AppSense Management Center. Product Guide Version 10.1

Transcription

1 AppSense Management Center Prduct Guide Versin 10.1

2 Table f Cntents Prduct Guide 1 Table f Cntents 2 What's new in Management Center 10.1? 5 Evaluatin Mde Installatins 5 Deplyment Statistics 5 Upgrade t Micrsft Visual Studi Micrsft Windws Server 2016 & Micrsft Windws 10 Cmpatibility 6 Single Management Center & Server Cnfiguratin Prtal Lg File 6 Abut Management Center 7 Management Center Cmpnents 7 Management Cnsle 8 Management Server 9 Database 9 Prduct Cnsles 9 Deplyment Agent 10 Cncurrency 12 Failver 13 Management Center Security 15 Security Challenges 15 Authenticatin and Authrizatin 15 Securing Cmmunicatins using SSL 15 Management Center Wrkflw 17 Deplyment Agent 25 Access Credentials 25 Deplyment Agent Cmmunicatin with the Management Server 26 Deplyment Agent Registering with the Management Server 26 Installing the Deplyment Agent 27 Cnfiguring the Deplyment Agent 32 CCA Cmmand Tl 34 Deplyment Agent Diagnstics 35 Licensing 38 License Agreement 38 Managing Licenses 38 Patching 40 Patch Distributin 40 Installing Patches Using the Management Center 40 Page 2 f 132

3 Installing and Uninstalling Patches Using the Cmmand-Line 41 Rlling-Back Patches 42 Hme 43 Cnnect t the Management Server 43 Management Server 44 Glbal Settings 46 Membership Rules 49 All Cmputers 50 Deplyment Grups 57 Default Deplyment Grup 57 Deplyment Grup 57 Cnfiguring Deplyment Grups 60 Mve Cmputers Between Deplyment Grups 61 Deplyment Grup Settings 61 Deplyment Grup Packages 91 Deplyment Grup Cmputers 94 Deplyment Grup Alerts 99 Deplyment Grup Events 100 Packages 102 Packages View 102 Package Uplad 103 Package Assignment 104 Package Installatin 105 Remve a Package 106 Deplyment Statistics 107 Prerequisites 108 Alerts 111 Alerts View 111 All Alerts 111 Delete Events 113 Alert Rules 113 Alert Rule 114 Alert Rule Criteria 117 Alert Rule Actin 118 Reprts View 121 Reprts 121 Default Reprts 122 Reprt Filter 123 Page 3 f 132

4 Generate a Reprt 123 View and Edit Reprts 124 Imprt a Reprt 125 Delete a Reprt 125 Security 126 Server Permissins 126 Object Permissins 127 Security Rles 128 Cnfiguring Security 131 Page 4 f 132

5 What's new in Management Center 10.1? Evaluatin Mde Installatins When using Evaluatin mde the installer will install the prducts int the default website using prt 80. Fr further infrmatin n Installing the prducts, see AppSense DesktpNw Install and Cnfigure Guide. Deplyment Statistics The Deplyment Statistics feature prvides reprting n the number f agents and cnfiguratins deplyed fr each f the DesktpNw prducts. This assists with verifying the fllwing infrmatin: Number f agents installed Number f cnfiguratins installed Number f installed agents that have plled in within the last 30 days Fr further infrmatin see "Deplyment Statistics" n page 107. Upgrade t Micrsft Visual Studi 2015 Management Server, Cnsle, Licensing Cnsle and Agent cmpnents have been upgraded t utilize the latest technlgy stack. The fllwing specific details have been included in v10.1: The.NET framewrk has been updated t use.net Micrsft Visual C++ Redistributable Package Update Installer prjects have been updated t use Wix Fr further infrmatin n Prerequisites, see AppSense DesktpNw Install and Cnfigure Guide. Page 5 f 132

6 Micrsft Windws Server 2016 & Micrsft Windws 10 Cmpatibility Management Server, Cnsle, Licensing Cnsle and Agent cmpnents are all cmpatible with Micrsft Windws Server 2016 and Micrsft Windws 10. Single Management Center & Server Cnfiguratin Prtal Lg File A single lg file is created in the fllwing lcatins: Server Cnfiguratin Prtal - %PrgramData%\AppSense\SCU Management Server - %PrgramData%\AppSense\Management_[InstanceName] Page 6 f 132

7 Abut Management Center Management Center Cmpnents The Management Center cmprises f the Management Server, Micrsft SQL Server, Management Cnsle and the Deplyment Agent installed n managed cmputers. The Deplyment Agent uplads event data frm managed cmputers t the Management Server and dwnlads prduct cnfiguratins and sftware updates frm the Management Server. Prduct cnfiguratins are created using the prduct cnsles and stred in the Management Center SQL database frm where they can be dwnladed alng with prduct agents by the Deplyment Agent fr installatin n managed machines. Page 7 f 132

8 Management Cnsle The AppSense Management Cnsle prvides an interface t the AppSense Management Server and the ther cmpnents f AppSense Management Center. The cnsle allws yu t manage Deplyment Grups, Glbal Settings, Packages, Alerts and Alert Rules, Reprts and Security. Navigatin Pane The Navigatin pane cnsists f the navigatin tree and navigatin buttns. The navigatin tree is the area fr managing ndes f the cnfiguratin. The navigatin buttns allw yu t view the different areas f the cnsle, including: Hme Prvides an verview f the Management Center with the first three step up steps t help yu get up and running. Frm here yu can launch the AppSense DesktpNw prduct cnsles; Applicatin Manager, Envirnment Manager and Perfrmance Manager. The wrk area als cntains verview details f the server cnnectin, deplyment grups, cmputers and alerts. Frm within the Hme view yu can setup and manage the fllwing: Deplyment Grups Glbal Settings Membership Rules All Cmputers Licensing Events Packages Manage AppSense sftware agent, cnfiguratin packages and any prerequisites n the Management Server. Alerts Add and manage alerts and alert rules fr AppSense sftware events sent t the server frm client cmputers. Reprts Imprt and generate a range f reprts fr AppSense prducts. Security Manage server and bject permissins and rle-based access rights t the Management Center cnsle views and settings. NOTE: The Navigatin pane is cllapsible allwing yu t create mre viewing space fr the ther areas f the cnsle. Wrk Area The Wrk Area prvides the main area fr managing the settings, cntrls and views f the selected nde in the navigatin pane. The cntents f the wrk area vary accrding t the selected ndes in the navigatin tree and the selected navigatin buttns. Page 8 f 132

9 Actins The Actins panel displays in the right-hand clumn and shws available cntrls fr the current view. Management Server The Management Server manages cmmunicatins with a Micrsft SQL database server fr data access and strage, prviding security cntrl, cmmunicatins fr managing netwrk discvery services and sftware deplyment t managed cmputers, resurce management and auditing. Management Server security manages netwrk authrizatin fr Management cnsles and prduct cnsles. Management Center handles dwnlad schedules, grup management and file transfers, and netwrk discvery services fr integratin with Active Directry. Auditing manages event data access and strage via the Management cnsle alert rules which includes mechanisms fr generating SNMP and SMTP alert ntificatins. Management Center supprts a list f failver f servers which can take ver the rle f the Management Server t allw the system t cntinue functining in the event f a hardware r envirnment failure. NOTE: Fr further infrmatin see AppSense Server Cnfiguratin Prtal Help. Database The Management Center relies n the availability n the netwrk f a Micrsft SQL server fr the strage and retrieval f AppSense sftware agents, cnfiguratin packages, license packages, and event and alert data. The Micrsft SQL database server is administered by the Management Server and can be installed lcally n the Management Server r n a separate server. NOTE: Fr mre infrmatin abut managing user permissins fr the SQL database during installatin and upgrades, see AppSense DesktpNw Install and Cnfigure Guide. Prduct Cnsles The AppSense prduct cnsles, including Applicatin Manager, Envirnment Manager and Perfrmance Manager, allw yu t cnfigure and save cnfiguratins t the Management Server's database fr adding t deplyment grups and deplying t managed cmputers. Page 9 f 132

10 NOTE: Fr mre infrmatin n the prduct cnsles refer t the relevant prduct help system. All Help systems can be fund at Deplyment Agent The Deplyment Agent is installed n managed cmputers t manage cmmunicatins between the prduct endpint and the AppSense Management Center. The Deplyment Agent plls the Management Server t manage the dwnlad and installatin f agents, cnfiguratins and sftware package updates, and als sends event data generated by the prduct agents t the Management Server. The Deplyment Agent can be dwnladed and installed directly n managed cmputers frm the Management Server web site r by using the Management Center cnsle. Yu can specify the Access Credentials used by the Management Server. This must be dne befre yu can install the Deplyment Agent using the cnsle. Other methds f installatin are Active Directry grup plicy bjects, r third-party deplyment slutins such as Micrsft Systems Center Cnfiguratin Manager (SCCM). Diagnstics The Deplyment Agent n managed cmputers runs a series f self-tests n first cntact with the Management Server r when requested by the Management Server during a pll. Diagnstics can be enabled r disabled fr any Management Server listed in the Failver Servers list. Each failver server entry in the failver servers lists includes the Diagnstics Enabled check bx ptin. The Management Server always requests a self-test when the Deplyment Agent first plls due t a rebt r service restart. All tests are run and an event, which indicates the test result, is raised in the Windws Event Lg and sent t the Management Server. Each test cntributes a success value t the results and, when tests fail, a detailed errr reprt is als included in the event reprt. In the event f a test failure, the Management Cnsle highlights, in red bld, the names f cmputers where the failure ccurred and als highlights the deplyment grups in the navigatin pane cntaining cmputers n which the tests failed. The Deplyment Agent perfrms the fllwing self-tests: Cnnectivity The cnnectivity test plls the Management Server. Any respnse, ther than an HTTP 200 (Success) return value, indicates a failure and a detailed errr message is returned. If this test fails, the results cannt be sent t the Management Server but can be viewed in the lcal Applicatin Windws Event Lg. Page 10 f 132

11 Package Dwnlad This test dwnlads a file frm the Management Server t the lcal hard disk, using BITS. Instead f dwnlading an MSI package, the test dwnlads a small XML file which can be easily validated and has a minimal impact n netwrk bandwidth. The XML file is dwnladed frm the same directry as packages t ensure the same access rights affect bth file types. Once the test is cmplete, the dwnladed file is deleted. Since BITS dwnlads can be delayed if the lcal cmputer is under heavy lad, the dwnlad ccurs within a new high pririty BITS jb, ensuring the test cmpletes in a shrter time. A single BITS jb is used t dwnlad files frm all enabled failver URLs. If any errrs are reprted during the dwnlad, the test fails. The descriptin f the errr is included in the test results. Events Uplad This test attempts t uplad an events file using BITS frm the lcal hard disk t the Management Server. The events file cntains n events t help minimize impact n netwrk bandwidth, and is upladed t the same directry as standard event uplads. Since BITS uplads can be delayed if the lcal cmputer is under heavy lad, the uplad ccurs within a new high pririty BITS jb ensuring the test cmpletes in a shrter time. If any errrs are reprted during the uplad, the test fails. The descriptin f the errr is included in the test results. NOTE: This test nly verifies that events can be sent frm the Deplyment Agent t the Management Server. N checks are made t ensure that the events can be upladed t the database. When this fails, an event is added t the Management Server event lg and raises a Management Center event, where pssible. Raising High Pririty Events The high pririty events mechanism allws critical events t be sent t the Management Server database. A typical high pririty event is the reprting f a failure t install packages. The test attempts a call by the Deplyment Agent t the Management Server web page with an empty list f events. Any errr values returned by the call are added t the self-test results. NOTE: Diagnstic failures are highlighted in red in the cnsle. Fr example, a deplyment grup nde and a crrespnding prblematic cmputer. Change Default Prts Yu can change the default prt settings fr cmmunicatins with the Management Center after installatin as fllws: Page 11 f 132

12 1. In Internet Services (IIS) Manager: Select Default Web Site > Edit Bindings > Site Bindings Select the rw which has a HTTP r HTTPS Type, click Edit. Change the TCP and SSL prt settings accrding t requirements. Defaults are TCP:80 and SSL: Change the prt number in the URL path f Deplyment Agents cnnecting t the Management Server, using ne f the fllwing methds: Uninstall current Deplyment Agents then reinstall n each target cmputer with the URL path specifying the new prt number. Add the NetBIOS name, the fully qualified dmain name r the IP address with the new prt number t the Failver Servers list and update currently installed Deplyment Agents using the Install Deplyment Agent functinality within the cnsle. Mdify cnnectivity t the Management Server fr the Management cnsle and prduct cnsles by editing the listed servers in the Select Management Server dialg bx: name>:<prt number>/managementserver NOTE: Prefix the address apprpriately with HTTPS r HTTP depending n whether yu are implementing the Management Center with SSL encryptin and a valid certificate r in a wrkgrup envirnment withut SSL. Cncurrency Cncurrency supprt ensures multiple users can cnnect t the Management Center simultaneusly but nt edit the same data simultaneusly. Users cnnecting with Management cnsles are regulated by the principle that the first user t submit edits t a particular area are applied. Other users are ntified that the settings have changed and the view is updated. Hwever, multiple users can edit different data simultaneusly. Fr example, a user editing the installatin schedule, can submit changes at the same time anther user submits changes t the grup Membership settings. Prduct cnsles are regulated by a lcking mechanism which ensures that the first user t access a cnfiguratin has exclusive editing cntrl until the cnfiguratin is saved and unlcked. Other users can view the cnfiguratin while it is lcked but nt edit the data. When the cnfiguratin changes are saved and the cnfiguratin is unlcked, ther users may attempt t access and edit the cnfiguratin. Editing Management Center Settings When different users cmpete t edit the same data in the Management cnsle, the first t submit an edit is allwed, a ntificatin is issued t the ther users and the Management Cnsle is refreshed. Page 12 f 132

