Data Discovery & Risk Insights 25.2.0 Help Center

# Agent installation and configuration

OpenText Core Data Discovery & Risk Insights uses a processing agent, installed on one or more host servers within the application environment, to communicate with your datasets and to process your data. These installed agents work cooperatively in an agent cluster to optimize performance, load balance, and maintain high availability.

Depending on the complexity of your environment and the diversity and amount of data you will process through OpenText Core Data Discovery & Risk Insights. You will install the processing agent on a dedicated VM host server meeting the necessary requirements—never on a server from which you will be processing data, such as a SharePoint or file system host. Placing the agent on a dedicated host ensures that future updates you make to the agent do not impact the data source server. You can also create additional dedicated agent host servers to the agent cluster as needed, such as to improve processing speed as your data volume increases. The separation of the agent host and the data source host means you can easily replace an agent should it encounter a major issue without any loss of data.

When determining the number of agents needed to process the data in your datasets, consider the following:

- the amount of data to be processed and the network-connected regions in your environment.

- expected daily throughput during initial data processing and future data processing.

Requirements for the server on which the agent is installed

CAUTION: Install the processing agent on a dedicated VM machine with connectivity to your data resources. Do not install the processing agent on a machine that you will be processing data from.

Operating System

Ensure that you are running a supported operating system with all currently "critical" and "important" updates installed from update.microsoft.com.

- Windows Server 2016 from English Installation Media (Standard, Datacenter)

  The "Server with Desktop Experience" installation option is required. Additional language packs may be added after OS installation.

- Windows Server 2019 from English Installation Media (Standard, Datacenter)

  The "Server with Desktop Experience" installation option is required. Additional language packs may be added after OS installation.

- Windows Server 2022 from English Installation Media (Standard, Datacenter)

  The "Server with Desktop Experience" installation option is required. Additional language packs may be added after OS installation.

Agent host ports in use

The processing agent uses the following ports on the agent host server for intra-process communications.

IMPORTANT: The processing agent interacts with the back office and requires connectivity to the 9000-9999 port range as indicated in the General requirements section.

Adapter binding | Listening ports | Owning process | Usage/Notes
--- | --- | --- | ---
0.0.0.0, [::] | 4200 | agent-ui.exe | Local agent admin ui application, accepts connections from loopback only.
127.0.0.1, [::1] | 7432 | postgres.exe | Local relational database to manage local configuration and workflow processing.
0.0.0.0, [::] | 7500, 7502 | cfs.exe | Local process that handles content extraction, accepts actions/commands from loopback only.
127.0.0.1, [::1] | 7957 | AgentApi.exe | Local process that coordinates with other local processes and communicates (outbound) with the back office.

Resources

The host server for the agent requires the following resources. The agent should be installed on a dedicated drive. If you will be processing large container files, start with the recommended values and consider defining a separate drive for processing.

Resource | Minimum (AWS c5.xlarge equivalent) | Recommended (AWS c5.2xlarge equivalent)
--- | --- | ---
CPUs | 4 | 8
RAM | 8GB | 16GB
Free space | 85GB | 200GB

- If more than 4 CPUs are available, increase the number of threads available to the Connector Framework Server service.

  To increase the threads available to the Connector Framework Server service

  1. Open `<agentInstallDir>\CFS\cfs.cfg`. By default, the agent install directory is `C:\Program Files\OpenText\Data Discovery & Risk Insights\Agent\`.

  2. Under the `[ImportService]` section, locate the `ThreadCount` setting.

  3. Change the default setting value of `3` to be roughly two-thirds the number of the cores available.

     For example, if you have 8 cores, set the `ThreadCount` value to `6`.

  4. Save the `cfs.cfg` file.

  5. Restart the Connector Framework Server service.

- If you are processing large container files, you may consider defining a separate, dedicated large capacity drive (such as 500GB) on the agent host to handle the data processing. Files are processed concurrently and processing large container files may use an excess amount of disk space. If disk space runs out or runs low, all other processing may pause.

