Version

Installation

Installation Requirements

Windows 64 bit machine
.NET Framework 4.6 or higher

Instructions for Local Install

1. Unzip the CleanMyOrg-x.x.zip archive into the desired directory

2. In the unzipped /installs folder, install MongoDB

Be sure to keep the checkbox to allow MongoDB to be run as a service
You can uncheck the install option for installing Compass if desired

3. Once MongoDB has been installed, you can go to the config/nodeconfig.json file to change any server settings before running. Here you can change settings for:

The port that will be used
Using HTTP or HTTPS
MongoDB Settings
Whether or not login credentials will be used
Default admin email
Level of server logs
Log size max
Whether resolution options will be allowed from the app

Please see the Config File Values section for more information on each item.

4. CleanMyOrg is ready to run. In the main unzipped folder, click on cleanmyorg.exe. This will launch the CleanMyOrg server application. Closing the app or shutting down your computer during a scan will cause the scan to fail. In order to use the ‘Scheduled Scan’ functionality, Clean My Org must always run in the background. See Step 4 of Instructions for Web Server Install below for instructions on setting up the application up to run in the background.

5. Once the app is running in the background, open a web browser and type http://localhost:8000 into your url bar.

This will start the CleanMyOrg client interface. From here, you can set up Mail Settings by clicking the cog in the top right. You can also set up your Identities for scanning on the Manage Identities page.

For convenience, there is also a cmolocal.bat file that can be run in the same directory. This will start the CleanMyOrg.exe server, then open a Chrome browser to http://localhost:8000. This file can be copied as a shortcut and placed on your desktop.

Instructions for Web Server Install

1. Unzip the CleanMyOrg-x.x.zip archive into the desired directory

2. In the unzipped /installs folder, install MongoDB

Be sure to keep the checkbox to allow MongoDB to be run as a service
You can uncheck the install option for installing Compass if desired

3. Once MongoDB has been installed, you can go to the config/nodeconfig.json file to change any server settings before running. Here you can change settings for:

The port that will be used
Using HTTP or HTTPS
MongoDB Settings
Whether or not login credentials will be used
Default admin email
Level of server logs
Log size max
Whether resolution options will be allowed from the app

Please see the Config File Values section below for more information on each item.

4. Now, we will set up CleanMyOrg as a service.

Open a Command Console by going to start -> run and typing “cmd”
Go to the installs directory of CleanMyOrg by typing: cd \D your_CMO_directory_location\installs i.e. cd \D C:\CleanMyOrg\installs
Type: nssm install “CleanMyOrg Server”
After the nssm service installer has opened, click on the box next to Application Path and navigate to the CleanMyOrg base folder and click on cleanmyorg.exe
If you are using IWA Authentication for an identity:
Click on the “Log on” tab and select the “This account” option.
Use the account and password that will have administrator privileges to your organization.
Once you are finished making changes, click the “Install service” button.

NOTE: The service can later be removed by running: nssm remove “CleanMyOrg Server” confirm

5. To make CleanMyOrg available outside of this machine, you will need to open up TCP port 8000 in your router settings.

6. Once the app is running in the background, open a web browser and type http://yourwebsitedomain:8000

This will start the CleanMyOrg client interface. From here you can set up Mail Settings by clicking the cog in the top right, and set up your Identities for scanning on the Manage Identities page.

Configuration

Running as HTTPS

To run CleanMyOrg as HTTPS, you will need both a certificate and key .pem file. If you need to generate these, you can do so by downloading OpenSSL at https://www.openssl.org/,
Open a Command Console in Windows
Run the following commands to generate your private key and public certificate:
openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem

openssl x509 -text -noout -in certificate.pem
Once you have the cert and key files, copy them to your CleanMyOrg main folder.
Edit the config/nodeconfig.json file and make the following modifications:
“useHTTPS”: "true", “certificate”: "certificate.pem", “key”: "key.pem"
Restart your CleanMyOrg server app or service, then load https://localhost:8000 or https://yourwebdomain:8000 in your browser.
Note: If you are using an absolute path in your nodeconfig.json file, be sure to use double backslashes, such as "C:\\CleanMyOrg\\Certificates\certificate.pem"

Running with password protection

If you are running CleanMyOrg in a public facing situation or wish to control access, you can enable login credentials. To enable login credentials, edit the config/nodeconfig.json file and make the following modifications:

Under the "useSecureAuth" field, set “enabled” to true
Using Command Prompt, go to the CleanMyOrg root directory and type: cleanmyorg setpw yourusername yourpassword
Restart your CleanMyOrg .exe or service.

