HP Device Manager 4.6

Transcription

1 Technical white paper HP Device Manager 4.6 HP t5740 Windows XPe Support Guide Table of contents Overview... 3 Updating the HPDM Agent... 3 Symantec Endpoint Protection (SEP) Firewall... 3 VNC Shadowing... 3 Imaging... 3 Other HPDM 4.5 features... 3 Prerequisites... 3 Updating the HPDM Agent... 3 Creating a template to stop the SEP firewall... 3 Creating a template sequence to update the HPDM Agent... 5 Troubleshooting... 5 HDPM Agent update task fails... 5 HPDM Agent update task succeeds, but the HPDM Agent still shows as older version... 5 Symantec Endpoint Protection (SEP) Firewall... 5 Additional firewall ports needed by the current version of HPDM... 5 Port Port Port Ports Modifying firewall rules in Symantec Endpoint Protection (SEP)... 6 Configuring the rules... 6 Exporting SEP rules to a.sar file... 7 Creating a task template to deploy SEP rules... 8 Troubleshooting VNC Shadowing Shadow Device Reverse Shadow Device Troubleshooting Imaging Space characters in the image name Captured image does not get compressed No entry for Image Size after a capture task Copying an image and delete deployment template... 15

2 Creating a new template and re-importing the image Cached Imaging option does not work Other HPDM 4.5 features Agent tasks Configure Agent Task Deferment Connections task Pull Connection Configuration File and registry tasks File and registry Get Registry Operations tasks Get Asset Information Shutdown\Reboot Send Message Resource Monitor Wake on LAN Settings tasks Apply Settings Clone Settings Hostname and IP Set Domain Set Password Write Filter Settings Untested HPDM 4.5 features Take TPM Ownership PXE imaging Templates imported from FTP Component Browser Settings and Connections Easy Tools Settings and Configurations Summary For more information

3 Overview There is only limited support for Windows XP Embedded (XPe) for HP Device Manager (HPDM, but there have been many requests for assistance from users who are attempting to use HPDM to manage their legacy HP t5740 thin clients running XPe. The new HPDM features might not work with an HP t5740 thin client running XPe. The latest stable HPDM release that has been fully tested with this configuration is HP Device Manager 4.4 (Installer version: , built on 08/29/2011). HP recommends using this earlier version be used to manage XPe thin clients. However, there might be situations, such as a mixed environment with older models running XPe and newer HP thin client models running a different operating system that require using the current version of HPDM. The purpose of this white paper is to provide troubleshooting assistance for the management of HP t5740 thin clients running XPe using HPDM 4.5 or higher. This document refers to HPDM 4.6 and XPe Rev. A. This document also provides details on the known limitations of using later versions of HPDM to manage XPe devices. Updating the HPDM Agent Updating the HPDM Agent on XPe thin clients will not work due to an issue with the firewall. Details and a workaround are provided in the section Updating the HPDM Agent. Symantec Endpoint Protection (SEP) Firewall Out of the box, the HP t5740 thin client running XPe uses Symantec Endpoint Protection (SEP) for its firewall. Because the port requirements for HPDM have changed, the advanced rules in SEP need to be modified to allow the traffic for some new or updated features. This document provides detailed instructions on how to configure the advanced rules and how to create a task template to deploy the advanced rules in the section Symantec Endpoint Protection (SEP) Firewall. VNC Shadowing The security protocol for VNC shadowing of WES thin clients has changed from SSH to SSL and now encrypts both forward and reverse shadow sessions. Details are provided in the section VNC Shadowing. Imaging There are several issues that might prevent a successful image capture of an XPe thin client. This document provides details and workarounds to help create an image and template to deploy in the section Imaging. Other HPDM 4.5 features This document describes some of the HPDM 4.5 features that have been put though basic testing in the section Other HPDM 4.5 features. Prerequisites The examples in this document show an HP t5740 thin client running the latest version of XPe ( ), and HPDM 4.5 SP2. The example Master Repository is configured for FTP protocol and tested to ensure that a dynamic port range (PASV), is working and that the needed ports are accessible through the firewall on the server. For more information on the installation and FTP configuration, see the Installing HP Device Manager 4.6 and FTP Server Configuration white papers available from the help menu in HPDM. Updating the HPDM Agent Whenever upgrading HPDM the first thing that needs to be done after the updating the system is to update the Agent on the devices. This can be an issue for HP XPe thin clients when using an IIS 7 or higher FTP because the SEP firewall blocks outbound connections to the PASV port range configured on the server. Even if the PASV ports in SEP are configured on the devices, tasks to deploy the updated firewall rules fail because the file deployment mechanisn in current HPDM versions has changed and requires the updated HPDM Agent. Fortunately, this can be overcome by using a template sequence that stops the SEP service on the device and then performs the HPDM Agent update. If the device has a fresh image (from USB deployment), as in this example, then the HPDM Agent will be at , which is quite old and has not been validated for update via an HPDM _Update Agent task. The following procedure was tested to update the Agent from to a current version. Creating a template to stop the SEP firewall To create a task template to disable the SEP firewall on the thin client: 3