  To define a separate drive on the agent host for data processing

  1. On the agent host server that will be processing very large files, log on to the agent administration UI.

     From the Start menu, click OpenText Core Data Discovery & Risk Insights Agent > Agent Admin.

  2. In the navigation panel, click Advanced Settings.

     The Advanced Settings page opens.

  3. In the Category list, select Common.

     The settings for the common configurations display.

  4. Make the following selections.

     1. In the Documents Path field, type the path to the desired directory on the local dedicated drive..

     2. In the Mail Spool Directory field, type the path to the desired directory on the local dedicated drive.

        CAUTION: This cannot be the same directory as the Documents Path.

     3. In the Maintain Free Space MB field, update the value as necessary.

        TIP: Start with doubling the existing value and then increase if necessary.

     4. In the Min Free Space MB field, update the value as necessary.

        TIP: Start with doubling the existing value and then increase if necessary.

  5. Click Save.

  6. Repeat for each agent server that will be processing very large files.

General

The following requirements must be met for the server hosting the processing agent. Applications listed must exist on the host server prior to installing the agent.

- If processing file system documents from a host machine that has long paths enabled, long paths must also be enabled on the agent host.

- Ensure the public certificate presented by the external proxy is trustable by agent hosts. Depending on the certificate presented, this may include importing a private certificate authority (CA) certificate to the local Windows certificate store.

  IMPORTANT: If a private CA is used, ensure the private CA’s certificate is removed if the agent is uninstalled.

- Ensure the Windows server is permitted to communicate through TLS 1.2 or 1.3, using a current “safe” cipher suite to ports 9000-9999. The OpenText Core Data Discovery & Risk Insights back office components (commonly in the cloud) implement and require an Intermediate TLS security level (see the "Security/Server Side TLS" article on the Mozilla wiki).

  IMPORTANT: By default, most supported Windows server operating systems are pre-configured to allow communication with the back office and to dataset targets enforcing TLS 1.2 communication using a reduced safe set of ciphers (EX2019, O365, SPO). Ensure this connectivity is communicating with functional targets by using a web browser that utilizes Windows Schannel (Internet Explorer) or via the Invoke-WebRequest PowerShell cmdlet.

  It is possible to harden encryption in Windows server to restrict the native Schannel encryption component, used by the processing agent services, to specific operating modes and particular cipher suites (see the "Transport Layer Security (TLS) registry settings" article on Microsoft Learn). The following are the minimum required values.

  - TLS 1.2 (Client): Enabled

  - Windows 2016/2019/2022 required cipher suites

    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

    - TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

    - TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

- Ensure earlier versions of SSL and TLS in Windows Schannel are disabled and that .NET applications (particularly 4.x) use the system’s Windows Schannel configuration. For more information, see the " Enable strong cryptography in .NET Framework 4.5 or higher" article on Microsoft Learn.

- Ensure that the user you run the installation as has administrative rights on each server. You cannot perform the installation unless you have administrative rights to perform the required tasks.

- If the agent will connect using a proxy, ensure the user you are logged in as has internet access on the host machine. Details for connecting using a proxy are detailed in the appropriate procedures for installing and configuring the agent.

- If using Media Server for optical character recognition (OCR), OpenText Core Data Discovery & Risk Insights processing agents and any Media Server host machines they interact with must be within the same network and can not have a proxy between them.

- If you will be sending copies of masked data items to a target location, ensure the most recent version of a 64-bit Chromium-based browser (such as Microsoft Edge, Google Chrome, or Chromium) is installed on the agent host machine.

  After the processing agent is installed, configure the path to the supported chromium browser.

- Microsoft Outlook 2019 x64 to process PST files located on file systems.

  IMPORTANT: The default installation for Outlook 2019 is x32. Ensure you have the x64 version installed.

- SMTP (currently optional)

- Visual C++ 2019 runtime, updated to the most current version

- If processing structured data from Db2 databases, ensure the following are in place.

  - Visual C++ 2013 Redistributable, updated to the most current version

  - Additional drivers to support processing from Db2 databases are needed on the agent host machine.

