Security. Workplace Manager

Transcription

1 User Gude Manageablty and Securty Workplace Manager

2 Congratulatons on your purchase of an nnovatve product from Fujtsu. The latest nformaton about our products, tps, updates etc. can be found on the Internet at: For drver updates, go to: If you have any techncal questons, please contact: our Hotlne/Servce Desk: your authorzed dstrbutor your sales offce We hope you enjoy workng wth your new Fujtsu product.

3

4 Publshed by Fujtsu Technology Solutons GmbH Mes-van-der-Rohe-Straße Munch, Germany Contact Copyrght Fujtsu Technology Solutons All rghts reserved. Edton date 08/2016 Edton 4

5 Workplace Manager User Gude About ths manual 1 The Workplace Manager concept 3 Overvew Components of Workplace 5 Manager and Workplace Protect Install Workplace Manager 6 Workplace Protect nstall managed 15 mode on the computers n the network Start Workplace Manager 18 Confgure Workplace Manager (frst tme) 20 SystemLock management 31 Job management 52 Workplace Manager Settngs 83 Glossary 87 Index 91

6 Remarks Notes on the product descrpton are consstent wth the desgn specfcatons from Fujtsu and are made avalable for comparson purposes. The actual results may dffer because of several factors. Techncal data s subject to change wthout notfcaton. Fujtsu does not accept any responsblty for techncal or edtoral errors or omssons. Trade marks Fujtsu and the Fujtsu logo are regstered trademarks of Fujtsu Lmted or ts subsdares n the Unted States and other countres. Mcrosoft and Wndows are trademarks or regstered trademarks of Mcrosoft Corporaton n the Unted States and/or other countres All other trademarks mentoned here are the propertes of ther partcular owner. Copyrght No part of ths publcaton may be coped, reproduced or translated wthout prevous wrtten permsson from Fujtsu. No part of ths publcaton may be stored or transmtted n any electronc manner wthout wrtten permsson from Fujtsu.

7 Contents Contents About ths manual... 1 Notatonal conventons... 1 The Workplace Manager concept... 3 Install Workplace Manager... 6 Requrements... 6 Set up the database server... 7 Set up the database server... 7 Install the Workplace Manager software... 8 Install Workplace Manager Cockpt under Wndows Installng Workplace Manager Cockpt Connectng the Workplace Manager Cockpt to the server Set frewall Update and repar Workplace Manager Workplace Manager versons/compatblty Unnstall Workplace Manager Unnstall the Workplace Manager Software Unnstall database server Workplace Protect nstall managed mode on the computers n the network Requrements Workplace Manager and Workplace Protect Install on the managed computers n the network Workplace Protect managed mode n Workplace Manager Unnstall managed computers n the network Start Workplace Manager Requred nput durng the frst start Overvew Workplace Manager User Interface Confgure Workplace Manager (frst tme) Import computers Group Computers Group Management Edt statc and dynamc groups Computer propertes Automatc update of computer detals Dsplay computer detals Lcensng Purchase lcences Actvate lcences Allocate lcences to computers n the network Handlng regstraton problems SystemLock management SystemLock concept System requrements SmartCard Puttng SystemLock nto operaton and admnstratng General procedure Actvaton of SystemLock management n the Workplace Manager Organsatons and groups Create organsatons Create groups Fujtsu

8 Contents Assgn a computer to a SystemLock group...39 Import/add users...41 SmartCard types...42 Confgure/wrte SmartCard types...43 SystemLock job settngs (BIOS settngs)...45 Change SystemLock settngs...48 Unnstall SystemLock on the Computer...48 Unlock SmartCard PIN...49 Unlock SystemLock PC...49 Job management...52 Workplace Manager Versons and Job Compatblty...53 Settng up BIOS admnstraton...53 Create/change/delete BIOS confguraton lst...55 Create BIOS confguraton lst from a (master) computer...56 Easy PC Protecton...57 Requrements for the use of Easy PC Protecton...57 Implementaton of the Easy PC Protecton functon...58 Certfcate settngs...59 Schedule settngs...60 Execute job...61 Change schedule settngs...63 Change log n methods...63 Set up allowed applcatons...65 Defne presence sensor settngs...67 Auto BIOS Update...68 Make BIOS updates avalable...69 Allocate BIOS updates to computers...70 Show the user BIOS update messages...70 Setup Auto BIOS Update...71 Set BIOS password...72 Set BIOS user password...74 Set hard dsk password...75 Password on boot settngs...77 Advanced Face Recognton...78 Lcences...78 Advanced Face Recognton lcensng...79 Job-Hstory / Delete jobs...80 Workplace Manager Settngs...83 Set language and port...83 TFTP Server...84 Settng up the TFTP server...84 Glossary...87 Index...91 Fujtsu

9 About ths manual About ths manual Ths manual s ntended for all persons n your company who perform system management tasks (system admnstrators, servce personnel). The nstallaton of the Workplace Manager, the nstallaton of the extensons and the ndvdual components are descrbed n ths manual. Notatonal conventons! Pay partcular attenton to texts marked wth ths symbol. Falure to observe ths warnng destroys the system, or may lead to loss of data. The warranty wll be nvaldated f the system becomes defectve through falure to take notce of ths warnng. Indcates mportant nformaton whch s requred to use the system properly Ths font Ths font Ths font "Ths font" Indcates an actvty that must be performed Indcates data entered usng the keyboard n a program dalogue or command lne, e.g. your password (Name123) or a command used to start a program (start.exe) Indcates nformaton that s dsplayed on the screen by a program, e.g.: The nstallaton s complete. Indcates product names, nternet addresses and the names of system components. Indcates names of chapters and terms that are beng emphassed. Representaton and spellng of command lnes The followng specal characters are used n command lnes: [] Optonal parameters <> Varables {} Optonal varables Parameters that can be used as alternatves Parameters and varables are allowed n uppercase, lowercase, or a combnaton of both. The values of varables can be entered wth or wthout quotaton marks. Fujtsu 1

10 About ths manual About Workplace Manager Workplace Manager s a software whch makes t easy for you to enter securty settngs for computers n a network. Workplace Manager provdes the followng functons: Set up accesses n a network Centrally manage the securty settngs n a network. The software and ths manual are ntended for network admnstrators n small to medum-szed networks. Workplace Manager conssts of the followng components: Component Workplace Manager Cockpt Fujtsu Workplace Manager Server Workplace Manager Database Fujtsu Workplace Manager Clent (alternatvely referred to as: Workplace Protect n managed mode) Bref descrpton The "My computer" of the admnstrator. Used to confgure Workplace Manager. Is automatcally nstalled on the Workplace Manager Server. Optonal nstallaton on a computer n the network wth operatng system Wndows 10 s possble. The server software Manages the computers, lcences and settngs n the network where Workplace Manager s nstalled Software whch runs on the managed computers n the network on whch Workplace Manager s nstalled You wll fnd a detaled descrpton of the components below. 2 Fujtsu

11 The Workplace Manager concept The Workplace Manager concept There are many dfferent computers n your network, whch you wsh to admnster usng Workplace Manager. You need to mport these computer detals nto Workplace Manager and then group them together for admnstraton purposes. After the mport, the Workplace Protect - managed mode program must be dstrbuted to the computers n the network. Computers n the network cannot be managed wth Workplace Manager wthout lcences. It s therefore necessary that you purchase lcences, actvate them and allocate them to computers n the network. Three test lcences are avalable free for test purposes. You can allocate jobs to the computer groups n the network f the Workplace Manager s set up accordngly: You can determne how your users should log n on ther computers, accordng to the equpment on the computer e.g. by fngerprnt, password or SmartCard. You can permt the use of a safe for passwords and the use of an encrypted data fle drectory. You can determne the actons when the user s present and when absent f a presence sensor s nstalled. You can defne passwords for the hard dsks and the BIOS. The user can also log nto the system by face recognton, f addtonal lcences are avalable and the computer s set up accordngly. Mult-factor authentcaton s one of the most mportant man functons. It ncreases IT securty n a network and guarantees that a user s actually the user he says he s. The more factors are used to determne the user's dentty, the greater the level of securty regardng genune authentcty. Management of the SystemLock pre-boot authentcaton soluton, whch s ntegrated n the BIOS (as an order opton), s another man functon. If SystemLock s actvated on the computer, t can then only be booted wth an ntalsed SmartCard (CardOS) and personal dentfcaton number (PIN). The SmartCard and PIN are checked n the BIOS durng system boot,.e. before the operatng system starts. You can carry out the followng tasks centrally n SystemLock-Management: Actvate/deactvate the pre-boot authentcaton SystemLock-capable computers n your network. Determne the SystemLock settngs Create access SmartCards wth dfferent authorsatons Create and admnster SystemLock organsatons and groups Unlock PINs Unlock computers Fujtsu 3

12 The Workplace Manager concept Settng up Workplace Manager and workng wth Workplace Manager can be llustrated as follows: 4 Fujtsu

13 The Workplace Manager concept Overvew Components of Workplace Manager and Workplace Protect Fujtsu 5

14 Install Workplace Manager Install Workplace Manager The nstallaton proceeds n two steps: Set up the database server Install the Workplace Manager software The nstallaton package for Workplace Manager s found on the nternet at You need admnstratve rghts for the nstallaton. The database server and the Workplace Manager software must be nstalled on the same computer. Requrements Hardware SmartCard reader, f SystemLock s to be worked wth Operatng system Wndows Server 2012 Standard R2, 64 Bt Software Mcrosoft.NET Framework 4.5 (s nstalled together wth Workplace Manager f necessary) Mcrosoft SQL Server 2012 Servce Pack 1 (SP1) Express You can download the software from the Mcrosoft Download Centre. Internet access You need Internet access to actvate the Workplace Manager lcences. 6 Fujtsu

15 Install Workplace Manager Set up the database server A database server nstance wth the name WPMDATABASESVR must be nstalled. The nstance must be set up wth SQL authentcaton. The bass s the Mcrosoft SQL Server 2012 data admnstraton system The password set up here wll be needed later durng nstallaton of the Workplace Manager software. For set up and nstallaton, you can also adapt the sample fles ncluded n the nstallaton package (folder SQLPrepare) to your envronment and requrements. The sample batch fle nst_wpm_dbs.bat nstalls Mcrosoft SQL Servers 2012 Express and uses data from the fle ConfguratonFle_SQL2012.n to set up the Workplace Manager data base nstance wth the name WPMDATABASESVR. Please read the correspondng Mcrosoft documentaton for addtonal nformaton about nstallng Mcrosoft SQL Server. Installaton drectory n the fle nst_wpm_dbs.bat In the sample batch fle nst_wpm_dbs.bat, change the path to the SQL server package and remove the exstng rem comment nstructons n front of the path specfcaton. Important: In the batch fle you must use the absolute path to the confguraton fle. Adapt the path specfcaton accordng to your settngs. Passwords n the fle ConfguratonFle_SQL2012.n The settngs from the sample fle ConfguratonFle_SQL2012.n are used when settng up the server. Adapt the fle ConfguratonFle_SQL2012.n to your envronment. For nstance, change the predefned password (SAPWD=PWD1). Important: Wrte down all the settngs, entres and the password and put these away n a safe place. You wll need the password durng nstallaton of the Workplace Manager software or f you have to update or repar Workplace Manager. Set up the database server Start the set up of the database server by callng the fle nst_wpm_dbs.bat. Settng up the database server can take from 5 to 20 mnutes dependng on the computer system. In the next step, the Workplace Manager software s nstalled wth the admnstraton nterface (Cockpt), the server servces and the database. Fujtsu 7

