Configuring Client Management

Tanium™ Cloud automatically handles initial configuration for Client Management, but you can set up additional Client Management users.

When you import Client Management with automatic configuration, the following default settings are configured:

The following default setting is configured:

Configure the service account

The service account is a user that runs several background processes for Client Management. This user requires the following roles and access:

• Client Management Service Account or Tanium Administrator role
• Trends Integration Service Account role, to send data to Trends
• (Optional) Discover Read Only User role, to deploy to endpoints based on labels created in Tanium Discover

For more information about Client Management permissions, see User role requirements for Client Management.

If you imported Client Management with default settings, the service account is set to the account that you used to perform the import. Configuring a unique service account for each Tanium solution is an extra security measure to consider in consultation with the security team of your organization.

1. From the Main menu, click Administration > Shared Services > Client Management to open the Client Management Overview page.
2. Click Settings .
3. In the Service Account section, update the service account settings and click Save.

Configure the Client Management action group

If you imported Client Management without the Apply All Tanium recommended configurations option or with Restricted Targeting enabled, the Client Management action group targets No Computers by default. To enable Client Management functionality after importing without the Apply All Tanium recommended configurations option or with Restricted Targeting enabled, set the Client Management action group to target the computer group All Computers.

1. From the Main menu, go to Administration > Actions > Action Groups.
2. Click Tanium Client Management.
3. Clear the selection for No Computers.
4. Select All Computers and click Save.

Client Management Administrator

Assign the Client Management Administrator role to users who manage all configuration in Client Management, configure client deployments, and investigate issues with specific clients.

This role can perform the following tasks:

• Configure the Client Management service account

• View, create, edit, and delete client configurations and client credentials

  No user can view passwords in existing credentials.

• View, create, and delete client deployments

• View summarized client health information

• Directly connect to endpoints to view detailed client health information

Client Management User

Assign the Client Management User role to users who execute client deployments.

This role can perform the following tasks:

• View client configurations and client credentials

  No user can view passwords in existing credentials.

• View and execute client deployments

• View summarized client health information

Client Management Read-Only User

Assign the Client Management Read-Only User role to users who can review details of client deployments.

This role can view client configurations, client credentials, and client deployments.

Client Management API User

This role is used internally and is not typically assigned to users.

Client Management Auditor

This role is used internally and is not typically assigned to users.

This role can perform the following tasks:

• Download installation packages for the Tanium Client.

• Directly connect to endpoints to view detailed client health information.

Client Management Endpoint Configuration Approver

Assign the Client Management Endpoint Configuration Approver role to a user who approves or rejects Client Management configuration items in Endpoint Configuration.

Client Management Service Account

Assign the Client Management Service Account role to the account that performs background processes for Client Management. For more information, see Configure the service account.

(Tanium 7.3.x only) Upload Tanium public key

If you are using Tanium Server 7.3.x, upload the Tanium public key. This public key enables the connection between the clients you are installing and the Tanium Server. This configuration occurs automatically with Tanium Server 7.4 and later.

1. From the Client Management Overview page, click Settings .
2. Click Choose File and select the tanium.pub file for your Tanium Server. The tanium.pub file is in the top-level installation directory for the Tanium Server.
3. Click Upload.

Add client installation files for air-gapped environments

If you cannot enable communication between your Tanium Module Server and content.tanium.com, contact Tanium Support for help with configuring client installers on the Tanium Module Server.