Enterprise Hybrid Work Job

Overview

Resilio Active Everywhere 6.0 introduces the Enterprise Hybrid Work Job - a highly scalable data transferring workflow enabling VPN-less access to SMB shares in Windows domain environments.

The Enterprise Hybrid Work Job type benefits include:

Ability to access volumes with billions of files - On-demand scanning fetches meta data of top-level file system items while the end user browses the Job folder. This reduces the volume of data required to serve files to all participating Agents.

Synchronous locking - The Primary Storage Agent serves as a lock server to provide synchronous locking for files in the Job folder. This allows preventing data corruption when multiple end users access the same files either remotely or from the local network.

To get started:

Review system requirements and complete preliminary setup steps.
Set up the Management Console
Set up the Primary Storage Agent
Set up user Agents
Create a Domain group
Create an Enterprise Hybrid Work Job

Set up Management Console

To set up the Management Console for Enterprise Hybrid Work Job:

Install Management Console version 6.0 or newer.
Note
- Install and run under Local System account.
- Install Resilio Connect Tracker.
(Optional) Enable authentication for Management Console administrators via Active Directory, Entra ID, Okta or Open ID Connect identity provider.

Set up Primary Storage Agent

Primary Storage Agent is responsible for providing remote access to shared file storage resources.

To set up Primary Storage Agent:

Download and run the Primary Storage Agent installer.

Note

Installed Agent service must run under the Local System account.
On the Configure connection with Management Console screen, choose Paste agent config as text and click Next.
Obtain Agent configuration:
1. In the Management Console, select Agents.
2. Click + Connect new Agent, then click Next.
3. In the Management Console address field, enter the FQDN of the machine where the Management Console is installed.
4. Deselect the Enable Agent UI option, then click Save.
5. Click Copy to copy the configuration to clipboard.
6. Paste the configuration in a text editor, then remove the lines with bootstrap_token and mc_restricted_access parameters.
```
{
  "management_server": {
    "host": "resilio-server.corp.example.com:8444",
    "cert_authority_fingerprint": "1234...5678",
    "bootstrap_token": "R2D2...C3PO",
    "disable_cert_check": false
  },
  "mc_restricted_access": false,
  "use_gui": false
}
```
7. Copy resulting configuration to clipboard.
Paste the Agent configuration and proceed with the installation.
Note

If your Management Console is set up in a local network, add the external_addr parameter with a public hostname or IP address of the Primary Storage Agent along with a port number used for data transfer (default 3839). This information is distributed to end user Agents via tracker server to allow direct connection to the Primary Storage Agent for file transfers.

Important: The external_addr parameter cannot be a DNS hostname. In case you're running a single Primary Storage Agent available via a DNS hostname, define known hosts in end user Agents Job profiles to establish connectivity between the Primary Storage Agent instance and end user Agents.
```
{
  "management_server": {
    "host": "resilio.corp.local:8444",
    "cert_authority_fingerprint": "1234...5678",
    "disable_cert_check": false
    },
  "use_gui": false,
  "external_addr": "203.0.113.1:3839"
}
```

Set up User Agents

User Agents are installed on end users' machines to provide them with access to the shared storage resource via the Primary Storage Agent.

Important: User Agent authentication

You cannot have user Agents using different authentication methods. Once you enable user Agent authentication via Open ID Connect compliant identity provider, all user Agents must authenticate using this method. Agents that previously authenticated using Active Directory will no longer be able to connect to the Management Console, unless they are reconfigured to use the Open ID Connect authentication method.

Windows

Domain-joined computers

If the Management Console's hostname is not the same as the FQDN of the machine in the Active Directory, configuration file is required to connect end user Agents to the Management Console. Use the template below to prepare sync.conf file and place it in the %AppData%\Resilio Connect Agent folder, then proceed with the installation.

{
    "management_server": {
        "host": "resilio.my-company.com:8444",
        "cert_authority_fingerprint": "iddqdi...91705",
        "disable_cert_check": false,
        "spn": "rslmc/mc.corp.resilio.us"
    },
    "use_gui": true
}

where

"use_gui": true is mandatory for enabling the Agent user interface.
spn is the Service Principal Name of the Management Console machine in the Active Directory. It is required for end user Agents to authenticate against the Management Console via Active Directory.
host is the hostname or the IP address of the Management Console machine. It must be accessible from end user devices.
cert_authority_fingerprint is the fingerprint of the Management Console's certificate authority, which you can find under Settings > General.

To set up end user Agents:

Download and install the End User Agent.
Note
- Installing Resilio Agent requires elevated privileges. To verify that the installer runs with administrator rights:
  In Task Manager, select Details, then verify that the installer process has Yes in the Elevated column.
- Windows Explorer restart is required to activate Resilio Shell Extension in order to enable TSS overlay icons. Conflicts with other shell extensions providers may occur, resulting in missing TSS icons. For information on how to resolve this issue, see No TSS icons on Windows Agent.
Connect Agent to the Management Console:
Open ID (Entra ID and Okta) authentication

When end user Agent runs on a non-domain joined computer, it can authenticate using OpenID Connect identity provider, e.g. Entra ID or Okta.
1. In the Agent UI, provide the Management Console's FQDN, then click Connect.
2. Authenticate against Open ID Connect identity provider.
  
