Thank you for choosing Thycotic Secret Server!

We hope you will love using this software!

Secret Server installation uses a simple wizard that asks for information needed to install the product and
then uses the information you supply to complete the installation. Further, Secret Server checks Thycotic's 
web site for any upgrades and informs you when a new version is available. If you should choose to upgrade 
Secret Server, the installation of a new version requires only a few clicks.


Installing from the .ZIP file 
--------------------------------

Unzip the zip file to a folder.  Create a virtual folder in (Microsoft Internet Information Server) IIS to 
point to the folder.  Ensure that it is running as an application in IIS.  Open your web browser to the new 
application and follow the steps in the web installer.



Finishing the install with the web installer
--------------------------------------------

There are 5 steps to the Web Installer
1. File System Access - the web installer requires writeable access to the files in the SecretServer folder
   to be able to upgrade the files.  This elevated access is only needed (and used) during the install.
2. Encryption Key - this steps creates a unique encryption key for your installation.  This is then used to
   encrypt all secrets in Secret Server.  It will create a file called encryption.config to store the key in
   in encrypted form.
3. Setting up Microsoft SQL Server for Secret Server
	You will need to create a database in Microsoft Enterprise Manager (the default name expected is SecretServer).
	You will need to give access to the database to a particular SQL Server login.  You can test that your login
	to that database works correctly by logging in using the new credentials using Query Analyzer or SQL Management
        Studio.  Secret Server supports both SQL Server and Windows Authentication modes.
4. Download Updates
     During this step, the web installer will check the website http://updates.thycotic.net for new versions to 
     download.  You can still install without web access if it is not able to get any updates (due to firewall, etc).
     We do not currently support proxy servers so you will need to give access to http://updates.thycotic.net
     to the machine to get updates.
5. Accept EULA and Install
     The final step is to review the End User License Agreement and begin the install which will copy all the 
     files over to the application and upgrade the database to the correct version.

You will now be prompted to add your first user to the Secret Server.

If you have any difficulty with any steps, please check the forums and contact support (details at the end of 
this document)



Frequently Asked Questions
--------------------------

We have tried to anticipate all of the environments into which Secret Server may be installed. Below you will 
find information that will help you should Secret Server inform you of an error during the installion process.

---------------------------------------------------------------------------------
How do I give write permissions to a user?

These instructions describe how to give access to local users under Windows XP and Windows 2003

	- Open Windows Explorer by pressing the keys Start-E or right clicking the Start button and choosing expore.
	- Navigate to the directory that you need to change.
	- Right-click on the directory and click properties.
	- Select the security tab.
	- If you see the group or user in the top pane, click it. Otherwise:
		- Click the Add... button
		- Click the Advanced... button
		- Click the Find Now buton
		- Choose one or more groups or users in the bottom pain and click OK. 
		- The groups/users you chosed should appear in the "Enter the object names" text box. Click OK.
		- The groups/users should now be available in the Security tab. Select the group or user you want to change.
	- In the bottom pane, click the "allow" check box for Full Control.
	- When you are finished, click Ok.

---------------------------------------------------------------------------------
To which user should I give write permissions?

* If you wish to give the user running the ASP.NET application access then:

	The answer to this question varies based on which version of IIS is installed:

	For IIS 5.x:
		You should grant permission to the users 'ASPNET' and 'IUSR_(machine name)'

	For IIS 6.0 / 7.0:
		You should grant permission to the users 'NETWORK SERVICE' and 'IUSR_(machine name)'

	For IIS 6.0 / 7.0 Where server is configured as a Domain Controller:
		You should grant permission to the users 'IWAM_(machinename)' and 'IUSR_(machine name)'

	NOTE: By default, there should only be one IUSR_(machine name) account on any given machine.

* If you wish to use a separate user for the install only then just give that account write access and 
  enter the accounts username and password in Step 1 of the installer.

---------------------------------------------------------------------------------
How do I turn on anonymous authentication for IIS?

To enable annonymous access in Windows XP:
	- Open Windows Explorer
	- Right-click My Computer and select Manage
	- Expand Services and Applications
	- Expand Internet Information Services
	- Expand Default Web Site
	- Right-click the site you want to set for anonymous access and select properties
	- Select the Directory Security tab, and press the Edit... button in the Anonymous access panel
	- The top panel of the resulting dialog shows if Anonymous access is set, and if so what 
		account will be used when the system is accessed by an anonymous user.
	- If the Anonymous access check box is checked, the web site allows anonymous access.
	- If not, check the Anonymous access check box.
	- You can use the default user [IUSR_(machine name)] or chooose another. Ensure the user you choose
		has write access to the application directory.


To enable annonymous access in Windows Server 2003:
	- Click start, then "Manage Server"
	- Under "Application Server" click "Manage this Application Server"
	- Expand Application Server
	- Expand Internet Information Services
	- Expand Default Web Site (or whichever website Secret Server is installed)
	- Right-click the site you want to set for anonymous access and select properties
	- Select the Directory Security tab, and press the Edit... button in the Anonymous access panel
	- The top panel of the resulting dialog shows if Anonymous access is set, and if so what 
		account will be used when the system is accessed by an anonymous user.
	- If the Anonymous access check box is checked, the web site allows anonymous access.
	- If not, check the Anonymous access check box.
	- You can use the default user [IUSR_(machine name)] or chooose another. Ensure the user you choose
		has write access to the application directory.


---------------------------------------------------------------------------------
How do I allow a Windows user access to SQL Server?

Follow these steps:
	- Open SQL Server Enterprise Manager
	- Expand Microsoft SQL Servers
	- Expand SQL Server Group
	- Expand the server to which you want to grant access
	- Expand the Securty folder
	- Click on logins to show existing accounts
	- To add the windows account to allowed logins:
		- Right-click on logins
		- Click New Login
		- Click the '...' button next to the Name text box
		- Select the user to add
		- Click the Add button
		- Click OK
	- If the user is already shown in the list, right click the user and select Properties
	- At the bottom of the dialog, select the database to use as the user's default
	- Select the database access tab and click the check boxes next to the databases the user should be able to access
	- Click OK. The user has been granted access


---------------------------------------------------------------------------------
Troubleshooting
* To restart Secret Server, touch the web.config (edit it in notepad and add a space to the end and save it)
  When you then visit a page in Secret Server with a web browser, it will detect the web.config change
  and automatically restart.


---------------------------------------------------------------------------------
Further resources for obtaining help

  * Support Forum
      http://www.thycotic.com/ForumsSecretServer.aspx
  
  * Email
      support@thycotic.com
      
  * Phone
      Monday-Friday 9am-5pm Eastern Standard Time (GMT+5)
       1-877-TDD-2WIN
       1-877-833-2946

