials, but these can be configured post-installation. By default, Tachyon assumes port 25 and anonymous authentication.

Tachyon stores its SMTP configuration in

After any changes reboot the server or restart the 1E Tachyon Coordinator service.

<configuration>
  ...
  <appSettings>
    ...
    <add key="smtpHost" value="ACME-EXC01.acme.local"/>
    <add key="TachyonEmail" value="Tachyon@acme.local"/>
    ...
    <add key="2FAEnabled" value="true" />
    ...
  </appSettings>
  ...
  </entityFramework>
  <!-- The settings in the following section can be modified to provide custom port and authentication options for SMTP -->
  <system.net>
    <mailSettings>
      <smtp deliveryMethod="Network">
        <network
          port="25"
          defaultCredentials="true"
          userName=""
          password=""
        />
      </smtp>
    </mailSettings>
  </system.net>
</configuration>

By default, a Switch will temporarily blacklist the IP addresses of devices that "misbehave" - that is, if an external device, browser or other endpoint, sends a message other than Online when it first connects. This is to handle denial-of-service attacks or other malicious attempts to connect to the Switch.

However, you may wish to disable this feature in some circumstances. For example, if you are using a load balancer that sends a probe which triggers the block on its IP address, potentially blocking all clients using the load balancer.

You can configure this feature by editing the TACHYON_SWITCH_DOSBLOCK_OFF setting in the <INSTALLDIR>\Tachyon\Switch\Tachyon.Switch.Host.exe.config file.

For a change of setting to take effect, restart the Switch Host service.

  <switchEnvironment>
    <settings>
      <setting name="TACHYON_SWITCH_DOSBLOCK_OFF" value="0" />
      ...
    </settings>
  </switchEnvironment>

You can test this by using a browser to go to:

http://tachyon.acme.local:4000

if the blocking is enabled this will be blocked for a few seconds, and if you refresh the browser you will see the connection is immediately rejected, but if the blocking is disabled you will see these are not rejected.

Blocking: On

When the blocking is on you will see Agent blocked warning messages in the Switch log when a device misbehaves:

Blocking: Off (default)

When the blocking is off, the first time it would have triggered you will see an INFO message saying it is disabled.

Please refer to the Device Deduplication page for further information about how the process works, and how to configure the settings.

Tachyon stores its Device Deduplication configuration in the <INSTALLDIR>\Tachyon\Coordinator\Tachyon.Server.Coordinator.exe.config file.

After any changes reboot the server or restart the 1E Tachyon Coordinator service.

The time and frequency of when the Device Deduplication process runs is changed by adding and editing the DeviceDeduplication setting.

<module assemblyName="Tachyon.Server.Coordinator" providerName="Tachyon.Server.Coordinator.Scheduling.SchedulingModule">
  <settings>
    <add key="Crontab1" value="50 23 * * * LogDevicesSeenInTheLast7Days" />
    <add key="Crontab2" value="15 * * * * MaintainPolicyRulePartitioning" />
    <add key="Telemetry" value="40 23 * * 5 SendTelemetryStats" />
    <add key="DeviceDeduplication" value="0 1 * * 0 DeviceDeduplication {DeleteDevices:'false',UpdateDeviceData:'false',DeleteOrphanedDeviceData:'false',DeviceIdentifier:['FQDN']}" />
  </settings>
</module>

The numbers that you see after value is a crontab schedule expression. The schedule 0 1 * * 0 means "at 01:00 hours, any day of the month, any month of the year, on weekday 0 (Sunday)". In other words, this configuration runs the Device Deduplication process at 1AM UTC every Sunday night.

You can use an online tool such as https://crontab.guru/ to verify your crontab schedule expression.

Telemetry helps 1E to continually improve your experience. Only summarized statistical information is collected, which enables 1E to see how customers use features of the application. No personally identifiable data is collected. 1E use this information to:

Server telemetry reports how the platform is used and data is compressed, encrypted and sent to 1E through email on a configurable schedule. Full details of the Server telemetry data sent to 1E is provided in Server telemetry data.

User Interface telemetry reports how the user interface is used, and data is sent directly from administrator browsers to the 1E Cloud.

<module assemblyName="Tachyon.Server.Coordinator" providerName="Tachyon.Server.Coordinator.Scheduling.SchedulingModule">
  <settings>
    <add key="Crontab1" value="50 23 * * * LogDevicesSeenInTheLast7Days" />
    <add key="Crontab2" value="15 * * * * MaintainPolicyRulePartitioning" />
    <add key="Telemetry" value="40 23 * * 5 SendTelemetryStats" />
  </settings>
</module>

User interface telemetry

In this version of the platform, you must edit the User interface telemetry configuration in the Master database.

Connect to the TachyonMaster database and edit the GlobalSetting table. Locate the entry whose Name is UITelemetryLevel and change the Value to 0, 1, 2 or 3, to reflect the type of data that is reported to 1E.

0 - Off

1 - Anonymous

2 - License Name

3 - License Name and Unique user ID

The change takes effect for each user when they close and reopen their browser to connect to the portal.

Note

License Name is Customer name as it appears in the license file and License information page.

Unique user ID is a random ID number representing an individual user.

2FA is optionally disabled (enabled by default) in the Active Directory and email screen. If you need to change this after installation, then you need to edit the setting <add key="2FAEnabled" value="true" /> in the <INSTALLDIR>\Tachyon\Coordinator\Tachyon.Server.Coordinator.exe.config file.

If enabling 2FA, please refer to Email and 2FA requirements.

You can optionally remove the HTTP binding from the Tachyon website on any Tachyon server (Master, Response, DMZ or other server). You can do this by simply deleting the HTTP binding in IIS Manager.

The table below lists 1E products and apps that may depend on the website HTTP binding, which you should consider before removing it from the Master Stack.

The following apps have no dependency on HTTP.