Platform features of the 1E Client

Determines whether the Agent presents the client certificate when authenticating with a Tachyon Switch. By default, the Switch will reject the connection if a certificate is not presented.

The value must be set to one of the following. The default value is set to Required.

• none: Do not present a client certificate.

• optional: Present a certificate if a suitable one exists. If none exists continue with the connection anyway. This is the default value.

  This option is useful if you are deploying the 1E Client before you have deployed certificates. Switches can be configured so they do not require client certificates, but if you did not select that option during installation then you can change the server setting.

• required: Present a certificate if a suitable one exists, otherwise fail the connection.

Default: required.

If the Switch setting is not provided, then AuthenticationPolicy setting is not used.

If Platform and Content Distribution client features are not required then the connection to Platform is not required, and both Switch and BackgroundChannelUrl settings must be set to none when doing a non-interactive (silent/quiet) install using installer properties on a command-line or in a MST transform file. When doing an interactive install then you must uncheck the Enable 1E checkbox.

1E Client features are not required if the 1E Client is being installed only to support PXE Everwhere, Shopping, or WakeUp. They are only required for Content Distribution if using Content Distribution features of the Platform.

To connect to the Platform then BackgroundChannelUrl will have one or more entries in the format:

BackgroundChannelUrl=https://<BackgroundChannelServer>:<BackgroundChannelPort>/Background/

<BackgroundChannelServer> is the DNS Name FQDN of the server, which is the same as:

• The same as <SwitchName>.

• The DNS Name specified in the 1E Server's Web Certificate.

Alter the client certificate selection criteria. Use "default" or "anonymous"."anonymous" will allow any valid and locally-trusted client certificate, ignoring FQDN matches.

ClientCertificateSelection=default (default).

Determines the time in seconds for the 1E Client to wait between sending a keep-alive messages to the Switch.

1E Client will wait a random amount of time between the two values set as minimum and maximum. Range is 0 to 900 seconds (No keepalive to 15 minutes).

Determines the time in seconds the 1E Client waits before trying to reconnect to a Switch after a connection failure.

The 1E Client tries once for each Switch in the list of Switches, and if it fails to connect then it waits before trying again. The wait is a random amount of time between the two values set as minimum and maximum. Range is 5 to 86400 (5 seconds to 24 hours).

See also FastReconnectTimeInSeconds.

The maximum time in seconds that can elapse between the 1E Client initializing the connection with a Switch and having a fully established websocket.

Range is 1 to 60.

When downloading a policy or the Exoprise Service Watch installer, this setting specifies the number of seconds to wait before the download times out.

The range is 5 to 3600 with a default of 600.

Determines whether 1E Client does Certificate Revocation List (CRL) checking for:

• The certificate it presents to the Switch when requesting a connection (see also AuthenticationPolicy, which determines whether 1E Clients present a certificate or not).

• The certificate received from the Switch when requesting a connection.

• The certificate received from the Background Channel server before attempting to download content.

• The certificate received from any other HTTPS-based endpoint from which 1E Client downloads content.

• The certificates used for digital signing of 1E Client executables (typically the certificate is found in the Trusted Publishers Store)

The value must be set to one of the following. The default value is set to soft:

• off: No CRL checking is performed by the 1E Client.

• soft: This is the default.

  Full CRL checking is performed by the 1E Client for each certificate in the list above. However if a CRL Distribution Point (CDP) is unreachable then only a warning will be reported.

  A certificate error occurs if a CDP is available and the CRL cannot be retrieved or refreshed, or the certificate is revoked.

• hard: Full CRL checking is performed by the 1E Client for each certificate in the list above. If a certificate error occurs then 1E Client stops processing the request.

  A certificate error occurs if a CDP is not available, or the CRL cannot be retrieved or refreshed, or the certificate is revoked.

If a certificate error occurs then 1E Client will not proceed, or will not start in the case of a digital signing certificate error.

The maximum time in seconds that is allowed to elapse whilst the 1E Client attempts to download a Certificate Revocation List (CRL) from a CRL Distribution Point.

The range is 1 to 10 seconds.

This setting determines whether the default system certificate store (Personal on Windows and System on macOS) will continue to be used, or whether a dedicated certificate store created by the 1E Client will be used for both client certificate look-up and automated client certificate provisioning.

This setting is applicable only to Windows and macOS.