16 Install Workplace Manager Install the Workplace Manager software To nstall the Workplace Manager software, proceed as follows: Double-clck on the fle WorkplaceManager_Setup.exe. The wzard for nstallng the Workplace Manager s started. Read and accept the lcence terms n the Lcence Agreement wndow. The Database Server wndow s opened, n whch you enter the parameters necessary for creatng a connecton to the database server. Select the database server (local)\wpmdatabasesvr. Enter the username and assocated password. You defned the password when nstallng the database server (see page 7). The name of the database catalog s WPMDatabase. No change s possble. Confrm your entres wth Next. An error message appears f the selected database server does not exst. 8 Fujtsu

17 Install Workplace Manager The Server-Clent communcaton wndow appears, n whch you can defne the ports for communcaton wth the computers n the network on the server and confgure the computers n the network. The name of the Workplace Manager server on whch the current nstallaton s runnng s dsplayed. The pre-set standard values 3298 for the Server Port (TCP) and the Clent Port (TCP) can be changed f necessary. Make sure that the ports defned here have been unblocked n your nstalled frewall (see followng secton page 10). You must specfy the ports assgned here and the name of the Workplace Manager Server durng the nstallaton of Workplace Protect. Confrm your entres wth Next. Fujtsu 9

18 Install Workplace Manager Regster the password for database encrypton n the next wndow Database Encrypton: Enter the password (at least 5 characters). Repeat the password entered to confrm t. Important: Keep ths password n a safe place. The password and database are encrypted. Wthout the password, update or repar nstallaton of the Workplace Manager software s not possble. If the password s not known, the database must possbly be reset meanng that all the settngs and the nformaton wll be lost. Confrm your entres wth Next. All the requred confguraton data has now been specfed. A wndow appears, n whch the actual nstallaton process s started. Clck on Install to start the nstallaton process. A message appears when the nstallaton process has completed successfully. Install Workplace Manager Cockpt under Wndows 10 Durng nstallaton of Workplace Manager, the graphcal user nterface (Workplace Manager Cockpt) s automatcally nstalled on the server. The Workplace Manager Cockpt can also be nstalled on the admnstrator's computer f operatng system Wndows 10 (64bt) s nstalled. Wth ths type of nstallaton, the network can be managed easly wthout swtchng computer workstaton and wthout a remote connecton to the server computer. A connecton to the Workplace Manager Server s establshed va the admnstrator's computer. 10 Fujtsu

19 Install Workplace Manager If several admnstrators are usng the Cockpt at the same tme, they must mutually agree the jobs. The most recently submtted job overwrtes the prevous jobs. Installng Workplace Manager Cockpt Workplace Manager Cockpt Durng nstallaton of the server, the WPMAdmnstrators user group s set up automatcally and the user, who s nstallng the server, s entered as a user. The admnstrator, who wll n future admnstrate Workplace Manager va the Cockpt on a Wndows 10 computer, should be added to ths user group. The verson of the Cockpt on the Workplace Manager Server must be the same as the verson on the computer wth Wndows 10. To nstall the Workplace Manager Cockpt software on a computer wth Wndows 10, proceed as follows: Double-clck on fle WorkplaceManager_Setup.exe, whch you also used to nstall the server. The wzard for nstallng Workplace Manager s started. Read and accept the lcence terms n the Lcence Agreement wndow. Clck on Next to start the nstallaton and nstall the graphcal user nterface. Connectng the Workplace Manager Cockpt to the server To connect the Cockpt on the Wndows 10 computer to the Workplace Manager Server, proceed as follows durng ntal start-up or followng a change of server address or port. Start the Workplace Manager Cockpt usng the admnstrator role. Clck on Applcaton settngs. Enter the server address and the port number. Clck on OK. The connecton to the server s establshed. In the Logn Workplace Manager Admnstrator wndow, clck on Logn Enter the doman name, user name and user password. Ths user data must be stored on the server n the WPMadmnstrors user group. Confrm wth OK. The programme s started. Fujtsu 11

20 Install Workplace Manager Set frewall The followng example for the Wndows frewall shows the actvaton of the ports wth the standard value of 3298 for the server port and the clent port. Smlar settngs apply to other frewalls. The example s executed n the command lne n "Admnstratve Mode": Set myport=3298 netsh advfrewall frewall add rule name="workplace Manager ncomng" dr=n acton=allow protocol=tcp localport=%myport% remoteport=any netsh advfrewall frewall add rule name="workplace Manager outgong" dr=out acton=allow protocol=tcp localport=%myport% remoteport=any Update and repar Workplace Manager Important: Backup the Workplace Manager database before performng an update. The nstallaton package for Workplace Manager can be found on the Internet at An update and repar nstallaton s carred out much lke the nstallaton of the Workplace Manager software. Assgnment of the password for the database encrypton s the only dfference, the password cannot be reassgned. Follow the nstructons as descrbed above n chapter "Install the Workplace Manager software ", page 8. Enter the database encrypton password that you assgned durng nstallaton. A message appears when the nstallaton process has completed successfully. 12 Fujtsu

21 Install Workplace Manager Workplace Manager versons/compatblty The Workplace Manager modules (features) are contnuously beng further developed. Therefore, durng nstallatons and job creaton, you must always note whch module s possble wth the Workplace Manager versons or feature set. The followng table provdes an overvew: Functon Workplace Manager 1.10/Feature set Workplace Manager 1.11/Feature set Workplace Manager 1.21/Feature set Easy PC Protecton Logn methods (*) Enabled applcatons Presence sensor Auto BIOS Update Hard dsk password BIOS password SystemLock BIOS user password Password request durng boot The feature set s dsplayed n the computer propertes. Ths allows you to see whether the clent supports a specfc feature. You must decde whether you have to update the clents. Example: You cannot use Workplace Manager 1.21 to adjust the logn methods on computers n the network wth Workplace Protect Workplace Protect 1.21 (feature set 3) or hgher must be nstalled on the computers n the network or you must forego the Workplace Manager update. Support of feature numbers by clent versons: 1 => WPP => WPP 1.11, 1.12, => WPP 1.21 (logn wth mult-factor authentcaton) Fujtsu 13

22 Install Workplace Manager Unnstall Workplace Manager Unnstall the Workplace Manager Software Unnstall Workplace Manager as software usng the tools of your operatng system. The data n the Workplace Manager database s not deleted. If the encrypton password s known, you can access the data agan by renstallng. BIOS settngs that you have made usng Workplace Manager (e.g. passwords, settngs, SystemLock, Auto BIOS Update, Easy PC Protecton) wll not be reset durng the unnstall. Unnstall database server You can remove the database when you ensure that SystemLock s no longer actvated on the computers n the network. Unnstall the Workplace Manager database usng your operatng system tools or Mcrosoft SQL Server Fujtsu

23 Workplace Protect nstall managed mode on the computers n the network Workplace Protect nstall managed mode on the computers n the network After nstallaton of the Workplace Manager software and mport of the computers (see page 20) the Workplace Protect - managed mode program must be dstrbuted to the computers n the network. Dependng on the operatng system, use the 32 bt or the 64 bt verson of the software. Ensure that all computers that should be managed are vsble n the group All computers (see chapter "Import computers", page 20). The nstallaton requres admnstratve rghts. Requrements Please read the release notes for Workplace Protect, these may contan more up-to-date nformaton than ths manual. Hardware Fujtsu computer, see FeatureFnder on the Internet at (search term Workplace Protect). SmartCard readers, f SmartCards are to be processed (e.g. for SystemLock). Bometrc devces on the computers n the network where logn s requred wth fngerprnt, face or palm recognton. Operatng system Wndows 7, Wndows 8.1 (32 bt or 64 bt) and Wndows 10 (64 bt) wth the current patches for the operatng system. Fujtsu drvers You must ensure that the latest Fujtsu drvers for bometrc devces and the SmartCard reader as well as current BIOS versons are nstalled on the computers so that they operate correctly. Internet access Internet access s requred to actvate lcences for face recognton. Fujtsu 15

24 Workplace Protect nstall managed mode on the computers n the network Workplace Manager and Workplace Protect Ths manual descrbes the current verson of Workplace Manager. If you have used a prevous verson, you should upgrade the computers n the network to the latest verson of Workplace Protect. You wll fnd detals concernng ths n the release notes for Workplace Manager and Workplace Protect. In Group Management you wll fnd a group whch provdes you wth a lst of the Workplace Protect computers n the network whch need updatng. Install on the managed computers n the network Installaton on the managed computers n the network causes Workplace Manager agents and an enhanced logn mechansm (Wndows Logn) to be nstalled. These support face recognton, SmartCards, palm recognton (PalmSecure TM ) and password entry. The Pcture Password (Wndows 8 and Wndows 10) and PIN Password (Wndows 8) logn methods are deactvated. To dstrbute the program, use the procedure that s general practce n your network. The followng example shows an unattended dstrbuton of the software to the computers n the network. The unattended nstallaton s executed automatcally. Nothng needs to be entered n the dalog boxes. The followng command s entered n the command lne (%WPM_HOSTNAME% must frst be replaced by the name of the server on whch the Workplace Manager s nstalled): WorkplaceProtect64_Setup.exe /s /v"/qn WPM_MANAGED=1 WPM_HOSTNAME=%WPM_HOSTNAME% WPM_SERVERPORT=3298 WPM_CLIENTPORT=3298 REBOOT=ReallySuppress" The nformaton means the followng: Command/nformaton Descrpton WPM_MANAGED=1 Command to the Setup to nstall a Managed Clent. WPM_HOSTNAME Name of the server on whch the Workplace Manager s nstalled. WPM_SERVERPORT Value of the server port whch was assgned durng the nstallaton (standard value 3298). WPM_CLIENTPORT Value of the clent port whch was assgned durng the nstallaton (standard value 3298). REBOOT=ReallySuppress Suppresses a restart of the managed computer after nstallaton. If you have already nstalled a prevous verson of Workplace Protect, you can also use the upper command lne for the update. Please note that the ports are confgured as wth the predecessor nstallaton. 16 Fujtsu