13 Editing Prduct Cnfiguratins Prduct cnfiguratin cncurrency errrs are prevented by a lcking system which ensures that nly ne user can edit a cnfiguratin at any time. Prduct cnfiguratins can be unlcked when editing is finished t allw thers users t mdify the cnfiguratin. When a cnfiguratin is lcked, ther users can nly pen the current saved versin in read-nly mde. The lcked status and details f the user wh has lcked the cnfiguratin display in bth the Management cnsle and in prduct cnsles when editing a cnfiguratin. Administrative users n the Management Center can verride cnfiguratins which are lcked by ther users by resetting the lck. Select the Packages buttn in the navigatin pane and then the Cnfiguratins nde. Right-click a lcked cnfiguratin and select Und Lck. Failver The Management Center supprts a list f failver servers which can take ver the rle f the Management Server t allw the system t cntinue functining in the event f a hardware r envirnment failure. The primary Management Server and failver servers can use the same SQL database t ensure that existing data can be accessed at all times with any Management Server. Failver in the Management Center prvides supprt nt nly in the event f critical issues affecting the main Management Server but als t allw fr system maintenance such as the decmmissining f a server r during a majr upgrade r server verhaul. Page 13 f 132

14 Failver supprt ensures that the Deplyment Agent n managed cmputers can maintain cnnectivity with alternative failver Management Servers, where the need arises, prtecting data integrity and cmpnent cmmunicatins. Failver servers are maintained by the Management Center using the lists defined in the Management Cnsle. The failver server lists are registered n managed cmputers via the Deplyment Agent. The Deplyment Agent can als register the Management Server URLs it uses, which are added t the list f failver servers in the Management Center. Each server is listed in rder f pririty. In the event that the first listed Management Server is unavailable, the Deplyment Agent attempts t cnnect with the next Management Server in the list until a cnnectin is achieved. The list f Management Servers can be managed bth glbally fr all deplyment grups r lcally applying a unique list t each deplyment grup. A lcal list f Management Servers applied t a Deplyment Grup cnfiguratin verrides the glbal list. Arranging Management Servers lcally fr each deplyment grup allws yu t manage the Management Center infrastructure flexibly, fr example by setting up servers gegraphically t cnserve bandwidth r accrding t different cnnectin types. Page 14 f 132

15 Management Center Security The AppSense Management Center can be implemented in a secure distributed envirnment with Active Directry integratin, Secure Scket Layers (SSL) fr encrypted cmmunicatins, authenticated Management Server and database cnnectins. Security Challenges The security challenges fr implementing the AppSense Management Center include: System integrity Attempts t tamper with cnfiguratin and agent packages distributed t managed machines thrugh the intrductin f malware r mdificatins t sftware packages undermine the security plicies which the management sftware is required t implement. Data cnfidentiality Event and alert data is cntinuusly relayed t the SQL database via the Management Server and culd be vulnerable t the threat f access by unauthrized users. Authenticatin and Authrizatin Authenticatin using Active Directry integratin ensures that AppSense Management Center and prduct sftware is nly accessed r mdified by authrized administrative users. Cnnectins frm the Management Server t the database can be authenticated using Micrsft Windws authenticatin r Micrsft SQL authenticatin. An apprpriate certificate issued by a Certificatin Authrity, fllwing enterprise plicy and prcedure and installed n the Management Server, ensures the server can be validated befre client cnnectins are established. Client cnnectins are frm managed cmputers and cmputers hsting the Management Center cnsle and prduct cnsles. Securing Cmmunicatins using SSL SSL prvides cnfidentiality and integrity f cmmunicatins t ensure sensitive data is accessible nly by authrized users, including: Event data Agents and agent cnfiguratin data Page 15 f 132

16 NOTE: If yu are setting up SSL certificates n web servers using ther supprted perating systems and ther versins f Micrsft SQL Server, see the fllwing fr further infrmatin: Enable SSL Cmmunicatins SSL prvides cnfidentiality and integrity f cmmunicatins t ensure sensitive data is accessible nly by authrized users, including: Event data Agents and agent cnfiguratin data Set up Secure Scket Layers (SSL) fr the Management Center, using a self-signed certificate. NOTE: Yu can run the Install Deplyment Agent functinality within the cnsle in small and medium scale enterprise envirnments t repair r mdify the URL path fr currently deplyed Deplyment Agents t change the http r https prefix and prt number. Setup SSL n IIS 1. In Start > All Prgrams > Administrative Tls > Internet Services (IIS) Manager, select the <ServerName> nde and in the IIS sectin click Server Certificates. 2. Select Create Self-Signed Certificate in the Actins panel. 3. Prvide a friendly name fr the certificate and click OK. 4. Select the Default Web Site nde and click Edit Bindings in the shrtcut menu. 5. Click Add and in the Type drp-dwn list select HTTPS. 6. In the SSL Certificate drp-dwn list, select the friendly name f the certificate specified in step Click OK and Clse. Page 16 f 132

17 Management Center Wrkflw This sectin prvides an verview f the steps t cnfigure and set up the AppSense Management Center and managed cmputers. It includes the tasks required t setup Deplyment Grups and push ut Deplyment Agents. Step 1 Cnnect t the Management Server 1. Launch the Management cnsle frm Start> All Prgrams>AppSense>Management Center. If yu d nt have a Management Server setup, r have mre than ne, the Select Management Server dialg displays. 2. Add r select the required server and clickcnnect. The Cnnect t Management Server dialg displays. 3. Select t cnnect as Current User r a Custm User. TIP: Select Remember me t autmatically cnnect as this user in the future. 4. Click OK. Step 2 Create and Cnfigure Deplyment Grups T create a deplyment grup: 1. Select the Hme buttn in the navigatin pane. 2. Right-click the Deplyment Grups nde and select New Deplyment Grup. 3. Right-click the new nde and select Rename. Give the nde an intuitive name, fr example, Terminal Servers UK. 4. Repeat the abve steps fr additinal deplyment grups, fr example, Terminal Servers US. 5. Cnfigure the fllwing settings: Server plling, dwnlads and uplads Deplyment Agent permissins Agent and Cnfiguratin Installatin schedules Failver servers Access credentials Step 3 Setup Membership Rules Membership rules determine which grup a cmputer is assigned t. Yu can cnfigure the rules by adding and excluding cnditins fr cmputers, grups and cntainers. Membership rules have a ne t ne relatinship with deplyment grups. The Discver actin places a cmputer int the first grup that has a matching rule. Page 17 f 132

18 NOTE: Rules are read in the rder they are listed in the Membership Rules wrk area. Yu can use the Mve Up and Mve Dwn cmmands t rder the rules. 1. Select the Hme navigatin buttn. 2. Select [Server] > Deplyment Grups > [Deplyment Grup] > Cnfigure Membership Rules buttn. The Membership Rules wrk area displays and lists all the deplyment grups. 3. Select the deplyment grup in the list yu want t add a cnditin t. 4. Select Edit Cnditins in the Actins panel. The Edit Grup Cnditins dialg bx displays. 5. Click Add and d ne f the fllwing: Select Cmputer by NetBIOS Name and specify the NetBIOS name fr the cmputer r brwse t the cmputer. Use Active Directry and select Cmputer, Grup r Cntainer and specify r brwse t the Active Directry cmpnent. 6. Repeat t add additinal cnditins, if required and click OK. 7. Click Submit t submit the changes t the rule. NOTE: Discvery takes place every five minutes. Click Discver t perfrm an immediate discvery f cmputers. Yu cannt cnfigure this time within the cnsle. 8. If required, expand the deplyment grup yu have discvered cmputers fr and select the Cmputers nde. Details abut the discvered cmputers display in the Cmputers wrk area. Step 4 Setup Security (Optinal) The Management Center cnsle installs with an Administratr accunt assigned t the user installing the sftware. This user is assigned a Server Administratr server rle which gives full access and cntrl t all areas and functins n the Management Server. Yu can als add ther user accunts and assign that server rle r anther f the default server rles, Mdifier r Viewer. Yu can create custm server rles t which yu can assign permissins frm a cmprehensive list. Yu can als setup custm bject rles which are used t setup security assignments in particular areas f the Management cnsle. Yu can assign permissins t an bject rle t allw users t view, mdify r delete bjects in different areas f the cnsle such as deplyment grups, alert rules, packages r reprts. Object rle access and cntrl can be specified at a very granular level in sme areas f the cnsle allwing yu t grant r restrict access either t a specific area such as a Deplyment Grup r t a particular bject, such as a reprt r an alert rule. Page 18 f 132

19 1. Select the Security buttn in the navigatin pane t setup security. 2. T view r edit the server permissins fr a grup r user expand the Server Permissins nde. 3. Select either the Grups nde r the Users nde. The Grups r Users display in the All Grups/All Users wrk area. 4. T edit rles click a grup r user, select the grup r user and select Edit Rles. The Glbal Security Rles dialg bx displays. 5. Allw r deny the rles and click OK. Step 5 Set the Pll Perid and Pll Variance The pll perid cntrls hw frequently the Deplyment Agent checks the Management Server fr changes t the AppSense prduct agents, cnfiguratins and deplyment grups. Yu can specify hw ften t pll. Yu can als specify the uplad event data perid. After yu define a pll perid and uplad event data perid yu can include a pll variance t reduce the ptential server lad when multiple Deplyment Agents are set t pll at the same time. 1. Navigate t Deplyment Grups > [Deplyment Grup] > Settings > General tab. 2. Specify the server plling and dwnlads perid. The perid can be set between 1 minute and 7 days. The default is 1 hur with a default pll variance f 20%, that is +/-12 minutes. 3. Specify the event data uplads. The perid can be set between 1 minute and 1 day. The default is 30 minutes with a default pll variance f 50%, that is +/-15 minutes. TIP: If yu intend n installing the Deplyment Agent manually n end-pint cmputers and nt thrugh the Management Center, the Allw self-registratin ptin must be selected in the Deplyment Agent Permissins sectin. Step 6 Specify the Installatin Schedule The Installatin Schedule cntrls hw agent and cnfiguratin packages install. If yu d nt enable the installatin, agents and cnfiguratins will nt install r uninstall. Yu can chse t install immediately, n cmputer startup, r n a schedule. 1. Expand the Deplyment Grups > [Deplyment Grup] > Settings nde. 2. Select the Installatin tab. 3. Set the Agent and Cnfiguratin Installatin Schedules t ne f the fllwing: 4. Click Submit. Disable - Agents/Cnfiguratins d nt install. Autmatically at next client pll - Agents/Cnfiguratins install when the cmputer next plls. Autmatically scheduled - Agents/Cnfiguratins install accrding t the specified schedule. At next system restart - Agents/Cnfiguratins install n next restart. NOTE: The installatin schedule uses the lcal time f the endpint. Page 19 f 132

20 Step 7 Assign Packages Check the availability f packages in the Packages view. The Management Center installatin lads the latest sftware int the database. Where apprpriate, yu can add existing packages such as cnfiguratins and earlier versins f the sftware agent packages which yu have previusly backed up in MSI file frmat prir t running the current installatin. Apply security access rights t packages t restrict r enable access and cntrl. Use the Packages view t view, add and remve agents and cnfiguratins, and t exprt cnfiguratins. Select the Packages buttn in the navigatin pane t display all the available packages, that is, all the agents and cnfiguratins. T assign a package t a deplyment grup. 1. Select the Hme buttn. 2. Select Deplyment Grups > [Deplyment Grup] > Packages nde. 3. T submit a package fr assignment t the deplyment grup, select the package and click Submit. 4. T assign the package, select the package and click Assign. CAUTION: Yu must enable the installatin schedule fr the deplyment grup befre yu can install agents and cnfiguratins. Step 8 Setup Alert Rules (Optinal) The Alerts view prvides a cmprehensive list f default alert rules which yu can enable r disable. Yu can als create new alert rules by specifying cmbinatins f the event ID, cmputer name and user name. Cnfigure alert rule ntificatins using mail server details fr and SNMP messages abut critical events yu wish t mnitr. 1. Select the Alerts buttn in the navigatin pane. 2. Expand the Alert Rules nde. 3. Select and expand the rule yu want t use in the navigatin pane. 4. If required, click the Criteria nde and specify criteria, fr example, a user name. 5. Expand the Actins nde and d ne f the fllwing: T send messages when the alert criteria is met, select the SMTP nde, select EnableSMTP and specify the settings in the SMTP cnfiguratin area. T generate SNMP traps when the alert rule criteria is met, select the SNMP nde and select Enable SNMP. Step 9 Setup Auditing (Optinal) Use Auditing t specify which events client cmputers send t the Management Server fr each prduct agent. Yu can als specify t display cmputer and user names annymusly. Events can be generated by: Page 20 f 132

