Chapter 6 Getting ZENworks Handheld Management 7 Working in Your Environment
This chapter provides a step-by-step walk-through of how to get ZENworks Handheld Management up and running quickly in your environment. This chapter assumes that you have previously installed eDirectory into your environment. If you are installing ZENworks into an Active Directory environment, you need to follow the information described in Chapter 2, “Installing ZENworks 7 Suite,” on how to install ZENworks in an Active Directory environment.
Before beginning this chapter, verify that you have installed the following components of ZENworks Handheld Management 7:
Handheld Management
Access Point (optional)
Desktop synchronization integration software (if you are using the desktop to hotsync your PDA device)
PDA client on the desktop
When you are sure that all these are installed, you can begin configuration.
You will most likely want to get inventory information and reports from your PDAs in the network. To get at this information you must complete the configuration of the handheld service object that was placed into eDirectory at installation time.
You can configure the service object with the following steps:
1. Open Explorer and browse to the installation directory of ZENworks Handheld Management (this is typically c:Progam FilesNovellfH) and make the ZfH directory a Windows share.
2. Launch ConsoleOne.
3. Browse to where the handheld service object was placed (it will most likely be called <HANDHELDSERVER>_ZfHService). Open the object to look at its properties.
4. Modify the Remote Path attribute to point to the ZfH share that you created in step 1. Click OK.
After this is done, you can move on to the next step of creating a handheld policy to import.
It is important to have the handheld objects imported into the eDirectory tree so that you can associate policies and applications with them, and it is possible to retrieve their inventory.
The following steps are necessary to get the import policy up and running in your ZENworks tree:
1. First make sure that you are logged in to eDirectory as admin and launch ConsoleOne.
2. Create a Handhelds container, if you are going to put them all in the same place.
3. Browse to the container where you want the handhelds import policy to be placed. This can be any container in the tree even if it is different from the Handhelds container.
4. Select the Policies container and select the Create Policy Package Wizard.
5. On the first page of the wizard select Handheld Service Package and click Next.
6. Select the container (that you defined in step 3) where you want it and click Next.
7. Select Define Additional Properties and click Finish. ConsoleOne creates the policy package and then opens the properties of that package.
8. Enable the Handheld Import policy by checking the check box and click the Properties button.
9. Select the Platforms→General tab for all PDAs, or administer different policies for each different type of device. These policies allow you to specify where you want the handheld object created (that represents the physical device), the rules the system should use to name the object, and any specifications on which groups you want the created handheld objects to be members of. After you have completed all these specifications, click OK.
10. Select the Associations tab and click Add; then browse to and select the ZENworks Handheld Service object created at installation and modified in a step 3 of the “Complete Handheld Server Configuration for Inventory” section.
After the handheld agents are installed on the handheld device, when the device attempts to perform synchronization, ZENworks will register the device and create a handheld device object in eDirectory. When that object is present, any associated applications and policies will be applied (on the next synchronization).
ZENworks Handheld Management always takes an inventory of the handheld device so that no additional inventory policy is required to be created and associated.
Now we are set on the server side and the configuration.
If your handheld devices are not going to synchronize via a desktop, the agents must be installed via your wireless synchronization point. After those agents are delivered to the device, they will connect via IP into the Access Points or directly to the ZENworks Handheld Server to get their policies and applications and to deliver their inventory.
The ZENworks Handheld Management clients and synchronization software must be installed on each of the workstations where a PDA device will be synchronizing from the cradle. Installing the agents via a group policy, login script, or other mechanisms can do this. If ZENworks Desktop Management is in the system, ZENworks can deliver these clients to the proper workstations. Proceed with the following steps to get the synchronization software and agents to the workstations via ZENworks Desktop Management:
1. Copy the Proxy directory (under a language directory of the ZENworks Handheld Management CD) to your ZfH share on the server. This is the proxy client that needs to be installed on the workstations where synchronization is done.
2. Log in as an eDirectory admin and launch ConsoleOne.
3. Browse to your Applications container, select that container, and select the Application Wizard.
4. Give the application object a name. Let’s call it Handheld Synchronization Client.
5. The path to the executable file should be a UNC path to the setup.exe file in the Proxy directory of the ZfH share you created earlier—for example, \w2003svr.zendemo.comfHProxySetup.exe. Click Next.