25 Workplace Protect nstall managed mode on the computers n the network Regster the computer at Fujtsu Workplace Manager Server f the software on the computer s nstalled n the network. The computers whch have been regstered on the server are dsplayed after an mport of the computers (see page 20) n the workng area Group Management (see page 21). Computers wth whch there are problems when regsterng on the server are recorded n the Regstraton Problems lst (see page 29). Ths completes the nstallaton of the managed computers n the network. Please make sure that users restart ther computers after nstallaton. Recommendaton: Installaton at nght and restart afterwards. Workplace Protect managed mode n Workplace Manager If Workplace Protect s nstalled as a local verson on a computer n the network, ths verson s converted nto a managed mode of Workplace Manager by the nstallaton descrbed above. In ths verson, the user at the computer n the network can no longer enter all the usual settngs. The recordng of bometrc data and the use of the Encrypted Contaner and Password Safe are allowed (f ther use s not ruled out by the admnstrator). You wll fnd more nformaton about these functons n the Workplace Protect manual. The followng settngs are assgned: Lock the computer when the SmartCard s wthdrawn. Ths settng can be changed va a Wndows Group Polcy. The password settngs are pre-set n the Workplace Manager so that Workplace Protect remembers the authentcaton password for the entre sesson of Workplace Protect. Unnstall managed computers n the network Access to the Encrypted Contaner or the Password Safe s not possble after unnstallng the Workplace Protect on the computers. Therefore tell your users to make a note of the passwords from the Password Safe and that they should back up the data from the Encrypted Contaner before unnstallng Workplace Protect on the computers. Fujtsu 17

26 Start Workplace Manager Start Workplace Manager Requred nput durng the frst start You wll be asked for the doman, user and password durng the frst start. If a user dfferent from the one who created the database should also be able to use Workplace Manager, ths user must be added to the WPM Admnstrators group. Ths user can also logn wth ther own user data. Overvew Workplace Manager User Interface The wndows n the Workplace Manager are always set up n a smlar way: Fujtsu

27 Start Workplace Manager 1 Informaton about the current verson and nstructons about the Open Source lcences used. 2 Access to the onlne manual 3 Settngs 4 Navgaton area 5 Workng area Area/Symbol Navgaton area Workng area Descrpton Conssts of 2 to 3 areas n whch you navgate or select job and management tasks Dsplays nformaton and contans functons for the opton selected n the navgaton area. Dsplays the current software verson Onlne manual Settngs (See "Workplace Manager Settngs", page 83) Fujtsu 19

28 Confgure Workplace Manager (frst tme) Confgure Workplace Manager (frst tme) You have set up the Fujtsu Workplace Manager Server (see page 7), nstalled the Workplace Manager software (see page 8) and dstrbuted the software program Workplace Protect managed mode to the computers (see page 21). The followng descrbes whch steps are necessary to confgure Workplace Manager for frst tme use. Import computers There are a number of dfferent computers n your network whch you wsh to admnster usng Workplace Manager. You must mport these computers: for the frst work wth Workplace Manager always, when new computers are added to your network. Computers whch experenced problems wth regstraton on the server are recorded n the lst of "Regstraton Problems" (see page 29). Select the opton Group Management n the lower navgaton area. Start the mport wth the context menu Import computers under the entry System Groups n the upper navgaton area or wth the Import button n the workng area. The Import computers wndow s opened. Select the opton Actve Drectory. Enter the requred nformaton (logn nformaton of the user who s allowed to read the Actve Drectory) and clck on the button Start. If you do not wsh to select all the computers from the Actve Drectory, you can enter the startng characters of the name or the desred name exactly at Flter for computer name. You can use "*" as a wldcard (e.g. enter PC12* to fnd all computers whose names start wth PC12). Computers whch are deactvated n the Actve Drectory are not selected. The mported computers are dsplayed n the group All Computers. 20 Fujtsu

29 Confgure Workplace Manager (frst tme) Group Computers Group Management The mported computers n your network are dsplayed wth the opton Group Management/All Computers n the workng area. Groups can be created and changed only n Group Management. The groups are also vsble n Job Management but cannot be edted there. Group names must be unque. You can sort the computers by clckng once n the column headng (e.g. wth Added, by the date on whch they were mported). You can use the correspondng functons n the navgaton area to dsplay the mported computers n the followng groups: System groups The computers n the network are automatcally allocated to the followng fxed groups. You cannot change the allocaton. Regstered Computers whch have been regstered wth the Workplace Manager Lcenced Computers for whch Workplace Manager Clent lcences were assgned. Unlcenced Computers on whch no jobs can be executed snce they are not lcenced. Fujtsu 21

30 Confgure Workplace Manager (frst tme) Statc groups Dynamc groups SystemLock groups Computers to update Computers on whch the prevous verson of Workplace Protect s nstalled and whch therefore must be updated. You can group computers accordng to specfc organsatonal crtera, e.g. all computers n a certan buldng or n a certan user group. Jobs for these groups wll be of a more organsatonal nature. You can flter computers n the network accordng to certan equpment features and group them together, e.g. all computers wth fnger sensor. Jobs for these groups wll be system-dependent, e.g. logn methods Reference to the groupng for SystemLock s made n chapter Create groups, page 38. To execute a job wth Workplace Manager, the computers must be allocated to a statc or dynamc group. Group the ndvdual computers accordng to partcular crtera, e.g. locaton, model or equpment features. Group names must be unque. Edt statc and dynamc groups How to create a statc or dynamc group Mark the Groups entry n the dsplay area and call up the context menu. Select Add new dynamc group or Add new group and enter the name you wsh to gve to the group. How to group the computers n your network Mark the entry Groups n the dsplay area and call up the context menu. Select Add new group and enter the name you wsh to gve to the group. Mark the desred computers and drag these nto a system group or a group created by you. 22 Fujtsu

31 Confgure Workplace Manager (frst tme) How to arrange the computers nto dfferent groups Mark the desred computer n another group Drag the computer nto the desred group. The computer s coped and s now avalable n the dfferent groups. How to allocate a computer to a new group Mark the desred computers and call up the context menu. Select Add to new group. A new group s created, to whch the marked computer s added. Enter a meanngful name for the group. How to copy a group Mark the group whch you want to copy and call up the context menu. Select Copy and enter the desred name. How to rename a group Mark the group whch you want to rename and call up the context menu. Select Rename and enter the desred name. How to delete a group Mark the group whch you want to delete and call up the context menu. Select Delete from group and confrm wth OK. The computer s deleted from the group. How to delete a computer from the system SystemLock must be deactvated. Mark the computer whch you want to delete from the desred group and call up the context menu. Select Delete from system and confrm wth OK. The computer s removed from the Workplace Manager admnstraton. Fujtsu 23

32 Confgure Workplace Manager (frst tme) Defne and change flters for dynamc groups How to create flters for dynamc groups Flters allow you to group together computers whch share certan equpment features, e.g. a specfc BIOS verson. The followng flters are avalable: And/or You can specfy one or more crtera whch must occur or whch can occur as alternatves. Inventory property Equpment feature that a computer must possess (e.g. BIOS verson, hardware equpment) Operator Defnes whether or not the defned value must be fulflled (equal to or not equal to) Value Values that can be fulflled (e.g. Manufacturer Fujtsu) are dsplayed accordng to the selected Inventory property. Deletes the flter element. Select the dynamc group whose flter you want to defne. Defne the flter crtera that a computer must meet n order to be dsplayed n the dynamc group. Clck on Save flter and apply. The computers that match the flter crtera are dsplayed n the work area. How to add new flter crtera Select the dynamc group whose flter you want to change. Double-clck n the last blank row. The already defned crtera are dsplayed. Add the desred crtera. Clck on Save flter and apply. The computers that match the flter crtera are dsplayed n the work area. 24 Fujtsu

33 Confgure Workplace Manager (frst tme) How to change a flter crteron Select the dynamc group whose flter you want to change. Double-clck on the lne of the flter crteron you want to change. The already defned crtera are dsplayed. Change ths crteron. Clck on Save flter and apply. The computers that match the flter crtera are dsplayed n the work area. How to delete a flter crteron To delete a flter crteron, clck on the symbol n the flter crteron lne. The lne s deleted. Clck on Save flter and apply. The computers that match the flter crtera are dsplayed n the work area. Applyng flters If a dynamc group s open, the flters are automatcally updated when a computer n the network sends updated data. If you clck on Save flter and apply, the computers n the network are fltered agan and dsplayed n the work area. Computer propertes Automatc update of computer detals If a computer s regstered n the Workplace Manager, the computer regularly synchronses ts propertes wth the propertes saved on the server. If somethng has been changed on the computer, e.g. BIOS Update, the new data s sent to the server and saved. Dsplay computer detals If you requre more detaled nformaton about a computer on the network, you can have ths nformaton dsplayed. Clck on the group you want n Group management. The computers of the group are dsplayed n the workng area. Clck on the computer you want n the Computer overvew lst. A wndow wll open dsplayng the detals of the selected computer. The assgned passwords are dsplayed on the Inventory data tab. Fujtsu 25

34 Confgure Workplace Manager (frst tme) Lcensng A lcence authorses the admnstraton of a computer n the network wth Workplace Manager. It s therefore necessary that you purchase lcences, actvate them and allocate them to computers n the network. Please use the three test lcences delvered to test the admnstraton wth Workplace Manager. These can be assgned once for test purposes. The lcence keys acqured and the allocaton of lcences to computers n the network are admnstrated usng lcence management (Opton Lcence Management n the navgaton area). Only computers on whch the software Workplace Protect managed Mode s nstalled and have been regstered at Fujtsu Workplace Manager Server after nstallaton can be lcensed (see page 21). In order to actvate lcences, t s necessary that the server can access the Internet. A specfed lcence can no longer be deleted and used n another Workplace Manager nstallaton. 26 Fujtsu

35 Confgure Workplace Manager (frst tme) Purchase lcences Or Purchase the necessary lcences from your servce partner. Open the lnk Clck here to go to the onlne shop and follow the nstructons on the screen. If you have purchased a lcence, you wll receve an emal wth an actvaton code at the emal address specfed. Save the emal n a secure place. Fujtsu 27

36 Confgure Workplace Manager (frst tme) Actvate lcences You must actvate the purchased lcences n the workng area Lcence actvaton. Enter the actvaton code whch you have receved by emal. Identfy yourself wth the name and emal address whch you gave durng purchase. If necessary you must specfy the proxy settngs. Fnalse your entres by clckng on the button Add new lcence. The lcence codes purchased and actvated are dsplayed n the workng area under Regstered lcences. Allocate lcences to computers n the network The lcences are lnked to the server. Ths means that the lcences or seral numbers of the computers whch are processed on the server cannot smply be used on another server. Tp: After each lcensng save the LIC fle (n the nstallaton drectory of Workplace Manager under \Lcense\WorkplaceManager.lc). An exstng LIC fle s taken nto account durng a renstallaton of the server on the same computer wth the matchng seral number. Please use the ncluded 3 test lcences to test the admnstraton wth Workplace Manager. These can be assgned once for test purposes. Snce verson 1.11, lcences whch have been assgned once can be assgned agan f the earler already lcenced system no longer exsts n the network. Durng deleton of the already lcenced system, the lcence s released agan and s avalable for lcensng of new computers n the network. Select the opton Lcence management / Lcensng n the navgaton area. In the lst of unlcenced computers, mark those whch you want to lcence. Clck on the Lcensng button. The selected computers are lcenced. 28 Fujtsu

