Sage HRMS 2014 Sage Employee Self Service/media/site/Sage HRMS/pdf... · Performance may dictate moving the installed applications to a multi- server environment. SQL Server 2005

Sage HRMS 2014 Sage Employee Self Service Pre-Installation Guide

October 2013

This is a publication of Sage Software, Inc.

Document version: October 17, 2013

Copyright © 2013. Sage Software, Inc. All rights reserved. Sage, the Sage logos, and the Sage product and service names mentioned herein are registered trademarks or trademarks of Sage Software, Inc. or its affiliated entities. All other trademarks are the property of their respective owners. Your use of this document and the Sage product(s) described herein is governed by the terms and conditions of the Sage End User License Agreement ("EULA") or other agreement that is provided with or included in the Sage product. Nothing in this document supplements, modifies or amends those terms and conditions. Except as expressly stated in those terms and conditions, the information in this document is provided by Sage "AS IS" and Sage disclaims all express, implied or statutory warranties of any kind, including but not limited to the warranties of merchantability, fitness for a particular purpose or of non-infringement. No implied license is granted to you under any Sage intellectual property or trade secret right. Sage reserves the right to revise, supplement, or remove information in this document at any time without notice to you or others.

Sage End User License: http://na.sage.com/sage-na/eula

http://na.sage.com/sage-na/eula

Sage HRMS 2014 | Sage Employee Self Service Pre-Installation Guide iii

Contents Hardware and Software Requirements ....................................................................... 4

Sage Employee Self Service, Benefits Enrollment, HR Actions for Sage HRMS ........................ 4 About Windows Server 2003 Web Edition ............................................................................................... 6 About Windows Server 2008 Web Edition ............................................................................................... 6 Microsoft Database Management Resources ........................................................................................... 6

Client Requirements for Web Access to Sage Employee Self Service .......................................... 6

Using ASP.NET 3.x ........................................................................................................... 7

Setting up Information Sharing with Microsoft Windows Server 2008 ....................... 8

Setting up Information Sharing with Microsoft Windows Server 2012 ..................... 12

View Builder Compatibility ............................................................................................................. 12

Roles and Features Configuration on Windows Server 2012 ...................................................... 12

Configuring Firewall and Security Services .............................................................. 15

Sage HRMS Firewall Configuration ............................................................................................... 15

Sage Employee Self Service Firewall Configuration .................................................................... 15

Network Security Configurations ................................................................................................... 16 Basic Network Security – IIS behind Firewall ........................................................................................ 16 Advanced Network Security – IIS and Two Demilitarized Zones (DMZs) ....................................... 16 Enhanced Network Security – IIS in Demilitarized Zone (DMZ) ....................................................... 17 Sage ESS Data Execution Prevention Settings ........................................................................................ 17

Creating a Microsoft Windows User Account ........................................................... 19

Recommendations for Public Access Workstations ................................................ 21

Software Applications Best Practices.............................................................................................. 21

Data Security Best Practices ............................................................................................................. 21

Additional Best Practices .................................................................................................................. 22

Sage HRMS 2014 | Sage Employee Self Service Pre-Installation Guide 4

Hardware and Software Requirements Important! This product should be installed by a certified Channel Partner or a certified member of the Sage Professional Services Group.

Sage Employee Self Service, Benefits Enrollment, HR Actions for Sage HRMS

Recommended Server Specifications

Processor Dual Core X86 Processor - 2.4 GHz or higher During Open Enrollment (if Benefits Enrollment installed): • > 500 but < 1000 employees: Dual Core X86 Processor - 3.0 GHz • > 1000 but < 3000 employees: Quad Core x86 Processor - 2.0 GHz

Operating System

Install and configure one of the following: • Windows Server 2012, Standard, Express, or Enterprise Edition • Windows Server 2008, Standard or Enterprise Edition, latest service packs • Windows Server 2003, Standard, or Enterprise Edition, latest service packs.

For Windows Server 2003, SP2 or higher, you must verify that the Data Execution Prevention (DEP) settings are correct. See “Sage ESS Data Execution Prevention Settings” (page 17).