6. The next page asks for rules that have to be satisfied before this application is delivered to the desktop. Specify the rules that tell whether HotSync or ActiveSync is installed on the desktop.
This can be done with a rule that checks to see whether the HotSync Manager or ActiveSync programs are in the Start menu of the user. The rule can be something like
File exists(%*ProgramFiles%PalmHotsync.exe) exists OR
(File exists(%*ProgramFiles%
Microsoft ActiveSyncWCESMgr.exe) exists)
Click Next.
7. Associate the application object with all users in the system. You will probably want it to be a force run so that it will automatically install and also to uncheck the App Launcher configuration so that it will not show up on the desktop. Click Next.
8. Select Define Additional Properties and click Finish. ConsoleOne creates the application object and opens the properties of that object.
9. Select the Run Options tab and turn on the Run Application Once field. This way the application object will only be run one time and not every time the application launcher is started.
10. Click OK.
This application object will now deliver and install the Handheld Synchronization Client to those desktops with ActiveSync or HotSync installed, when the user logs in to her workstation.
If you want to also deliver the IP clients for wireless connectivity to other desktops, you can create another application object just as we did for the synchronization client and associate it with your users. The synchronization client then delivers the IP client with it.
The way we have configured this application object will launch the installer from the server, and the user will need to walk through the installation interface. If you want, you could run Snapshot to capture the install and provide this as a Microsoft Installer package (MSI) or Application Object Template (AOT) package that would remove the user interface installation. (See Chapters 10, “Creating Application Packages with snAppShot,” and 11, “Creating and Using Application Objects,” for more information on Snapshot and application object creation.)
From the previous step, you will have created an application object for the synchronization software required to run on the workstation where the handheld will run. If you have workstations that are Windows XP workstations with SP2 installed, there could be a firewall running on these workstations. ZENworks Handheld Management requires that certain ports be opened for communication between the synchronization workstation and the Access Points.
If ZENworks Desktop Management is in the system, ZENworks can deliver the proper registry key changes to the clients to open these ports and allow handheld communication. Proceed with the following steps to get the firewall ports opened properly on these workstations via ZENworks Desktop Management:
1. Log in as an eDirectory admin and launch ConsoleOne.
2. Browse to your Applications container, select that container, and select the Simple Application Wizard.
3. Give the application object a name. Let’s call it Open Handheld Firewall.
4. Leave the path to the executable file blank. Click Next.
5. The next page asks for rules. Leave the page blank and press Next.
6. Leave the associations page blank as well and press Next.
7. Select Display Details After Creation and click Finish. ConsoleOne creates the application object and opens the properties of that object.
8. Select the Distribution Options tab and then the Registry submenu from there.
9. Create the following registry keys by adding each component of the registry tree to the list and finishing with the proper key and value:
Key Tree:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices
SharedAccess
ParametersFirewallPolicyDomainProfileGloballyOpenPortsList
Value Name = Value Data
"2398:TCP"="2398:TCP:*:Enabled:ZENworks Handheld TCP"
"2398:UDP"="2398:UDP:*:Enabled:ZENworks Handheld UDP"
10. Select the Run Options tab and turn on the Run Application Once and Install Only fields. This way the application object will only be ran one time for the user.
11. Select OK to close the application object.
12. Select the application object you created above for the handheld agent and open its properties.
13. Select the Run Options tab and Application Dependencies submenu.
14. Click Add. Browse to and select the Open Handheld Firewall application object. This will cause the firewall application to be delivered any time that the synchronization client is delivered.
15. Click OK to save and close the application.
This application object will now deliver and install the registry keys required to open the firewall on the workstation. This allows the handheld synchronization client on desktops with ActiveSync or HotSync installed to communicate back to the Access Points.
You can create a handheld application object to deliver applications to the handheld device by following these steps:
1. Place the files destined for the handheld device in the ZfH share that you created. You may want to create an Apps subfolder for your files.
2. Launch ConsoleOne.
3. Browse to and select the container where you want to create your handheld application object.
4. Right-click and select New→Object from the pop-up menu.
5. Select Handheld Application from the list of available objects and click OK.
6. Enter a name for the handheld application. In this example, we call it ListDB because that is the name of the Palm application we will demonstrate. Select Define Additional Properties and then click OK.
