Summary

How to quickly install, configure and run Tachyon for first use in a small-scale lab, evaluation or pilot environment.

To simplify things, this quick start assumes a simple design in which you will be installing Tachyon components on a single web server, with SQL Server installed either locally or remote (split). When implementing in a more complex environment you should instead follow the design, install and verify phases described in the  Implementing Tachyon Platform section.

This quick start is intended only for a fresh install. For upgrading or replacing an existing Tachyon system with Tachyon Platform 8.0, please see Upgrading to Tachyon Platform.

There are four stages to the Tachyon quick start. Each of these stages touch upon the design, install and verify phases described in the Implementing Tachyon Platform section.

Verifying Tachyon

This quick start provides an outline to installing, configuring and verifying a Tachyon system that is suitable for a lab-type environment. After the Prepare and Install sections, the Configure and Use sections provide steps that will verify the following aspects of the Tachyon system installation:

1. Configure quick start users - confirms integration with Active Directory and the basic RBAC capabilities of Tachyon.
2. Configure verification instructions - confirms the basic functionality for importing instruction definitions into Tachyon as well as confirming that licensing is working appropriately.
3. Viewing connected devices - confirms that the Tachyon certificates have been correctly configured
4. Asking a question - confirms that the Tachyon client communications are working
5. Performing an action - confirms that two-factor authentication, email connections and the approval workflow are working. The stage 2 verification action also checks that the Tachyon client download mechanism is working and that the background channel has been correctly configured.

This run through of the basic Tachyon functionality listed above works as a verification of the installation of Tachyon in a lab environment. If you see any issues when running through these steps please check the Troubleshooting section for a list of known issues. For production environments a more formal verification process that uses the same 1E-TachyonPlatform.zip file as used in this quick start guide is provided on the Verifying page.

Prepare

This quick start assumes a simple design in which you will be installing Tachyon components on a single web server, with SQL Server installed either locally or remote (split).

A summary of the preparation tasks:

1. Get a suitable license file for the Tachyon Platform, this should cover all the Tachyon applications you want to use.
2. Review your quick start infrastructure.
3. Prepare the quick start Tachyon server(s).
4. Create the DNS Name.
5. Install IIS roles, role services and features on the Tachyon Server.
6. Get and install the Tachyon Server's web server certificate.
7. Get and install a certificate on the Tachyon Server with at least Client Authentication Enhanced Key Usage. You might find that your Tachyon Server web certificate has this already, but that will not usually be the case.
8. Get the Tachyon files that will be used to complete the quick start.
9. Prepare the quick start Tachyon client devices.
10. Create the quick start user accounts.

The below process assumes your quick start environment has a Microsoft Enterprise CA and you are familiar with how to:

• configure your CA to use a CRL DP that supports HTTP or HTTPS
• publish a Web Server certificate template or issue a PFX
• use certlm.msc or the mmc certificates snap-in to request a web server certificate
• deploy computer certificates to clients, optionally using auto-enrollment

Quick start infrastructure

A Tachyon system consists of:

• Tachyon Server, which includes the Tachyon Switch component and website, hosted on an IIS web server
• SQL Server instance, which hosts the Tachyon Master and Responses databases, can be local or remote (split)
• Tachyon clients on supported devices
• Browsers used by Tachyon users and administrators to access the Tachyon Explorer and Admin portal

Your environment also requires:

• A correctly routed network environment where each device is configured with a genuine default gateway
• The server where Tachyon Web Server will be installed also needs internet access so that the licensing will work, specifically to https://license.1e.com
• AD domain for the Tachyon Server and user accounts, but Tachyon client devices can be in workgroups or other domains
• SMTP email server - See Requirements: Email requirements for more details
• A PKI which serves the Tachyon Server and all Tachyon client devices
• Your CA(s) are able to issue certificates with a CRL DP that supports HTTP or HTTPS

Quick start Tachyon servers

These are the servers required by Tachyon in addition to quick start infrastructure.

Server(s) can be physical or virtual, and must be domain joined.

If using any other version of Windows OS or SQL Server, or more detail is required, please refer to Requirements: Server requirements, and Preparation: Server Provisioning.

If using a firewall on the Tachyon Server, then ensure the following incoming ports are open:

• Website HTTPS 443
• Switch Port 4000

If more detail is required, refer to Communication Ports in the Reference section.

DNS Name

Create the DNS Name for the Tachyon Server, for example tachyon.acme.local

This can be a CNAME or a (A) Host record.

This DNS Name is used in the Web Server certificate that needs to be installed on the Tachyon Server.