    1. Download the driver package for your operating system from your Db2 web console.

    2. Unpack the driver package.

    3. Copy `IBM.data.Db2.dll` and the entire `\clidriver` directory from the unpacked driver package and place in the `\Agent\StructuredDataProcessor` directory of the OpenText Core Data Discovery & Risk Insights application installation path. By default, the application installation path is `C:\Program Files\OpenText\Data Discovery & Risk Insights\Agent\StructuredDataProcessor`.

Supported data resources

The following resources are supported for data processing by the on-premises agent.

- OpenText Content Manager 23.4.x

  IMPORTANT: Only Microsoft SQL Server Unicode RDB datasets are supported at this time.

- File system CIFS/ SMBv2 shares

  - Must comply with SMBv2 protocol for share name restrictions.

- Microsoft Exchange Server 2016 fully updated and patched, 2019 fully updated and patched, and Office 365

- SharePoint 2016, fully updated and patched, and Office 365

  - For SharePoint 2016, Site Collections, Web Applications, and OneDrive are supported.

  - For Office 365 SharePoint, Site Collections and OneDrive are supported.

- Google Workspace's Drive (personal Google Drives are not supported)

- Documentum 24.4.x or later

- Extended ECM 24.3.x or later

- Structured data platforms

  - Platforms supported by the built-in structured data processor

    - Oracle

      - Oracle 19c, Oracle 21c

    - IBM Db2

      - Db2 11.5.x

    - SQL Server

      - SQL Server 2019, SQL Server 2022

    - PostgreSQL

      - PostgreSQL 12.x, PostgreSQL 13.x, PostgreSQL 14.x, PostgreSQL 15.x, PostgreSQL 16.x

    - MySQL

      - MySQL 8.x

    - Sybase

      - Sybase 16.0

  - Platforms supported by connection to Structured Data Manager

    NOTE: For supported versions, see the Structured Data Manager Certification Matrix.

    - Oracle

    - IBM Db2

    - SQL Server

    - PostgreSQL

    - MySQL

    - JDBC

    - Sybase

CAUTION: OpenText Core Data Discovery & Risk Insights does not support scanning and processing of the following.

- virtual hard drives

- Operating System container files such as ISO files

To fully install and configure the agent, perform the following tasks:

1. Download the agent.

   TIP: You will need to enter credentials for a OpenText Core Data Discovery & Risk Insights user account that has the Manage agents permission for Connect. Create a user for this purpose and do not use these credentials for any other purpose.

2. Install the agent on the first agent host server.

   Install the agent on any additional agent host servers.

3. Configure cloud connection web proxy settings (optional) if OpenText Core Data Discovery & Risk Insights is installed in the cloud.

4. Define antivirus exclusions to ensure optimal agent performance.

5. If processing very large files, review the free space configuration tasks.

6. If sending copies of masked data items to a target, configure the path to the supported chromium browser.

7. If managing file system data, review File system connection.

8. If managing structured data, complete the Structured data connection tasks.

9. If managing Content Manager data, complete the Content Manager integration tasks.

10. If managing O365 Exchange data, complete the Exchange connection tasks.

11. If managing SharePoint data, complete the SharePoint connection tasks.

12. If managing Google Drive data, complete the Google Drive connection tasks.

13. If managing Documentum data, complete the Documentum connection tasks.

14. If managing Extended ECM data, complete the Extended ECM connection tasks.

15. If connecting to datasets using custom adapters, contact OpenText Core Data Discovery & Risk Insights support for guidance.

16. If protecting documents using Microsoft Purview Information Protection, complete the Microsoft Purview Information Protection connection tasks.

17. If performing OCR on documents, complete the Media Server connection tasks.

## Download the agent

You can download the agent from the Agent Download page.

To download the agent

1. From the primary navigation panel, click Agents > Agent Download.

   The Agent Download page opens.

2. Make note of the Gateway URL, including the port number, specified in the Assign Agent panel. You will need this information when you install the agent.

   TIP: Click the link icon () to copy the Gateway URL to your local clipboard.