7. Click on the Files tab.
8. Click Add to add the files. Browse to the directory and select the files that you need to deliver to the device as part of the application.
9. Click the drop-down for Destination and select what is appropriate. For the Palm, we will select Copy the Files to a Palm Device.
10. Select the Associations tab and then click Add. Browse to and select any containers of devices or a specific device. Click OK.
11. Click OK again to save the handheld application object.
Now we have an application to deliver to any new Palm devices introduced into the system. The next step illustrates how policies also can be applied.
In this step we create a handheld policy for our Palm device. You can also create policies for Windows CE or PocketPC devices as well as RIM Blackberry devices.
To create a new handheld policy and hand it out to your devices, do the following:
1. Log in as admin and launch ConsoleOne.
2. Browse to and select the container where you want to keep your policies for handhelds—it does not have to be in the container where the actual handheld objects reside.
3. Select the Create Policy Package Wizard on the toolbar.
4. Select Handheld Package on the first page of the wizard and click Next.
5. Enter a package name for the object and the container where you want this object. Click Next.
6. Click Define Additional Properties and click Finish.
7. On the Policies tab, select the device type, and enable the policy you want. For this example, enable Palm Security Policy, as shown in Figure 6.1.
8. Click on the Security tab and activate Require a Password to Be Set on the Handheld. For this example, also activate Additional Password Settings and then Enable Auto Lock Configuration On Power Off, as shown in Figure 6.2.
9. Click on the Self-Destruct tab and enable self-destruct after the specified number of failed attempts. Click OK.
NOTE
When the user fails to log in properly, immediately after the specified failed login the device will be reset and will remove all applied software and content.
10. Select the Associations tab and then click Add. Browse to and select the handheld devices or containers of handheld devices that you want to receive and enforce this policy. Click OK.
11. Click OK.
Now you have an application and a policy to deliver to your new handheld objects when they are created.
Now it is time to see whether everything works properly.
Log in to a workstation that has the ZENworks agent installed. If you are in a Windows environment, the ZENworks Management agents will automatically log in to eDirectory behind the scenes and will not prompt the user as long as the username and password for the domain are the same as the username and password for eDirectory.
Launch the Application Launcher or Explorer on the workstation, if you did not set it to automatically launch. ZENworks should display the associated applications. The Force Run installation of the Open Handheld Firewall application and the Handheld Synchronization application should happen automatically. When installed on the laptop or desktop where the device is synchronized, the clients will be automatically placed on the handheld device at the next synchronization.
Synchronize the handheld device. You should see some ZENworks Handheld Management agents being installed on the device. The first synchronization places the agents on the device.
Synchronize the device again. This time the agents will communicate with the Access Point installed on the ZENworks Handheld Server. Notice that because user associations are active for Handheld Management, you are prompted for a username and password for eDirectory. After the agents have communicated with the server, a handheld object will automatically be created in the directory along with full inventory information.
Go to the server and launch ConsoleOne. Browse to the container where you told the import policy to place handheld devices. You should see the handheld device that was just created. Look into its properties and see the general and inventory information about the device. Notice that the application and security policy has still not been sent to the device. The last synchronization just created the object.
Synchronize the Palm device yet again. This time you will see that the list application is automatically installed. You will also see that the policy is delivered—the Palm automatically prompts you for a password. Enter a password and click OK. Power off the Palm and power it back on—note that the password is now enforced on power-on of the device.
Check out the policy. Enter the correct password at the power-on prompt. Enter some addresses in the address book. Power off the Palm device. Power it back on, but enter an incorrect password the number of times you specified in the policy (default is 5). After the fifth incorrect password, enter the correct one. Notice that the address book is empty, and the list application is gone. Reset and synchronize to restore your Palm device.
Go to the server and look at the properties of the Palm device. Click on the ZENworks Inventory tab and click the Advanced Inventory button at the bottom. Another inventory tool opens up and shows you the full details of the handheld scan as shown in Figure 6.3.
From this Advanced Inventory view you can create and run reports. From the menu, select Reports→Software Inventory→Applications→For a Client, for example. Select the Palm device that was just imported and click OK. This brings up the report for that handheld device as illustrated in Figure 6.4.
Congratulations! You have now successfully installed ZENworks Handheld Management, delivered applications and policies, and run an inventory report.