21 Applicatin Manager Envirnment Manager Perfrmance Manager Management Center 1. Select the Hme buttn in the navigatin pane. 2. Expand the Deplyment Grups > [Deplyment Grup] > Settings nde. 3. Select the Auditing tab. The Auditing wrk area displays. 4. T display cmputer names annymusly, select Always use annymus MACHINE names in events. 5. T display user names annymusly, select Always use annymus USER names in events. 6. In the Event Filter expand the prduct name that yu want t enable events fr. 7. Select the Enabled clumn fr the required events. Step 10 Setup Access Credentials Befre yu can install the Deplyment Agent n any endpint, Access Credentials must be supplied. The list f credentials are used by the Management Server t install the Deplyment Agent when chsen by the user. Yu can add multiple users t the list and they are attempted in the rder defined in the Access Credentials wrk area. Access Credentials cnfigured frm the tp level tree view apply t all Deplyment Grups by default, unless specific credentials have been defined within a specific Deplyment Grup. In this case, the Deplyment Grup s Access Credentials precede the default credentials. Yu can create default Access Credentials and credentials specific t a deplyment grup. Glbal Access Credentials 1. Select the Hme buttn in the navigatin pane. 2. Select the Glbal Settings nde. 3. Select the Access Credentials tab. 4. The Access Credentials wrk area displays. 5. D ne r mre f the fllwing: T add a credential enter the User name and Passwrd and select Add. T remve a credential, highlight the required credential and select Remve. T rder credentials in the list highlight the required credential and select Mve Up and Mve Dwn. Page 21 f 132

22 Access Credentials fr Deplyment Grups 1. Select the Hme buttn in the navigatin pane. 2. Navigate t Deplyments Grups > [Deplyment Grup]. 3. In the Details sectin in the wrk area select the Manage Credentials buttn. The Manage Credentials dialg displays. 4. D ne r mre f the fllwing: T add a credential enter a User name and Passwrd and select Add. T add the credentials t the glbal default list select Add t Glbal Credentials. T remve a credential, highlight the required credential and select Remve. T rder credentials in the list highlight the required credential and select Mve Up and Mve Dwn. Step 11 Install the Deplyment Agent n Managed Cmputers The Deplyment Agent can be installed n client cmputers using any f the fllwing methds. Befre yu can install the Deplyment Agent yu must setup the Access Credentials. 64-bit Deplyment Agent packages can nly install n 64-bit perating systems. 32-bit Deplyment Agent packages can nly install n 32-bit perating systems. 1. Dwnlad the Deplyment Agent installatin package frm the Management Server website and run the installatin package n the client cmputer. 2. The Deplyment Agent can be installed manually by running the installatin package r silently using a cmmand line prmpt. 3. Deply the Deplyment Agent t multiple client cmputers using the Install Deplyment Agent functinality within the cnsle r ther third-party deplyment mechanisms, such as Micrsft System Management Server, depending n the scale f deplyment required. Install using the Install Deplyment Agent Functinality 1. Expand the Deplyment Grups > [Deplyment Grup] ndes. 2. Select the Cmputers nde. 3. All the cmputers within the deplyment grup display. 4. Select ne r mre f the cmputers and click Install Deplyment Agent in the Actins panel. The Client Access Lg prvides details n the installatin prcess and the Deplyed (%) clumn indicates the percentage f the package deplyed. Page 22 f 132

23 Once the Deplyment Agent is installed, the service registers with the Management Server at the website address yu supplied during installatin. After the Deplyment Agent dwnlads the deplyment grup settings, the service implements the plicies t install sftware, generate events and pll the server fr further changes and package updates. The Deplyment Agent regularly plls the server fr updates and changes t the deplyment plicy, accrding t the deplyment grup settings. Ensure that yu prvide a valid Management Server URL and prefix the address apprpriately with HTTPS r HTTP depending n whether yu are implementing the Management Center with SSL encryptin and a valid certificate r in a wrkgrup envirnment withut SSL. Step 12 Install and Cnfigure Failver Servers (Optinal) Failver Servers prvide a list f alternate Management Servers t which the Deplyment Agent can cnnect t. In the event f a cnnectin failure the Deplyment Agent attempts t cnnect t the next available server in the list. Management Servers are listed in rder f pririty, starting with the first in the list. The Failver Servers list is autmatically ppulated with the URLs that the Deplyment Agents use t cnnect t the Management Server. Install additinal Management Servers and select t use the existing SQL Server name and database name. After installatin, add the URL f the failver server t the list f servers in the Management Center cnsle. Yu can specify default failver servers and failver servers specific t a deplyment grup. Failver servers assigned t a particular deplyment grup can verride the default failver servers. NOTE: Fr mre infrmatin abut installing the Management Server, see the AppSense DesktpNw Install and Cnfigure Guide. Default Failver Servers 1. Select the Hme buttn in the navigatin pane. 2. Select the Glbal Settings nde > Failver Servers tab. 3. D ne f mre f the fllwing: T add a server, select Add Serverin the Actins panel. The Add Failver Server dialg bx displays. Specify the server yu want t add. T remve a server, highlight the required server in the list and select Remve Servers in the Actins panel. T rder existing servers, select Mve Up and Mve Dwnin the Actins panel. T test a server cnnectin, select Test Server Cnnectinin the Actins panel. A message displays t cnfirm cnnectin. Page 23 f 132

24 Deplyment Grup Failver Servers 1. Select the Hme navigatin buttn. 2. Expand the Deplyments Grups > [Deplyment Grup] > Settings ndes. 3. Select the Custm Failver Servers tab. 4. D ne r mre f the fllwing: T add a server, select Add Serverin the Actins panel. The Add Failver Server dialg bx displays. Specify the server yu want t add. T remve a server, highlight the server in the list and select Remve Servers. T rder existing servers, select Mve Up and Mve Dwn. T test a server cnnectin, select Test Server Cnnectin. A message displays t cnfirm cnnectin. T verride the default list f failver servers, select the Override Default Failver Servers ptin. The deplyment grup list f failver servers verrides the default servers fr all Deplyment Agents in the current deplyment grup. T manage the default list f servers, select Manage Default Failver Servers. Page 24 f 132

25 Deplyment Agent The Deplyment Agent is a sftware agent that must be deplyed t all clients managed by the AppSense Management Center. The Deplyment Agent runs as a Windws Service and perfrms tasks n the client when instructed by the Management Server. These tasks include the installatin, upgrade and uninstall f AppSense agents and cnfiguratins and the cllectin and uplading f auditing infrmatin frm any AppSense prduct agent. The Deplyment Agent plls the Management Servers peridically as determined by the pll perid f the deplyment grup f which it is a member. Membership f a deplyment grup is determined by the set f membership rules as defined within the Management Cnsle. During each pll, the Deplyment Agent asks the Management Server which agents, cnfiguratins and prerequisites shuld be installed n the client, and which auditing events shuld be cllected. The Deplyment Agent uses this infrmatin t ensure nly the crrect set f agents and cnfiguratins are installed n the client and t filter the events cllected by the AppSense prduct agents. The Deplyment Agent peridically uplads all cllected events t the Management Server. Access Credentials The Access Credentials are used t specify a list f credentials used by the Management Server t install the Deplyment Agent. These credentials must be supplied befre attempting t install the Deplyment Agent n any endpint via the Management Cnsle. Cnfiguratin f these credentials can be setup glbally fr the Management Server in Hme > Glbal Settings > Access Credentials tab r per Deplyment Grup in Hme > Deplyment Grups > [Deplyment Grup] > Details sectin > Manage Credentials buttn. Access Credentials cnfigured thrugh Glbal Settings apply t all Deplyment Grups by default, unless specific credentials have been defined within a specific Deplyment Grup. In this case, the Deplyment Grup s Access Credentials precede the default glbal credentials. CAUTION: Yu will nt be able t install the Deplyment Agent n any endpint using the integrated Install Deplyment Agent functinality if the credentials have nt been set up. T add Access Credentials, enter a user name and passwrd. These credentials are stred in the database. The Server Cnfiguratin Prtal (SCP) creates an RSA public-private key pair that is stred in the Micrsft Cryptgraphic Prvider f the server. This key is used t encrypt and decrypt the credentials stred in the database and therefre secures the infrmatin. On attempting t install the Deplyment Agent, the credentials supplied are tried in the rder defined in the list. These credentials can be rdered by making use f the Mve Up and Mve Dwn ptins in the Actins panel. Page 25 f 132

26 Deplyment Agent Cmmunicatin with the Management Server When cmmunicating with the Management Server, the Deplyment Agent will make use f the designated Client Authenticatin mdel as specified in the Management Server Cnfiguratin Utility during installatin f the Management Server. This makes use f either Annymus r Windws Authenticatin. When Annymus authenticatin is selected, the Deplyment Agent cmmunicates with the Management Server using a specific accunt designated fr annymus access, IUSR_[server name]. All interactins with the Management Server then inherit the permissins assigned t this accunt. When Windws authenticatin is used, the cmputer credentials are used t cmmunicate with the Management Server. An issue may ccur resulting with the fllwing message being displayed: Unable t access the Master Key n the server, errr was Keyset des nt exist. This is caused by the service accunts being unable t access the decryptin certificate stred n the Management Server. T reslve this issue, any identities that are used by the services f AppSense Management Center must be granted sufficient permissin t access the key stre. This is achieved by using the fllwing cmmand line: aspnet_regiis.exe -pa AppSenseMasterKey <DOMAIN>\<USERNAME> Deplyment Agent Registering with the Management Server Once the Deplyment Agent has been installed successfully, the Deplyment Agent service registers with the Management Server. There are a number f ways in which the Deplyment Agent can register with the Management Server: Deplyment Agent is installed directly via the Install Deplyment Agent ptin within the Management Cnsle, it will autmatically register with the Management Server. Deplyment Agent is installed manually using the ClientCmmunicatinsAgent.msi file as dwnladed frm the Management Server website, a valid Management Server must be supplied t allw the Deplyment Agent t cmmunicate and register with the Management Server. Deplyment Agent is installed manually frm the cmmand line including a valid Management Server URL and ptinally, a specific Deplyment Grup with which t self-register. NOTE: The Deplyment Agent can nly self-register if Allw self-registratin is selected in Hme > Deplyment Grups > [Deplyment Grup] > Settings > General tab > Deplyment Agent Permissins. Page 26 f 132

27 If a Deplyment Grup is nt specified during the installatin prcess r the relevant grup des nt allw the Deplyment Agents t self-register, then the Management Server searches the membership rules, if a match is fund the cmputer is placed in the grup. If n match is fund then the cmputer is placed in the catch-all (Default) Deplyment Grup. After the Deplyment Agent registers with the server, the AppSense Deplyment Agent service implements the plicies t install sftware, generate events and pll the server fr further changes and package updates. All available agent, cnfiguratin and prerequisite packages are stred within the Management Server database, which is ppulated by the Management Server installatin prcedure. A list f assigned packages, cnfigured fr the specific deplyment grup is dwnladed by the Deplyment Agent n the managed endpint device frm the Management Server. This list is then cmpared with what is installed n the endpint. If this list f assigned packages differs frm what is installed n the endpint, the required packages are dwnladed frm the Management Server. Cmputer restart is c-rdinated accrding t the installatin schedule settings as specified n the relevant deplyment grup. Packages are then installed n either cmputer shutdwn r restart depending n the deplyment grup installatin settings. Cnfiguratins and deplyed Deplyment Agent upgrades can be installed mid-sessin withut a rebt depending n the deplyment grup settings. Installing the Deplyment Agent The Deplyment Agent must be installed n all endpints t be managed by AppSense Management Center. The Deplyment Agent can be distributed using the integrated Install Deplyment Agent functinality within the Management Cnsle, by dwnlading the ClientCmmunicatinsAgent.msi package frm the Management Server web site r by third-party deplyment mechanisms. Prerequisites The fllwing are prerequisites fr all cmputers t allw Deplyment Agent installatin: Allw File and Print Sharing in the Firewall settings. The default Windws File and Print share exceptin pens up the fllwing prts: NetBIOS - TCP 139, UDP 137, UDP 138 LLMNR - TCP 5255, UDP 5355 SMB - TCP 445 RPC - TCP 135, TCP 445, UDP 445 Access t ADMIN$ share and IPC$ share. Page 27 f 132