Additional nodeconfig.json values

Additional values you can change are:

port: (default: 8000) the port CleanMyOrg will be running. This will change the URL of the CleanMyOrg page to http://localhost:yournewportnumber
hostname: the default hostname used in links for email notifications
adminEmail: this will auto-populate the mail scan results field of scans. Can specify multiple recipients by separating with commas.
serverLogLevel: (default: 1) set the level of log verbosity from 0 to 4, where 0 is silent running and 4 is debug level logging. Logs will show up under CMO-logs.txt in the main CleanMyOrg directory.
logSizeMaxMB: set the maximum file size of the CMO-logs.txt file. Once the CMO-logs.txt has hit the limit, it will copy the existing logs to CMO-archive.txt and restart the CMO-logs.txt file.
allowAutoResolutions: (true/false) If you do not wish to allow users to make changes to the contents of your organization, you can set this option to false. Notification and Allowlist resolution options are still allowed.
enableHSTS: Enable HSTS support on the CleanMyOrg server. HTTPS must be configured to run with HSTS support.
Other settings should not be adjusted unless instructed to do so by GEO-Jobe Support.

Configuring CleanMyOrg for OAuth2

If your organization is using ArcGIS Online or ArcGIS Enterprise with OAuth2 authentication, you will need to create a CleanMyOrg application item in your organization.

Click here to visit our Clean My Org Knowledge Base for step-by-step instructions on how to set up an application item to retrieve your App ID.
Once you receive your App ID, copy and paste it into your Identity setup on the CleanMyOrg Add Identity page.

Clean My Org Operation

Setting up Mail Options

To set up settings for sending email notifications, click on the cog icon in the top right of the CleanMyOrg page.

There are 3 options for mail types that can be configured:

Service (Gmail, Outlook, etc)

The service section provides some templates for common mail services such as Gmail and Outlook.
Before sending email using Gmail, you will need to allow less secure apps to access Gmail. You can do this by going to https://myaccount.google.com/lesssecureapps
The Gmail option with less secure apps will not work with 2-factor authentication, so it is advised to create a new account specifically for the purpose of CleanMyOrg email notifications.

SMTP

Standard SMTP options are available in this section, including host, port, username, and password. If there is a configuration that is not supported here, the Custom Mail Type can be used instead.

Credentialless SMTP

Credentialless SMTP options are available in this section, including host and port. If there is a configuration that is not supported here, the Custom Mail Type can be used instead.

Custom

CleanMyOrg uses NodeMailer for its mail system, so any transport configuration that works in NodeMailer can be entered here. The format for this section is JSON, and you can get a list of options at https://nodemailer.com/smtp/#examples.

Setting up Identities

You can set up your Organization’s identities and credentials on the “Manage Identities” page. To add a new identity, click on blue plus button next to either ArcGIS Online or ArcGIS Enterprise.

Setting up an ArcGIS Online Identity:

Organization Name: the name your scans will be associated with in CleanMyOrg
URL: the licensed connector to your ArcGIS Online organization
App ID: You will need to set up an app in your ArcGIS Online organization to work with CleanMyOrg. Please see Configuring CleanMyOrg for OAuth2 for information on how to generate the App ID.

Setting up an ArcGIS Enterprise Identity:

Organization Name: the name your scans will be associated with in CleanMyOrg
Authentication: IWA or OAuth2.

For IWA, no additional credentials are needed. Authentication will be done by the user identity of the web server service, or the current Windows user if run locally. Please ensure that the user has administrator privileges in your organization for scans to function properly.
For OAuth2, you will later need to specify an App ID. Please see Configuring CleanMyOrg for OAuth2 for information on how to generate the App ID.

URL: the licensed connector to your ArcGIS Online organization
App ID: If you are using OAuth2 authentication, you will need to set up an app in your ArcGIS Online organization to work with CleanMyOrg. Please see Configuring CleanMyOrg for OAuth2 for information on how to generate the App ID.

