Deploy LogRhythm in a FIPS-Enabled Domain

Complete the Prerequisites

Before deploying LogRhythm in a FIPS-enabled domain, complete the following prerequisites. If your deployment does not adhere to any of the requirements, contact LogRhythm Support.

• Perform the LogRhythm Database installation prior to joining the server to the domain.
• Complete the LogRhythm Software Install Wizard steps prior to joining the server to the domain.
• Select or create a domain user or service account to be used as a LogRhythm Global Administrator.

In High Availability or Disaster Recovery deployments, perform the steps in this guide on both the primary and the secondary servers.

Note the following:

• The initial configuration of LogRhythm will occur in one of two places:
  • Connected to the network and not joined to the domain
  • Connected to the network, joined to an organizational unit in the domain that doesn't inherit the GPO enabling FIPS.
• Local server administrator accounts are temporarily allowed.

• FIPS and Integrated Security must be enabled for the same LogRhythm components. For more information, see Integrated Security.

  

  Integrated Security must be configured prior to FIPS.

• The initial configuration of LogRhythm will occur with MS SQL Server in SQL and Windows Authentication Mode enabled.

Stop LogRhythm Services and Set to Manual Startup with PowerShell

1. Open a PowerShell console as the administrator and enter the following commands:

   CODE

   Get-Service -DisplayName “LogRhythm*” | Stop-Service

   CODE

   Get-Service -DisplayName “LogRhythm*” | Set-Service -StartupType Manual

Grant the LogRhythm Server Local Administrator Access to SQL Server

1. Sign in to SQL Server as sa.
2. Create a new login for the local server administrator account.
3. Ensure that the account has sysadmin access.

Validate Local Administrator SQL Server Access

1. Sign in to SQL server as the local admin account. 
2. Under Logins, right-click the <Server\LocalAdmin> account.
3. Verify that the sysadmin role is selected.

Put Windows into FIPS Mode

1. Log on to Windows as a Windows system administrator.
2. Click Start, Control Panel, and Administrative Tools.
3. Click Local Security Policy.  
   The Local Security Settings window appears.
4. In the navigation pane, click Local Policies, and then click Security Options.
5. In the right-side pane, double-click System cryptography: Use FIPS–compliant algorithms for encryption, hashing, and signing.
6. In the dialog box that appears, click Enabled, and then click Apply.
7. Click OK.
8. Close the Local Security Settings window.
9. Restart the computer for the change to take affect.