37 Confgure Workplace Manager (frst tme) Handlng regstraton problems In the lower navgaton area, select the opton Regstraton problems. Computers wth whch conflcts have occurred durng regstraton are dsplayed n the workng area. Computers are recorded n the problem lst for the followng reasons: Durng regstraton, the computer has reported a seral number whch s already n use by another regstered computer. Possble cause: The computer was renamed n the Actve Drectory and the regstraton was restarted. Important: If the computer whch had used the seral number was already lcensed, ts lcence wll be allocated to the new computer when t s approved. An already regstered computer reports wth a dfferent seral number. Possble cause: Hardware was changed n the computer and the regstraton was restarted. If an already lcenced computer s recorded n the problem lst due to a seral number conflct (new regstraton of the computer wth the same computer name, but dfferent seral numbers) and f t s authorsed for re-regstraton, ts lcensng s nvald. The computer must be lcenced agan for further admnstraton. Fujtsu 29

38 Confgure Workplace Manager (frst tme) Computer models whch are locked for admnstraton wth Workplace Manager (unsupported model). A computer whch has not yet been mported has tred to log n. Possble cause: The computer tres to log n before t was mported by the Actve Drectory. Possble cause: A known computer was renamed n the Actve Drectory and the regstraton was restarted, but the computer has not yet been mported nto the Workplace Manager. As a result the computer s not recognsed by the system (fully qualfed name s not known). To resolve the problem You have two ways of handlng problematc computers: Allow: The computer s prepared for re-regstraton and a re-regstraton s ntated on the computer. The seral number, regstraton status, model and f necessary lcensng (only wth seral number conflct) are reset when preparng the computer. Deny: The problematc computer s removed from the problem lst, but wll be re-entered nto the lst f t tres to regster tself agan. 30 Fujtsu

39 SystemLock management SystemLock management SystemLock s the pre-boot authentcaton soluton from Fujtsu, whch s ntegrated nto BIOS (as an order opton). If SystemLock s actvated on a computer, t can then only be booted wth an ntalsed SmartCard (CardOS) and personal dentfcaton number (PIN). The SmartCard and PIN are checked n the BIOS durng system boot,.e. before the operatng system starts. You can carry out the followng tasks centrally on the admnstrator console n SystemLock Management: Actvate/deactvate the pre-boot authentcaton SystemLock-capable computers n your network. Determne the SystemLock settngs Create access SmartCards wth dfferent authorsatons Create and admnstrate SystemLock Organsatons and SystemLock Groups! Wth ncorrect settngs and n some crcumstances, you can rrevocably lock ndvdual computers or networks n SystemLock. Please read the followng descrpton closely and follow the nstructons descrbed. SystemLock concept You can defne access rghts wth SystemLock and wrte on SmartCards whch enable or deny user access to partcular computers n your network. The ndvdual computers are allocated to an organsaton, n whch dfferent groups are defned. A computer can only be allocated to one group of ths organsaton. A user who has the SmartCard for ths group has access to all computers whch are n ths group. You can also allocate a sngle computer just to ts own "Group". A "Sngle Group" s referred to when allocatng a computer just to ts own group. In that case, the name of the computer must also be the name of ths sngle group. You create a personal computer n the lteral sense wth ndvdual groups, wth whch an ndvdual user has access to "ther own" PC wth the rght SmartCard. If you duplcate ths SmartCard and pass t on to other users, you can also create a scenaro n whch several users share just one computer. If a computer s allocated to a group whch s not an ndvdual group, there are normally several computers whch belong to ths group. All users who possess a SmartCard for ths group can access any computer of ths group. Hence for example, fve users can share three computers or one user can access just fve computers. Fujtsu 31

40 SystemLock management 32 Fujtsu

41 SystemLock management System requrements Computer: The SystemLock must have been requested wth the computer otherwse the functons are not ncluded n the BIOS of the computer. Please contact your Fujtsu contact person to check whether a subsequent acquston of SystemLock s possble on your systems. SmartCard: The followng SmartCards are supported by the SystemLock manager: Smartcard CardOS V 4.4 and SIEMENS Smartcard CardOS V 4.3b Only SmartCards whch have been purchased from and ntalsed by Fujtsu Technology Solutons are supported. SmartCard reader: The followng SmartCard readers are supported: SCR USB2.0 Intern Dual Smartcard Reader D321 SCR USB Solo 3 CLOUD 2700R SCR 3500 SCA Express card Readers ntegrated n LIFEBOOK Keyboards wth ntegrated SmartCard readers: The followng keyboards wth SmartCard readers are supported: KB SCR (K528) KB SCR esig (K529) KB SCR2 (K538) KB SCR2 esig (K539) KB SCR Pro (K328, K329) If necessary, refer to the documentaton ncluded wth your SmartCard reader for nstructons on drver nstallaton. Fujtsu 33

42 SystemLock management SmartCard A SmartCard s used to save securty-related data. Bascally, t conssts of memory whch records data and an upstream mcro-controller whch montors access to ths data. Access to the securtyrelevant data s protected by a PIN (Personal Identfcaton Number). A locked SmartCard can be unlocked agan usng the PUK (Personal Unlock Key). Important notes for handlng SmartCards To ensure the securty of your access protecton, you should observe the followng: The frst tme you use your SmartCard, you must enter the preset PIN dsclosed to you by the SmartCard manufacturer or your system admnstrator. When delvered, the preset PIN and PUK numbers for the above-mentoned supported SmartCards are " ". For securty reasons, we strongly recommend that the partcular user changes the PIN and PUK mmedately, provded authorsaton to do so has been granted by the admnstrator. Both secret numbers must have a mnmum of four and a maxmum of eght dgts. Do not use combnatons that are easy to guess, such as number sequences (e.g ) or repettons (e.g. 4444). The SmartCard can only be used wth a PIN, so protecton s mantaned even f the SmartCard s lost. If the PIN s entered ncorrectly three tmes, the SmartCard s locked and can no longer be used. It must be unlocked wth the PUK. If the PUK s entered ncorrectly ten tmes, the SmartCard s locked and can no longer be used. In general, t s advsable to create backup copes of SmartCards, and especally of Admnstrator SmartCards. Always keep one of the SmartCards n a safe place f you are carryng the other SmartCard wth you. Thnk of the SmartCard n the same way as your car keys, of whch you also have a spare set that you normally keep n a safe place. SmartCard reader There s ether a SmartCard reader ntegrated n your computer or you have connected a SmartCard reader. Wth the approprate SmartCards and the assocated software, you can also use your SmartCard reader for the dgtal sgnature, e-mal encrypton or for home bankng. Insert the SmartCard Do not use force when nsertng and removng the SmartCard. Make sure that foregn objects do not fall nto the SmartCard reader.! 34 Fujtsu

43 SystemLock management Puttng SystemLock nto operaton and admnstratng General procedure If you want to use SystemLock n your network, you must frst enable t n Workplace Manager. For ths purpose, you need a SmartCard whch then automatcally becomes the Database Admnstrator SmartCard. You wll need the Database Admnstrator SmartCard from ths tme on, to be able to operate the Workplace Manager Cockpt. Ths also apples to Workplace Manager tasks whch are not assocated wth SystemLock. For securty reasons, create one or more addtonal Database Admnstrator SmartCards, so that you wll contnue to have access to the database f the frst card s lost. You confgure the cards whch you need n your company n the database usng the Database Admnstrator SmartCard. For ths purpose, you must set up at least one organsaton (see page 37) and at least one group (see page 38) wthn ths organsaton. You allocate a computer to the group. A computer can only be allocated to one group. Afterwards you assgn the necessary rghts for each ndvdual computer/user. At frst, all your nformaton s only stored n the database. If requred you can also wrte to the necessary SmartCards mmedately after confguraton. The PIN and PUK are automatcally generated durng confguraton. You can also notfy the user n your company that a SmartCard was prepared and that they can collect ths from a central offce. The central offce accesses the confguraton stored n the database wth the Personalsaton SmartCard and ssues the SmartCard for the user. If you are sure that all users have ther SmartCards, you can swtch on the SystemLock functonalty n the BIOS of the systems on those computers n the network whch are equpped wth the SystemLock functon. Actvaton occurs va the SystemLock job n Job Management n the Workplace Manager. Fujtsu 35

44 SystemLock management Actvaton of SystemLock management n the Workplace Manager Make certan that there s no SmartCard stll n the reader. Select the opton SystemLock management n the lower navgaton area. Clck on the Actvate SystemLock button. The followng wndow opens: Insert an empty SmartCard nto the reader. The reader wll automatcally be recognsed. 36 Fujtsu

45 SystemLock management A PUK must contan 4 to 8 dgts. Enter the PUK and confrm your entry wth OK. You wll need to know the PUK assgned to the SmartCard f you want to use an already ntalsed SmartCard. A new SmartCard has the number sequence as PIN and PUK. The frst SmartCard automatcally becomes the Database Admnstrator SmartCard. Organsatons and groups To be able to execute a SystemLock job, computers must be assgned to organsatons and groups. Wth ths mappng you can portray the access concepts wth correspondng access rghts n your company (see page 42). The name of an organsaton and group must be unque. Create organsatons Select the opton Organsatons and SystemLock Groups n the upper navgaton area and select the entry Set up SystemLock Organsaton n the context menu. The followng wndow opens: The password s optonal. Wth the help of Fujtsu Support you can actvate the computer wth actvated SystemLock usng the password, see the followng secton. Enter a unque name for the organsaton. If you want to access Fujtsu Support, assgn a password and confrm t. Confrm the entres wth OK. Fujtsu 37

46 SystemLock management Password for Servce Actvaton In an emergency, (e.g. faulty card, ncorrect code entered several tmes), Fujtsu Servce can actvate your computer (see chapter "Unlock SystemLock PC", page 49). Requrement: On creatng a new organsaton, you assgn a password whch wll be requested durng actvaton. If you do not want actvaton by Fujtsu Servce, leave the nput feld Unlock password empty. If you wsh to allow actvaton by Fujtsu Servce, enter the password. The password s accepted wth the button OK. The password s saved n the BIOS and the dalogue wndow closes. Keep ths password n a safe place. Create groups The creaton of the SystemLock groups s smlar to processes n Group Management. A computer can be assgned to a sngle SystemLock group n contrast to the SystemManager groups. A dstncton s made between the followng SystemLock groups: a group to whch several computers can be assgned. a sngle group to whch just one computer s assgned. Ths group must have the same name as the computer. Ths group can also not be assgned to any addtonal computer later on. The number of groups s lmted to 65, Fujtsu