3. In the Download Agent section, click DOWNLOAD.

4. Once the download has completed, navigate to the download location and copy the agent install file to the agent host server.

   NOTE: When you copy the downloaded agent file to the local directory of the agent host server, place the file in a directory as close to the root of the destination drive as possible. Errors may occur if the file path to the installation file is too long.

   Follow the instructions to install the agent.

## Install the Agent

When installing and configuring the agent on the host machines, keep the following recommendations in mind.

- You will need to enter credentials for a OpenText Core Data Discovery & Risk Insights user account that has the Manage agents permission for Connect. Create a user for this purpose and do not use these credentials for any other purpose.

- As part of the agent installation, a PostgreSQL superuser is created. The user name and password you define must conform to PostgreSQL standards.

NOTE: When you uninstall a processing agent, OpenText Core Data Discovery & Risk Insights does not remove configuration information in `\ProgramData\OpenText Core\Data Discovery & Risk Insights\Agent\Config`. We keep this to preserve any custom settings. If you need to fully uninstall and reinstall an agent from scratch, you can remove the `\Config` directory from the host machine.

To install the agent

1. If not already completed, copy the agent installation file (`CDDRI-agent-version.exe`) to the agent host server from the download location.

2. Ensure all server requirements for the host server are in place.

   CAUTION: Do not install the processing agent on a machine that you will be processing data from.

3. Open the downloaded installation file (`OpenText-CDDRI-agent-version.exe`).

4. When the installation dialog opens, review the Introduction information, and then click Next.

   TIP: You may be informed of any missing prerequisites, some of which you will need to install manually.

   - If you are missing prerequisites that require manually installation, Cancel the wizard, install the prerequisite, and then restart the installation.

   - If you are missing prerequisites that the agent installer can update, click Install in the dialog. The agent installation will continue when the prerequisite installation completes.

   The License Agreement dialog opens.

5. Review the license information, select I accept the terms of the License Agreement, and then click Next.

   The Installation Directory dialog opens.

6. Accept the default location (`C:\Program Files\OpenText\Core Data Discovery & Risk Insights\Agent`), or click Change to select the desired location (it must be local).

   IMPORTANT: OpenText recommends installation on a dedicated drive with 200GB free space.

   Click Next.

   The PostgreSQL Credentials dialog opens.

7. Define the PostgreSQL credentials to be used for OpenText Core Data Discovery & Risk Insights.

   Option | Description
   --- | ---
   User Name | Type the User Name of the PostgreSQL superuser to be created. Limits: Must be at least one character in length; maximum 63 characters. Can contain only letters, numbers, or underscores; the first character cannot be a number. NOTE: This is not a Windows account.
   Password | Type the desired password for the superuser to be created.
   Verify Password | Re-type the password.

8. Click Next.

9. Provide the credentials necessary for completing the installation.

   Option | Description
   --- | ---
   URL for the cloud gateway | Type the gateway URL and port number as defined in the Assign Agent panel on the Agent Download page. This is the main access point in the cloud. TIP: Click the link icon () to copy the Gateway URL to your local clipboard.
   Tenant ID | Type the tenant ID for the OpenText Core Data Discovery & Risk Insights instance to which this agent is assigned. IMPORTANT: The tenant ID is case specific.
   User Name | Type the User Name of a user in your tenant that will be used to connect the agent to the cloud. This user must have the Manage agents permission for the Connect component.
   Password | Type the password for the user defined.

   Click Next.

   The Ready to Install the Program dialog opens.

10. If you need to make changes, click Back to work your way back, modify as desired, and then work forward to this dialog.

    Click Install.

    The installation begins.

11. When the installation completes, click Finish. You should see a "success" message at the completion of the installation.

    IMPORTANT: If you are using a proxy and see a warning instead, there may be issues getting around the proxy. In this scenario, accept the warning and, if still open, close the installation wizard. You must authorize the agent.

12. Set the logon account for the OpenText Core Data Discovery & Risk Insights services.

    The user account must be a local or domain account and have the Logon as a service permission. This can be the admin user used to install the agent, but is not required.

