How do you scan your assets on your network?

[OycAdmin]

Hello all,

I just recently purchased a license for Lansweeper and am enjoying it so far. My intention is to make sure that I'm keeping it as secure as possible.

What are you scanning setups? Do you have Lansweeper on a server segmented off on its own network and maybe firewalled down to what you need?

For Windows environments with AD - do you have a Lansweeper AD account you use for the credentials to scan?

Any tips or input is welcome. I'd just like to have a discussion about how everyone uses Lansweepers scan and what security methods they employ.

Thanks.

[MakeBug]

We're running it on a vm server as well. The server is in the same network as the clients, so there is no real need for a firewall between them (we simply don't scan the clients from outside at the moment). The scanning user is an AD account without access to anything and has been added to the administrators group on each client (via GPO).

The Lansweeper-server also hosts the package-share for most of these locations, only some have their own shares on one of their local servers because the line between us and them isn't that great (China and the US for example). All users have full access to the share, to make sure noone finds and deletes any content, it's hidden with $. If someone still manages to delete/change something then A) we have a history of the folder changes so we can go after them and rip their head of and B) We have daily backups of the whole server so we can restore it within 5 minutes.
The deployment jobs use the scanning user, it's already a local admin on each client and the packageshare is public anyways so no need for an additional user there.

So far this setup has been more than successfull. It's working almost too well so my boss now expects all updates to be installed on about 90% of the environment within 2 weeks. This basically means I have only 2 weeks to organise every last one of our ~1500 clients (randomly distributed worldwide)

[CyberCitizen]

We are running it on a vm server on the same network. We setup a separate domain admin account for Lansweeper.

The package share directory though we did a little different. That isn't on the Lansweeper server but a hidden $ share on our file server (Apps$).

We pointed Lansweepers (PackageShare) to this new location which has read and execute rights to all users. For the share username we are using a local user account .\lsshare so should it be discovered it doesn't really give them much access.

Deployments we are using SYSTEM or Scanning Credentials (Domain Admin) or the odd as logged on user.