47 SystemLock management How to create a group wthn an organsaton Mark the desred organsaton n the workng area and call up the context menu. Select Create SystemLock Group and enter the desred name for the group. How to rename a group A group can only be renamed f no computer s allocated to t. Mark the group whch you want to rename and call up the context menu. Select Rename and enter the desred name. How to delete a group A group can only be deleted when no computers are allocated to t. A computer s deleted from the group va the SystemLock Job Unnstallng SystemLock (see page 40). Mark the group whch you want to delete and call up the context menu. Select Delete and confrm wth OK. The group s deleted. How to update the vew n the work area Select Refresh. The changes made by you n the SystemLock Groups are dsplayed n the workng area. Assgn a computer to a SystemLock group When you assgn a computer to an organsaton, a SystemLock sngle group s generated for ths computer. Therefore the users of an organsaton have access to just one computer n the organsaton wth ther SmartCard. When you assgn a computer to a group, the "Group Members" have access to all computers n the group wth ther SmartCard. Movng computers between groups s not possble. Fujtsu 39

48 SystemLock management How to create a sngle group wthn an organsaton Mark the desred computers n the system groups and drag these nto the organsaton created. A yellow trangle appears n front of the computer name, provded SystemLock s not actvated on the computer. How to assgn a computer to a group Mark the desred computer and drag t nto the group created. A yellow trangle appears n front of the computer name, provded SystemLock s not actvated on the computer. How to delete a computer from a group The deleton of computers from SystemLock groups s only possble f SystemLock s not nstalled and no SystemLock Job s open. Computers on whch the SystemLock s nstalled are automatcally deleted f the Unnstall SystemLock Job was carred out successfully. Mark the computer whch you want to delete from the desred group and call up the context menu. Select Delete and confrm wth OK. The computer s deleted from the group. 40 Fujtsu

49 SystemLock management Import/add users SmartCards are assgned to users (except for the ntalsaton SmartCard durng enablng of SystemLock). Ths s why t s necessary to create or mport the users. How to mport users In the navgaton area, rght-clck wth the mouse on the Users entry to open the context menu. Select the Import user entry. In the followng dalogue wndow, enter the Doman, User name and Password. Clck on Start to mport the users How to add sngle users In the navgaton area, rght-clck wth the mouse on the Add user entry to open the context menu. or or Select the Add user entry. In the followng dalogue wndow, enter the user's full name, the user name and e-mal address. Clck on Save & Close to create the user and complete the process. Clck on Save & New to create the user and to add another user. Clck on Cancel to close the wndow wthout any changes. How to rename a group A group can only be renamed f no computer s allocated to t. Mark the group whch you want to rename and call up the context menu. Select Rename and enter the desred name. How to delete a group A group can only be deleted when no computers are allocated to t. A computer s deleted from the group va the SystemLock Job Unnstallng SystemLock (see page 40). Mark the group whch you want to delete and call up the context menu. Select Delete and confrm wth OK. The group s deleted. How to update the vew n the workng area Select Refresh. The changes made by you n the SystemLock Groups are dsplayed n the workng area. Fujtsu 41

50 SystemLock management SmartCard types A new SmartCard ntally only has a preset PIN and PUK. Access rghts and the ndvdual PIN and PUK are only assgned when the SmartCard s ntalsed. You can create dfferent types of SmartCards wth Workplace Manager: Cards for admnsterng the SystemLock envronment n the network. Cards whch control access to the systems at organsatonal and group level and allow or block partcular functons (e.g. BIOS, system start). The followng SmartCards are used n Workplace Manager: The Database Admnstrator SmartCard s ntally created durng the actvaton of SystemLock. The card s necessary: to defne the SystemLock network envronment wth organsatons, groups, users and SmartCards to create SmartCards and admnster the SystemLock functon n the BIOS of computers va Workplace Manager Personalsaton SmartCard allows the generaton of SmartCards n accordance wth the gudelnes defned by the database admnstrator. The followng SmartCards control access to the computers n the network: Access wthn the assocated SystemLock group (on ste): Admnstrator SmartCard (Admnstrator va the allocated SystemLock group, unnstallng SystemLock) Servce SmartCard (BIOS settngs) Superuser SmartCard (BIOS settngs, system start) User SmartCard (system start) Access wthn all groups of an organsaton (on ste): Organsatons Servce SmartCard (servce SmartCard for all groups of an organsaton, BIOS) Organsaton Admnstrator SmartCard (Admnstrator SmartCard at organsaton level. necessary for example for the local admnstraton of sngle groups) All these SmartCards can change ther PIN and unblock a blocked SmartCard wth knowledge of the PUK and authorsaton of the admnstrator. 42 Fujtsu

51 SystemLock management User SuperUser Servce Admn SmartCard SmartCard SmartCard SmartCard PIN PUK PIN PUK PIN PUK PIN PUK System start x x x Call BIOS Setup x x x Change own PIN x x x x Unlock own blocked SmartCards va the software Unlock own blocked SmartCards n BIOS SystemLock actvate/ unnstall x x x x x* x* x* x x** * Confgured n BIOS setup (desgnaton of the BIOS settng: Unlock SmartCard) ** If allowed n BIOS Setup Confgure/wrte SmartCard types Warnng Please be aware you carry a great responsblty when confgurng and wrtng SmartCards.! An ncorrect procedure can permanently lock ndvdual computers, groups of computers or n extreme cases all computers. When confgurng SmartCard types your settngs are ntally entered only n the database. Your settngs are wrtten onto the SmartCard and saved n the database when wrtng. Database Admnstrator SmartCard! When frst swtchng on SystemLock the frst SmartCard becomes the Database Admnstrator SmartCard. Wth ths card you have access to the database n whch you enter organsatons and groups and assgn the computers n the network. Keep ths SmartCard safe, snce you have no access to the database wthout t. Fujtsu 43

52 SystemLock management Addtonal SmartCard types In the workng area, select the computer for whch you want to confgure the SmartCard. Select the opton SmartCards n the navgaton area and open the context menu. Select SmartCard confguraton. The followng wndow opens: Select your desred SmartCard type: SmartCard type Admnstrator Database Admnstrator Personalsaton servce Organsaton admnstrator Organsaton servce Servce Superuser User Descrpton Boot system, make changes n BIOS Setup, change PIN, unnstall SystemLock, ntalse SmartCards, unlock SmartCards Only access to the database Generatng SmartCards accordng to the database admnstrator defntons Admnstraton wthn a SystemLock organsaton Servce SmartCard for all groups of an organsaton, BIOS settngs. Changes n the BIOS setup Boot system, make changes n BIOS Setup, change PIN Boot system, change PIN Select the desred SystemLock group whch you prevously created When you mark the opton Enable SystemLock actvaton on the followng computer, an nput feld appears where you have to specfy the name of the computer. When you mark the opton Generate PIN and PUK for new SmartCards, the PIN and PUK are automatcally generated and entered nto the database. 44 Fujtsu

53 SystemLock management A new SmartCard has the dgt sequence as standard PIN and standard PUK. If the opton Generate PIN and PUK for new SmartCards s not selected and the standard PUK was not changed, the standard PIN s wrtten n the database. The PUK s requested f the PIN and PUK were already changed. Ths s wrtten n the database. In ths case the PIN remans unchanged. The entres on the SmartCard can be dsplayed wth SystemLock Management/SmartCards. The order s entered nto Job Management. SystemLock job settngs (BIOS settngs) SystemLock jobs can only be executed on computers whch are allocated to a SystemLock group. Select Jobs/SystemLock n the navgaton area. The computers for whch SmartCard types are defned are dsplayed n the upper navgaton area. Symbol overvew - navgaton area Refers to groups of computers for whch SystemLock jobs are stll pendng SystemLock computer SystemLock change has not yet been carred out for clent SystemLock organsaton Refers to SystemLock organsatons for whch SystemLock jobs are stll pendng SystemLock group Refers to SystemLock groups for whch SystemLock jobs are stll pendng The exclamaton mark ndcates that changes are pendng Fujtsu 45

54 SystemLock management The settngs for the SmartCard are dsplayed n the workng area. 46 Fujtsu

55 SystemLock management Select the desred settngs as follows: Settng Acton Install SystemLock Actvate mmedately Change settngs Unnstall SystemLock Descrpton SystemLock s nstalled on the computer. Actvaton s carred out by the user by swtchng on the computer and nsertng the SmartCard generated for them. Test whether the computer s actually ntended for nstallaton. Immedately actvates SystemLock on the selected computer n the network Ensure that the user already possesses a functonng SmartCard whch grants access to the computer. Allows change of the settngs already entered nto the database. Unnstalls SystemLock on the selected computer n the network. Test whether the computers are actually ntended for unnstallng. Settng Request for SmartCard and PIN Request PIN durng every boot Allow Wake on LAN wthout PIN Descrpton Requres PIN entry on each restart Allows system changes va the network. Ths permsson represents a securty rsk, snce an unauthorsed user can gan access to the computer wth ths settng. Settng Support for Sngle Sgn-On (SSO) Users can reset PIN BIOS changes are allowed Descrpton Authentcaton nformaton s forwarded to the operatng system to automate the logn. Addtonal software s requred for ths. Please fnd out more from your specalsed dealer. Allows the unblockng of the PIN Allows changes n BIOS Fujtsu 47

56 SystemLock management Clck on the Execute button to wrte the changed BIOS settngs nto the BIOS. The settngs are wrtten nto the BIOS upon actvatng the computer n the network. Change SystemLock settngs Insert the Admn SmartCard nto the reader. Enter the PIN and confrm the entry wth OK. Select the desred SystemLock group. In the workng area, select the computer from whch you want to unnstall SystemLock. Select Job/SystemLock n the navgaton area. Clck on the acton Change settngs. Change the desred settngs as descrbed above (see chapter "SystemLock job settngs (BIOS settngs)" Page 45) Assgn a job name and clck on Execute. The SystemLock data s changed n BIOS. The settngs are wrtten nto the BIOS upon actvatng the computer n the network. Unnstall SystemLock on the Computer Insert the Admn SmartCard nto the reader. Enter the PIN and confrm the entry wth OK. Select the desred SystemLock group. In the workng area, select the computer from whch you want to unnstall SystemLock. Select Job/SystemLock n the navgaton area. Clck on Unnstall SystemLock. Assgn a job name and clck on Execute. The SystemLock data s changed n BIOS. The settngs are wrtten nto the BIOS upon actvatng the computer n the network. SystemLock s unnstalled. 48 Fujtsu

57 SystemLock management Unlock SmartCard PIN If a user has locked ther SmartCard you can unlock t wth the tool Workplace Protect CardOS SmartCard PIN Tool. For ths purpose, you must know the PUK of the SmartCard. Workplace Protect CardOS SmartCard PIN Tool s nstalled wth the Workplace Manager setup n the folder %programfles%\fujtsu\workplace Manager\Admn\Tools. Unlock SystemLock PC You need the password whch was ssued on creaton of an organsaton (see secton "Create organsatons", page 37). Start the locked computer wthout nsertng a SmartCard. The followng BIOS dalog s dsplayed: Fujtsu 49

58 SystemLock management You (or the user) should press the ESC key. The followng wndow appears: Clck on ESC to unlock through Fujtsu Servce. Unlockng by the admnstrator s not mplemented. Clck on OK n the followng wndow: 50 Fujtsu