• Windows Server 2003 Web Edition: see “About Windows Server 2003 Web Edition” (page 6).

Install and configure: • Microsoft Internet Information Services web server and the World Wide

Web Publishing Service • SMTP Service • MDAC 2.8 • .Net Framework 3.5 (for HR Actions). For IIS setup instructions, see “Using

ASP.NET 3.x” (page 7). IIS must be in WOW mode on 64-bit applications. Use Manage Your Server to add and configure: • The Application Server role, including ASP.NET. • The Mail Server role.

For configuration information for IIS and SMTP, refer to the Sage Employee Self Service Technical Install Guide for Windows 2003, 2008, and 2012.

http://na.sage.com/Sage-HRMS/In-Product/hrmsexthelp/sageabrasqlhrmsguides



Recommended Server Specifications

Database Install and configure one of the following: • SQL Server 2005 Standard Edition, latest service packs. This must be set up

using mixed mode authentication and default collation sequence (SQL_Latin1_General_CP1_CI_AS).

• SQL Server 2005 Express Edition, latest service packs. This is the default database installed with Employee Self Service. Advanced Services is required to run full-text queries in Abra eRecruiter when searching resumes.

• SQL Server 2008 Standard Edition, latest service packs. This must be set up using mixed mode authentication.

• SQL Server 2008 Express Edition, latest service packs.

• SQL Server 2012, Standard, Express, or Enterprise Editions, latest service packs.

For configuration information for SQL Server and mixed mode authentication setup, refer to the Sage Employee Self Service Technical Install Guide for Windows 2003, 2008, and 2012.

Sage HRMS Sage HRMS v10.1, or version 2012

RAM Recommended: 2048 MB for up to 1,000 employees and 50 concurrent users*. You must also do the following: • Add 128 MB for every additional 500 employees in Sage HRMS.

• Add 128 MB for every additional 25 concurrent users* (administrators, employees, and applicants) in Sage Employee Self Service.

• File Attachments require additional disk space (HR Actions).

*Concurrent users are the maximum number of users logged on to Sage Employee Self Service at the same time.

Hard Drive 100 MB available space for the server (+100 MB for HR Actions) 80 MB plus 1 MB additional available space for every 100 employees

Monitor SVGA 1024 x 768 resolution or higher Browser Internet Explorer v7 and higher Network Speed

100 Mbps minimum, 1000 Mbps preferred.

Performance may dictate moving the installed applications to a multi-server environment.

SQL Server 2005 Express Edition (the embedded database installed with Sage Employee Self Service) is appropriate for organizations with 5 administrative Sage HRMS users or less and 25 concurrent Sage ESS




users or less. Organizations with more than 5 administrative Sage HRMS users or more than 25 concurrent Sage ESS users (administrators, employees, applicants) should consider SQL Server.

About Windows Server 2003 Web Edition

SQL Server 2005 or 2008 Express Edition can be installed on the same server that is running Windows Server 2003 Web Edition

SQL Server cannot be installed on the same server that is running Windows Server 2003 Web Edition. However, you can use SQL Server with Windows Server 2003 Web Edition if SQL Server resides on a different server.

About Windows Server 2008 Web Edition

SQL Server 2005 or 2008 Express Edition can be installed on the same server that is running Windows Server 2008 Web Edition.

SQL Server can be installed on the same server that is running Windows Server 2008 Web Edition.

Microsoft Database Management Resources

Information concerning SQL Server security, stability, and scalability is available on the Microsoft SQL Server website: http://www.microsoft.com/sql/techinfo/default.mspx

Client Requirements for Web Access to Sage Employee Self Service Your system must meet the minimum requirements for Microsoft® Internet Explorer version 7 or higher. At the time of release, information about Microsoft® Internet Explorer current versions is available on their product website: http://windows.microsoft.com/en-us/internet-explorer/download-ie

Note: When navigating in Sage Employee Self Service, clicking the browser’s Forward and Back buttons does not advance or change the pages within Sage ESS. You must use the navigation buttons on the application page to navigate.

http://www.microsoft.com/sql/techinfo/default.mspx

http://windows.microsoft.com/en-us/internet-explorer/download-ie


Using ASP.NET 3.x If ASP.NET 3.x Framework is installed, you must open Internet Information Services (IIS) Manager and change the Web Service Extension for ASP.NET v2.0 from Prohibited to Allowed, or you will be unable to open the ESS Web page.