On macOS, keychains are file based. The dedicated certificate keychain is created by the 1E Client as:

/Library/Application Support/1E/Client/1EClient

This keychain file is password protected using the format:

OneECl!entP@ssw0rd<device_serial_number>

It can be added to the macOS Keychain Utility. The device serial number can be found under About This Mac in Settings.

On both platforms, these dedicated stores are retained during upgrades and uninstalls. For complete removal:

• On Windows: Invoke MSIEXEC with APPDATACLEANUP=2 during uninstall (as documented below).

• On macOS: Run the uninstall.sh script bundled into the 1E Client .dmg with the clean parameter.

Some operations (including HTTPS downloads from the BackgroundChannel) are randomly time-staggered across clients. This property dictates the upper-limit on the default randomization period in seconds.

Range is 0 to 3600. Default is 300.

Use 0 to instruct 1E Client not stagger operations by default.

Determines whether the client should attempt to compress payloads when responding to instructions, if it looks like compression would be beneficial.

Must be set to true or false.

During machine wakeup, following a machine sleep or hibernation, the first reconnect attempt to the Switch will occur in <FastReconnectTimeInSeconds> seconds.

This value is configurable between 5 and 60 seconds.

For the majority of Windows devices the default value of 15 seconds is more than adequate for the Windows network stack to stabilise on wakeup.

On non-Windows platforms this property is currently ignored.

See also ConnectionRetryTimeInSecondsMin/Max.

Determines how much logging information is generated. This may be set to one of the following values. The default value is info

• Error: Only outputs errors. An error is a serious problem, typically requiring operator intervention of some sort to restore full functionality.

• Warn: Outputs errors and warnings. A warning indicates a potential problem, where the system can nonetheless function without intervention.

• Info: Outputs general information in addition to the errors and warnings. This is the default.

• Debug: Outputs debugging information in addition to all the previous levels.

• Trace: Outputs the maximum information available. Used only in exceptional circumstances as it will generate huge amounts of logging output.

The LogPath setting is stored in the 1E.Client.Conf file and determines the full path and filename of the 1E Client log file.

The 1E Client log is shared by:

• 1E Client.

• 1E client features.

• Shopping client module (only available on Windows OS).

To change the logging level, refer to LoggingLevel in the 1E.Client.CONF file.

The following are not configurable in this version:

• Maximum size of 5MB.

• 5 rollover files numbered 1 (newest) to 5 (oldest) with the rollover number included as n.log.

By default, Windows resolves %ALLUSERSPROFILE% as C:\ProgramData\

The Content Distribution integration feature is for Windows clients only. The feature is enabled if this value is set to true and Content Distribution is running on the device. There is no dependency on Configuration Manager which Content Distribution also integrates with.

false:

• 1E Client waits a randomized stagger period defined by its DefaultStaggerRangeSeconds setting, and then downloads content from the specified Background Channel.

• 1E Client retains modules and extensibles that it has downloaded, but does not retain instruction scripts after they have been run. Any instruction that requires a script or other file will download the latest version each time the instruction is run.

true:

• 1E Client immediately requests Content Distribution to download content from the specified HTTP source, such as the Background Channel. Content Distribution behaves in the same way as it does with Configuration Manager by ensuring the latest version of content is obtained and electing a master to perform the actual download.

• Content Distribution maintains its own cache of downloaded content which avoids the need for repeat downloads over the WAN, and provides content to peers that require the same resources which avoids peer devices having to download over the WAN.

The Content Distribution integration feature is only for Windows computers. If this feature is enabled, and requested content is not provided within the timeout period, The 1E Client will fall back to downloading directly from the Background Channel

The most likely reason for a timeout is if Content Distribution is busy downloading other content.

The range is 10 to 3600 (1 hour).

Determines if the Policy feature of the 1E Client is enabled (true) or not (false). The Policy feature is responsible for downloading, evaluating and reporting on policy rules defined in the Endpoint Automation application on the Platform.

If set to true then you must also configure settings for Switch and Background Channel.

Must be set to true or false.

Skips the local trust chain check during the client certificate selection process. Previously, client certificates needed to be trusted locally to be viable for presentation to the Switch.

The default setting is true.

Limits the number of rows returned by a SELECT expression. The principle is that if there is more than this number of rows then something has gone wrong. This limit prevents an unexpectedly excessive amount of both data and CPU usage.

The range is 1 to 1000000000 (10⁹). The default value is 100000 (10⁵).

Determines which security protocol the 1E Client uses when connecting to Switches and Background Channel.