4 Note: Do not copy and paste the commands from this document as the formatting might prevent the command from executing properly. Enter the commands manually. 1. Log on to the HPDM console. 2. Ensure that the HP WES\XPe and Task Templates tabs are selected. Note: This operating system tab name HP WES\XPe has been changed to WES7/WES09/XPe. 3. Double click the _File and Registry template to edit a new template. 4. In the Template Editor, click Add. 5. Select Command for the subtask and then click OK. 6. Edit the Command box to add the following command: C:\Program Files\Symantec\SPA\Smc.exe" stop Include the quotes. Ensure that Yes is selected for the Wait option and then click OK. Figure 1. Execute Command Sub-Task editor 7. In the Template Editor, click Save As. Then, provide a name for the template and click OK. Figure 2. Enter New Template Name 4

5 Creating a template sequence to update the HPDM Agent After you create a task template that can stop the SEP service, you can combine that with the HDPM Agent Update template in a template sequence that performs the HPDM Agent updates on the XPe thin clients. Troubleshooting HDPM Agent update task fails If the Agent Update task that uses the sequence we created fails, it might be because SEP firewall was not disabled. To test whether the firewall is disabled, send the Stop SEP template to a test device with the Write Filter Policy set to excute regardless of Write Filter status. Then, without rebooting, verify on the device that the SEP has stopped. The icon disappears from the system tray on the device, if the SEP has stopped. If it does not stop, verify that the command line is correct. If the SEP firewall does stop, verify that FTP server is configured correctly for both the data channel port range and the external IP address of the firewall. For more information on FTP configuration, see the FTP Server Configuration white paper. HPDM Agent update task succeeds, but the HPDM Agent still shows as older version It has been observed in some cases that the Update Agent task succeeds, but the agent version still shows as the older version in the HPDM Console. In these cases, the HPDM Agent was updated and shows correctly on the thin client itself. Restarting the devices or sending a Get Asset Information task usually resolves this issue. Symantec Endpoint Protection (SEP) Firewall As the port requirements have changed, the firewall rules in SEP in XPe need to be updated to enable the needed ports. One issue that might occur before updating the SEP rules is that tasks with a payload might fail because the SEP might block the PASV ports being requested by FTP client on the thin client. This section describes how to configure the SEP rules, how to export those rules, and how to create a task template to use the current version of HPDM to deploy the updated firewall rules. Additional firewall ports needed by the current version of HPDM Port 139 This port is needed to allow NetBIOS Session Services connections. Either create a new rule to allow outbound TCP connections to this remote port or modify an existing rule to add this port. Port This port is used for SSL VNC Proxy in listen mode (reverse VNC) and is required to enable the new or updated SSH secure shadowing feature. Previous versions of HPDM used SSL to secure VNC traffic on the standard port 22. Either create new rules to allow outbound TCP connections to this remote port and inbound TCP connections to this local port or modify existing rules to add this port. Port This port is used by the HPDM Agent to send resource information (CPU, RAM, Disk IO, Network IO, Processes, and so on) to the HPDM Server. Either create a new rule to allow outbound TCP connections to this remote port or modify an existing rule to add this port. Ports In order to deploy files when using IIS 7 or higher for the FTP repository, a data channel port range (passive port range) needs to be configured on the FTP server and firewall rules need to be added to SEP to allow outbound TCP connections to the passive port range. This example port range is the example used in the FTP Server Configuration white paper. This range can be configured as desired so long as the firewall rules on both the server and the thin client match the port range defined in IIS FTP. Note: If currently using IIS 7 or higher, the passive port range needs to be opened on the thin client regardless of which version of HPDM is in use. If this is the case and you are unable to transfer files until the ports are open on the thin clients, you might have issues attempting to deploy the new firewall rules. There are three ways in which you can overcome this limitation. First, you can set up another repository using the Filezilla FTP server and deploy from there. Second, you can set up a network share and use a command task to instruct the thin client to copy and deploy the new rules. Third, you can use a command task to temporarily turn off the SEP firewall and deploy the new rules. 5