28 Access t the Service Cntrl Manager (SCM) with the fllwing rights: Create a service (SC_MANAGER_CREATE_SERVICE) Query service status (SERVICE_QUERY_STATUS) Service all access (SERVICE_ALL_ACCESS) Service stp (SERVICE_STOP) Service start (SERVICE_START) Service delete (DELETE) Windws Installer service running. Server service running. We recmmend setting up deplyment grups and cnfiguring settings in the Management Cnsle befre installing the Deplyment Agent. Yu can run the Install Deplyment Agent functinality in small and medium scale enterprise envirnments t deply the Deplyment Agent t multiple cmputers, r t repair r mdify the URL path fr currently deplyed agents t change the http r https prefix and prt number. The Install Deplyment Grup functinality is available in Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Cmputers. The IT administratrs in rganizatins ften create master images which include the perating system with all the required sftware and updates required fr a new cmputer, as a labr saving apprach t setting up multiple cmputers. It is recmmended t install the Deplyment Agent n a gld image prir t rlling ut t cmputers in yur rganizatin. Integrated Install Deplyment Agent Functinality The Management Cnsle prvides an Install Deplyment Agent functin which allws yu t deply the Deplyment Agent t multiple cmputers which match the Management Center Deplyment Grup and Membership Rules. The Deplyment Agent can be deplyed either n a Micrsft Active Directry netwrk r in a Micrsft Windws Wrkgrup in small r medium scale envirnments. The sftware requirements fr the target client cmputers are detected and the 32-bit r 64- bit versin f the Deplyment Agent, assigned t the deplyment grup f which the cmputer is a member, is dwnladed. If n versin f the Deplyment Agent is assigned t the grup then the latest versin is dwnladed. Deplyment Agents are cpied t the target cmputers and installed silently, alng with the crrect URL f the Management Server. The basic steps required t install the Deplyment Agent are as fllws: Step 1 - Deplyment Grup Hme > [Server] > Deplyment Grups Page 28 f 132

29 1. Create a Deplyment Grup. 2. Cnfigure the plling settings in Deplyment Grup > Settings > General tab - Plling is where the Deplyment Agent n the endpint initiates cmmunicatin with the Management Server. The pll perid is split int the fllwing: Server Plling and Dwnlads - Deplyment Agent dwnlads updates t the deplyment grups and agent and cnfiguratin packages. Pll variance - reduces the impact f multiple machines plling the Management Server at any ne time. Event Data Uplads - Deplyment Agent uplads event data t the Management Server. Pll variance - reduces the impact f multiple machines plling the Management Server at any ne time. 3. Setup the agent and cnfiguratin installatin schedules in the Installatin tab. NOTE: A warning displays in Deplyment Grups > [Deplyment Grup] > Cmputers if an installatin schedule is set t Disable. Step 2 - Membership Rules Hme > [Server] > Membership Rules Every Deplyment Grup has a ne t ne relatinship with a set f Membership Rules. The Membership Rules act like a filter t discver cmputers within Active Directry. 1. Highlight a Deplyment Grup, select Edit Cnditins t add a new cnditin based n NetBIOS Name r Active Directry. Click OK. 2. Select Submit frm the Membership Rules wrk area. 3. Select Discver frm the Actins panel. 4. The discvered cmputers that match the Membership Rules are listed in the relevant Deplyment Grup > Cmputers nde. NOTE: Fr the cmputers discvered by Membership Rules the Cmputer Status shuld initially display: N Deplyment Agent deplyed. Step 3 - Access Credentials Custm - Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Details sectin > Manage Credentials buttn r Glbal - Hme > [Server] > Glbal Settings > Access Credentials tab Enter the user credentials; user name and passwrd, fr an accunt which has lcal administratr privileges n the endpint that the Deplyment Agent is being installed. Yu can add multiple accunts, they will be attempted in rder f the list. Page 29 f 132

30 CAUTION: Yu will nt be able t install the Deplyment Agent n any endpint using the integrated Install Deplyment Agent functinality if the credentials have nt been set up. Step 4 - Install Deplyment Agent Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Cmputers 1. Select the cmputer r cmputers n which yu want t install the Deplyment Agent. 2. Select Install Deplyment Agent frm the Actins panel. The Client Access Lg prvides details n the installatin prgress. The Deplyed (%) clumn indicates the percentage f all the packages assigned t the grup that have been deplyed. NOTE: If the cmputer is in a Wrkgrup yu must make sure that Annymus authenticatin is selected as the client authenticatin methd in the SCU. Install the Deplyment Agent using an Installatin Schedule Yu can deply the Deplyment Agent assigned t a grup t the cmputers listed in the Cmputers page using an installatin schedule. The Deplyment Agent can be deplyed either n a Micrsft Active Directry netwrk r, in small r medium scale envirnments, in a Micrsft Windws Wrkgrup. The Management Center uses grup membership rules t create a list f cmputers t which it can deply the Deplyment Agent. Active Directry is queried fr active directry types fr membership rules by cmputers, grups and cntainers. Alternatively, yu can manually include r exclude cmputers frm the list by NetBIOS Name. NOTE: Yu must specify Access Credentials befre Management Center can install the Deplyment Agent. Management Center deplys the Deplyment Agent installatin package that has been assigned t the grup. If yu did nt assign a Deplyment Agent installatin package, Management Center detects the latest available versin fr the target cmputers and dwnlads the 32-bit r 64-bit versin as required. Deplyment Agents are installed silently, alng with the crrect URL f the Management Server. T install the Deplyment Agent using the Install Deplyment Agent Functinality: 1. Select the Hme navigatin buttn. 2. Expand [Server] > Deplyment Grups > [Deplyment Grup] > Settings > Installatin tab. 3. Setup the Installatin schedule. 4. Navigate t Deplyment Grups > [Deplyment Grup] > Cmputers. Page 30 f 132

31 5. Select the cmputer yu want t deply t and select Install Deplyment Agent frm the Actins panel. 6. Yu can review installatin feedback n the Client Access Lg tab in the wrk area. NOTE: A warning displays in Deplyment Grups > [Deplyment Grup] > Cmputers if the installatin schedule is set t Disable. After the Deplyment Agent is installed it registers with the Management Server. After registering, the deplyment agent implements the plicies t install sftware, generate events and pll the server fr further changes and package updates. The Deplyment Agent regularly plls the server fr updates and changes t the deplyment plicy, accrding t the deplyment grup settings. Install the Deplyment Agent Manually Yu can manually install the Deplyment Agent n a managed cmputer by dwnlading and running the Deplyment Agent installatin package n a client cmputer. 1. Launch a web brwser such as Micrsft Internet Explrer and navigate t the Management Server web site at the fllwing address: name>/managementserver NOTE: If yu have cnfigured SSL cmmunicatins, use the HTTPS prefix fr the Management Server web site: name>/managementserver/ The Management Center dwnlad page displays where yu can dwnlad the Deplyment Agent, prduct cnsles, release ntes and cmpnents which are prerequisites fr installing AppSense DesktpNw. 2. Dwnlad and run the apprpriate 32-bit r 64-bit Deplyment Agent installatin MSI package. NOTE: Make a nte f the Management Server URL displayed in the dwnlad page. Frm the website yu can als dwnlad the Management Cnsle, EULA, release ntes, Applicatin Manager, Envirnment Manager and Perfrmance Manager cnsles, and prerequisites sftware. 3. In the Deplyment Agent installatin Welcme screen, click Next. 4. Accept the End User License Agreement and click Next. 5. Leave the default installatin directry unchanged, and click Next. 6. The Deplyment Agent Settings screen displays: Enter the Management Server cmputer name, Name>:Prt Number/. NOTE: If yu have cnfigured SSL cmmunicatins, use the HTTPS prefix fr the Management Server web site: name>:prt Number/ 7. Click Next t prceed. 8. When the installatin is cmplete, click Finish t exit the installatin wizard. Page 31 f 132

32 Yu have nw successfully installed the AppSense Deplyment Agent. The hst cmputer is able t cnnect t yur Management Server ready t dwnlad prduct Agents, license and cnfiguratin sftware packages accrding t the settings cnfigured fr the deplyment grup t which the current cmputer belngs. Install the Deplyment Agent in Silent Mde Yu can install the AppSense Deplyment Agent silently via a third-party deplyment mechanism using the cmmand line prmpt. msiexec.exe /qn /i "<MSI file path>\clientcmmunicatinsagent.msi" WEB_ SITE=" Server Name>:Prt Number" GROUP_NAME="<DeplymentGrup>" NOTE: Use the HTTPS prefix fr the Management Server web site nly if yu intend t install an SSL certificate n the server cmputer and managed cmputers are lcated in the same Active Directry dmain as the Management Server. /i - Install /qn Quiet mde install withut the user interface. WEB_SITE Enter the Management Server web site address using the name f the hst cmputer. GROUP_NAME (Optinal) Enter the Deplyment Grup name t which the Deplyment Agent shuld register. The Deplyment Agent can nly register with a grup which is set up t allw the Deplyment Agent t self-register. Otherwise, the Deplyment Agent attempts t register with the Management Server deplyment grups accrding t grup membership precedence: GROUP_NAME self-register Deplyment Grups - membership rules (Default)Grup if n match is fund Cnfiguring the Deplyment Agent Allw Deplyment Agent t Self Register with a Deplyment Grup Yu can set up a deplyment grup t allw the Deplyment Agent t self-register with a specific grup. This ptin is disabled by default but prvides an alternative methd fr installing Deplyment Agents n managed cmputers t register with a specific deplyment grup n the Management Center rather than predefining the grup membership in the Management Cnsle. 1. Select the Hme buttn in the navigatin pane. 2. Expand the [Server] > Deplyment Grups > [Deplyment Grup] nde. Page 32 f 132

33 3. Select the Settings nde. 4. Select the General tab. 5. Select the Allw self-registratin ptin. Any user can nw chse during Deplyment Agent installatin fr the cmputer t jin the deplyment grup. Allw Deplyment Agent t Unregister frm a Deplyment Grup Yu can set up a deplyment grup t allw a lcal administratr t request the Deplyment Agent unregisters cmputers frm a specific grup. This ptin is disabled by default. 1. Select the Hme buttn in the navigatin pane. 2. Expand the [Server] > Deplyment Grups > [Deplyment Grup] nde. 3. Select the Settings nde. 4. Select the General tab. 5. Select the Allw unregistratin ptin. An administratr can nw cmmand the Deplyment Agent t unregister cmputers frm this deplyment grup. Allw Deplyment Agent Initiate Updates Yu can set up a deplyment grup t allw a lcal administratr t request the Deplyment Agent initiates updates f agents and cnfiguratins utside f any installatin schedule that is set up. This ptin is disabled by default. 1. Select the Hme buttn in the navigatin pane. 2. Expand the [Server] > Deplyment Grups > [Deplyment Grup] nde. 3. Select the Settings nde. 4. Select the General tab. 5. Select the Allw update initiatin ptin. An administratr can nw cmmand the Deplyment Agent t immediately install r uninstall packages fr this deplyment grup regardless f the installatin schedule. Page 33 f 132

34 CCA Cmmand Tl The CCA Cmmand tl, CcaCmd.exe, allws an administratr t cnfigure the Deplyment Agent frm an endpint giving an advanced level f cntrl ver the Deplyment Agent and its behavir. Administratrs may use it t prepare a master image fr prvisining. The cmmands can be run individually r in a batch file as part f an existing prvisining script. Befre Using the CCA Cmmand Tl Befre yu can use CcaCmd.exe the fllwing cnditins must be met: 1. ClientCmmunicatinsAgent.msi installed n the endpint. 2. The fllwing permissins must be enabled in Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Settings > Deplyment Agent Permissins: Allw self-registratin - maps t CCA Cmmand tl switch /URL Allw unregistratin - maps t CCA Cmmand tl switch /UNREGISTER and /IMAGEPREP Allw update initiatin - maps t CCA Cmmand tl switch /UPDATEAGENTS and /UPDATECONFIGS 3. Yu must be a member f the lcal administratrs grup and running with an elevated tken. Using the CCA Cmmand Tl The CcaCmd.exe cmmands are as fllws: Cmmand /url /imageprep Descriptin Changes the url used t cmmunicate with the Management Server. Yu can ptinally include a Deplyment Grup with which t self register. This requires Allw selfregistratin t be enabled in the Deplyment Grup Settings. Prepares this cmputer fr prvisining, the cmputer will be registered n the next pll. This cmmand can be cmbined with the /unregister cmmand. NOTE: When running /imageprep, the Deplyment Agent will autmatically Check fr and dwnlad new Cnfiguratins at Startup regardless f the Deplyment Grup Settings. /unregister Unregisters the Deplyment Agent frm the Management Server and stps the Deplyment Agent service. Des nt uninstall any AppSense agents r cnfiguratins. This requires Allw unregistratin t be enabled in the Deplyment Grup Settings. Page 34 f 132