SSL must be set to one of the following values:

Value: TLSv1.2

TLS version 1.2 is a cryptographic protocol aimed at securing the network transport layer, and has recently been adopted by all the major browsers. It is considered to be more secure than SSLv3. This is the default.

If Platform and Content Distribution client features are not required then the connection to Platform is not required, and both Switch and BackgroundChannelUrl settings must be set to none when doing a non-interactive (silent/quiet) install using installer properties on a command-line or in a MST transform file. When doing an interactive install then you must uncheck the Enable 1E checkbox.

1E Client features are not required if the 1E Client is being installed only to support PXE Everwhere, Shopping, or WakeUp. They are only required for Content Distribution if using Content Distribution features of the Platform.

To connect to the Platform then Switch will have one or more entries in the format:

Switch=<SwitchName>:<SwitchPort>

When the 1E Client attempts to find a Switch, it will try each entry in turn, starting at the first. If all attempts fail the Platform restarts the connection process after a period determined by ConnectionRetryTimeInSecondsMin/Max.

Set this setting to true to enable the Interaction module. Default value is true.

Must be set to true or false.

This setting is used to ensure that if the user is currently busy interacting, then focus will not be stolen from the user to display a notification.

Notification display will only be considered if the user stopped interaction at least Active Session Threshold Seconds before.

Active Session Threshold Seconds is configurable between 0 and 30.

The organization name that is displayed in the header of the Real-Time Control Center and other 1E Client UI dialogs. Can be set by the installer.

Set true to enable Do not disturb, and stop notifications after startup. Surveys sent to this device will respond as Timed out.

Set false to disable Do not disturb, and show notifications after startup.

In each case, if the Module.Interaction.NotificationIcon setting is true, the user can still use the notification area icon to enable or disable notifications. However, each time the user signs in, the Do not disturb mode will be reset.

To ensure that notifications only appear when the user is present, this threshold specifies that notifications should not be displayed if more than the configured number of idle minutes has elapsed.

Idle Session Threshold Minutes is configurable between 1 and 1440.

If set to true, and ServiceNow integration is enabled, then users can create new incident tickets. (New in 8.0)

Enable ServiceNow integration. This feature shows ServiceNow ticket information in the Real-Time Control Center.

This feature also requires the following:

• Module.Interaction.Enabled to be set to true

• Module.Interaction.ITSM.ServiceNow.Url to be configured with the URL of the ServiceNow instance.

Sets how far back to look for tickets that changed state to inactive (closed, resolved or cancelled).

By default, the Real-Time Control Center shows all active tickets for the user. The user can also choose to view inactive tickets that have changed state during this period.

The range is 1 to 365.

Only used if Module.Interaction.ITSM.ServiceNow.Enabled is true. Can be set by the installer. (New in 8.0)

The URL to a ServiceNow instance, for example https://acme12345.service-now.com.

Only used, and required, if Module.Interaction.ITSM.ServiceNow.Enabled is true. Can be set by the installer. (New in 8.0)

If set to true, the 1E Client will log an INFO message to indicate that a given user session is ready for notifications.

If set to false, this information will be logged only at TRACE level. Intended for troubleshooting purposes only.

To ensure that notifications don't appear too soon after logon, this setting specifies the minimum time in minutes that must elapse after the user has been logged onto a session before notifications can appear.

Minimum Minutes After Logon Before Prompt is configurable between 1 and 1440.

To ensure that notifications don't appear immediately after session unlock or reconnect, this setting specifies the minimum time in minutes that must elapse since the user session has been reactivated before notifications can appear.

Minimum Minutes after Session Activation Before Prompt is configurable between 1 and 1440.

To ensure that notifications don't appear too frequently, this setting specifies the minimum time in minutes since a notification was displayed before another notification will appear.

Minimum Minutes Between Prompts is configurable between 1 and 1440.

• If set to true, a notification area icon will appear when the Client UI is running.

• If set to false, the icon will not be visible.

  If false, Windows users may see notification popups, but will not be able to:

  • Select User Sentiment surveys from the menu.

  • Use the Do not disturb option.

Specifies how many time periods to wait before launching the 1E Client UI, typically a launch time period is 5 seconds.

Periods Before UI Launch is configurable between 1 and 120.

Specifies how many time periods may elapse before it is considered that the 1E Client UI has failed to launch, typically a launch time period is 5 seconds.

Periods Before UI Launch Timeout is configurable between 1 and 24.

The port number used for communication between the 1E Client service and 1E Client UI.

Port is configurable between 100 and 65535.