Running an On Demand Scan

To run an immediate scan, click the On Demand Scan section on the left side of the page.
Select your configured identity in the “Organization To Scan” section. If you have not set up an Identity yet, click the “Add Identity” button to go to the “Manage Identities” section.
Under Scan Name, you can provide a custom name to help identify the scan
You can enable a notification email by enabling the switch next to “Email Scan Results to”. You will need to set up Mail Settings before scanning to receive emails. Please see Setting up Mail Options for more information.
One or more email addresses can be entered in the email box. Multiple email addresses will need to be separated by commas.
There are 3 tabs containing the Item, Group, and User scans that may be run. The number next to the tab denotes how many currently active scans are in each section.
Some fields may require additional input, such as item tagging. Multiple tags or names can be separated by commas.
Click the Run Scan to begin the scan. You will see the scan results in real time. You can navigate away from the currently running scan at any time. Clicking back on the On Demand Scan will take you to the active results.

Running a Scheduled Scan

Clicking on Scheduled Scan on the left side of the page will open the list of Scheduled Scans that have been created.
Toggling the switch under the “Repeating” column will disable or re-enable the scan.
To edit an existing scan, double click on a row or click the Edit button on the right of the row.
To delete a scan, click the Delete button the the far right of the row.
To create a new scheduled scan, click the Add Schedule button at the top right.
The Scheduled Scan settings are very similar to the On Demand settings, with the exception of frequency fields to determine how often the scans will run.
Click the Save Settings to save the new Scheduled Scan. The first scan will run at the starting date specified.

Scan History Page

The Scan History page will list all scans that have been run to-date.
To view a scan, double click on a row or select the Review Button under the Results column.
To delete a scan, click on the Delete button to the far right of the row.
You can choose which fields to view by clicking on the plus icon at the top right of the table.
Clicking on a column will sort by that column.

Scan Results Page

The Scan Results page will display all information on a scan and provide resolution options.
Clicking the blue Information icon next to the scan results name will give you a list of all of the scan types this scan processed.
You can filter the results by Scan Type as well as a partial match of the content name.
Click the Blue X to remove the filter results.
The results can be sorted by clicking on a column header.
The results are also paginated and can be navigated with the page controls at the bottom right.
To resolve a scan issue, you can choose an option on the right column. See Scan Resolution Actions below.
You can also bulk select issues in order to compile a list of issues to notify stakeholders. Once you have selected your issues, you can click the “Notify Selected” button at the bottom of the grid.

Scan Resolution Actions

Notify: The notify action will email stakeholders about an issue.
Multiple recipients can be used by placing commas between emails.
You can type a partial email address that will be autocompleted if the email is in the Address Book.
You can also attach a message to the email clarifying the contents in the “Additional Note” field.
Clicking the blue button to the right of the email box will open the Address Book. Address Book entries are saved per Identity.
To use an Address Book entry, click the name. This will insert the address into the notification.
To delete an entry, click the red trash can button to the right of the entry.
To add a new entry, type in the email addresses and click the Add Address button. This will insert the addresses into the notification and save for future use.
Allowlist: The allowlist will flag the issue so that it does not show back up in future scans. See Allowlist Management for more information.
Delete: This will delete the item.
Fix: This will replace the url or content of an item with a replacement url or content. An example would be replacing the url of a broken layer inside a web map, or replacing tags.
Clean: The Clean action will remove the instance of the content from the item, such as removing a broken layer from a web map.

Allowlist Management

To manage the allowlist for a particular identity, click on the Manage Identities link on the left side of the page. Then click on the Manage Identity button next to the Identity listing.
From here you can see the current members of the allowlist. To remove a allowlist entry, click the X to the left of the name. This will return the entry to normal scanning.

Troubleshooting

I have started CleanMyOrg.exe, but the window immediately closes.

Go to the Start -> Run menu and type ‘cmd’ to open a Command Shell. Navigate to the folder using cd /D your_install_location and type cleanmyorg. This will let you see the result of running the server app. Also note that only one instance of the CleanMyOrg.exe server can run at one time, so if there is already an instance running the second one started will fail.