    1. Using one of the following methods, stop the OpenText Core Data Discovery & Risk Insights services.

       - Using the Service Control Panel

         1. Open the Service Control panel.

         2. Except for the OpenText CDDRI PostgreSQL service, stop all other services that start with OpenText CDDRI.

       - Using a PowerShell script

         1. Open PowerShell as an administrator.

         2. Change the directory to `\Agent\bin` within the agent installation path. For example, `C:\Program Files\OpenText\Core Data Discovery & Risk Insights\Agent\bin`.

         3. Using the following command, stop the OpenText Core Data Discovery & Risk Insights services.

                _stop_services.ps1

    2. Open PowerShell as an administrator.

    3. Change the directory to `\Agent\bin` within the agent installation path. For example, `C:\Program Files\OpenText\Core Data Discovery & Risk Insights\Agent\bin`.

    4. Using the following command, set the logon account. Provide the requested information.

           _set_services_run_as.ps1

       NOTE: The OpenText Core Data Discovery & Risk Insights services can use the Windows user level proxy settings set under Windows Settings > Proxy.

    5. Username | Type the user name of the user that will be used to log on to the OpenText Core Data Discovery & Risk Insights services. For a local user, use the format `machineNetBIOS\username`. For a domain user, use the format `domainShortName\username`. NOTE: This is different than the user defined in the installation wizard.
       Password | Type the password for the user defined.

    6. Reauthorize the agent.

13. (Optional) Configure cloud connection web proxy settings.

14. Using one of the following methods, start the OpenText Core Data Discovery & Risk Insights services.

    - Using the Service Control Panel

      Open the Service Control panel and start all stopped services that start with OpenText CDDRI.

    - Using a PowerShell script

      1. Open PowerShell as an administrator.

      2. Change the directory to `\Agent\bin` within the agent installation path. For example, `C:\Program Files\OpenText\Core Data Discovery & Risk Insights\Agent\bin`.

      3. Using the following command, start stopped OpenText Core Data Discovery & Risk Insights services.

             _start_services.ps1

15. Repeat the agent installation process on any additional agent host servers.

### Authorize or reauthorize the agent

The agent may need to be authorized or reauthorized.

IMPORTANT: If using a proxy, you must authorize the agent after you install it to define the proxy connection.

To authorize or reauthorize the agent

1. From the machine hosting the agent, open a command prompt and change the directory to the `/bin` directory of the processing agent installation location.

   Default location: `C:\Program Files\OpenText\Core Data Discovery & Risk Insights\Agent\bin`

2. Run the credential utility, `AccessHandler.exe`.

   - To display all available options, run the credential utility with the help option,`-h`.

     Example

     `AccessHandler.exe -h`

   - To run the credential utility to authorize the agent using a proxy connection, run the utility with the `-needproxy` option.

     Example

     `AccessHandler.exe -needproxy`

3. Provide the requested information.

   Option | Description
   --- | ---
   Gateway URL | Type the gateway URL and port number as defined in the Assign Agent panel on the Agent Download page. This is the main access point in the cloud. TIP: Click the link icon () to copy the Gateway URL to your local clipboard.
   Tenant ID | Type the tenant ID for the OpenText Core Data Discovery & Risk Insights instance to which this agent is assigned.
   User Name | Type the User Name of a user in your tenant that will be used to connect the agent to the cloud. This user must have the Manage agents permission for the Connect component.
   Password | Type the password for the user defined.

   Example: if run with the `-needproxy` option, the entry for the authenticated outbound webproxy URL uses a plain connection.

       http://webproxy.example.local:8080

4. Follow any additional guidance in the command prompt for any additional options and regarding success or failure of credential validation.

## Define antivirus exclusions (Optional)

To ensure that the agent runs at optimal performance, some exclusions must be defined when running an antivirus application on your agent hosts. These exclusions are specific to the OpenText Core Data Discovery & Risk Insights agent application.

CAUTION: Although not required, OpenText strongly recommends that you exclude the services and paths defined in this section if you are running an antivirus application on your agent hosts. Not doing so, performance on these hosts will be dramatically reduced.