35 Cmmand Descriptin NOTE: Once a cmputer has been unregistered the Deplyment Agent Service must be restarted fr the cmputer t re-register. /updateagents /updatecnfigs /isupdating Initiates install f agents assigned t the Deplyment Grup, verriding the Installatin Schedule. This requires Allw update initiatin t be enabled in the Deplyment Grup Settings. A system restart is triggered if requested by the installer. The system restart can be suppressed by supplying the /suppressrebt ptin. The updating f agents is asynchrnus. Use /isupdating t check if the Deplyment Agent is still applying updates. Initiates install f cnfiguratins assigned t the Deplyment Grup, verriding the Installatin Schedule. This requires Allw update initiatin t be enabled in the Deplyment Grup Settings. The updating f cnfiguratins is asynchrnus. Use /isupdating t check if the Deplyment Agent is still applying updates. Determines whether a previus call t /updateagents r /updatecnfigs is still prcessing updates. Deplyment Agent Diagnstics Diagnstics prvide the administratr with an verall view f the health f the Deplyment Agent in terms f the relatinship and cmmunicatin with the Management Server. Diagnstics can be enabled r disabled fr each Management Server frm the Hme > Deplyment Grups > Glbal Settings > Failver Servers tab by selecting the Diagnstics Enabled ptin next t the relevant Management Server. This ptin is disabled by default. When the Diagnstics Enabled ptin is selected, the Deplyment Agent n managed endpint devices runs a series f self-tests n first cntact with the Management Server r when requested by the Management Server during a pll. Additinally, t perfrm a manual diagnstics test select the Request Diagnstics ptin frm the Actins panel available frm the All Cmputers nde. An event which indicates the test result, is raised in the Windws Event Lg n the managed endpint device and sent t the Management Server. Each test prvides a success r failure result and, where a test fails, a detailed errr reprt is included in the event reprt. In the event f a test failure the Management Cnsle highlights, in red, the names f the cmputers where the failure ccurred and als highlights the deplyment grups in the navigatin pane cntaining cmputers n which the tests failed. There are fur specific tests that are run when diagnstics are requested: Cnnectivity Page 35 f 132

36 The cnnectivity test invlves the Deplyment Agent attempting t pll the Management Server. Any respnse, ther than an HTTP 200 (Success) return value, indicates a failure and a detailed errr message is returned. If this test fails, the results cannt be sent t the Management Server (as there is n cnnectivity) but can be viewed in the lcal Applicatin Windws Event Lg n the endpint device. Dwnlad f Packages This test dwnlads a sample file frm the Management Server t the lcal hard disk f the endpint device, using the Backgrund Intelligent Transfer Service (BITS). Instead f dwnlading a full MSI package, the Deplyment Agent dwnlads a small XML file which can be easily validated and has a minimal impact n netwrk bandwidth. The XML file is dwnladed frm the same directry as standard MSI packages t ensure the same access rights affect bth file types. Once the test is cmplete, the dwnladed file is deleted. Since BITS dwnlads can be delayed if the lcal cmputer is under heavy lad, the dwnlad ccurs within a new high pririty BITS jb, ensuring the test cmpletes in a shrter time. A single BITS jb is used t dwnlad files frm all enabled failver URLs. If any errrs are reprted during the dwnlad, the test fails. A descriptin f the errr is included in the test results. High Pririty Events The high pririty events diagnstics test allws critical events t be sent t the Management Server database frm the managed endpint device. A typical high pririty event is the reprting f a failure t install packages. The test attempts a call by the Deplyment Agent frm the managed endpint t the Management Server with an empty list f events. Any errr values returned by the call are added t the results. Uplad f Events The diagnstics test attempts t uplad an events file using BITS frm the lcal hard disk n the endpint device t the Management Server. The events file is empty s as t help minimize impact n netwrk bandwidth, and is upladed t the same directry n the Management Server as standard event uplads. %\PrgramFiles%\AppSense\ManagementCenter\Server\WebSite\Deplyment\Events Since BITS uplads can be delayed if the lcal cmputer is under heavy lad, the uplad ccurs within a new high pririty BITS jb ensuring the test cmpletes in a shrter time. If any errrs are reprted during the uplad, the test fails. The descriptin f the errr is included in the test results. NOTE: This test nly verifies that events can be sent frm the Deplyment Agent n the managed endpint device t the Management Server. N checks are made t ensure that the events can be upladed t the database. When this fails, an event is added t the Management Server event lg and raises a Management Center event, where pssible. The Cmputers view within a specific Deplyment Grup prvides a Diagnstic State which indicates the current state f the diagnstics taking place n the endpint device. There are fur diagnstics states including: Untested Pending Page 36 f 132

37 Requested Cmpleted The diagnstics test results are reprted t the Management Server and displayed in the Diagnstics tab in the Management Panel area f the Cmputers view within the relevant deplyment grup, including a breakdwn f the test type and the result f each test. Page 37 f 132

38 Licensing AppSense Management Center enables yu t manage individual AppSense prduct licenses, and full AppSense DesktpNw licenses fr cmputers acrss yur Enterprise. Prduct licenses are managed using the AppSense DesktpNw Licensing cnsle when AppSense Management Center is nt being used. Licensing allws yu t: Add licenses fr DesktpNw prducts. Imprt and exprt licenses in MSI file frmat. License Agreement License details are included in the License Agreement which is issued when an rder fr AppSense sftware has been cmpleted. The License Agreement includes the fllwing infrmatin: Prduct, Feature, and Versin Details Issue Date Expiry Date Custmer Name Serial ID Tgether with the license agreement yu will receive either a TXT file r a LIC file. Use file t add r imprt the license. If a prduct license r an evaluatin license expires yu will receive limited r n functinality n the endpint. An Event is raised fr each unlicensed prduct. Managing Licenses The fllwing prcedures describe hw t add a license and imprt r exprt a license. Add a License 1. In the Management Cnsle, select the Hme navigatin buttn. 2. Select the Licensing nde. 3. In the Actins panel click Add License. The Add License Key dialg displays. Page 38 f 132

39 4. Enter the license key and click Add. If yu received a TXT file frm AppSense, pen the file and cpy the license key, paste it in t the Add License Key dialg. If yu received a LIC file frm AppSense, refer t the Imprt a License File sectin. Details f the license are displayed in the cnsle and the license key is added t the fllwing lcatin: %ALLUSERSPROFILE%\AppSense\Licenses 5. Sme license types may need activating. Click Activate License, enter the activatin cde and click Enter. Once a license is active the icn changes t indicate the current license state. 6. Any prduct license added t the Management Center, is autmatically deplyed t the managed endpint at time f plling. Managed endpints are any devices which have the Deplyment Agent installed. The endpint autmatically uses the first valid license if finds. Yu d nt have t assign a particular license t a particular grup r endpint. Imprt a License File 1. In the Management Cnsle, select the Hme navigatin buttn. 2. Select the Licensing nde. 3. In the Actins panel, click Imprt Licenses. The Open dialg displays. 4. Select the required license LIC file. 5. Click Open. Details f the license are displayed in the cnsle and the license key is added t the fllwing lcatin: %ALLUSERSPROFILE%\AppSense\Licenses Exprt a License File Exprt licenses t MSI r LIC file frmat fr saving t ther cmputers which can be remtely accessed. 1. In the Management Cnsle, select the Hme navigatin buttn. 2. Select the Licensing nde. 3. In the Actins panel, click Exprt Licenses. The Save As dialg displays. 4. Brwse t the required lcatin, prvide a name fr the file and click Save t save the file. Page 39 f 132

40 Patching AppSense DesktpNw prducts can be patched using a Windws Installer patch (MSP file). A patch is an MSP file which, when installed, updates files and registry keys n an existing installed prduct. Installing an MSP can reduce system dwntime as rebts are nt always required. DesktpNw prduct patching gives all f the usual benefits assciated with Windws Installer Patching, including ease f deplyment and the ability t rllback t an earlier versin. Patch Distributin Public Htfix - Issued publicly n myappsense t address a widely reprted issue and shuld nly be installed t address the specific prblem. Public Htfixes are cumulative in that they cntain all previus Private and Public Htfixes. Public Htfixes are distributed as an MSP. Service Pack - Cntains all f the fixes frm the last Private r Public Htfix and any previus Service Packs, plus any fixes that have been fund fr which a Private r Public Htfix was nt issued. Service Packs are distributed as an MSP. Installing Patches Using the Management Center T install a patch using AppSense Management Center yu must first uplad the MSP and then assign it t a deplyment grup fr deplyment t the endpints. Uplad an MSP 1. Open the Management Cnsle and in the navigatin pane select the Packages navigatin buttn. 2. Click n the required prduct, fr example Envirnment Manager. The package library fr the selected prduct displays in the wrk area. 3. Frm the Actins panel, select Add Package. The Brwse fr Package dialg displays. 4. Lcate the required MSP file and click Open. NOTE: The base MSI package fr the selected patch must have previusly been upladed. 5. The Package Uplad wizard displays. 6. Check the details f the selected package and ptinally enter a descriptin. 7. Click Next t start the uplad. Page 40 f 132

41 8. When the uplad has cmpeted successfully click Finish. The MSP can nw be seen in the package library. Deply an MSP t an endpint 1. In the Management Cnsle navigate t: Hme > Deplyment Grups > [Deplyment Grup] > Packages. The Packages wrk area displays a list f DesktpNw prducts and the assciated packages. 2. Highlight the required prduct package and frm the Actins panel select Change Agent Versin. A dialg t change the packages used by the grup displays. 3. Select the required patch package. Fr example, 8.6 SP2 HF3 4. Click Finish. The packages list updates. 5. Once all changes have been made, frm the bttm f the wrk area, click Review and Submit. The Submit Changes fr [Deplyment Grup] dialg displays. 6. Review the changes t be made t the deplyment grups and click Submit. NOTE: A warning may display infrming yu that changes t an agent can cause rebts at the times defined by the installatin schedule. 7. If the warning message displays, click Yes t assign the changes. Alternatively, click Submit t assign the changes. 8. The patch deplys t the deplyment grup cmputers accrding t the Installatin Schedule. Installing and Uninstalling Patches Using the Cmmand-Line AppSense DesktpNw patches can be installed frm the cmmand-line as well as frm the AppSense Management Center. NOTE: It is recmmended that Lgging is switched n when using the fllwing cmmands. T enable Lgging add /l*vx Patch.lg immediately after the /i r /p. Fr example: msiexec.exe /i /l*vx Patch.lg Agent.msi Install an MSP T install an MSP type the fllwing cmmand: msiexec.exe /p Agent.msp Page 41 f 132

42 NOTE: D nt use /update when installing the MSP file as this will remve all existing features. Install an MSI and MSP T install an MSI and MSP in a single peratin type the fllwing cmmand: msiexec.exe /i Agent.msi PATCH=C:\FullPath\Agent.msp Uninstall an MSP T uninstall an MSP type the fllwing cmmand: msiexec.exe /i Agent.msi MSIPATCHREMOVE=C:\FullPath\Agent.msp Uninstall an MSI and MSP T uninstall an MSI and MSP type the fllwing cmmand: msiexec.exe /x Agent.msi NOTE: This uninstalls all assciated MSP files. Rlling-Back Patches Using AppSense Management Center t install patches, prvides additinal advantages such as the facility t dwngrade newer versins f MSI files as well as remving MSP files t apply previus versins. T rll back t an lder patch, just reassign the lder versin t the deplyment grup. Page 42 f 132

43 Hme Cnnect t the Management Server Cnnect the Management cnsle and Prduct cnsles t the Management Server using the Select Management Server dialg bx. Yu can add, edit and delete listed servers. When adding r editing a server, prvide the friendly name, enter a server name r IP address and prvide the cnnectin type (HTTP, HTTPS) and prt number. Yu can als brwse the netwrk r Active Directry t select a server. When cnnecting, yu are prmpted fr credentials using the current user accunt r a custm user fr which yu need t prvide name, passwrd and dmain. In the prduct cnsles, yu cnnect t the Management Server when attempting t pen a live cnfiguratin n a remte cmputer r when saving a cnfiguratin. Select Management Server The Select Management Server dialg displays when yu select Hme > [Server] > Actins panel > Cnnect... The dialg allws yu t cnnect t a Management Server and maintain the list f Management Servers with which yu regularly cnnect. Settings New Server Click t add a server t the list by prviding details in the Add Server dialg bx, including friendly name, server name (cmputer name r IP address), cnnectin type and prt number (HTTP/80, HTTPS/443). Edit Server Click t edit a listed server by prviding details in the Edit Server dialg bx, including, friendly name, server name (cmputer name r IP address), cnnectin type and prt number (HTTP/80, HTTPS/443). Delete Server Remve the highlighted server frm the list. Remve Cached Credentials - Select t delete any cached cnnectin credentials. The Management Server dialg prmpts yu t prvide credentials fr cnnecting t the selected server either using the currently cnnected user accunt r a custm user. Yu can brwse fr a user n the active directry r lcal netwrk, prvide a passwrd and, where apprpriate, the dmain. If Remember me is selected the credentials are cached. Page 43 f 132