  Click Sign in, and once you're redirected to the web browser, authenticate with your Open ID Connect login credentials.
  
  Note
  
  If your organization uses multi-factor authentication, you may need to generate an app password to authenticate Agent connection to the Management Console.
Active Directory authentication

Note

When authenticating using Active Directory, user is not prompted for credentials.
Verify the end user system is domain-joined

Windows Settings
In Windows Settings, select System > About. Locate and analyze Full device name. If the device is domain-joined, the Full device name contains the domain name, for example device1.corp.us.

Windows CMD/PowerShell
In Windows Command Prompt or PowerShell, run the command systeminfo | findstr "Domain". If the device is domain-joined, the output will contain the domain name, for example Domain: corp.us. If the device is not domain-joined, the output will indicate that the device is part of a workgroup, for example Domain: WORKGROUP.
```
systeminfo | findstr /B /C:"Domain"
```
Enter Management Console's FQDN, then click Connect.

Periodic reauthentication

End user Agents authenticating via Active Directory require direct connection to the domain controller to obtain Kerberos tickets for authentication. You can allow Agents to reuse their authentication tokens and continue to operate for a certain period of time without having to re-authenticate. For more information, see Agent authentication - Active Directory.

Tip

For Agent UI overview, see Resilio Agent UI.

Agent configuration in Windows Registry

On Windows, Agent configuration is also stored in Windows Registry under HKEY_LOCAL_MACHINE\SOFTWARE\Resilio\Resilio Connect Agent\config.

Important

Registry entries override the configuration in sync.conf file. If you have both sync.conf and registry entries, the Agent will use the values from the registry.
If the management_server.host is specified in the registry, you must also specify the remaining management_server parameters.

Registry entries for Agent configuration

Registry entry	Description
`management_server.host`	The hostname or IP address of the Management Console along with the Management Console's control traffic port number (default: 8444). Data type: `String Value` Example: `resilio.my-company.com:8444`
`management_server.cert_authority_fingerprint`	The fingerprint of the Management Console's certificate authority. Data type: `String Value` Example: `r2d21244iddqdaab5idkfafb8def2965b03e32be628b624a9d08a33588b0ae96bb`
`management_server.disable_cert_check`	Whether to disable certificate checking. Applicable values: `0` - False `1` - True Data type: `DWORD 32-bit Value`
`management_server.bootstrap_token`	The bootstrap token for the Management Console. Data type: `String Value` Example: `IDDQDIDKFAR2D2C3POMHETX7ZZ44GEWULIBTIWVL3RFXQUA6H3RJ6HQ`
`management_server.spn`	The service principal name for the Management Console. Data type: `String Value` Example: `rslmc/mc.corp.resilio.us`
`local_policy.allowed_jobs`	The types of jobs allowed for the Agent. Applicable values: `all` `sync` `script` `transfer` `hybrid` Data type: `String Value`
`local_policy.allowed_hybrid_job_cache_path`	The path for the hybrid job cache. Data type: `String Value` Default: `%HOME%\Resilio\Cache`
`local_policy.allow_fs_browsing`	Whether to allow filesystem browsing. Applicable values: `0` - False `1` - True Data type: `DWORD 32-bit Value`

macOS

To install Active Everywhere 6.0 Agent on macOS:

Download the Agent installer.
Open the installer image, then drag and drop the Resilio Agent on to the Applications folder.
Enable Resilio Connect Agent extensions:
1. In System Settings, select General > Login Items & Extensions.
2. In the Extensions section, click By Category.
3. Locate File Providers category and click the info icon to manage file providers extensions.
4. Enable Resilio Connect Agent extension, then click Done.
5. Locate File System Extensions category and click the info icon to manage file system extensions.
6. Enable Resilio Connect Agent FS extension, then click Done.
Enable background activity for Resilio Connect Agent:
1. In System Settings, select General > Login Items & Extensions.
2. In the App Background Activity section, locate and enable Resilio Connect Agent.
Connect Agent to the Management Console:
1. In the Agent UI, provide the Management Console's FQDN, then click Connect.
2. Authenticate against Open ID Connect identity provider.
  
  Click Sign in, and once you're redirected to the web browser, authenticate with your Open ID Connect login credentials.
  
  Note
  
  If your organization uses multi-factor authentication, you may need to generate an app password to authenticate Agent connection to the Management Console.

Create a Domain group (Optional)

In Management Console, create a Domain group that matches the Active Directory group that end users belong to.

Note

This step is optional. You can add individual end user Agents or Domain groups during Job creation.