In your antivirus application, define the following exclusions.

- Folders to exclude:

  - The agent installation directory.

    Example: `C:\Program Files\OpenText\Core Data Discovery & Risk Insights\Agent`

- Processes to exclude:

  - DataProcessor.exe

  - cfs.exe

  - FileSystemProcessor.exe

  - kvoop.exe

  - postgres.exe

## Configure cloud connection web proxy settings (optional)

The AgentAPI service controlled by the processing agent requires connectivity to the OpenText Core Data Discovery & Risk Insights cloud components, often located away from the local network where the agent host servers are located. Although direct connectivity is ideal, use of a web proxy may be required in some environments for the agent systems to reach the OpenText Core Data Discovery & Risk Insights cloud.

IMPORTANT: Web proxy information entered here takes precedence over any system proxy information defined for the current /run as user.

To configure the cloud connection using the agent administration UI

1. On an agent host server, log on to the agent administration UI.

   From the Start menu, click OpenText Core Data Discovery & Risk Insights Agent > Agent Admin.

2. In the navigation panel, click Advanced Settings.

   The Advanced Settings page opens.

3. In the Category list, select Agent API.

   The settings for the AgentAPI service display.

   NOTE: This defines the proxy settings for the AgentAPI service. If you need to define the proxy for all OpenText Core Data Discovery & Risk Insights services, select Common instead of AgentAPI. If unsure, contact OpenText Core Data Discovery & Risk Insights support.

4. Complete the following options.

   Option | Description
   --- | ---
   Proxy Address URL | Type the URL of the web proxy.
   Proxy Bypass List | If applicable, type a comma delimited list of addresses that do not use the proxy server.
   Proxy Bypass on Local | Specify whether to bypass the proxy for local addresses. Select True to bypass for local addresses. Select False to not bypass for local addresses.
   Proxy Password | Type the password for the user account that will access the proxy server.
   Proxy Username | Type the username for the user account that will access the proxy server.

5. Click Save.

6. Repeat for each agent server connecting to the OpenText Core Data Discovery & Risk Insights cloud.

## Configure free space for processing large files (Optional)

If you plan to process very large files, such as ZIP files, you may need to ensure the file size settings related to available free space on the processing agent host server. For example, you have many ZIP files that are 2+ GB but expand to 12 GB each when fully extracted. Processing may slow down and storage may be reduced to an undesirable level.

CAUTION: Do not adjust these values unless it is necessary. If you have any questions, contact Support.

To configure free space for processing large files

1. On the agent host server that will be processing very large files, log on to the agent administration UI.

   From the Start menu, click OpenText Core Data Discovery & Risk Insights Agent > Agent Admin.

2. In the navigation panel, click Advanced Settings.

   The Advanced Settings page opens.

3. In the Category list, select Common.

   The settings for the common configurations display.

4. Make the following selections.

   1. In the Maintain Free Space MB field, update the value to `24000`.

   2. In the Min Free Space MB field, update the value to `16000`.

5. Click Save.

6. Repeat for each agent server that will be processing very large files.

## Configure path to chromium-based browser

If you will be sending copies of masked data items to a target, you must configure the path to the 64-bit chromium-based browser executable that is installed on the processing agent host machine. This must be configured on each agent host in your environment.

To configure the path to the chromium browser

1. On the agent host server, log on to the agent administration UI.

   From the Start menu, click OpenText Core Data Discovery & Risk Insights Agent > Agent Admin.

2. In the navigation panel, click Advanced Settings.

   The Advanced Settings page opens.

3. In the Category list, select Common.

   The settings for the common configurations display.

4. Locate the Chromium Browser Executable Path option.

   Type the fully qualified path to the 64-bit chromium-based browser on this host.

5. Click Save.

6. Repeat for each agent host server.

Copyright 2019-2025 Open Text
Version 25.2.0 | Last updated May 2025
Connect
Marketplace
Learn
Support portal
Documentation
Contact
Submit or view service request