This setting defines how frequently responses should be pruned to retain only the most recent responses.

A response audit typically occurs each time a user responds to a notification, where a response includes dismissing or snoozing a notification.

Response Audits Before Tidy is configurable between 10 and 1000.

This setting ensures that the 1E Client only retains the most recent responses, with this value indicating how many responses should be retained.

Response Retention rows is configurable between 100 and 50000.

A comma-separated list of process names that are excluded from User Interaction sampling. Case is not significant. Only used if Module.Interaction.SampleUserInteraction is true.

When User Interaction sampling is enabled, the Interaction module uses regular sampling to determine the responsiveness of application windows on the user's desktop. If the foreground window's process name has any of these values as a substring then it is excluded from the interactivity test.

Set to true, to enable User Interaction sampling.

The Interaction module uses regular sampling to determine the responsiveness of application windows on the user's desktop, and will also track user keyboard and mouse input to determine the level of activity.

This setting specifies the time in minutes that must elapse before a notification can be considered for re-display, after the user clicked on the Later button, or it had timed out.

Snooze Time Minutes is configurable between 1 and 1440.

Specifies a theme that should be applied to the notifications.

Can be one of: Light, Dark or HighContrast.

If a value is not provided, the 1E Client UI will automatically determine the most appropriate theme based on the user's Windows desktop settings.

Fallback language for multi-language surveys when the user's locale does not match any translation.

Set to a language code (e.g. "en", "fr") or leave empty for no fallback.

n/a

n/a

n/a

n/a

n/a

n/a

n/a

25.1

n/a

2.1

n/a

n/a

n/a

2.1

n/a

n/a

2.1

Whether cold storage is enabled. Required for 1E trace feature.

• Default: true

Perform cold storage housekeeping (deletion of expired slices) every n Inventory aggregation cycles. (So the number of DB files can temporarily exceed MaximumNumberOfSlices until the next housekeeping runs occurs.) Aggregation runs every minute by default. Housekeeping is also always performed regardless of this value when the 1E Client starts up and when it shuts down (strictly, when the Inventory module initializes and uninitializes if cold storage is enabled).

• Default: 30

• Minimum:1

• Maximum: 100

The maximum number of cold storage slices to store. Or to be precise, if any slice is older than now - (MaximumNumberOfSlices * SliceSizeMinutes).

then it will be deleted by the next cold storage housekeeping action.

• Default: 14 (2 weeks when SliceSizeMinutes is 1440)

• Minimum: 2

• Maximum: 28 (4 weeks when SliceSizeMinutes is 1440)

Whether cold storage is enabled for a particular capture source. Defaults depend on which capture source:

• Disabled by default

  • ARP

  • BootPerformance

  • ProcessStabilization

• Enabled by default

  • Everything else

Wait for a random number of minutes between zero and this value after midnight UTC before generating daily summary events. This is to spread the load on the platform and Experience, whereas previously they were bombarded by events from all clients at midnight.

Each client instance calculates the random value when it starts and so will generate events at the same time after midnight each day during its run.

The range is 0 to 720 with a default of 60.

Determines whether the Client Activity Record feature is enabled or disabled.

Must be set to true or false.

Must be set to true if using the 1E Powered Inventory feature (1E connector).

If set to true, individual capture sources can be enabled or disabled by setting Module.Inventory.<source>.Enabled to true or false.

If set to false , this setting takes precedence over individual capture source settings with all being disabled.

Controls whether the Inventory module will, on Windows, use a polling-based mechanism to capture data instead of event-based.

The Inventory module will use Windows operating system events to capture data, if the host operating system supports it. If this setting is true, the Inventory module will instead use a polling-based approach to capture data.

This setting is ignored on other operating systems.

Controls whether this capture source is active (true) and will capture data. To disable capture of this data, use false.

The Process Usage capture source is required by the 1E Powered Inventory feature (1E connector).

Determines the maximum number of capture entries held in memory during an aggregation period.

The Inventory module will store data in memory prior to writing it to disk (as determined by the Module.Inventory.AggregationIntervalSeconds setting described above). This setting controls the size of the capture buffer available for this data.

If this capture buffer is exceeded, older entries will be discarded to make room for newer ones.

For example, based on the default values, if more than 1000 DNS lookups occur within 60 seconds.

A higher value will allow the Inventory module can capture higher volumes of events at the cost of additional memory use.

Range is 100 to 10000.

Determines the frequency, in seconds, at which the capture source will poll for data. This setting is ignored if the Inventory module is using an event-based mechanism to capture data.