See the following figures for IIS v6.0, IIS v7.0, and IIS v8.0 setup.

IIS V6.0

IIS V7.0 and IIS V8.0


Setting up Information Sharing with Microsoft Windows Server 2008

With the employee analytics feature in Sage ESS, you can share workforce data with other employees in your company. Using View Builder, a highly versatile and customizable analytical tool, you can implement dynamic information sharing in your company. View Builder is used for creating a view (similar to a template) that both generates data and displays the output in your web browser.

Follow the steps below if you install Sage Employee Self Service on a server running Windows Server 2008 and you plan to use View Builder.

1. On the server, select Start > Administrative Tools > Server Manager to open the Server Manager dialog box.

2. Click the Roles node in the left-hand pane.

3. Click Add Roles Services to open the Add Role Services dialog box.


4. Select Application Development and then click Install.

5. Scroll down the list of Role services and select Security.


6. Scroll down the list of Role services and select IIS 6 Management Compatibility.

7. Click Next and then click Install to install the selected components.

8. After the install is complete, click the Features node and then click Add Features to open the Add Features Wizard.


9. Select SMTP Server. If necessary, click Install to also install the Web Server (IIS) service.

10. Click Next and then click Install to install the selected features.

11. Restart the server.


Setting up Information Sharing with Microsoft Windows Server 2012

View Builder Compatibility With the release of Sage HRMS 2014 and Sage Employee Self Service, the View Builder functionality is not currently supported with Microsoft Windows Server 2012. All other features and functionality with Sage Employee Self Service for Sage HRMS 2014 are supported with Server 2012.

To solve for incompatibility with Server 2012, you must use View Builder on a machine with Microsoft Windows Server 2008, 2005, or 2003. Once the views are built they can be viewed and used in Sage Employee Self Service on Windows Server 2012 without issues.

Roles and Features Configuration on Windows Server 2012 1. On the server, select your Server Manager.

2. Select Add roles and features from the Quick Start list. The Wizard walks you through the configuration steps.


3. From the Server Roles list, select Web Server (IIS) and click Next.


4. Scroll down the list of Roles and select IIS 6 Management Compatibility.

5. Click Next and then Install to install the selected components.

6. After the installation is complete, click Features from the left menu and click Add Features to open the wizard.

7. Select SMTP Server. If necessary, click Install to also install the Web Server (IIS) service.

8. Click Next and then click Install to install the selected features.

9. Restart the server.


Configuring Firewall and Security Services

Sage HRMS Firewall Configuration Sage HRMS Clients require the following firewall considerations:

Outgoing Connections

The following ports must be open for clients to connect to Sage Employee Self Service:

• www-http: 80/TCP This is needed only when non-secure (http) access to the server is allowed.

• https: 443/TCP This is needed only if you want https access to the server and it is configured.

When Sage HRMS is configured to connect to a non-local SQL Server, incoming and outgoing traffic for the following port is required. Refer to Microsoft Knowledge Base article “INF: TCP Ports Needed for Communication to SQL Server Through a Firewall” at: http://support.microsoft.com/?id=kb;en-us;Q287932

• mssql ms-sql: 1433/TCP

Sage Employee Self Service Firewall Configuration A Sage Employee Self Service server requires the following firewall considerations:

Incoming Connections

The following ports must be open for incoming connections to the server:

• www-http: 80/TCP This is needed only when non-secure (http) access to the server is allowed.

• https: 443/TCP This is needed only if you want https access to the server and it is configured.

