Installing ITM On-Prem Web Console

The ITM On-Prem Web Console is the component that is used to configure, administer and use the product. Multiple Web Consoles can be installed in an environment for redundancy purposes.

In most cases, the Web Console is installed on the same machine as the Application Server (the first one, in case of multiple Application Servers). However, it’s also possible to configure a dedicated machine for this.

The time displayed in the Web Console is defined by the time zone of the database. Therefore, it is recommended that the Web Console and Database are installed with the same time zone.

Before you can verify the Web Console installation you must install the SQL Native client. This lets you work with ITM On-Prem (ObserveIT) REST APIs.

Prerequisite for installing the Web Management Console: Download the most recent version of Microsoft ASP .Net Core Runtime Windows Hosting Bundle.

Installing the ITM On-Prem Web Console with PowerShell

You can use the following PowerShell commands to install the ITM On-Prem Web Console. (This is the recommended procedure.)

Optionally, you can use the manual precedure, see Installing ITM On-Prem Web Console.

Prerequisites:

ITM On-Prem (ObserveIT) Databases installed (see Installing the ITM On-Prem (ObserveIT) Databases)
Windows Server machine installed
Microsoft SQL Server Standard Edition 2019 installed
Complete Active Directory Prerequisites, Firewall System Prerequisites, Back-end Components Prerequisites and Digital Certificates Prerequisites
Credentials for the Active Directory Service Account.

You must remove previous version of .Net core before upgrading.

Connect (with RDP) to the server that will host the ITM On-Prem Web Console component as the Active Directory Service Account.
Download the ITM On-Prem installer into c:\temp and extract the contents. (See Downloading the Latest Version.)

(Assume the installer files are extracted to c:\temp\ObserveIT_Setup_vx.xx.y.yy path, where x.xx the major ITM On-Prem version, and y.yy is the minor version and build.)
Run PowerShell as Administrator.

From the table below, copy the rows from Command column, replacing the values as applicable. The Values to Replace column indicates which values you will need to replace.

Paste the commands in the table below into the PowerShell window.

Command	Values to Replace
`$observeitInstallerPath = "c:\temp\ObserveIT_Setup_vx.xx.y.yy"`	Replace the generalized path with the correct path for your ITM OnPrem installer. For example: C:\temp\ObserveIT_Setup_v7.11.0.25
`$SQLServer = '<# FQDN of the SQL Server #>'`	Replace the commented section with FQDN of your SQL Server
`$DNSForestName = "<# enter your DNS domain name here #>"`	Replace the commented section with the DNS domain name of your Active Directory. For example: domain.local.
`$Creds = Get-Credential`
`$WebSiteName = 'ObserveITWebConsole'`
`$WebSitePort = "443"`
`$WebSiteProtocol = "https"`
`$ComputerName = (Get-WmiObject -Class Win32_ComputerSystem).PSComputerName`
`$MachineFQDN = $ComputerName + '.' + $DNSForestName`
`$ApplicationPool = "IIS:\AppPools\$WebSiteName"`
`$WebSiteBinding = ":" + $WebSitePort + ":"`
`$OutputDestination = 'C:\temp'`
GMSA_USER = 1	Optional for gMSA account

When PowerShell prompts, Enter your Active Directory Service Account credentials here, enter your Active Directory username in the format DOMAIN\account.
Install the required Windows features:

Install-WindowsFeature Web-Server, Web-WebServer, Web-Common-Http, Web-Default-Doc, Web-Dir-Browsing, Web-Http-Errors, Web-Static-Content, Web-Stat-Compression, Web-Security, Web-Filtering, Web-App-Dev, Web-Net-Ext45, Web-Asp, Web-Asp-Net45, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Mgmt-Tools, Web-Mgmt-Compat, Web-Mgmt-Console, NET-WCF-Services45, NET-WCF-HTTP-Activation45 -IncludeManagementTools

Create the directory and Microsoft IIS folder structures:

                    New-Item -Name ObserveIT -Path "C:\Program Files" -ItemType Directory
New-Item -Name Web -Path "C:\Program Files\ObserveIT" -ItemType Directory
Import-Module WebAdministration
New-Item $ApplicationPool -Force
New-Item IIS:\Sites\$WebSiteName -PhysicalPath 
'C:\Program Files\ObserveIT\Web\' `
-Bindings @{protocol = $WebSiteProtocol; bindingInformation = 
$WebSiteBinding } -Force
Set-ItemProperty IIS:\Sites\$WebSiteName\ -Name applicationpool -Value 
$WebSiteName -Force

Require SSL for connections to the ITM On-Prem Web Console websites:

Import-Module WebAdministration
$ConfigSection = Get-IISConfigSection -SectionPath 
"system.webServer/security/access" -Location "$WebSiteName"
Set-IISConfigAttributeValue -AttributeName sslFlags -AttributeValue 
Ssl -ConfigElement $ConfigSection
Get-IISConfigAttributeValue -ConfigElement $ConfigSection 
-AttributeName sslFlags

Disable IIS logging:

Set-ItemProperty -Path "IIS:\Sites\$WebSiteName" -Name Logfile.enabled -Value $false

Configure the best-practice IIS Application Pool recycling settings:

Import-Module WebAdministration
$AppPoolPath = "$ApplicationPool Set-ItemProperty $AppPoolPath -Name Recycling.periodicRestart.time 
-Value 0.08:00:00
Clear-ItemProperty $AppPoolPath -Name Recycling.periodicRestart.schedule
$RestartAt = @('12:00', '20:00', '07:00')
New-ItemProperty -Path $AppPoolPath -Name Recycling.periodicRestart.schedule 
-Value $RestartAt

Assign the provisioned TLS certificate to the ITM On-Prem Web Console website. (The TLS certificate was provisioned in Back-end Components Prerequisites.
Right-click the StartMenu and click Run.
Type inetmgr and click OK.
In the Microsoft Internet Information Services management console, select and expand your server and then expand Sites.
Right-click the ITM On-PremWebConsole website and click Bindings.
Select the row starting with https in the Site Bindings window and click Edit.
From the SSL certificate drop-down, at the bottom of the window, select your provisioned TLS certificate.
Click OK to apply the settings.
Click Close in the Site Bindings window.
Install ITM On-Prem Web Console prerequisites:

$NodeJSInstaller = $observeitInstallerPath + '\Web\PreRequisite_nodeServices.exe' $ComponentInstallArguments = "wconly=1", "sqlcli=1", "/install", "/quiet", "/norestart" ,"/log PreRequisite_nodeServices.log" Start-Process $NodeJSInstaller -ArgumentList $ComponentInstallArguments -Wait

Assign Logon as Service Rights to the Active Directory Service Account:

function Set-LogonRight ($accountToAdd) {
    if ( [string]::IsNullOrEmpty($accountToAdd) ) {
        Write-Output "no account specified"
        exit
}
    $sidstr = $null
try {
        $ntprincipal = new-object System.Security.Principal.NTAccount "$accountToAdd"
        $sid = $ntprincipal.Translate([System.Security.Principal.SecurityIdentifier])
        $sidstr = $sid.Value.ToString()
} catch {
        $sidstr = $null
}
    Write-Output "Account: $($accountToAdd)"
    if ( [string]::IsNullOrEmpty($sidstr) ) {
        Write-Output "Account not found!"
        exit -1
}
    Write-Output "Account SID: $($sidstr)"
    $tmp = [System.IO.Path]::GetTempFileName()
    Write-Output "Export current Local Security Policy"
    secedit.exe /export /cfg "$($tmp)" 
    $c = Get-Content -Path $tmp 
    $currentSetting = ""
    foreach ($s in $c) {
        if ( $s -like "SeServiceLogonRight*") {
            $x = $s.split("=", [System.StringSplitOptions]::RemoveEmptyEntries)
            $currentSetting = $x[1].Trim()
    }
}
    if ( $currentSetting -notlike "*$($sidstr)*" ) {
        Write-Output "Modify Setting ""Logon as a Service"""
        if ( [string]::IsNullOrEmpty($currentSetting) ) {
            $currentSetting = "*$($sidstr)"
    } else {
            $currentSetting = "*$($sidstr),$($currentSetting)"
    }
        Write-Output "$currentSetting"
$outfile = @"
[Unicode]
Unicode=yes
[Version]
signature="`$CHICAGO`$"
Revision=1
[Privilege Rights]
SeServiceLogonRight = $($currentSetting)
"@
        $tmp2 = [System.IO.Path]::GetTempFileName()
        Write-Output "Import new settings to Local Security Policy"
        $outfile | Set-Content -Path $tmp2 -Encoding Unicode -Force
        Push-Location (Split-Path $tmp2)
    try {
            secedit.exe /configure /db "secedit.sdb" /cfg "$($tmp2)" /areas USER_RIGHTS 
    } finally { 
            Pop-Location
    }
} else {
        Write-Output "NO ACTIONS REQUIRED! Account already in ""Logon as a Service"""
}
    Write-Output "Done."
}

Set-LogonRight "$($Creds.GetNetworkCredential().UserName)"

Install the ITM On-Prem Web Console by executing the following command:

$ComponentInstallArguments = "/i", ($observeitInstallerPath + '\Web\WebConsole\ObserveIT.WebConsoleSetup.msi'), "/qb", "/norestart", "DATABASE_SERVER=$SQLServer", "TARGETAPPPOOL=$WebSiteName", "TARGETSITE=$WebSiteName", "DATABASE_LOGON_TYPE=WindowsAccount", "SERVICE_USERNAME=$($Creds.GetNetworkCredential().Domain + '\' + $Creds.GetNetworkCredential().UserName)", "SERVICE_PASSWORD=$($Creds.GetNetworkCredential().Password)","/leo", ".\WebConsoleMSI.log"

Optionally, for gMSA include /GMSA_USER = 1

Start-Process msiexec.exe -ArgumentList $ComponentInstallArguments -Wait -NoNewWindow
Extract the Advanced ITM On-Prem Web Console components:

Set-Location "C:\Program Files\ObserveIT\Web\V2\apis"

Get-ChildItem *.zip | foreach {Expand-Archive -LiteralPath $_.FullName -DestinationPath $($_.Directory.ToString() + '\' + $_.BaseName.ToString()) -Force}

Set-Location "C:\Program Files\ObserveIT\Web\V2\apps"

Get-ChildItem *.zip | foreach {Expand-Archive -LiteralPath $_.FullName -DestinationPath $($_.Directory.ToString() + '\' + $_.BaseName.ToString()) -Force}

Validate the ITM On-Prem Web Console is installed correctly:

add-type @"
    using System.Net;
    using System.Security.Cryptography.X509Certificates;
    public class TrustAllCertsPolicy : ICertificatePolicy {
        public bool CheckValidationResult(
            ServicePoint srvPoint, X509Certificate certificate,
            WebRequest request, int certificateProblem) {
            return true;
        }
    }
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
iisreset /start
Import-Module WebAdministration
Get-IISSite $WebSiteName | Start-IISSite
$CurrentURL = $WebSiteProtocol + '://localhost:' + $WebSitePort + 
'/ObserveIT/FormLoginAuth.aspx?UserDefaultPage=True'
(Invoke-WebRequest $CurrentURL).RawContent -match 'ObserveIT - Login Page'

If successful, the PowerShell prompt returns the value of True. The ITM On-Prem Web Console installation is now complete.

If after installing the ITM On-Prem Web Console component you decide to change the Microsoft Internet Information Services configuration (such as switching http to https), re-install the ITM On-Prem Web Console. ITM On-Prem cannot detect changes to Microsoft IIS.

Related Topic:

Custom Installation Steps