59 SystemLock management The unlock data s dsplayed, whch was generated once for ths specfc unlockng procedure: Contact your Servce Centre. Servce wll gude you through the next steps. You need the password whch you assgned when settng up an organsaton (see Password for Servce Actvaton, page 38). When you are asked to do so, close the dalogue shown above on the locked computer by clckng OK. An nput screen appears: Enter the unlockng code whch you have receved from Fujtsu Servce nto the BIOS dalog shown above. SystemLock s unnstalled. The system starts, or opens BIOS f the F2 key was pressed at the start of the boot process. The PC s unlocked. Fujtsu 51

60 Job management Job management All orders whch can be sent to the computer n your network are found n Job management of the Workplace Manager. Two man groups are dstngushed: BIOS-Jobs: Changes to the BIOS settngs of the computers n the network. Lcensng jobs: Lcensng of add-on functons, e.g. face recognton. Jobs can only be executed successfully f the computers have been regstered n Workplace Manager and you have allocated a Workplace Manager clent lcence to the computers n Lcence Management. A job conssts of: a number of parameters or settngs whch you have selected for the partcular order. a selecton of computers whch you have combned nto groups n group management. A meanngful name makes t easer to recognse a job n the job hstory log. Wth the command Start Job, the order s sent to the computer n the network and executed. If a computer s not reached because t s swtched off or not located n the network, the job s executed as soon as the computer can be reached. The completon of a job can be delayed through ths. The processng status of the job can be checked n the job hstory log. You recognse the jobs by the names you gave them, see secton "Job-Hstory / Delete jobs", page Fujtsu

61 Job management Workplace Manager Versons and Job Compatblty The Workplace Manager modules (features) are contnuously beng further developed. Therefore, t may not be possble to execute a job wth a prevous verson of Workplace Manager. You wll receve a notfcaton from the program n ths case. The followng table provdes an overvew of the functons and requred feature sets n the dfferent versons: Functon Workplace Manager 1.10/Feature set Workplace Manager 1.11/Feature set Easy PC Protecton Logn methods Enabled applcatons Presence sensor Auto BIOS Update Hard dsk password BIOS password SystemLock BIOS user password Password request durng boot Workplace Manager 1.21/Feature set If necessary, update Workplace Manager (see chapter Update and repar Workplace Manager, page 12), to be able to use a desred feature. Settng up BIOS admnstraton BIOS admnstraton offers you the opton of defnng the BIOS settngs for dfferent groups of computers on the network and settng those computers on the network va a job. The BIOS confguratons can be saved and used agan. You can also extract the settngs of an exstng computer usng ths functon. You can also record ths extracton n Workplace Protect as an example confguraton fle to then dstrbute these settngs to the computer you want on the network. You can also reset the computers on the network to predefned BIOS settngs usng BIOS admnstraton. In the navgaton area, select Jobs/BIOS jobs/bios admnstraton. Fujtsu 53

62 Job management The groups of computers and ndvdual computers are shown n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. The selected groups and computers are shown n the workng area. Assgn a meanngful job name. Enter the BIOS admnstrator password or use the password saved n the database BIOS confguraton A Factory settngs confguraton s avalable as standard, enablng you to reset the computers to the BIOS standard confguraton. Ths fle cannot be deleted or changed. You can create your own confguratons as fles (see the secton below). Choose the confguraton you want to use on your computers from the BIOS confguraton lst. Clck on Execute job to send the job. 54 Fujtsu

63 Job management Indvdual tasks are created for each confguraton settng for each computer selected. If no parameters have been set n the confguraton lst for a BIOS settng, no task wll be created. If errors occur when executng jobs, these are dsplayed n the job hstory referrng to the tasks. Create/change/delete BIOS confguraton lst The Workplace Manager settngs descrbed below offer you all settngs on all computer models wth the dfferent BIOS versons. Therefore, wth regard to a specfc computer on the network, settngs are also possble whch are not avalable on ths model. Incorrect settngs n the confguraton result n errors that are dsplayed n the job hstory. It s therefore recommended that you create a sutable confguraton for each computer model. The range of values of a BIOS settng has also been changed at tmes throughout the computer generatons. Therefore make sure that the supported settng s always selected for each computer model. In the navgaton area, select Jobs/BIOS jobs/bios admnstraton/job settngs. Fujtsu 55

64 Job management New confguraton lst To create a new confguraton, clck on Create new confguraton lst. Enter the name you want to use n the Name of confguraton feld. Choose the confguraton you want to use as a bass from the Template selecton lst. Clck on Save to create the lst. Change confguraton lst Always change the confguraton usng ths functon. Changes made drectly n the assocated fle can result n errors. Choose the confguraton you want to change from the Name of confguraton selecton lst. Choose the BIOS settngs you want from the selecton lsts. Settngs you do not choose (=empty selecton feld) are not changed on the target computers. Save your settngs by clckng on the Save settngs button. Rename/delete confguraton lst You can rename or delete exstng confguraton lsts usng the Rename or Delete buttons. Create BIOS confguraton lst from a (master) computer You can extract the settngs of an exstng computer. You can record ths extracton n Workplace Manager as a confguraton fle. You need the DeskVew Clent product for ths, whch s currently avalable on the Fujtsu download stes for free. Open the BIOS (press F2 button when startng the system) on the computer on whch you want to create a BIOS extracton. Set the BIOS to match your requrements. Create an archve of the BIOS settngs (see DeskVew Clent user manual, command-lne command BIOSSET usng /AR parameter). Gve the archve a meanngful name. 56 Fujtsu

65 Job management Copy the archve to the Workplace Manager Server n the drectory: %AppData%\Roamng\Fujtsu\WorkplaceManager\BosSettngs\ The next tme you call up the Confguraton lst, ths archve s made avalable to you as a predefned confguraton fle. Easy PC Protecton The am n a network envronment s to protect the computers n the company aganst unauthorzed access. Despte the protectve measures necessary as a result, the employees should have access to ther computers wthout any great effort on ther part. The computers of dfferent user groups (e.g. nght shft, day shft, producton, management, etc.) are usually logged nto the network at certan tmes. Easy PC Protecton s a functon wth whch the request for a set BIOS password durng system boot can be suppressed at specfed standard tmes n a secure company network envronment. The bass for ths functon s a TFTP server (see secton Settng up the TFTP server, page 84), whch makes avalable a tme profle fle n CSV format and an assocated sgnature fle n the company network. The tme profle fle contans data records whch begn wth a profle name. Usng these names, the computers n the network can dentfy those entres whch contan the tme perods relevant to them. The tmes for each weekday are presented after the profle name. To exclude any falsfcaton of the data, a cryptographc checksum about the fle s calculated for every change n the fle. Ths s sgned and saved n the attached sgnature fle. The computer n the network attempts to fnd the server. If the server cannot be reached, the sgnature does not match or the sgnature fle s not present, the PC gnores the tme profle fle and requests the BIOS password as usual. Requrements for the use of Easy PC Protecton TFTP Server For nformaton on settng up the TFTP server, please refer to ths manual, TFTP Server, page 84. Network wth DHCP support Easy PC Protecton can only be nstalled on selected systems from Fujtsu. Easy PC Protecton requres approprate BIOS support by the devces. To be able to use the Easy PC Protecton functon, the lcence for Workplace Embedded Tools (order number S26361-F2542-E437) must be ordered at the same tme that the system s ordered. It s not possble for the lcence to be ssued later on. If computers n the network are protected by SystemLock, Easy PC Protecton cannot be used. Fujtsu 57

66 Job management Implementaton of the Easy PC Protecton functon In the navgaton area, select Jobs / BIOS Jobs / Easy PC Protecton / Job settngs. Symbol overvew Symbol Functon Insertng a new schedule Opens a dalogue wndow below Opens an explorer wndow for selectng a fle Sgns the schedule fle Swtches to edt mode to edt the schedule fle Deletes the selected schedule 58 Fujtsu

67 Job management All settngs and changes, both durng Certfcate settngs and also durng Schedule settngs must always be concluded wth the Sgn button. To exclude any falsfcaton of the data, a cryptographc checksum about a fle s calculated for every change n the fle. Ths s sgned and saved n the attached sgnature fle. The networked computer checks ths sgnature. If the sgnature s not found or the sgnature does not match, the computer gnores the tme profle fle and requests the BIOS password as usual. Certfcate settngs A prvate key fle s requred for the job executon. Ths fle s used to create a fle from t wth the matchng publc key. In the job, ths s then sent to the computers n the network. Create new prvate key fle To create a new prvate key fle, clck on the symbol n the Certfcate settngs area. The followng wndow opens: All the entres are requred. Confgure the target folder usng Explorer. Enter the fle name of the prvate key fle to be created. Enter the name of the ssuer. Assgn a password. Once you have made all the necessary entres, the Create button becomes enabled. Clck on the Create button. A prvate key fle wth the fle extenson.pfx and wth the name specfed s created n the path specfed. Fujtsu 59

68 Job management Open exstng prvate key fle To open an exstng prvate key fle, clck on the Open button. You can set the fle you requre n the Explorer wndow whch then opens. Confgure the path. Enter the assocated password. Clck on the OK button whch has now become enabled. The prvate key fle s opened. Schedule settngs The computers of dfferent user groups (e.g. nght shft, day shft, producton, management, etc.) are usually logged nto the network at certan tmes. Durng these standard tmes, the users should be able to log nto the network wthout the BIOS password. In order to determne the tmes for the computers of dfferent user groups n your network, you need a fle called a schedule fle. TIP Mount the TFTP server as a network drve n your system and select the root drectory of the TFTP server as the path for the schedule fle. To create a new schedule fle, clck on the symbol n the Schedule settngs workng area. In the subsequent dalog wndow, enter the path and the fle name of the fle to be created. Clck on the OK button whch s now enabled. 60 Fujtsu

69 Job management A schedule fle wth the fle extenson.csv and wth the name specfed s created n the path specfed. To open an exstng schedule fle, clck on the symbol. Select the requred fle n Explorer. The fle wth the fle extenson.csv wth the correspondng path s shown n the Schedule fle feld. Use the symbol to create a new schedule. The name of the schedule s shown n the Schedule name feld. Or Change an exstng schedule wth the symbol. The name of the schedule s shown n the Schedule name feld. Or Delete an exstng schedule wth the symbol. In the days table, enter the tmes durng whch the selected computers are normally accessble. Clck on the symbol to sgn the changes n the schedule fle. Execute job Before you create the job, make sure that the schedule fle (csv) and the assocated sgnature fle (sg) are stored n the root drectory of the TFTP server. The sgnature fle *.sg must have the same name as the schedule fle (*.csv). In the navgaton area, select Jobs / BIOS Jobs / Easy PC Protecton. A new workng area opens, n whch you create the job. Fujtsu 61