Install IIS

Run the following PowerShell script on the Tachyon Server. Do this even if IIS is already installed because it will ensure all the required features and roles are installed.

If more detail is required, refer to IIS Configuration in the main Preparation section.

Import-Module ServerManager

Get-WindowsFeature | Out-file $PSScriptRoot\ServerManager-1.txt -Append
Install-WindowsFeature Web-Server,
Web-Http-Redirect,
Web-Dyn-Compression,
Web-Basic-Auth,
Web-IP-Security,
Web-Windows-Auth,
Web-Asp-Net45,
Web-Mgmt-Console,
Net-Framework-45-Core,
Net-Framework-45-ASPNET

Uninstall-WindowsFeature Web-DAV-Publishing
   
Get-WindowsFeature | Out-file $PSScriptRoot\ServerManager-2.txt -Append

Request a Web Server certificate

You will need to have requested a Web Server certificate from your Certificate Authority. To get the certificate in your organization you will have either:

• Submitted a CSR and received a password protected PFX file
• Used the Certificate Enrollment wizard to request a suitable Web Server certificate.

Once the Web Server certificate has been provided it must be imported into the Tachyon Server's local computer Personal Certificates store.

Each server that has Tachyon Server components installed requires its own Web Server certificate (except for a remote SQL Server). This certificate is also used by the Tachyon Switch and the Tachyon Coordinator. Therefore, a single-server installation requires only one Web Server certificate. This certificate must be provided on the server prior to installation of Tachyon.

The Web Server certificate requires the minimum of the following:

1. Issued by a trusted Certificate Authority (CA)
   • The certificate for the Root CA in the Certification Path must exist in the Trusted Root CA store of the server
   • If the issuing CA is not the Root CA then the certificate for the issuing CA and any intermediate CA in the Certification Path must exist in the Intermediate CA store of the server
   • The above CA certificates must exist on the Tachyon Web Server and Windows client devices
   • Most organizations have automated distribution of these CA certificates to servers and clients, using Group Policy for example.
2. Has at least the following Key Usage:
   
   • Digital signature
   • Key encipherment
3. Has at least the following Enhanced Key Usages:
   
   • Server Authentication
4. Revocation information is included
   • References at least one CRL Distribution point that uses HTTP - see DMZ Server note below
5. Must have a private key available

Request a client certificate

You will need to have requested a client certificate from your Certificate Authority. This will be used to authenticate communications between the Background Channel and the ContentDistribution components to support Nomad features.

Get the Tachyon files

You will need to download the following to complete the quick start.

1E Client installers

The 1EClient zip file can be downloaded from https://1eportal.force.com/s/tachyontopicdetail on the 1E Support Portal. The zip includes the following files used to install the Tachyon client on Windows devices:

• 1E.Client-x64.msi
• 1E.Client-x86.msi

Tachyon Server installers

The TachyonPlatform zip file can be downloaded from 1E Support Portal (1eportal.force.com/s/tachyontopicdetail). Extracting the zip will create a folder structure containing the following, where the files highlighted in bold are required by Tachyon Setup.

Quick start Tachyon client devices

The Tachyon client is supported on the following Windows OS in a quick start environment.

• Windows Server 2022
• Windows Server 2019
• Windows Server 2016
• Windows 10 CB 22H2
• Windows 11 CB 22H2
• Windows 10 CB 21H2
• Windows 11 CB 21H2

If using any other OS then please refer to Supported Platforms and Tachyon client installation pages in the Reference section.

Tachyon users on the Tachyon client devices can connect to the Tachyon Explorer portal using any of the following browsers:

Latest version of:

• Google Chrome
• Microsoft Edge (Chromium)
• Mozilla Firefox

PowerShell is used by some Tachyon Product Packs. If more detail is required, refer to PowerShell on Windows OS in the main Design considerations section.

If you have configured Tachyon Server to require client certificates (Tachyon Setup: Client certificates) then each device requires a certificate with the following properties, so the Tachyon client can be authenticated by the Tachyon Switch.