44 Management Server The Management Server nde prvides an verview f the Management Center with getting started pints. The verview has Launch Cnsle buttns fr each f the AppSense DesktpNw prducts, Applicatin Manager, Envirnment Manager and Perfrmance Manager. The lwer sectin f the wrk area presents a summary f the cnnectin status f the Management Server and details n deplyment grups, cmputers and alerts. Deplyment Statistics Fr each f the DekstpNw prducts Applicatin Manager, Envirnment Manager and Perfrmance Manager, data is gathered and reprted n in the fllwing three areas: Number f agents installed Number f cnfiguratins installed Plled in Last 30 Days - Number f cmputers with an installed agent that have plled the Management Server within the last 30 days. Agents and cnfiguratins are included in each cunt if they have a status f Installed, Pending Uninstall, r Unmanaged. Cnnectin Cnnected T - Indicates the name f the server the Management cnsle is cnnected t. User - The name f the user currently lgged n. Click the link t view and edit the server permissins fr the current user. Nte that yu can nly edit if yu have permissin. Glbal Permissins - The glbal permissins f the current user. Fr example, Mdifier and Viewer. Click the link t display the system wide server rles. Deplyment Grups Deplyment Grups - Displays the number f deplyment grups defined within the Management Server. Deplyed - Displays the number f deplyment grups that are deplyed. With Errrs - Displays the number f deplyment grups with errrs, fr example a failed package deplyment. Page 44 f 132

45 Cmputers All - Displays the number f managed cmputers defined in the Management Server. Deplyed - Displays the number f cmputers with packages deplyed. Offline - Displays the number f cmputers ffline. A cmputer shws as ffline if the Deplyment Agent des nt pll back within twice the default pll perid. With Errrs - Displays the number f cmputers with errrs. An errr ccurs if an attempt has been made t deply a package and it has failed. Click a link t g t the All Cmputers view. Alerts All - Displays the ttal number f alerts. Alert rules allw yu t specify the event criteria t match with an incming event t generate an alert. Alert rules allcate a severity fr an alert and matches against the specified event ID. Alert rules can als match against any value fr cmputer r user t generate mre specific alerts. Critical - Displays the number f critical alerts. New - Displays the number f new alerts. New in Last 24 Hurs - Displays the number f new alerts in that have be generated in last 24 hurs. Click n any f the links t view further detail. Actins The Actins panel prvides the fllwing ptins: Cnnect - Launches the Select Management Server dialg. Select a Management Server t cnnect t. If already cnnected t a Management Server it is autmatically discnnected when anther ne is selected. Dwnlad Page(nly available when cnnected t a Management Server)- Displays the Management Center dwnlad page in a web brwser. All available sftware releases are listed fr dwnlad. Page 45 f 132

46 Settings - Launches the Settings dialg. Shw 'Getting Started' n hme screen - De-select t hide the Management Center Getting Started sectin frm the Server Overview screen when yu next launch the cnsle. Cmmunicatin Settings - Timeut values are set t determine the amunt f time the Management Cnsle shuld wait t get a respnse frm the Management Server, the default values are set t 60 secnds. Be aware that if yu set the value t lw themanagement Cnsle may nt be able t cmmunicate with the server and if the value is set t high then the Management Cnsle may stall if there is a cmmunicatins issue. General Timeut value is used by the Management Cnsle when cmmunicating with the Management Server. Reprt Timeut value is used by the Management Cnsle when generating a reprt. Details - Launches the Server Details dialg which displays all f the server details. Glbal Settings Glbal Failver Servers Failver servers can be setup s that in the event f the fllwing they can take ver the rle f the Management Server: A cnnectin, hardware r envirnment failure. Decmmissining a Management Server. Cnducting an update. Overhauling a Management Server. When installed n managed endpints the Deplyment Agent dwnlads the list f servers and maintains the list as a reference. If a Management Server is unavailable, the managed cmputer refers t the list and attempts t register with the next available server. The list f servers cnsists f ne r mre URLs. Yu can specify a server using the server NetBIOS name, the fully qualified dmain name r the IP address. The failver servers can be maintained in a: Glbal default list, which applies t all deplyment grups. Custm deplyment grup list, which can be set t verride the default list. The glbal r default list f failver servers is maintained in the fllwing lcatin f the Management Cnsle: Hme >Glbal Settings> Failver Serverstab Page 46 f 132

47 This tab allws yu t add and remve failver servers. The list f servers is shwn in rder f pririty. T change the rder use the Mve Up and Mve Dwn ptins in the Actins panel. T validate cnnectins, select Diagnstics Enabled, t set a diagnstics check prmpt n any client cmputer cnnecting with a particular server. By default, the Server is enabled but the Server Enabled ptin allws yu t disable the server t prevent further cnnectins. When the Deplyment Agent successfully registers with a Management Server, the URL f the server is added t the server list if the URL des nt already exist. This ensures the Deplyment Agent never lses cntact with the Management Server. A URL can be remved frm the list f servers t which Deplyment Agents cnnect, by deselecting the URL Enabled ptin. Failver Servers List The Management Server list includes the ptins shwn in the fllwing table: Clumn Server Descriptin The URL address f the failver server. Displayed in ne f the fllwing frmats and may als include prt specificatins: Server hst name: IP address: Fully qualified path: tserver Diagnsti cs Enabled Nt selected by default. When selected fr Management Servers, all cnnecting Deplyment Agents n managed cmputers perfrm self-tests at startup and n request t ensure that cnnectivity is available. Deplyment Agent selftests reprt events t the Management Server, except in the case f cnnectivity issues r failure, and als reprts t the lcal Windws Event Lg. Deplyment Agent self-tests check the fllwing: Cnnectivity. Package dwnlads. Event uplads. Ability t raise high pririty events, such as failure t install packages. Server Selected by default. When selected, the server is Page 47 f 132

48 Clumn Enabled Descriptin available. When deselected, the server is unavailable fr any further cnnectins. Client cmputers autmatically redirect t the next available server in the list. This can be used when decmmissining a server by preventing Deplyment Agents cnnecting t the server. Actins Add Server Launches the Add Failver Server dialg. Enter a URL r brwse fr a server t add t the list. Select the Cnnectin Type, HTTP r HTTPS, and the cnnectin prt. Remve Servers Remves selected Servers frm the list f failver servers. CAUTION: Any servers remved frm the servers list which are still listed by Deplyment Agents n managed cmputers registering with the server, can be added back int the list autmatically. T avid this ccurring, it may be necessary t disable redundant r decmmissined servers until all managed cmputers have been updated with the crrect list f available servers. Mve Up Mves the selected server t a higher psitin in the list and in the rder f pririty. Mve Dwn Mves the selected server t a lwer psitin in the list and in the rder f pririty. Test Server Cnnectin When selected, the Management Server perfrms a cnnectin test t each selected server in the list and reprts any successes r failures. Glbal Access Credentials The credentials are used by the Management Server t authenticate access t the clients when installing the Deplyment Agent. These credentials must be supplied befre attempting t install the Deplyment Agent n any endpint via the Management Cnsle. The Glbal Settings Access Credentials apply t all Deplyment Grups by default, unless specific credentials have been defined within a specific Deplyment Grup. In this case, the Deplyment Grup s Access Credentials verride the default glbal Access Credentials. The credentials are attempted in the rder listed, t change the rder use the Mve Up and Mve Dwn ptins. T add new credentials, enter a user name and passwrd and click Add. The credentials are stred in the database, the Server Cnfiguratin Prtal (SCP) creates an RSA public-private key pair that is stred in the Micrsft Cryptgraphic Prvider f the server. This key is used t encrypt and decrypt the credentials stred in the database and therefre secures the infrmatin. Page 48 f 132

49 Managing the Glbal Access Credentials 1. Select the Hme buttn in the navigatin pane. 2. Select the Glbal Settings nde. 3. Select the Access Credentials tab. 4. D ne r mre f the fllwing: T add a credential enter a User name and passwrd, select Add. The credentials are entered int the list belw. T remve a credential, highlight the required credential and select the Remve buttn. T rder credentials in the list highlight the required credential and select the Mve Up r Mve Dwn buttns until in the preferred rder. Membership Rules Membership rules determine which grup a cmputer is assigned t. Yu can cnfigure the rules by adding and excluding cnditins based n cmputer by NetBIOS name, r path references t Active Directry cmputers, cmputer grups r cntainers. Membership Rules have a ne t ne relatinship with Deplyment Grups. A membership Rule is autmatically created n creatin f every Deplyment Grup. The (Default) Deplyment Grup has a nn-editable set f membership rules t Include All. Yu cannt add, r remve a cnditin r change the pririty fr this grup. Multiple Membership Cnditins fr the same Rule always evaluate using OR Blean lgic. Membership Rules are prcessed in the rder the Deplyment Grups are listed in the Membership Rules wrk area. Therefre, if a cmputer matches multiple membership cnditins in different Deplyment Grups, it is added t the first Deplyment Grup in the list where a membership cnditin matches. T change the rder f the Deplyment Grups use the Mve Up and Mve Dwn ptins in the Actins pane. 1. Select the Hme navigatin buttn. 2. Select the Membership Rules nde. The Edit Grup Cnditins dialg displays. 3. Click Add and d ne f the fllwing: Select Cmputer by NetBIOS Name and specify the NetBIOS name fr the cmputer r brwse t the cmputer. Use Active Directry and select Cmputer, Grup r Cntainer and specify r brwse t the Active Directry cmpnent. 4. Repeat t add additinal cnditins, if required and click OK. Page 49 f 132

50 5. If yu want t autmatically discver cmputers that match the membership rules select Autmatically discver cmputers every... Yu can set the discvery as frequent as every hur, intervals in between, r as infrequent as 1 week. TIP: Click Discver t perfrm an immediate discvery f cmputers. 6. Click Submit t submit the changes t the rule. 7. If required, expand the deplyment grup yu have discvered cmputers fr and select the Cmputers nde. Details display abut the discvered cmputers in the Cmputers wrk area. NOTE: Asterisk (*) and questin mark (?) wildcard characters are supprted in grups. The asterisk represents ne r mre characters, and the questin mark wildcard represents a single character. Actins Edit Cnditins - Displays the Edit Grup Cnditins dialg bx allwing yu t include and exclude cnditins fr cmputers, grups and cntainers. Mve Up - Mves the selected membership rule up. Mve Dwn - Mves the selected membership rule dwn. Discver - Discvers cmputers and places the cmputers int the first grup that has a matching rule. Only users with Server Administratr r Grup Administratr permissins can execute the Discver actin. Discvery Settings Autmatically discver cmputers every [ ] - select t autmatically discver cmputers frm ne f the fllwing intervals: 1 Hur 4 Hurs 12 Hurs 24 Hurs 1 Week All Cmputers The Cmputers nde allws yu t manage the list f cmputers acrss all Deplyment Grups fr the Management Server. Management ptins allw yu t add, mve, delete cmputers and mnitr alerts, events, AppSense sftware agent and cnfiguratin packages and cmputer details. The Cmputers nde includes the fllwing sectins: Page 50 f 132

51 Clumn Name Deplyment Grup Alerts Last Respnse Status Deplyed (%) Descriptin Cmputer name. The Deplyment Grup f which the cmputer is a member. Number f active alerts. The perid since the last pll. The latest infrmatin received when installing the Deplyment Agent and any status infrmatin sent frm the endpint, including pending diagnstics, failed deplyments and failed diagnstics. Indicates the status f the packages assigned t the deplyment grup fr each cmputer. 100% indicates that the assigned packages have all been installed (r uninstalled). Cntrl Tabs The fllwing tabs display at the bttm n the Cmputers wrk area: Tab Cmputer Details Alerts Descriptin The Cmputer details tab displays infrmatin abut the selected cmputer, and includes: Prperty Cmputer hardware and system prperties. Value Cmputer hardware and system details. The Alerts tab allws yu t mnitr alerts fr the selected cmputer, and includes: ID Event fr which the alert is generated. Rule Alert rule. Cmputer Where the alert riginated. Deplyment Grup Deplyment grup frm which the alert riginated. Last Event When the alert is raised n the Server. Status Alert status: New, Acknwledged r Reslved. Page 51 f 132

52 Tab Events Packages Descriptin The Events tab allws yu t mnitr events n the selected cmputer, and includes: ID Event number. Date/Time Date and time the event ccurred. Cmputer Where the event ccurred. User Wh caused the event. The Packages tab allws yu t view packages n the selected cmputer, and includes: Prduct The prduct t which the package belngs. Name Title f the sftware agent r cnfiguratin package n the currently selected cmputer. Installed Versin Number f the current sftware package versin n the selected cmputer. Installatin Status Indicates the prgress f the package. Pssible states include: Pending Install Checking Prerequisites Dwnlading Dwnlad Failed Installing Installed Install Failed Unmanaged - fr mre infrmatin n this state see Deplyment Statistics Pending Upgrade Upgrading Upgraded Upgrade Failed Pending Uninstall Uninstalling Uninstall Failed Uninstalled Install Prerequisite Failed Page 52 f 132