CleanMyOrg is failing with ‘TypeError: Cannot read property ‘db’ of null.

You either need to install MongoDB, or your MongoDB service is not running. From the start menu, open Services and make sure the MongoDB service is running.

CleanMyOrg is failing with an ‘EACCES’ error.

You may need to change the port from the default 8000.

In your CleanMyOrg folder, open up the /config/nodeconfig.json folder.
Change the port from 8000 to another number, such as 8001.
Stop any services or cleanmyorg.exe processes that are running.
Restart your cleanmyorg.exe or service.

http://localhost:8000 is not working when I open it in a browser.

Make sure the CleanMyOrg.exe or service is running
Make sure port is 8000 in config/nodeConfig.json.
If you are using HTTP, in config/nodeConfig.json make sure useHTTPS is false.
If you are using HTTPS, in config/nodeConfig.json make sure useHTTPS is true, and that you have the correct location of certs.certificate, and certs.key.
If you have made any changes to the config settings, be sure to stop cleanmyorg.exe and restart.

I am getting Invalid Redirect URI when trying to save my identity.

You will need to configure your Redirect URI in your CleanMyOrg application item in your organization. Please refer to Configuring CleanMyOrg for OAuth2 for more information.

My organization’s URL is not showing up on the Add New Identity URL field.

If you have not licensed a connector URL for that organization, please contact GEO-Jobe to purchase an additional connector. If you existing connector needs to be changed, please contact GEO-Jobe to update your build with the proper connectors.

I am unable to add new OAuth Identities in Internet Explorer.

To add OAuth Identities in Internet Explorer, you must first add your ArcGIS Enterprise or ArcGIS Online connector url to the Trusted Sites under the Security Settings.

In Internet Explorer, click on the gear at the top right of the window.
Click on the Security tab
Click on the Trusted Sites icon
Click the Sites button to add a trusted site.
Add the ArcGIS Online or ArcGIS Enterprise URL and click Close
Restart Internet Explorer and try to add a new Identity in CleanMyOrg.

Note: While creating a new identity, if you get a 404 page in the popup after entering your credentials, try refreshing that popup window.
If you are logging into a CleanMyOrg site other than localhost, you will also need to add your CleanMyOrg domain as well. If using http, be sure to uncheck the box for “Require server verification (https:) for all sites in this zone.”

Additional Support Resources

If you have any questions, problems, or feature requests, you can get in touch with us via email at support@geo-jobe.com or Live Chat on https://geo-jobe.com, or call us at 1-844-GEOJOBE.

You can also access answers to frequently asked questions or issues in the GEO Jobe Knowledge Base HERE.

Export Server Logs

This option will allow you to download the log files for server operations. This may be requested in the event you open a support ticket with GEO Jobe's support team. If you need to adjust the level of specficity in the server logs, you can do so in the settings menu. Please note that increased specificity may result in longer processing times.

To receive updates on new Clean My Org releases, sign up for updates HERE.

Version 1.6.1.2 Hotfix Notes

Fix for bulk delete resolutions (.02)
Services that are not used by any webmap: better caching of group layers (.02)
Fix for downloading scan reports in Firefox (.02)
Improvements to logging logins (.01)

Version 1.6.1 Release Notes

New Scans and Improvements
- New Scan: Users Created before/after X
- New Scan: Users with total storage less than X
- New Scan: Items that are public/private
- New Scan: Items modified within X days
- New Scan: Feature Services modified within X days (ArcGIS Online Only)
- New option for organization (org), group (sharing) and private options for Public/Private services and items scans
- Users that logged in within X days is now broken up into have / have not logged in
- Improved caching messages for On-Demand Scans
- node config "useMongoLogins" to track logins in LogLogins collection in MongoDB
- nodeconfig logLogin option to track logins in report/loglogins folder
- Nodeconfig option "enableHSTS" to enable HSTS support for the server.
- PFX Certificate support for HTTPS
- Customer number reporting on the license page
- Test Mail option in Mail Settings
- Additional hardware logging for troubleshooting
Fixes
- Entitlements and App bundles reworked and can be removed when contents exists or not. Note: Deleting users through Scan History will need delete content/move content confirmation.
- Delete resolution fixes for IWA
- Fix for Uncaught exception in Add Tags Resolution
- Services with Broken References: fixed issue with infinite loop due to negative indexes
- Option in the delete resolution to either delete permanently or move to recycling bin
- Fix for credential-less email option
- Fixed for App bundles and entitlements are removed when deleting a user, but not possible when deleting a user with content
- Fix for invalid scan code not displaying scheduled results
- Fix for token expiration email notifications
- IWA ArcGIS Authentication fix
- Only check token validity for allowed identities
- Fix for an issue updating custom roles assignments with the deselect all checkbox
- Fix for a login issue with custom roles
- Fix for azure mail module
- Fix for mailconfig templates
- Fix for an issue with nodeconfig parameters
- Fix for possible infinite loop on negative feature service index