1. Issued by a trusted Certificate Authority (CA)
   • The certificate for the Root CA in the Certification Path must exist in the Trusted Root CA store of the client
   • If the issuing CA is not the Root CA then the certificate for the issuing CA and any intermediate CA in the Certification Path must exist in the Intermediate CA store of the client
   • If either of these CA certificates are different to those used by the Tachyon Web Server, they will need to be exported and imported on the Tachyon Web Server
   • Most organizations have automated distribution of these CA certificates to clients and servers, using Group Policy for example.
2. Has at least the following Enhanced Key Usage
   • Client Authentication
3. Has at least the following Key Usage
   • Digital Signature
   • Key encipherment
4. Has a private key
   • For workgroup and non-Windows devices, the private key must be exportable
5. Revocation information is included.
   • References at least one CRL Distribution point that uses HTTP.
6. Has a Subject Name of type Common Name (CN=<computername>) or Subject Alternative Name (DNS Name=<computername>) where <computername> depends on the type of device:
   • On domain-joined Windows PCs this must be the computername FQDN of the computer, for example W701.ACME.LOCAL
   • On workgroup Windows PCs and non-Windows devices, this must be the computername of the computer - as returned by the hostname command, for example on Windows PC this could be W701, and on a Mac this could be MAC01.local

Quick start user accounts

For simplicity in the quick start guide, we use just two Tachyon user accounts, the installation account and another full administrator account.

For the purposes of the quick start, which uses two-factor authentication, each account must have its AD account configured with an email address.

Using just the following accounts we can perform all the installation, Tachyon administration, verification questions, actions and approval tasks shown in this quick start guide.

Quick start service accounts

The table below describes all the service accounts and where they are used. Where domain accounts are required, you should create separate domain user accounts for each service.

Install

Tachyon Server

After obtaining your Tachyon.lic file from 1E you should store it in a secure location. In our example we've placed the Tachyon.lic file in the installation directory where Tachyon.Setup.exe is located.

Logon to the server using the server installation account TCNInstaller01.

Tachyon clients

When installing 1E Client (with Tachyon features enabled) the following installation settings are mandatory and must be supplied. Other Tachyon client configuration settings are optional and have been assigned default values.

The following properties can be entered manually when installing from the Windows Installer wizard. Alternatively, the properties can be included as part of a Windows msiexec command-line launch.

https://TACHYON.ACME.local:443/Background/

TACHYON.ACME.local:4000

Example which enables only Tachyon client

Example Windows 1E Client installer command-line with only the Tachyon client features enabled, other client modules are not enabled. Tachyon uses HTTPS only.

msiexec /i 1E.Client-x64.msi SWITCH="tachyon.acme.local:4000" BACKGROUNDCHANNELURL="https://tachyon.acme.local:443/Background/" /qn /l*vx C:\Windows\temp\1EClient-install.log

Example which enables only Nomad client

Example Windows 1E Client installer command-line with only Nomad client module enabled, which also requires Tachyon client features to be enabled. Tachyon uses HTTPS only.

msiexec /i 1E.Client-x64.msi SWITCH="tachyon.acme.local:4000" BACKGROUNDCHANNELURL="https://tachyon.acme.local:443/Background/" MODULE.NOMAD.ENABLED=true MODULE.NOMAD.CONTENTREGISTRATION=1 MODULE.NOMAD.SSDENABLED=1 /qn /l*vx C:\Windows\temp\1EClient-install.log

Example which enables only PXE Everywhere Agent

Example Windows 1E Client installer command-line with only PXE Everywhere Agent client module enabled, and Tachyon features disabled (by setting SWITCH and BACKGROUNDCHANNELURL to none). PXE Everywhere uses only HTTP. 

msiexec /i 1E.Client-x64.msi SWITCH=none BACKGROUNDCHANNELURL=none MODULE.PXEEVERYWHERE.ENABLED=true MODULE.PXEEVERYWHERE.CONFIGSERVERURL="http://pxecentral.acme.local/PXELite/PXELiteConfiguration.asmx" /qn /l*vx C:\Windows\temp\1EClient-install.log

Example which enables only Shopping client

Example Windows 1E Client installer command-line with only Shopping client module enabled, and Tachyon features disabled (by setting SWITCH and BACKGROUNDCHANNELURL to none). Ensure you use HTTP or HTTPS as appropriate.

msiexec /i 1E.Client-x64.msi SWITCH=none BACKGROUNDCHANNELURL=none MODULE.SHOPPING.ENABLED=true MODULE.SHOPPING.SHOPPINGCENTRALURL="https://appstore.acme.local/shopping" MODULE.SHOPPING.LOOPBACKEXEMPTIONENABLED=true /qn /l*vx C:\Windows\temp\1EClient-install.log

Example which enables only WakeUp client

Example Windows 1E Client installer command-line with only WakeUp client module enabled, and Tachyon features disabled (by setting SWITCH and BACKGROUNDCHANNELURL to none).

msiexec /i 1E.Client-x64.msi SWITCH=none BACKGROUNDCHANNELURL=none MODULE.WAKEUP.ENABLED=true MODULE.WAKEUP.REPORTINGSERVER="nwmserver.acme.local" /qn /l*vx C:\Windows\temp\1EClient-install.log

Export all responses feature

This step is optional, only if you require this feature. Please refer to Tachyon Server post-installation tasks: Configure the Tachyon Server to support the Export all responses feature for more details.