6 Modifying firewall rules in Symantec Endpoint Protection (SEP) There is no command line to set individual advanced rules in SEP, so the required ports need to be added manually on the thin client using the SEP Agent user interface. However, there are command line options to import and export the rules, which make deployment possible. After the rules are added, they can be exported into a file which can then be deployed to other thin clients. The ports can either be added to existing rules or in a new rule. The following example modifies the existing HPDM rules to add the needed ports. Configuring the rules 1. Log on to the thin client as the Administrator. 2. Click Start > All Programs > Symantec Endpoint Protection for Windows XP Embedded > Symantec Endpoint Protection for Windows XP Embedded. 3. In the main dialog of the SEP 5.1 Agent, click on the Tools menu and select Advanced Rules. 4. Click OK in the priority warning dialog. 5. Locate and select the existing rule titled Allow HPDM Agent TCP. Click Edit 6. In the Advanced Rule Settings dialog, select the Ports and Protocols tab. 7. Edit the remote ports to add ports 139, 40004, 40009, and as shown in the following figure. Configure the passive port range to match the range you configured on the IIS ftp server. Figure 3. Advanced Rule Settings Note: In order to use the Reverse Shadow and Resource Monitor functions of HPDM, additional changes to the Allow HPDM Agent TCP rule are required on the Applications tab. For more information, see VNC Shadowing. 8. Click OK to save the changes. 9. Select the existing rule titled Allow HPDM Agent Local TCP. Click Edit 10. In the Advanced Rule Settings dialog, select the Ports and Protocols tab. 6

7 11. Edit the local ports to add port as shown in the following figure. Figure 4. Advanced Rule Settings 12. Click OK to save the changes. 13. Click OK in the Advanced Rules dialog. 14. Exit the SEP 5.1 Agent, commit changes to EWF (if enabled), and then restart the thin client. Exporting SEP rules to a.sar file Now that the firewall rules have been updated on one device to allow traffic, export the rules to a.sar file to deploy the rules to other devices. 1. Log on to the thin client as the Administrator. 2. Click Start > Run. 3. Enter cmd, and click OK. 4. In the command prompt window, enter following command: C:\Program Files\Symantec\SPA\Smc.exe" -exportadvrule C:\hpdm_45.sar 5. Press ENTER. The rules are exported to the C:\hpdm_45.sar file. Copy this file from the thin client to a USB flash drive, network share, or other storage device, and then copy it to the server running the HPDM Console. 7

8 Creating a task template to deploy SEP rules Now that the necessary rules are in a.sar file, create a File and Registry task to deploy the rules. Assuming that the FTP repository is IIS 7 or higher, the task disables the SEP firewall to successfully transfer the exported rule file to the device, and then transfers the file. Before importing the SEP rules, restart SEP. Then, the task imports the rules file. The following steps show how to create the task template. Note: Do not copy and paste the commands from this document as the formatting might prevent the command from executing properly. Enter the commands manually. 1. Log in to the HPDM Console. 2. Ensure that the HP WES\XPe and Task Templates tabs are selected. Note: The operating system tab name HP WES\XPe has been changed to WES7/WES09/XPe. 3. Double click the _File and Registry template to edit a new template. 4. In the Template Editor, click Add. 5. Select Command for the subtask, and then click OK. 6. Edit the Command box to add the following command: C:\Program Files\Symantec\SPA\Smc.exe" stop Include the quotes. Ensure that Yes is selected for the Wait option and then click OK. Figure 5. Execute Command Sub-Task editor 7. In the Template Editor, click Add, select the Deploy Files subtask, and then click OK. 8. Click Add from local to add the SEP rules file to the repository. 8

9 9. Select the SEP rules file (.sar) that you copied over from the thin client. Figure 6. Add from local 10. Click Add from local. 11. In the Deploy Files dialog, edit Path on the Device. This example uses Z:\Temp. Figure 7. Deploy Files 12. Click OK. 13. To ensure that the transfer of the rules file completes before the firewall is re-enabled and imports the files, add a Pause subtask. In the Template Editor, click Add. 14. Select Pause for the subtask and click OK. 9

10 15. In the Pause Sub-Task dialog, set the pause duration to 5 seconds and click OK. Figure 8. Pause Sub-Task editor 16. Repeat steps 4 6 to add another Command subtask to re-enable the SEP firewall using the following command: C:\Program Files\Symantec\SPA\Smc.exe" start Include the quotes. Ensure that Yes is selected for the Wait option and then click OK. 17. Repeat steps to add another 5 second pause. This ensures that the SEP firewall is started before the import. The import only succeeds if SEP is running. 18. Repeat steps 4 6 to add another Command subtask to start SEP using the following command: C:\Program Files\Symantec\SPA\Smc.exe -importadvrule Z:\Temp\hpdm_45.sar Include the quotes. Ensure that Yes is selected for the Wait option and then click OK. 19. In the Template Editor, click Save As. Then, provide a name for the template and click OK. Figure 9. Enter New Template Name 20. The Package Description Editor dialog opens. In this dialog, enter the details of the deployment package for the SEP rules file. Necessary details include: Title, Installation Space (bytes), OS Type, Thin Client Models, and Description. Figure 10. Package Description Editor 21. Click Generate. 10