Version 1.6 Release Notes

New Scans and Improvements

Scanning engine overhaul for increased speed and effficiency
New Item Scan: Items Containing the following string in their URL field
New Item Scan: Web map layers with mismatched IDs and URLs
New Item Scan: Services with or without Sync capabilities
Updated fetching for over 10,000 items
Optional Custom Role System for granular access to scanning and resolution actions
ArcGIS login authentication option
Additional Mail Options for Azure OAuth2
Capabilities checking improvement for indexed layers or empty layers or tables
Selection for titles, type and tags
Force delete for resolution items

Fixes

Fix for crash in logging
Fix for crash during check for duplicate title, type and tags scan
Fix for resolution options not available after initial fix option taken
Items not accessed in X days: Fixes for WFS and Vector Tile Service item types
Services are/are not editable: enable apply fix button
Services are/are not editable: Fixed duplicate scan pass
Fix for IWA tokens in the scanning engine
Fix for items accessed issue
Debug logging for item access, item capabitilites, editable services
Invalid licensed identities now properly end scan and report why scan was ended
Fix for crash during group caching
Fix for resolution text box issues
Fix for CSV log issues with special characters

Version 1.5.0 Release Notes

New Scans and Improvements
- New Item Scan: Web map layers with mismatched IDs and URLs
- New Item Scan: Web Maps with mismatched IDs and URLs
- New Item Scan: Code Attachments with missing parent Apps
- New Item Scan: Items Missing Access Use Contstraints (Terms of Use)
- New Item Scan: Items with blank Summary
- New Item Scan: Items with blank Credits (Attribution)
- New Group Scan: Groups with outstanding group requests
- New User Scan: Users that are invalid
- New User Scan: Users whose total storage is greater than X MB
Improvements
- Save favorite scans
- ArcGIS Login option for client page
- Weekly email for expired credentials
- Scheduled Scans: Expand Schedule Options including "First Day of the Week/Month"
- Issue notice for registered service scans that are 403 with domain proxy issues
- Delete Resolution: Added force delete workflow to delete items with delete protection
- Scan Results: Add filtering for all fields of the table
- "Case-Sensitive" toggle for Scans against specific text strings.
- Added custom header support for fetch operations
Fixes
- Registered and Hosted Services with invalid responses scan improvements for Tile MapServers
- Modify Items with duplicate Title, Tags and Type to make Tags and Type optional
- Fix for CMO nodemailer first time save crash fix
- Fix for CSV not exporting correctly for groups with duplicate group issues scan results

Version 1.4.1 Release Notes

New Scans and Improvements
- Item Scan: Service fields with improper naming conventions
- Collaborations: Users on destination collaboration group that are not in host collaboration group
- Collaborations: Users on host collaboration group that are not in destination collaboration group
- Web Maps with Broken References can now filter out layers with 0 records from results
Fixes
- User Filter: Role displaying name instead of role ID now
- Scheduled Scan: Have/Have not setting for user login setting now saves
- Mass notify now clears previous notification
- Fix for issues causing collaboration scans not to resolve
- Installation .bat file fixes for creating, editing and deleting the CleanMyOrg service
- Fix for getOwnerFolders causing failed scan
- Fix for issue with public/private service scan
- Fix for scan timeouts