70 Job management The groups of computers and ndvdual computers are shown n the upper navgaton area. Select the desred group or ndvdual computers wthn the group. The selected groups and computers are shown n the workng area. Assgn a meanngful job name. In the Easy PC Protecton selecton lst, choose whether the functon should be actvated or deactvated. Enter the address of the server n the TFTP Server nput feld. The prevously chosen fle name of the schedule fle n the root drectory of the TFTP server s dsplayed n the Fle name feld. In the Schedule name selecton lst, choose the schedule that you have created n Jobs BIOS Jobs / Easy PC Protecton / Job settngs / Schedule. An overvew of the selected schedules s supermposed. Clck on the Execute job button to dspatch the job. 62 Fujtsu

71 Job management Change schedule settngs If the computers n the network are set up for the TFTP server, sgnature fle and schedule fle, you can change the tmes wthn a schedule at any tme on the TFTP server. Requrement: You must use the same certfcate for savng the fle. If the server address, fle name, schedule or certfcate change, the job must be executed agan wth the changed parameters. A change to the schedule fle must not be made drectly wth an edtor, because otherwse the sgnature fle (sg) wll not be matched. Change log n methods The logn methods secure access to the computers n the network. You can ncrease ths securty by combnng several logn methods wth each other. Wth ths mult-factor authentcaton, you can protect the computers n the network sgnfcantly more effectvely aganst unauthorsed access. The more factors are used for authentcaton at the computer, the greater the securty regardng the genune dentty of a user. For mult-factor authentcaton, the followng factors can be combned: Somethng that the user knows Password or PIN (secret) Somethng that the user possesses SmartCard Somethng that the user s Bometrcs, e.g. a fngerprnt!! Please note that ncorrect settngs for "Log n" can lock out the user from the system. Ths means that, f you confgure only devces whch are not present on the PC (e.g. fngerprnt), the user has no way n whch they can use ther system. If you wsh to change a prevously permtted logn method for a user, notfy the relevant user n good tme. The change wll cause the bometrc data to be deleted. Ensure that the user can adapt to the change. For example, allow Wndows logn as a logn method for a short tme. Informaton about face recognton: An Advanced Face Recognton lcence must be nstalled on the computer before the face recognton can be used as a regstraton method. Apart from that, ensure that the user has already recorded hs or her face n Workplace Protect, snce no recordng of the face can be carred out n "Log In", n contrast to fngerprnt and palm recognton. Select Allow jobs/regstraton methods n the navgaton area. In the followng wndow, select the securty level you wsh to assgn to the user. Symbol / Securty level Functon? / Sngle factor Logn wth password, SmartCard, etc.? / Mult-factor (Template on Logn wth bometrc data, whch s saved on the SmartCard Card)? / Mult-factor (Secret) Logn wth bometrc data and a password, whch must be entered by the user Fujtsu 63

72 Job management Dependng on the selected securty level, the ndvdual logn methods or addtonally possble logn optons wll be dsplayed. The groups of computers and ndvdual computers are dsplayed n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. Of those computers that you wsh to assgn, select only the ones that are equpped wth the "Log n" functon. The selected groups and computers are dsplayed n the workng area. Assgn a meanngful job name. 64 Fujtsu

73 Job management Mark one or several logn methods or the addtonal log-n optons, whch are applcable to the selected computers: Methods Palm recognton Fngerprnt Facal recognton Password SmartCard RFID Logn Logn usng the palm sensor Logn by fngerprnt Logn by matchng the face of the user wth a photo of the face taken prevously n Workplace Protect (Lcence requred) Logn wth password Logn wth SmartCard and PIN Logn wth RFID Defne where the bometrc data should be saved (on the computer or on a SmartCard). The face recognton data cannot be saved on the SmartCard. Clck on the Execute job button to dspatch the job. The settngs must be performed agan when renstallng a computer. Set up allowed applcatons You can use ths job to enable addtonal securty applcatons for the user. Before actvatng the applcaton, check the operatng system on the computer for whch the job has been created, s compatble wth the applcaton. If the users were already workng wth Password Safe before verson 1.21, the exstng database must be updated. To do ths, users wll requred Internet access. If Internet access s not possble, provde the users wth the followng fles. Lnk to converter: F FC1-E2DA Lnk to lcence: 1EB B997-3AEAECCB411D Ensure that the users can save the requred fles on ther computers n the %programdata% \fujtsu\kpconverter drectory. Select Jobs/allowed applcatons n the navgaton area. Fujtsu 65

74 Job management The groups of computers and ndvdual computers are dsplayed n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. The selected groups and computers are dsplayed n the workng area. Assgn a meanngful job name. Mark the applcaton whch you want to enable for the selected computers n Workplace Protect: Applcaton Password Safe Encrypted Contaner Easy Restore Descrpton Safe for savng passwords Encrypted data area on the hard dsk Allow restore to delvery status or backup of networked computers. If ths functon s to be enabled, as admnstrator you must make a TFTP server avalable. (see manual: Workplace Protect) Clck on the Execute job button to dspatch the job. 66 Fujtsu

75 Job management After the nstallaton of Workplace Protect (managed mode), the applcatons are enabled, so that the end users could already have these n use when you lock the applcatons. In ths case, you should nform your end users n advance about swtchng off the applcatons. Defne presence sensor settngs Ths functon requres a presence sensor on the computers. Ths can for nstance be ordered as an order opton together wth the computer models ESPRIMO X913 or ESPRIMO X923. Wth the presence sensor settngs, you determne whch actons may be performed f the user s sttng n front of the screen, or s absent. Select Jobs/Presence sensor settng n the navgaton area. The groups of computers and ndvdual computers are dsplayed n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. The selected groups and computers are dsplayed n the workng area. Fujtsu 67

76 Job management Assgn a meanngful job name. Mark the opton Actvate presence detecton. The Presence sensor functon s actvated or deactvated wth ths. Select an acton whch should be performed after a defned perod of tme f the user remans absent: Acton durng absence Lock computer Turn off dsplay Turn off dsplay and lock computer Energy savng Hbernate Not all actons may be selectable, dependng on what has already been selected. The tme set for a subsequent acton must be greater than that of the prevous acton. Select an acton whch should be performed n the presence of the user: Acton when present Actvate montor Transfer the computer from sleep or hbernate mode nto normal mode Clck on the Execute job button to dspatch the job. Auto BIOS Update You can use Auto BIOS Update to allow the BIOS on a group of computers to be automatcally updated. You have two optons thereby: You update to the latest BIOS drectly from the offcal Fujtsu Download Server. (Lcence not needed Internet access needed). Or You place the BIOS on a TFTP server n your company. Wth ths you can decde whch BIOS verson wll be nstalled on the computers. (It s necessary to buy a lcence when buyng the system - Internet access s not needed) Requrements for the BIOS update from a company n-house server TFTP server (for settng up the server, please refer to ths manual, TFTP Server, page 84) Network wth DHCP support. Durng the boot process, the system uses the DHCP protocol to obtan a free IP address for tself, and to receve nformaton about the network nfrastructure. The condtons of use must be accepted Auto BIOS Update can only be nstalled on selected systems from Fujtsu. 68 Fujtsu

77 Job management To be able to use Auto BIOS Update n your company network, the lcence for Workplace Embedded Tools must be ordered at the same tme as the system s ordered (order number S26361-F2542- E437). Auto BIOS Update va the Fujtsu server s not possble wthout a lcence. It s not possble for the lcence to be ssued later on. Make BIOS updates avalable For each system famly supported by Fujtsu and that should be suppled wth BIOS updates automatcally, certan fles must be present. To receve the necessary fles for the system beng used by you, download the Admn package from the Fujtsu Support web ste: From there, select Drvers & Downloads. Enter the seral number or dentfcaton number of the product, or select the product from the lst (e.g. ESPRIMO P ESPRIMO P520 desktops). As operatng system, select OS Independent (BIOS, Frmware, etc.). Download the BIOS Update - Admn Pack. If you wsh to download an older verson of a BIOS Update, clck on Other versons. The downloaded.zp fle contans a drectory called TFTP, whch contans the fles necessary for the server. In the followng example, for the BIOS Update to verson of the ESPRIMO P520 system, these fles are ncluded: D3220-A csv (control fle for all BIOS versons for the ESPRIMO P520) D3220-A UPC (compressed BIOS Update to verson ) For your present system, create an empty master fle n the root drectory of the TFTP server, named as follows: <Manboardname>.csv. (e.g. D3220-A1.csv). Copy the contents of the fle contaned n the ZIP fle (D3220-A csv n the example) nto the master fle. If you wsh to make several BIOS versons avalable, transfer ther contents lne-by-lne nto the master fle. Copy all the assocated UPC fles nto the root drectory of the TFTP server. Customsaton for several BIOS versons s necessary f a BIOS verson of a specfc earler verson s needed for an update. Wthout customsaton, the hghest avalable verson avalable on the server s always nstalled automatcally on the computers. Repeat the steps descrbed to add BIOS updates for other system famles. Fujtsu 69

78 Job management The Flash Wrte Support settng n the BIOS Setup Securty menu must be enabled for the BIOS update to be successful. (For DeskVew Clent users: BIOSSET /FW ) Allocate BIOS updates to computers For each system famly for whch BIOS updates are dstrbuted, a CSV control fle must exst n the TFTP root drectory, contanng the nformaton on the avalable BIOS updates for the system famly. If you wsh to provde several versons of frmware for a system famly (e.g , and ) customzaton of the CSV fle s requred for ths system famly. The control fle s constructed as follows: The frst lne contans the header record wth the followng "column names": verson,needed_verson,flename,changelog Each further lne contans nformaton about the partcular frmware update. In the example (BIOS verson for the ESPRIMO P520) the second lne contans: ,,D3220-A UPC,, Another lne must be nserted n the CSV fle for each further BIOS verson whch s allocated. You can copy the lnes requred from the partcular CSV fles of the correspondng "Admn packs". The fle for the example ESPRIMO P520 system can for nstance look lke ths: verson,needed_verson,flename,changelog, 1.5.0,,D3220-A UPC,, ,,D3220-A UPC,, ,,D3220-A UPC,, Show the user BIOS update messages Immedately before an update, you can report text to the user by storng a Change log fle. The followng conventons must be adhered to for an error-free descrpton: Maxmum of 43 characters per lne Maxmum of 14 lnes ASCII character set (no specal characters, umlauts, etc.) Save the text fle n the TFTP root drectory of the server, gvng t a meanngful fle name (e.g. D3220-A changes.txt). Insert the fle name n the correspondng column for ths frmware verson n the csv fle. verson,needed_verson,flename,changelog ,,D3220-A UPC,D3220-A changes.txt, 70 Fujtsu

79 Job management Setup Auto BIOS Update Select Jobs / BIOS Jobs / Auto BIOS Update n the navgaton area. The groups of computers and ndvdual computers are dsplayed n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. The selected groups and computers are dsplayed n the workng area. Assgn a meanngful job name. Enter the BIOS admnstrator password or use the password saved n the database. In the Automatc Update selecton lst, choose the frequency at whch the BIOS should be automatcally updated (e.g. monthly). In the User-defned Update selecton lst, choose whether or not an update should be searched for once, durng the next boot of the computer. In the Server for update selecton lst, choose the server on whch the search for the BIOS update should be performed. Fujtsu 71