53 Tab Descriptin Status Message Displays status messages received frm the endpint when a prblem ccurs during package installatin r remval. Diagnstics The Diagnstics tab prvides details f the diagnstics test n the selected cmputer and the result f each test perfrmed. Test Indicates which test is perfrmed. Cnnectivity Dwnlad Packages Uplad Events High Pririty Events Result Indicates the current state f the diagnstics taking place n the cmputer, fr example, untested, pending, requested r cmpleted with test passed r test failed. Client Access Lgs Prvides prgress updates n the installatin f the Deplyment Agent. Cmputer Find Yu can use Cmputer Find t lcate a specific cmputer r range f cmputers in the list f cmputers that have the Deplyment Agent installed. Enter a full string r partial strings in the edit field t match cmputer names using wildcard characters, including: Questin mark (?) Indicates a single character Asterisk (*) Indicates zer r mre characters Cmputer Find facility searches fr cmputers by deplyment grup beginning with the (Default) grup. The search cntinues in turn t each grup until a match is fund. When there are n mre matches, a message bx ntifies yu that there are n mre results. Navigate thrugh results using the Find Next and Find Previus buttns. Actins Mve Launches the Mve Cmputers dialg fr selecting a different grup t relcate the highlighted cmputer. Page 53 f 132

54 Delete Deletes selected cmputers frm the system. Deleted cmputers remain listed in this grup until all sftware packages have been remved with Pending delete status displayed next t the cmputer name in the verview panel. Agents and packages are deleted as fllws: Prduct Agents and Cnfiguratins AppSense prduct agents and cnfiguratins uninstall accrding t the Installatin Schedule. Deplyment Agent The Deplyment Agent uninstalls after prduct agents have uninstalled, accrding t the Installatin Schedule. NOTE: When the Agent Schedule is disabled the Cnfiguratin Schedule is ignred and therefre n agent r cnfiguratin packages uninstall. Delete All Deletes all cmputers in the grup. Deleted cmputers are mved t the (Default) grup t await the uninstall prcess t remve sftware packages. Unregister Unregisters the cmputer frm server. NOTE: If yu select this ptin befre the packages and agents have successfully been deleted frm this cmputer, the Deplyment Agent re-registers the cmputer again n the next pll perid. Restre Restres a cmputer set t Delete r Unregister. Shw Event Details Launches the Event Details dialg fr viewing infrmatin abut the selected event. Request Diagnstics Starts a diagnstics check n selected cmputers t test cnnectivity with the main Management Server and any failver servers fr which Run Diagnstics is selected in the Failver Servers nde. Clear Filter Clears any filters that have been applied t the display. T apply a filter t the display right-click n the clumn yu want t filter and select Filter Editr. The Filter Editr is used t filter the list based n the entered criteria. Manually Added The Manually Added nde displays if any cmputers have been manually added t a deplyment grup, and nt discvered and placed in a grup by use f Membership Rules. The wrk area displays the name f the cmputer and the expected grup t which the cmputer has been manually added. Page 54 f 132

55 Remve the Manually Added Status 1. Navigate t All Cmputers > Manually Added. 2. Select the cmputer that yu want t remve the manually added status frm, and frm the Actins panel select Remve. A message displays infrming yu that the expected grups fr the selected cmputers will revert t the grups determined by membership rules and that managed cmputers will nt change grups until they are mved. T mve a cmputer yu can select ne f the fllwing: Deplyment Grup > Cmputers > Mve actin - select the cmputer(s), click Mve and select the required deplyment grup. Deplyment Grup > Cmputers > Misgruped > Regrup actin - select the cmputer(s), click Regrup and the cmputers are autmatically re-assigned t the deplyment grups based n the Membership Rules. 3. Click OK t cnfirm the remval. NOTE: If the remved cmputer has nt been mved t a deplyment grup it may be listed in the Misgruped nde. This happens if there's a membership rule that puts the cmputers in a different grup. Misgruped The Misgruped nde is added when a cmputer has: Been manually added t a grup, but the cmputer subsequently registers with a different grup because that's the grup it had been in. Been added t Active Directry which puts the cmputer in a certain grup, but the cmputer subsequently registers with a different grup because that's the grup it had been in. Mved t a different Active Directry grup, which puts the cmputer in a different deplyment grup. Been deleted frm the Manually Added nde and Membership Rules puts the cmputer in a different grup. The Misgruped nde is added t the All Cmputers nde and the Cmputers nde fr the deplyment grup. Yu have the ptin t remve the cmputers frm the misgruped list using ne f the fllwing methds: Mve - manually select which deplyment grup t place the cmputers. Regrup - autmatically place the cmputers in the deplyment grup as defined by the Membership Rules and Manually Added List. Page 55 f 132

56 NOTE: Mving cmputers t anther deplyment grup can cause AppSense cnfiguratins and agents t be installed r uninstalled when the Deplyment Agent next plls. Agents are installed accrding t the installatin schedule f the target deplyment grup. Installatin Schedules are set up in Deplyment Grup > Settings > Installatin tab. If there are n misgruped cmputers the Misgruped nde des nt display in the navigatin tree. Page 56 f 132

57 Deplyment Grups Default Deplyment Grup The Default deplyment grup nde includes cmputers which are registered t the Management Server but d nt match the membership criteria f existing deplyment grups. If an existing deplyment grup is deleted, cmputers within the deleted grup are mved t this nde. The default deplyment grup cntains the same settings and ndes as a new deplyment grup. Yu can mve the cmputers t anther deplyment grup by selecting them and then clicking Mve in the Actins clumn. Deplyment Grup When yu create a new deplyment grup the verview wrk area displays the fllwing sectins: Details Displays the name and descriptin f the deplyment grup. Click in either field t make any amendments. The access credentials display with the Manage Credentials buttn t add and manage the credentials specifically fr the deplyment grup. Manage Credentials Access Credentials prvide a glbal list f access credentials fr all deplyment grups. The Access Credentials list fr Deplyment Grups verrides any glbal Access Credentials within that grup. Yu can add multiple users t the list and they are attempted in the rder defined in the wrk area. 1. Select the Hme nde in the navigatin pane. 2. Expand the Deplyment Grups nde. 3. Select the [Deplyment Grup] nde. 4. In the Details sectin select the Manage Credentials buttn. 5. D ne r mre f the fllwing: T add a credential enter the user name and passwrd and select Add. T remve a credential, highlight the required credential and select the Remve buttn. T rder credentials in the list select the required credential and select the Mve Up r Mve Dwn buttns. Page 57 f 132

58 Settings Directly access the fllwing settings fr the deplyment grup: General - setup the server plling, dwnlads and event data uplad perids, cnfiguratin deplyment frmat and deplyment agent permissins. Installatin - setup the agent and cnfiguratin installatin schedules. Custm Failver Servers - setup the list f failver servers specific t this deplyment grup. Auditing - setup annymus lgging and event filters. Membership Rules The Membership Rules sectin displays a list f all membership rules fr the deplyment grup. Cnfigure Membership Rules Click the Cnfigure Membership Rules buttn t change the view t Hme > [Server] > Membership Rules t setup r manage the membership rules fr the deplyment grup. Assigned Packages The Assigned Packages sectin displays a list f all assigned packages fr each installed AppSense prduct with details f package type, agent r cnfiguratin and versin number, number f packages installed and the number f cmputers in the grup, with agents installed, that have plled the management server within the last 30 days. Assign Packages Click the Assign Packages buttn t changes the view t Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Packages t change agent r cnfiguratin versins. Cmputer The Cmputer sectin displays the fllwing: Ttal number f cmputers within the selected deplyment grup. Number f cmpletely deplyed cmputers i.e. packages are 100% deplyed. Page 58 f 132

59 Ttal number f Cmputers which are currently ffline. A cmputer is cnsidered ffline if the installed Deplyment Agent des nt pll back within twice its default pll perid. The Server Plling perid is set up in the Deplyment Grups > [Deplyment Grup] > Settings > General tab, the default pll perid is set at 1 Hur. Number f cmputers which have either a deplyment r diagnstic errr. A cmputer shws with errrs if an attempt t deply a package has failed r has a diagnstic errr. The relevant Cmputer displays in red in the Cmputers nde and als the Grup t which the cmputer belngs. Click n any f the numbers t change the view t the Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Cmputers nde. Alerts The Alerts sectin displays the fllwing: Ttal number f unreslved alerts that the user has permissin t view fr the deplyment grup. Ttal number f unreslved alerts which belng t an alert rule that has Critical severity. Ttal number f alerts which have a status set t New. Ttal number f unreslved alerts that have been raised in the last 24 hurs. NOTE: The Critical, New and Created in Last 24 hrs alert categries are nt mutually exclusive,therefre, an alert can ptentially be seen in all 3 categries. Click n any f the numbers t change the view t the Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Alerts nde. Events The Events sectin displays the ttal number f events in the system which belng t the selected deplyment grup that the user has permissin t view and the ttal events raised in the last 24 hurs. Click n any f the numbers t change the view t the Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Events nde. Actins Security Launches the Security fr [Deplyment Grup Name] dialg in which yu can change the Allw/Deny settings in the list f available Security Rles and change the wner f the current bject. Page 59 f 132

60 Cnfiguring Deplyment Grups Once created, Deplyment Grups can be cnfigured in a number f ways, this is a suggested wrkflw s yu can see all elements that need t be setup. Step 1 Create Deplyment Grup Hme > [Server] > Deplyment Grups > New Deplyment Grup in the Actins panel. A new deplyment grup is created. The new grup is created with the name NewDeplymentGrup. T rename the nde yu can right-click and select Rename frm the cntext menu, alternatively yu can click n the Name field in the Details sectin in the deplyment grup wrk area. Step 2 Deplyment Grup Settings Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Settings Cnfigure the fllwing fr the deplyment grup: Settings Packages Cmputers Alerts Events Step 3 Setup Membership Rules Hme > [Server] > Membership Rules Edit the cnditins t set up the membership rules. Yu can mve the membership rules up and dwn, this is imprtant because when discvering cmputers the cmputer is placed in the first deplyment grup that has a matching rule. Step 4 Discver Cmputers Hme > [Server] > Membership Rules > Discver in the Actins panel Click Discver in the Actins panel t find cmputers that match the grup membership rules. Matching cmputers display in the list. Step 5 Install Deplyment Agent Hme > [Server] > Deplyment Grups > [Deplyment Grup] > Cmputers > Install Deplyment Agent in the Actins panel. Select the cmputer t which yu want t deply the Deplyment Agent and select Install Deplyment Agent in the Actins panel. The Client Access Lg tab in the Cmputers wrk area displays details n the installatin prgress. Page 60 f 132

61 Mve Cmputers Between Deplyment Grups Yu can mve cmputers between different deplyment grups by highlighting a listed cmputer in a deplyment grup and selecting Mve in the Actins panel. Yu can select this ptin in the Cmputers nde f any deplyment grup. Select ne r mre cmputers in the list. Click Mve in the Actins panel. The Mve Cmputers dialg bx displays. Select the deplyment grup t mve the cmputers t and click Mve. The cmputers are relcated t the new grup. Check the destinatin deplyment grup t view the cmputer in the new lcatin. Deplyment Grup Settings Deplyment Grup Settings General The Deplyment Grup > Settings > General tab prvides the fllwing ptins t cnfigure the deplyment grup. Server Plling and Dwnlads The Server Plling and Dwnlads perid determines hw frequently the Deplyment Agent cmmunicates with the Management Server t check fr changes related t assigned prduct agents, cnfiguratins r deplyment grup settings. The perid can be set t ccur as lw as 1 minute r as high as 7 days. The default is 1 hur and the fllwing are selectable values: Minutes - 1, 5, 15, 30 Hurs - 1, 4, 8, 12 Days - 1, 2, 5, 7 Server Plling and Dwnlads Sets the frequency the client cmputer checks the server fr changes t the deplyment grup. When new settings, agents r cnfiguratins are detected, the client dwnlads the relevant cmpnents and installs them. The client cmputer als initiates diagnstics tests when a request is detected n this pll perid. The default cmputer pll perid is 1 Hur. Page 61 f 132

62 NOTE: Prduct agents and cnfiguratins install accrding t the installatin schedule. Select Settings nde > Installatin tab t cnfigure the schedule settings. Pll Variance After the perid is determined, yu can include a pll variance t reduce the impact f multiple Deplyment Agents plling at any ne time. The variance ranges frm 0 t 100 percent and wrks by staggering when the Deplyment Agents pll. Fr example, if a pll perid is set t 10 minutes with a variance f plus r minus (+/-)10% the Deplyment Agent will pll between 9 and 11 minutes. The default variance is 20%. NOTE: The Server Plling and Dwnlads ranges frm 1 minute t 7 days. The ptins fr setting the pll perid are limited t avid verlading the demand n netwrk bandwidth which very shrt pll perids wuld cause and the risk f missing critical updates and dwnlads that much lnger pll perids might cause. Event Data Uplads The Event Data Uplads perid determines hw frequently the Deplyment Agent uplads event data frm the managed endpint device t the Management Server database. The perid can be set t ccur as lw as 1 minute r as high as 1 day. The default is set t 30 minutes and the fllwing are selectable values: Minutes - 1, 5, 15, 30 Hurs - 1, 4, 8, 12 Day - 1 After the perid is determined, yu can include a variance t reduce the impact f multiple Deplyment Agents uplading at any ne time. Event Data Uplads Sets the frequency with which client endpints uplad event data. The uplad pll perid variance wrks in the same manner as the cmputer pll perid variance and is used t stagger the times when the Deplyment Agents uplad event data t the Management server. The default uplad pll perid is 30 minutes. NOTE: The Event Data Uplads ranges frm 1 minute t 1 day. The ptins fr setting the pll perid are limited t avid verlading the demand n netwrk bandwidth which very shrt pll perids wuld cause and the risk f missing critical updates and dwnlads that much lnger pll perids might cause. Cnfiguratin Deplyment Frmat Select the frmat in which t deply cnfiguratins: Page 62 f 132