Outgoing Connections

When Sage Employee Self Service is configured to connect to a non-local SQL Server, incoming and outgoing traffic for the following port is required. Refer to Microsoft Knowledge Base article “INF: TCP Ports Needed for Communication to SQL Server Through a Firewall” at: http://support.microsoft.com/?id=kb;en-us;Q287932

http://support.microsoft.com/?id=kb;en-us;Q287932

http://support.microsoft.com/?id=kb;en-us;Q287932


• mssql ms-sql: 1433/TCP

To resolve IP addresses via DNS (depending on your server configuration), the following ports need to be open:

• domain: 53/TCP

• domain: 53/UDP

To send mail from the local SMTP service, at least the following port has to be available if outgoing connections are configured to be sent or forwarded from the Sage Employee Self Service server:

• smtp: 25/TCP

Network Security Configurations The following images are of common configurations that are used when implementing Sage Employee Self Service. These are guidelines only and can be modified for your environment.

Basic Network Security – IIS behind Firewall

Advanced Network Security – IIS and Two Demilitarized Zones (DMZs)


Enhanced Network Security – IIS in Demilitarized Zone (DMZ)

Sage ESS Data Execution Prevention Settings

Data Execution Prevention (DEP) is a set of hardware and software technologies that perform additional checks on memory to help prevent malicious code from running on a system. If you are running Sage Employee Self Service on a Windows 2003 Server with Service Pack 1 or higher, you must verify the DEP settings are correct.

On the Sage Employee Self Service server, follow the steps below. We recommend that these steps be performed only by the company’s IT department and with the assistance of a certified Channel Partner or a member of the Sage Professional Services Group.

Note: After verifying the DEP settings, you will be instructed to reboot the server. Before you begin, we recommend you make the necessary preparations for this required server reboot.

1. Verify the operating system is Windows 2003 Server with Service Pack 1 or higher: Click Start > Run, type winver, and press Enter.

2. Verify the processor supports hardware DEP:

a. Go to Control Panel > System > Advanced.

b. Click Settings in the Performance section.

c. Click the Data Execution Prevention tab.

d. Verify that you do not see the following text at the bottom of the tab:

“Your computer’s processor does not support hardware-based DEP. However, ...”

3. If you do not see the text and Employee Self Service is generating error 80010105, do the following to switch DEP settings:

a. Go to Control Panel > System > Advanced.


b. Click Settings in the Performance section.

c. Click the Data Execution Prevention tab.

d. Select Turn on DEP for essential Windows programs and services only.

e. Click OK to save and close all dialog boxes.

4. Reboot the server.

Tip: Refer to the following Microsoft Knowledge Base article for more information on DEP: http://support.microsoft.com/kb/875352.

http://support.microsoft.com/kb/875352


Creating a Microsoft Windows User Account

Sage Employee Self Service requires a Microsoft Windows user account with read and write access to the Sage HRMS data files, has permissions to log on as a service and launch processes, and is a member of the administrators group from the Sage Employee Self Service Web/Application server.

Use these instructions to create this account if the data files are located on your Sage Employee Self Service Web/Application server (that is, the server where you perform the Sage Employee Self Service installation).

If the Sage HRMS database files are located on a different server and your enterprise uses workgroups, you must create the same Windows user account on both the Sage ESS Web server and the Sage HRMS server. If your enterprise uses domains or active directory, a Windows user account at the domain level is sufficient.

If Sage HRMS is accessed through a file share, you must set both share permissions and NTFS permissions (if applicable) to allow read and write access for the account. The account should have a ‘static’ password that does not need to be changed. This prevents errors when Sage ESS accesses the share using the account information.

Skip the steps below if you already have a Windows user account that meets the aforementioned criteria.

1. From the Start menu, select (All) Programs > Administrative Tools > Computer Management > System Tools > Local Users and Groups.

2. Add a New User:

a. Right-click Users and select New User. The New User dialog box opens.


b. In the User Name field, enter the Windows user account that has write access to the Sage HRMS data files. This account should have the rights of a standard user account (local or domain).

c. In the Password fields, enter and confirm the password.

d. Clear User must change password at next logon.

e. Select User cannot change password and Password never expires.

f. Click Create.

g. Click Close.