80 Job management Wth declaraton of your n-company TFTP server, you can specfy whch of the BIOS versons that you have made avalable wll be nstalled (lcence needed). Enter the address of the server nto the Server Address feld. For an n-company TFTP server, enter the IPv4 address of the TFTP server n the partcular network. If the BIOS should be updated wthout any messages beng ssued, mark the Slent Update opton. Read the condtons of use and then mark the opton Accept condtons of use. Clck on the Execute job button to dspatch the job. The computer s now set up for Auto BIOS and at the specfed tmes a test wll be made for a new BIOS and f so t wll be nstalled. If you are to unnstall Workplace Protect, the settngs for BIOS Update are kept. If you do not wsh to keep the settngs, you must send a job whch sets the Never opton n the Automatc Update selecton lst n the BIOS Update confguraton and swtches off the User-defned update. Set BIOS password You use the BIOS password to protect the BIOS from beng changed. Only the admnstrator should have unlmted access to the BIOS. You can assgn dfferent passwords for groups of computers. Ths ncreases the BIOS securty on your network. So that you do not have to memorse all of these passwords, you can store them n encrypted form usng the "Save password" opton n the Workplace Manager database. You can use saved passwords for all jobs for whch the BIOS admnstrator password s requested. Each saved password s used for each computer. If you need a password of an ndvdual computer to gve t to a support member, you can read t out by clckng on a computer n the Computer overvew lst (see secton Computer propertes). The password should be mmedately changed after the support operaton. You can set and admnster passwords whch contan specal characters. The use of specal characters requres the support of BIOS for the managed systems. When usng specal symbols n passwords, please note that the BIOS Setup nput masks (e.g. durng system boot) are based on the Englsh keyboard layout. Select Jobs / BIOS Jobs / BIOS password settngs n the navgaton area. 72 Fujtsu

81 Job management The groups of computers and ndvdual computers are dsplayed n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. The selected groups and computers are dsplayed n the workng area. Assgn a meanngful job name. If a password has already been assgned, enter ths n the feld current password. Enter the "old" hard dsk password n the feld Current Password, f a password s already assgned. Enter the new password n the feld New password and confrm t n the feld Confrm password. Clck on the button Execute job on concluson of the entres. The password assgned s sent to the computer. It s checked and s mmedately vald. If for example the BIOS Admnstrator password was ncorrectly wrtten, the passwords are not set. Fujtsu 73

82 Job management Set BIOS user password You severely restrct access to the BIOS Setup wth the BIOS user password. If the users n the network should use ther own BIOS user passwords for ther computers, you can acheve ths usng ths job. You send the users a temporary password that you predefne, nform the end users of t and ask them to change the password as soon as possble usng Workplace Protect. The end users do not need to know your BIOS Admnstrator password for ths purpose. You can also use ths job f one of your end users has forgotten ther BIOS user password. You can set and admnster passwords whch contan specal characters. The use of specal characters requres the support of BIOS for the managed systems. When usng specal symbols n passwords, please note that the BIOS Setup nput masks (e.g. durng system boot) are based on the Englsh keyboard layout. In the navgaton area, select Jobs / BIOS Jobs / BIOS user password settngs. 74 Fujtsu

83 Job management The groups of computers and ndvdual computers are dsplayed n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. The selected groups and computers are dsplayed n the workng area. Assgn a meanngful job name. You can also have dsplayed the characters whch you enter n the password feld, by markng the Character dsplay opton. Enter the requred password n the BIOS admnstrator password feld. Enter the new user password n the feld New user password and confrm t n the feld Confrm password. Clck on the button Execute job on concluson of the entres. The password assgned s sent to the computer. It s checked and s mmedately vald. If for example the BIOS Admnstrator password was ncorrectly wrtten, the passwords are not set. Set hard dsk password Wth the hard dsk password, you prevent the hard dsk beng used n another system wthout knowledge of the password. The BIOS admnstrator password s only requred f SystemLock s not actvated. You can set and admnster passwords whch contan specal characters. The use of specal characters requres the support of BIOS for the managed systems. When usng specal symbols n passwords, please note that the BIOS Setup nput masks (e.g. durng system boot) are based on the Englsh keyboard layout. Select Jobs / BIOS Jobs / BIOS password settng n the navgaton area. Fujtsu 75

84 Job management The groups of computers and ndvdual computers are dsplayed n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. The selected groups and computers are dsplayed n the workng area. Assgn a meanngful job name. If no SystemLock s set up, enter the BIOS admnstrator password or use the password saved n the database. If a password has already been assgned, enter ths n the feld current password. Enter the new password and confrm ths. Clck on the button Execute job on concluson of the entres. The password assgned s sent to the computer. The next tme the computer s booted, an attempt s made to wrte the password onto all hard dsks. These hard dsks must not have any password assgned, or these hard dsks were protected up to now wth the same "old" password. The passwords specfed are checked or set durng the next boot. 76 Fujtsu

85 Job management If for example the BIOS Admnstrator password was ncorrectly wrtten, the passwords are not set. Password on boot settngs Password on boot settngs specfes whether the user of the selected computer n the network must enter the user password durng bootng. In the navgaton area, select Jobs / BIOS Jobs / Request password durng boot. The groups of computers and ndvdual computers are dsplayed n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. The selected groups and computers are dsplayed n the workng area. Assgn a meanngful job name. Enter the requred password n the BIOS admnstrator password feld. Fujtsu 77

86 Job management In the User password durng start lst, select the opton Actvate or Deactvate to swtch the password request on or off. Clck on the button Execute job on concluson of the entres. Advanced Face Recognton Lcences Wthout specal lcences for face recognton, computers n the network cannot use Advanced Face Recognton. It s therefore necessary that you purchase lcences, actvate them and allocate them to computers n the network. Lcence management (the Lcence management opton n the navgaton area) s used to admnstrate the purchased lcence key and the allocaton of lcences to computers n the network. Purchase lcences Select Job management / Lcensng jobs / Lcensng facal recognton lcence nput. Open the lnk Clck here to go to the onlne shop and follow the nstructons on the screen. The name and emal address whch you must provde at purchase are requested durng actvaton of the lcence. If you have purchased a lcence, you wll receve an emal wth an actvaton code, sent to the emal address gven. Save the emal n a secure place. Enter lcences You must actvate the lcences acqured n the workng area Advanced Face Recognton key regstraton. Enter the lcence or read t from the fle wth the functon Read from fle. Identfy yourself wth the name and emal address whch you gave durng purchase. Enter the actvaton code whch you have receved by emal. Lcences once assgned cannot be assgned agan. 78 Fujtsu

87 Job management Advanced Face Recognton lcensng Ensure that the computers to whch you are sendng a job have an Internet connecton. In the navgaton area, select Job management / Lcensng Jobs / Face Recognton lcensng. The groups of computers and ndvdual computers are dsplayed n the upper navgaton area. Select the desred group or ndvdual computers wthn the groups. The selected groups and computers are dsplayed n the workng area. Assgn a meanngful job name. If necessary specfy the address and port for the server. Clck on Execute Job to send the job. Fujtsu 79

88 Job management Job-Hstory / Delete jobs You can check whether and how a job was carred out n the job hstory. Va the context menu, you can sort accordng to any column and delete ndvdual jobs or groups of jobs (e.g. delayed jobs). 80 Fujtsu

89 Job management Deletng jobs Please note that you can also delete jobs created by a dfferent admnstrator. Therefore, please only delete jobs that you yourself have created or whch you know can defntely be deleted. Sort the desred column. Select the jobs that you want to delete. In the context menu, select the entry Delete jobs. The selected jobs are deleted. Detals about the jobs carred out Job status Descrpton Acton Successful Partal success The job was successfully carred out on all computers n the network. The job was stll not carred out on all computers. Or The job was ncorrectly carred out on some computers. - Or Check whether the computers are reachable. Check whch error s present. Faled Error durng executon Check whch error s present. Not known The job was just started and there s no feedback. Check the status agan at a later tme. Executon Descrpton Acton Delayed The executon s delayed, for If necessary cancel the nstance because a computer cannot executon by callng up the be reached. context menu wth the rght mouse key (Cancel job). Immedately The job was carred out and ended. - Fujtsu 81

90 Job management Informaton about the job results Status Descrpton Acton Not known Job s currently ntalsed. - Sent The job was sent to the computers n the network. - Completed The computer n the network has If the return value expected returned a result. on completon does not match the actual return value, check what error has occurred. Faled to send to computer Unlcenced Not regstered Unsupported The computer could not be reached (e.g. frewall blockng communcaton, computer swtched off). Computer cannot be managed, snce t s not lcensed. Computer cannot be managed, snce t s not regstered. The job cannot be executed n the current confguraton (e.g. when an unnstall job s stll pendng and an nstall job was just sent). Check why the computer s not reachable. Lcence your computer. Import the computer agan or test the cause wth the opton Group management / Regstraton problems If necessary cancel the executon by callng up the context menu wth the rght mouse key (Cancel job). 82 Fujtsu

91 Workplace Manager Settngs Workplace Manager Settngs Set language and port Clck on the Spanner symbol n the navgaton area. Select the desred language. You should not change the settngs under Workplace Manager for the server address and port. They descrbe the address of the server f the admnstrator console s not nstalled on the server (not supported n the current verson). Confrm your entres wth OK. Fujtsu 83

92 TFTP Server TFTP Server TFTP (Trval Fle Transfer Protocol) s a smple protocol for data transmsson. A TFTP server must be set up before Easy PC Protecton or Auto BIOS Update can be used n your company network. In dong so, any TFTP server that s compatble wth RFC 1350, RFC 2347, RFC 2348 and RFC 2349 can be used. Alternatvely, a Fujtsu CELVIN NAS wth ntegrated TFTP Server can also be used. A selecton of chargeable and free TFTP servers for Wndows s lsted below: WnAgents TFTP server Open TFTP server TFTP Server Alternatvely, a Fujtsu CELVIN NAS wth ntegrated TFTP Server can also be used. Settng up the TFTP server You requre admnstratve rghts for the nstallaton. The TFTP server must be set up so that t responds on port 69 to ncomng requests. The followng secton descrbes an example of the confguraton of the TFTP server from whch also requres.net 4.0. Download the requred setup fles from the webste. Install the TFTP server on your server operatng system. Start the program and clck on Confgure to set up a new TFTP server. A confguraton screen opens, n whch you can add a new TFTP server. 84 Fujtsu

93 TFTP Server Clck on Add. The Settngs wndow opens. The IP address s an example and may dffer from your system. Clck on Pck to select the desred network nterface and the matchng IP address. Please be careful to select an IPv4 address. Enter the root drectory of the TFTP server n Root path. All the fles stuated n the root drectory can be reached usng TFTP. Confrm your nput wth OK. Fujtsu 85

94 TFTP Server The server s shown n the confguraton wndow. Confrm your nput wth OK. Start the server wth Start. The TFTP server s now avalable as a servce va the network adapter chosen by you. All ncomng and outgong connecton requests are clearly shown n the program wndow. 86 Fujtsu