63 Windws Installer MSI Native Cnfiguratin When deplying a native cnfiguratin the Deplyment Agent persists the cnfiguratin file using the file name cnfiguratin.a?mp. The file name is saved int the registry s that each prduct knws where t find the cnfiguratin. Native cnfiguratin files cntain the versin f the cnfiguratin and upgrade and prduct cde, these values are the same as thse stred in the MSI file which means they can be cnverted t an MSI and back again. Lcatin - select the ellipsis t select the required flder lcatin. NOTE: The native cnfiguratin path can nly be a valid lcal path, it cannt be empty r be a netwrk path. CAUTION: The Deplyment Agent expands envirnment variables included within the native cnfiguratin path under the cntext f the LcalSystem accunt. This means envirnment variables such as %UserPrfile% will be expanded t "C:\Windws\System32\cnfig\SystemPrfile" and nt the user prfile f the currently lgged n user. Use f the user prfile envirnment variables is nt recmmended. Deplyment Agent Permissins Allw self-registratin - Select this ptin t allw lcal administratrs t frce the Deplyment Agent t self-register with this deplyment grup. Self-registering Deplyment Agents are installed using a cmmand line with the GROUP_NAME parameter specifying the grup with which the Deplyment Agent registers. This ptin is disabled by default but prvides an alternative methd fr installing Deplyment Agents n managed cmputers t register with a specific Deplyment Grup n the Management Center rather than predefining the grup membership in the Management Cnsle. This ptin is disabled fr the (Default) Deplyment Grup. Allw unregistratin - Select this ptin t allw lcal administratrs t request Deplyment Agents unregister cmputers frm this deplyment grup. TIP: If a cmputer has been unregistered by the CCA Cmmand tl the Deplyment Agent service must be restarted fr it t be re-registered. Allw update initiatin - Select this ptin t allw lcal administratrs t request Deplyment Agents immediately install and uninstall packages fr this deplyment grup regardless f the deplyment grup installatin schedule. Page 63 f 132

64 Deplyment Grup Settings Installatin The Installatin tab allws yu t cnfigure the deplyment grup installatin schedule fr Agents and Cnfiguratins. Sftware agents and cnfiguratins are installed accrding t the installatin schedule fr the deplyment grup. Licenses are installed immediately upn dwnlad by the Deplyment Agent frm the Management Server. Agent Installatin Agent installatin defines the manner in which updates t Deplyment Agents are pushed t the endpints. Regardless f the selected agent schedule, the Deplyment Agent begins dwnlading packages immediately after the next time it plls the server. Dwnladed packages are stred n the endpint until the scheduled installatin time. Fr the fllwing situatins, we recmmend that yu use the settings described: Setting Autmatically restart system and install - at next client pll, with user pstpnement. Autmatically restart system and install - scheduled. At next system restart. Suggested Use Yu need t push ut an update quickly, such as an imprtant patch release r ht fix. Yu need t push ut updates in a predictable manner. Fr example, when an installatin is required by a certain time f day. The update can wait until the end user schedules a cmputer restart, r when a remte cmputer restart can be scheduled ut f nrmal wrking hurs t install an update - this is the recmmended setting fr servers. T prevent assigned agents frm being dwnladed, installed r uninstalled check the D nt install ptin. Restart and Install Agents Select frm the fllwing ptins: Autmatically restart system and install - at next client pll - select t check fr agent updates next time the client plls the Management Server. If agent updates are fund an autmatic system restart takes Page 64 f 132

65 place t install the agent. If selected the fllwing ptin displays: Select Allw user pstpnement fr up t - ptins available t pstpne a system restart fr up t 8 hurs, yu can select hurly intervals frm 1 hur t 8 hurs. Page 65 f 132

66 Autmatically restart system and install - scheduled - select t check fr agent updates next time the client plls the Management Server. If agent updates are fund an autmatic system restart takes place t install the agent nly within the set scheduled perid. If selected, the schedule table displays: Click n a Start r End time t display a drp dwn list, select the required time. The Agent packages are installed accrding t the specified days and times enabled in the list. Setting the Installatin Schedule The Deplyment Agent installs packages after the start time, and befre the end time. Fr example, with a start time f 08:00 and an end time f 18:00, packages install between 08:00 and 18:00. A scheduled end time can be set befre the start time t invert the installatin perid. Fr example, with a start time f 18:00 and an end time f 08:00, packages install after and befre n the specified day. NOTE: After an agent schedule with user pstpnement has started, yu cannt shrten the end time fr cmputers that have already plled. In this case, if yu need t change the installatin time, yu can set a new schedule that starts in the future. If yu d reduce the end time n an active schedule, nly cmputers that have nt plled are affected. Allw user pstpnement within the schedule t allw the end user t pstpne the installatin f agents within the installatin schedule time frame. The end user receives the pstpnement message at the beginning f the installatin schedule, befre being frced t install at the end f the installatin schedule. The user can select t restart immediately r pstpne fr 10 minutes, 30 minutes r 1 hur, prvided the delay des nt exceed the end f the schedule time. T prevent a single user lgging ff ther users, the pstpnement message nly displays n cmputers where a single user is lgged in. If at the start f the scheduled installatin perid tw r mre users are lgged in then the Deplyment Agent skips the pstpnement message and, at the end f the scheduled perid, displays the cuntdwn message t all users befre restarting the cmputer. Page 66 f 132

67 If a user prevents the agent installatin by, fr example, shutting dwn the cmputer befre the end f the schedule perid, the scheduled installatin takes place autmatically the next time the cmputer starts. A cuntdwn message displays when there are nly 5 minutes remaining in the schedule with a warning that a restart will be frced. If the user pstpnement ptin is nt enabled the Deplyment Agent delays the restart by 2 minutes t allw users t save any wrk. At next system restart - Assigned agents install when the endpints are started and befre user lgn. This is the default setting fr all Deplyment Grups with the exceptin f the (Default) grup which has a default setting f Disable. Additinal Optins Within Restart, install Agents during [ ] phase: Shutdwn - select t install agents at time f endpint shutdwn. Startup - select t install agents at time f endpint restart, install takes place befre user lgn. Install agents immediately if n restart required - select t install agents, that d nt require a restart, immediately. Cnfiguratin Installatin The cnfiguratin installatin schedule cntrls when cnfiguratins install. T prevent assigned cnfiguratins frm being dwnladed r installed check the D nt install ptin. TIP: If yu attempt t uninstall a cnfiguratin when the Agent Schedule is set t D nt install, the Cnfiguratin Schedule is ignred. Therefre, n agent r cnfiguratin packages uninstall. Cnfiguratin Install Behavir Select frm the fllwing ptins: Autmatically install - at next client pll - select t check fr cnfiguratin updates next time the client plls the Management Server. If cnfiguratin updates are fund they install autmatically. Page 67 f 132

68 Autmatically install - scheduled - select t check fr cnfiguratin updates next time the client plls the Management Server. If cnfiguratin updates are fund they autmatically install within the set scheduled perid. If selected, the schedule table displays. Click n a Start r End time t display a drp dwn list, select the required time. The cnfiguratin packages install accrding t the specified days and times enabled in the list. Once the Deplyment Agent n the managed cmputer plls the Management Server fr the list f packages t install and their assciated installatins schedule, the packages install at the scheduled time. If the installatin f any f these prerequisites r agents fail, installatin is re-attempted at cmputer startup. If simultaneusly deplying agents and cnfiguratins fr the same prduct the Deplyment Agent ensures bth install n cmputer startup regardless f the cnfiguratin installatin schedule. When a cnfiguratin is deplyed but n agent change is required deplyment ccurs accrding t the installatin schedule. Regardless f the selected cnfiguratin schedule, the Deplyment Agent begins dwnlading immediately after the next time it plls the server. Dwnlads are stred n the endpint until the scheduled installatin time. NOTE: The Deplyment Agent installs packages after the start time, and befre the end time. Fr example, with a start time f 08:00 and an end time f 18:00, packages install between 08:00 and 18:00. A scheduled end time can be set befre the start time t invert the installatin perid. Fr example, with a start time f 18:00 and an end time f 08:00, packages install after and befre n the specified day. Mirrr Agent installatin schedule - select t set the schedule t the same as the Agent schedule. At next system restart - cnfiguratins install when the endpints are started and befre user lgn. Additinal Optins Check fr and dwnlad new Cnfiguratins at startup - select t check the Management Server fr any new cnfiguratins and t dwnlad and replace them at cmputer startup. This stalls lgn until it's cmplete. Once the Cnfiguratin n the managed cmputer has plled the Management Server fr the list f packages t install and their assciated installatin schedule, the packages are installed at the scheduled time. If the installatin f any f these prerequisites r agents fail, installatin is re-attempted at cmputer startup. CAUTION: The status f the check bx at shutdwn is retained at startup. If the setting was disabled n shutdwn the Deplyment Agent will nt cntact the server n startup t check if the setting is nw enabled. Page 68 f 132

69 AppSense Update Manager Agent installatins and upgrades are perfrmed at cmputer shutdwn r restart, depending n the deplyment grup settings. If dne at restart, it is befre the user lgs n, meaning that functinality prvided by the agents is never cmprmised while end users are lgged n. Yu can use the AppSense Update Manager t cntrl when the endpint cmputer restarts t install agents. End-pint Install and Uninstall Order The agent schedule installs, updates, r uninstalls agents, including the Deplyment Agent, at cmputer startup r shutdwn depending n the deplyment grup settings. If yu set the cnfiguratin schedule t At next system restart, cnfiguratins als install at cmputer startup r during shutdwn if paired agent is being installed r updated at the same time. The Deplyment Agent carries ut the actins in the fllwing sequence based n the packages assigned t the endpint: Upgrade f the Deplyment Agent. Uninstall AppSense prduct cnfiguratins which are n lnger assigned. Uninstall AppSense prduct agents which are n lnger assigned. Install r upgrade sftware prerequisites, fr example MS Cre XML Services (MSXML). Install r upgrade assigned AppSense prduct agents. Install r upgrade assigned AppSense prduct cnfiguratins. Uninstall the Deplyment Agent. NOTE: When simultaneusly deplying an agent and cnfiguratin fr the same prduct, the Deplyment Agent ensures that bth are installed n cmputer startup r cmputer shutdwn, depending n the deplyment grup settings, regardless f the cnfiguratin schedule. This ensures cnfiguratins which depend n an upgraded agent are nt installed t sn. When a cnfiguratin is deplyed, but n change is made t its prduct agent, deplyment ccurs accrding t the installatin schedule. Page 69 f 132

70 AppSense Update Manager Pstpnement Message If the administratr has selected t allw the end user t pstpne installatin f agents a pstpnement message displays when there are agents ready t install. The message gives the user the ptin t pstpne the installatin and therefre the system restart until a mre cnvenient time s that they have the pprtunity t save wrk befre a system restart is frced. NOTE: The pstpnement message nly displays if nly ne user is lgged n. This prevents a user lgging ff ther users n the system. The user can select frm the fllwing ptins: Restart Nw - initiates a system restart which installs the package upn cmputer startup and befre lg n. Be reminded in 10 minutes Be reminded in 30 minutes Be reminded in 1 hur Available Pstpnement Perids fr Scheduled Installatins The available pstpnement time perids are determined by the installatin schedule. Fr example, a pstpnement time will nt be ffered if it wuld delay the installatin past the scheduled installatin time. Or, if the scheduled installatin time is less than the minimum pstpnement time the ptin t pstpne des nt display and nly the Restart Nw ptin is available. The default pstpnement perid is always the shrtest selectable time perid. Page 70 f 132

71 AppSense Update Manager Pstpnement Message fr Windws 8 r Windws Server 2012 Users Windws 8 r Windws Server 2012 users have an additinal ntificatin which displays n the Start screen when a pstpnement message displays n the desktp. If yu click the ntificatin the desktp displays where the pstpnement message can be seen and actined. NOTE: Ntificatins can be turned ff in Grup Plicy r PC Settings. AppSense Update Manager Cuntdwn Message When there are n mre pstpnement intervals available the cuntdwn message displays. The AppSense Update Manager cuntdwn message nly displays the Restart nw buttn fr single user sessins. If there are multiple users the cuntdwn message displays fr infrmatin nly infrming the users f the remaining time befre a restart will take place with n ptin t restart. The maximum cuntdwn time is 5 minutes, the cuntdwn time can reduce if the scheduled installatin time is in less than 5 minutes. NOTE: If a user prevents the agent installatin by, fr example, shutting dwn the cmputer befre the end f the schedule perid, the scheduled installatin takes place autmatically the next time the cmputer starts. Page 71 f 132