Configure

Set security roles

After installation you will only be able to log onto the Tachyon Explorer using the installation account. This account is purposefully restricted to just allowing the configuration of security roles. So the first step must be to add other users to access the other capabilities of Tachyon.

Users for administration

We suggest that you add a user or group to handle the administration tasks for your evaluation environment.

Users for performing actions

To perform actions you will need at least two other users. One an actioner and the other an approver, otherwise you won't be able to perform actions.

A Tachyon AD group tutorial

For this quick start guide we use two specific accounts and a security group to assign to the roles we need. You may want to use AD groups to define Tachyon access and we have provided a complete tutorial on adding users and roles via AD groups, on the Configuring Access Rights: tutorial page, which you may find useful.

Use

Using Tachyon

Having configured the users who will access Tachyon we can now go on to demonstrate the basic functionality of Tachyon including: viewing connected devices, asking a question and seeing the responses, requesting to perform an action and the associated approval process.

In conclusion

In this quick start guide we've shown how to configure an example environment, how to implement the Tachyon Server and Tachyon clients onto the environment, how to configure the Tachyon users and import product packs. Finally we've shown those users accessing the Tachyon Explorer to investigate the devices that are currently connected and then asking a question and performing and approving an action.

Next Steps

Using applications that are installed by default

The following applications are always installed by Tachyon Setup, although you may have limited access to features depending on your Tachyon license.

• Settings - please refer to Using Settings
• Inventory - please refer to Using Inventory
• Tachyon Explorer - please refer to Tachyon Explorer 8.0 - Using Tachyon Explorer
• Guaranteed State - please refer to Guaranteed State 8.0 - Using Guaranteed State
• Experience - please refer Tachyon Experience 8.0 - Implementing Experience.

Please refer to Tachyon Platform 8.0 - Using consumer applications for a summary of these and other optional applications.

Use the Connectors page in the Inventory application to configure connectors and populate the inventory repository. Using Inventory describes how to view the normalized inventory data, which can then be used by the following applications that adepend on inventory.

• AppClarity
• Application Migration
• Patch Success.

Installing and Using AppClarity

You can use Tachyon Setup install AppClarity during or after you install or upgrade Tachyon using Tachyon Setup. Please refer to AppClarity 8.0 - Implementing AppClarity.

Installing and Using Application Migration

You can install Application Migration during or after you install or upgrade Tachyon using Tachyon Setup. Please refer to Application Migration 8.0 - Implementing Application Migration.

Installing and Using Patch Success

Use must use Tachyon Setup to install and configure Patch Success when you install or upgrade Tachyon Platform. Further configuration is then required as described in 1E Patch Success 8.0 - Implementing Patch Success

Installing and Using Nomad

You can install Nomad during or after you install or upgrade Tachyon using Tachyon Setup. Please refer to Nomad 8.0 - Implementing Nomad.

Using Configuration Manager Console Extensions

If you have Microsoft System Center Configuration Manager (SCCM, ConfigMgr) then you can install the Tachyon toolkit on each computer that has Configuration Manager Console installed, in order to add right-click tools. Please refer to The 1E Tachyon Toolkit.

Creating your own instructions

You will need your own code signing certificate, and have it registered in your Tachyon license, if you want to develop your own custom Tachyon instructions, or modify those of other authors. Instructions that are provided in the Tachyon Platform zip or downloaded from the Tachyon Exchange have already been code signed using the Platform and Exchange certificates from 1E. Your Tachyon license controls whether you can use these instructions.

Ideally, all of your Tachyon instruction developers should share a single code signing certificate between them. Each code signing certificate must be registered in your Tachyon license and associated with your organization's instruction name prefix. When you have chosen your prefix and have your code signing certificate(s) you then need to send details of these to 1E, who will update your Tachyon license. This will then automatically activate on your Tachyon Server (assuming it has connection to the Internet).

For a detailed step-by-step process, please refer to Setting up custom Tachyon Instructions for the first time.

The Tachyon SDK is where you can find comprehensive resources for using Tachyon Instruction Management Studio (TIMS) and authoring your instructions.