3. Add the new user to the Administrator group:

a. Right-click the (Sage ESS) user and select Properties.

b. Click the Member Of tab and then click Add to open the Select Groups dialog

c. Click Advanced and then Find Now to find the Administrators group.

d. Highlight the Administrators group and click OK.

e. Click OK.

f. Click OK to end the task. The ESS user has now been added to the Administrators group.

4. Using Windows Explorer, navigate to the Sage HRMS Data folder, right-click and select Properties.

• If you are using a Windows XP or Windows Server 2003 machine, the default location is \Documents and Settings\All Users\Application Data\Sage\SageHRMSServer\Data

• If you are using a Windows Server 2008, Windows Vista, Windows 7, or Windows 8 machine, the default location is \ProgramData\Sage\SageHRMSServer\Data

5. In the Data folder’s Properties dialog box, select the Security tab and click Add. The Select Users, Computers, or Groups dialog box opens.

6. In the Enter the object names to select field, enter <local server name>\ESS.

7. Click OK.

8. Set the Modify user permission to Allow.

9. Click OK.


Recommendations for Public Access Workstations

Sage Employee Self Service allows users to access their personal, payroll, and benefit information via the Internet or an intranet.

When you connect to a network and communicate with others, you are taking a risk. Internet security involves the protection of a computer's internet account and files from intrusion of an unknown user. This means people will always strive to find new ways to circumvent IT security, and users will need to be continually vigilant.

Below are some recommendations for keeping your system and network secure. However, we highly recommend that you contact an Information Security expert to determine the best way for your company to keep your information secure.

Software Applications Best Practices • Install and maintain up to date and properly configured anti-virus software. Be sure that real-

time protection scans all files.

• Install active spyware defenses, for example, Windows Defender.

• Install only the minimum number of applications as needed.

• Update web plug-ins, Java Scripts, and media players on a regular basis as these are areas of increasing vulnerability.

• Periodically check the website of the Operating System vendor (such as Microsoft) for critical security updates that may need to be applied.

• Consider using multiple web browsers for different software applications. Currently, Sage ESS operates with Internet Explorer 7.0, 8.0 and 10.0; Google Chrome 4.0.223.16; Apple Safari 3.2.3 (525.29), and Mozilla Firefox 3.6.3. Sage Employee Self Service Open Enrollment/Life Events can run with Internet Explorer 7.0, 8.0, and 10.0. So, for example, you could use Mozilla Firefox to access Sage ESS and a different browser for general purpose web browsing. This can minimize the chances of vulnerability in a web browser, a website, or related software that can be used to compromise sensitive information.

• Disable other unnecessary network services.

Data Security Best Practices • Keep backup copies of important documents on a secure server and not a shared workstation.

• Use certificates, especially if you modify a DNS server (or write a Java-based SSL proxy) to point your web or XML client to another website.


• Configure the Sage Employee Self Service web server for HTTPS/SSL using a valid site certificate and do not allow access from public workstations or computers on the Internet.

• Enable or disable functionality as required to secure your web browser. Because some software features, such as ActiveX, Java, Scripting (for example, JavaScript or VBScript), that provide functionality to a web browser can also introduce vulnerabilities to the computer system, you must understand which browsers support which features and the subsequent risks they could introduce. If you are not sure how to define the security settings, please consult an Information Security expert.

• Disable broadcast services.

• Disable the cache on the local system and always store confidential data securely (in transit and at rest).

• Clear temporary files regularly and set Internet Explorer to have a 0 day history and to clear the cache upon exit. This helps destroy session cookies.

• Require users to change their password regularly and require a strong password.

• Never allow Windows to remember your passwords.

• Lock the BIOS to prevent USB, CD-ROM, or Network booting and use a strong BIOS password.

• Prevent Internet Explorer from caching passwords.

• Perform a port scan or a network statistics on the kiosk operating system to determine active TCP connections. Block everything except the ports you need.

Additional Best Practices • Institute strong group policies. This is a good way to prevent security issues.

• Stress the importance of logging off and closing all applications, not opening attachments unless you know the sender and know that it was intentionally sent to you, and not clicking links without considering the risks of their actions.

Important! The best approach to adequately maintain the security of the system, without unduly inconveniencing the user, should be determined in consultation with an Information Security expert.