Version 1.4 Release Notes

Individual Content Selection
- Select your targeted items, users, and groups to scan for quicker scans.
CSV audit files for all scans
- Download detailed csv audit files of the results of scans and their results.
Item Scans:
- Check for broken links in applications
- Items with no tags
- Check services for HTTP in URL
- Item string in fields/descriptions contains X
- Find string in a service field value
- Improvements to "Services that are not used by any Web Map" scan
Group Scan:
- Groups with setting "members can update all items" enabled
User Scans:
- Users that have no thumbnail
- Users that have no description
- User folder with no content
- Added have option to "Users that have/have not logged in within X days" scan
New Resolution Options:
- Allowlist expiration dates
- Bulk tagging issues
- Bulk delete entries
Secure client login authentication added (command-line)
- Use command line cleanmyorg setpw yourusername yourpassword in your CleanMyOrg directory.
- In your config/nodeconfig.json file, use "useSecureAuth": true, to enable password protection.
Owner field now sortable in scan results
Added service install .bat files for easier installation
Marketplace button to purchase CMO
Fixes
- Removed all external dependencies for page load
- Fix 10,000 fetch limit for ArcGIS Online
- Fix temporary parameter caching for CMOfetch
- Fix for error 400 false positives on BITEM2, better support for tile image layers
- Fix for saving appID in Managed Identities
- Fix expanded Scan Results interface issues
- Fix for Groups Pass 1 issue during group scans

Version 1.3 Release Notes

Collaboration Scans
- Groups/Workspace that are used by portal collaboration and were deleted
- Items in Host but not in receiving portals
- Items in sending portals but not in Host
Item Scans
- Services that are/are not editable
- Duplicate gallery Apps for the same Group
- Services that are private/public
Group Scans
- Enterprise Sites shared to multiple groups
- External groups with Org members
- Groups share with Everyone
User Scans
- Users that have no tags
Usability Improvements
- Improved performance for broken registered and hosted services scans
- User that have not logged in within X days now does not include users that have never logged in
- Allow notify owner email as a default notify resolution option
- Additional options for CSV Export (select fields for Export)
- WPAD proxy support
- Configurable useragent for requests
- Fixed scan history deletion issue

Version 1.2.1 Release Notes

Fix for UTF-8 encoded characters on Scan Results
Fix for issues related to bulk resolution option select on Scan Results Page
Token refresh button added for expired tokens on Manage Identity Page
Test Mail Settings button added to Mail Settings Page
Support added for Mail Settings that do not require authentication
Connection check is now run after saving Identity

Version 1.2 Release Notes

Item Monitoring Scans
- Empty Gallery Items
  This scan will look for gallery web applications and check to see if the group it is displaying has any content.
- Items that are missing delete protection
- Items that have Authoritative/Deprecated/Neither content
  Will report on all items that have either the Authoritative, Deprecated, or Neither Authoritative or Deprecated content flag.
Duplicate Item Scans
- Items with duplicate title, tags and type
- Web Maps with identical layers
  This will search all web maps and take a look at all operational and basemap layers and look for identical layers being used.
- Services with identical layers
  This will search all services and compare layers to see if there are any other services that contain the same layer names.
Duplicate Group Issue Scans
- Groups with duplicate Gallery Apps
  This scan will look for any gallery applications that are shared to multiple groups.
Client Improvements

Bulk delete for scan history
Select all on scan results
Tooltip summaries of each scan in scan settings
Delete resolution will now ask to move users content before deletion

Fixes

Improved secure service scanning for scans with broken services
Fixed log rotation crash during scans
On Demand Portal selection remembers last used
Improvements to app types for “Webmaps that are not used by any application” scan
Fixed issue with bulk allowlist on certain types
Fixes for Internet Explorer issues

Version 1.1.2 Patch Notes

Fix for Field Matching Scans
Fix for Log File Issues
Fixes for Internet Explorer

Version 1.1.1 Patch Notes

Fix for Export Scan Results

Version 1.1.0 Patch Notes

New Scans:

Items with <X% Score Completeness
Items Created Within the Last X Days
Items not assigned to any category
Items with blank description
Shared Webmaps with non-shared layers
Users that are not members of any groups
Users that have no content

Additional Features:

Bulk allowlisting of issues
Export Scan Results to CSV

On-Demand Scan

Waiting on Scan

General

Users

Groups

Items

Waiting...

Select Users to Scan

Select Groups to Scan