A lower value (more frequent polls) is likely to capture more data at the cost of additional processing overhead on the device.

Range is 5 to 600 (10 minutes) for all sources except for OperatingSystemPerformance which can go up to 86400 (1 day).

Determines the number of aggregation cycles that should occur before old data is removed (groomed) from the Inventory module’s live disk-based store. See the three Retention settings below.

The Inventory module will store captured data for a limited time before removing it. This setting determines how frequently the grooming operation will be performed. The clean-up operation happens every N aggregation cycles.

A lower value (more frequent deletion) will remove old data more quickly at the cost of additional processing overhead on the device.

Range is 1 to 50.

Determines the maximum number of capture entries that will be stored in the Inventory module’s live disk-based storage.

The Inventory module stores detailed (non-aggregate, live) capture entries on disk, as well as aggregated capture entries per hour, day and month (see below). This setting determines the limit of the detailed entries. When the limit is reached, older entries are deleted to make room for newer ones.

A higher value allows storage of a longer period of detailed entries at the cost of additional disk space on the device. Storing more data will also cause queries on that data to take longer.

Range is 100 to 50000.

Determines the maximum number of hours/days/months for which aggregated data will be kept in the Inventory module’s disk-based storage.

The Inventory module will discard data from its hourly/daily/monthly store to make room for newer data.

A higher value allows a longer record of data to kept at the cost of additional disk space on the device. Storing more data will also cause queries on that data to take longer.

Note that these settings are independent of one another – for example, it is not necessary to specify an “hourly” value of 24 or greater to be able to capture “daily” values.

A value of zero means “disable data aggregation at this resolution”. Again, since the settings are independent, it is valid to disable hourly data aggregation yet keep daily and monthly aggregation active.

Range is 0 (disabled) to 100.

The difference between the startup time of current and parent processes to consider the current process as a boot process.

• Default: 30

• Minimum: 1

• Maximum: 120

When monitoring boot, how long before we give up waiting for a valid to appear.

• Default: 60

• Minimum: 30

• Maximum: 240

Time threshold allowed between the provisional boot time and new data points to trust them.

• Default: 60

• Minimum: 30

• Maximum: 240

Time to wait before a logon session that has not stabilized will be marked as complete.

• Default: 180

• Minimum: 120

• Maximum: 360

Time to wait before a boot event that has not stabilized will be marked as complete.

• Default: 30

• Minimum: 1

• Maximum: 120

Time to wait before a complete logon session is marked closed waiting for additional data.

• Default: 10

• Minimum: 1

• Maximum: 30

Time to wait before a complete boot event is marked closed waiting for additional data.

• Default: 5

• Minimum: 1

• Maximum: 15

Time threshold allowed between the logon time and the authentication dialog time for us to trust it as a data point.

• Default: 10

• Minimum: 1

• Maximum: 60

Number for polls before we cool down and stop polling for new logon sessions.

• Default: 30

• Minimum: 1

• Maximum: 100

Number of samples to be reviewed when determining handle stabilization.

• Default: 3

• Minimum: 1

• Maximum: 10

Percentage of the most recently-observed handle count does the standard deviation (over the last N samples) need to have dropped below in order for us to decide that handle count has stabilized.

• Default: 1.0

• Minimum: 0.5

• Maximum: 10.0

Modifies the margins within which a process is considered stable. The default is 5, and the range is 1 to 66 inclusive. This setting should be left unchanged.

This is a comma separated, case insensitive list of executable names (with extensions) of any processes that require stabilization monitoring. By default, this is not set and therefore process stabilization monitoring is disabled. The list should not exceed 15 executables.

Enables or disables Process Usage log messages, which typically appear for each data capture refresh. ProcessUsage is used by the 1E Powered Inventory feature.

Number of rows to retain in the extended inventory replication audit table.

• Default: 500

• Minimum: 1

• Maximum: 1000

Number of days to retain the replica table for an extended inventory item after the last replication.

• Default: 30

• Minimum: 7

• Maximum: 365

Override the default BGC target for extended inventory replication.

Time period in minutes that seeds the exponential wait time before retrying a failed replication.

• Default: 5

• Minimum: 1

• Maximum: 1440

Maximum wait time before retrying a failed replication.

• Default: 1440

• Minimum: 5

• Maximum: 7 * 1440

Stagger range in minutes before starting an initial full replication.

• Default: 60

• Minimum: 1

• Maximum: 1440