Create an Enterprise Hybrid Work Job

To create an Enterprise Hybrid Work Job:

In the Management Console, select Jobs > Configure Jobs, then click + CREATE NEW JOB and select Enterprise Hybrid Work.
On the DETAILS tab, provide the Job name and, optionally, a description.
On the PRIMARY STORAGE tab, add your Primary Storage device:
Note
- Only server type Agents running on domain joined machines under Local System (machine) accounts are shown at this step.
- Only one Primary Storage instance can be selected.
- Once the Job is created, you cannot change the Primary Storage instance.
- The Primary Storage instance serves as a Lock server and the Reference Agent.
1. Select your Primary Storage Agent, then specify Job folder path:
  1. Click Specify path.
  2. Provide an SMB share or Nasuni DFS namespace path, then click Save.
  Nasuni DFS namespace
  
  When using Nasuni DFS namespace, make sure that the Primary Storage Agent's Job Profile has:
  - The Follow symlinks option enabled.
  - The preserve_logical_path custom parameter has been added and set to true.
  Important: Primary Storage Agent Job folder path
  
  You cannot change the Job folder path on the Primary Storage Agent once the Job is created. If you need to change the Job folder path, you will have to create a new Job.
2. Click Assign Job Profile and select Primary storage default profile.
3. (Optional) Change the service principal name fetched from the Active Directory:
  Select Input SPN manually, then provide the Primary Storage device SPN.
  
  Note
  
  Computers in Active Directory can have multiple SPNs assigned. If the SPN fetched by the Management Console is incorrect, specify the correct SPN value manually.
On the USERS tab choose from previously added domain groups and individual users , or add new ones.

Note

User accounts in Active Directory must have UserPrincipalName (UPN) property assigned. For more information, see System Requirements and Prerequisites - User accounts properties.
1. Click + ADD DOMAIN USER/GROUP and search for a user or a group.
2. Select a user or a group, then click Select.
  
  Tip: Multiple domains
  
  If you cannot locate a user or a group, make sure they are in the same domain as the Management Console or a two-way trust relationship exists between the domains.
3. (Optional) Click the default Job folder path to change it, provide paths for mount and cache locations for end user devices, then click Save.
  
  Tip: Map Job folder to a drive letter
  
  Define the Mount location as <drive_letter>: to map the Job folder to a specific drive letter, for example, M:. The drive letter must be in uppercase and not already in use by another drive.
  
  Important: External storage devices
  
  External storage devices are not supported.
4. (Optional) Click Assign File Policy and choose a file policy that defines how Agents manage file caching depending on available storage space.
5. Click Assign Job Profile and select End-user default profile.
On the SETTINGS tab, adjust File Locking parameters.
Important: File locking
- Do not disable file locking.
- You cannot enable or disable file locking after the Job is created.
- Do not clear the default Ignore locks for these files and folders entry. Instead, add each new regular expression rule in a separate line.
- When Agent is not connected to Lock server - Access level to shared files when the locking server is unavailable.
- Ignore locks for these files and folders - A regular expressions (PCRE2 syntax) to match files and folders that you want to exclude from locking.
On the SUMMARY tab, verify your Job's configuration, then click Save.

Known issues and limitations

Existing Resilio deployments

You cannot upgrade your existing 4.x or 5.x deployment to Active Everywhere 6.0.

IT environment

Proxy servers are not supported.
Management Console cannot list Foreign Security Principal (FSP) objects within a group in an Active Directory domain. If you have a group, containing users from other trusted domains as Foreign Security Principal objects, Management Console won't be able to access those users and add them to the Job. You must assign users and groups from each domain separately.

Analytics

There's no option to limit the size the analytics database takes up on the Management Console host.
When upgrading from version 6.0.0.3622 or older, delete the mchost\UserData\userdata.sqlite database file in the Management Console storage folder. Note that this will delete all existing Saved Views but it is necessary due to changes in the analytics framework.

Enterprise Hybrid Work Job

Speed Scaleout Groups are not supported.
File locking must remain enabled.
Impersonation does not apply to highly privileged accounts, e.g. Domain Admins or Enterprise Admins.
You cannot create and manage Enterprise Hybrid Work Jobs via API.
You cannot change the Primary Storage Agent after the Job is created.
You cannot change the Job folder path on the Primary Storage Agent after the Job is created.
You cannot enable or disable file locking after the Job is created.

End user Agents

External drive support is not available for end user Agents.
Cache folder cannot be located on an SMB share on a ReFS volume.
Download and upload time estimates can be inconsistent - Job ETA may be missing while ETA for individual files could be available.
Agent UI may be blank if there are thousands of files in the active queue.
Some errors can remain for some time, even after they have been resolved.
If there is a connection problem or invalid MC address was applied, user can see pending attempting to connect to the MC.
Minor UI glitches and inconsistencies.
Running executable files from the Job folder may fail due to a bug in Windows WebDAV client. For details, see Cannot access executable binaries.
Windows end user Agents don't lock files if the Job folder path is specified as a UNC path.
Overloading the Agent with too many file operation requests within the Job folder, may result in Agent reporting the SE_RECHECK_FILE: Cannot check file blocks, error=transfer key invalid, system error: The cloud operation is invalid. (380) error.
File's mtime update on the Primary Storage Agent triggers dehydration of the file on end user Agents participating in the Job, even if the file is not modified. The file won't be rehydrated automatically until the end user Agent accesses the file.
Applying a file policy after the Job is created may result in issues with browsing files in the Job folder on end user Agents. To avoid this, create a file policy before creating a Job and apply it during Job creation.