11 Troubleshooting The task template is ready to deploy to other XPe thin clients. HP recommends that you first test the task template on one or a small group of devices before a larger deployment and verify that the rules have the new ports we added. If the task completes successfully but the advanced rules do not change to include the new ports, try adjusting the timing of the pauses. If the command execution fails for any of the subtasks, verify that the command line is correct, especially the quotes. VNC Shadowing Shadow Device After updating the HPDM Agent, the VNC service is disabled on the thin client. Before any Shadowing tasks can work, you must first send a settings task to Enable VNC Shadow. After this has been sent and the SEP firewall ports have been updated, both the Shadow Device and Reverse Shadow Device functions work as expected. Reverse Shadow Device Even with the VNC service enabled correctly, you might find that Reverse Shadow Device tasks succeed, but the VNC connection does not occur. This is because the rule that allows the outbound ports for HPDM is limited to the HPDM Agent process only and a separate application is required to secure outbound connectivity to the shadow connection. To resolve this issue, you need to use the procedure in the Symantec Endpoint Protection (SEP) Firewall section to add and deploy the following application to the rule titled Allow HPDM Agent TCP: C:\Windows\XPEAgent\VncSSLProxy.exe Figure 11. Advanced Rule Settings Troubleshooting If the Shadow Device or Reverse Shadow Device task succeeds, but the connection does not occur, verify that the SEP firewall is not blocking the connection. To test this issue, send the Stop SEP template created in the Symantec Endpoint Protection (SEP) Firewall section to a test device with the Write Filter Policy set to excute regardless of Write Filter status. Then, without restarting, test the shadow task. If the task succeeds, then the SEP rules need to be examined to ensure proper traffic can pass through on the thin client. If the task does not succeed, verify that the firewall on the HPDM Console is not blocking the traffic. Note that it might take some time to see the VNC connection, depending on the auto-connect settings of the VNC service on the device. 11

12 Imaging There are several issues that can prevent imaging operations from working properly on XPe thin clients, especially when capturing an image from an XPe thin client. These issues include the following: Space characters in the image name Captured image does not get compressed The current version of HPDM has fixed this issue. No entry for Image Size after a capture task The current version of HPDM has fixed this issue. Cached Imaging option does not work To create a template with an image payload that works, you need to capture the image, name it without using spaces, and then export, rename, and re-import it to a new template. After the new template is created, it can be deployed to other HP t5740 thin clients after the HPDM Agent and SEP firewall rules have been updated. If you are using the latest version of HPDM, you can skip the export, rename, and re-import steps. The following sections contain detailed information and workarounds for these four issues. Space characters in the image name When sending a capture image task, you might have a problem if you use one or more space characters in the image name. For example, you might send a capture image task named My XPE Image. Figure 12. Task Editor 12

13 After sending the task, the task successfully captures an image from the device and a template is created. When you attempt to send the deploy image task created by this capture image task, however, it will fail with a error (Image file not found on FTP repository). During the capture image task, the file name is truncated after the first space character and so the imaging tools are unable to find the file by the specified name. In this example then, the file name ends up as My. Figure 13. Tuncated apture image file name Renaming the file does not help. Also, copying the image file, re-importing it, and creating new template does not work. The image must be recaptured without spaces in the image name. Captured image does not get compressed Sometimes a resulting image file has the.dd.gz extension, but is not compressed. Using a third party compression tool, such as 7-zip, results in an error. If you re-import the file as is and attempt to deploy, the task succeeds but does not make changes to the thin client. If you observe the device during the image deployment attempt, you might notice a not in gzip format error. Figure 14. gzip error on thin client. 13

14 22. To resolve this issue, copy the file in the repository, rename it without the.gz extension, and re-import it. Re-import details are provided in Creating a new template and re-importing the image. No entry for Image Size after a capture task After having successfully pulled an image from the HP t5740 running XPe,you might see the deployment stall with a division-by-zero error on the device when you attempt to deploy the image. Figure 15. Division by zero error on thin client. 14

15 Reset the thin client to recover the device and cause the task to fail with a error (Failed to obtain return code from returned update file from updating.). This error occurs if the value in the image package for Installation Space is 0. Figure 16. Properties dialog of captured image. This value cannot be modified. You need to re-import the image file and create a new template. Copying an image and delete deployment template 1. Use Windows explorer to copy the image file from the local directory of the repository. This file is usually as follows: C:\Inetpub\Ftproot\HPDM\Repository\Images\<image name>\<image name>.dd.gz 2. Rename the copied file so that it does not have the.gz extension (for example, image.dd). 3. Copy the file to a temporary location on the same system, and then use the content management to delete the image file from the repository. 4. Next, delete the Deployment template from the Task Templates tab. Creating a new template and re-importing the image 1. In the HPDM console, click the Template menu and then select Import> Image Files > to deploy without PXE. 2. In the resulting Import Image File dialog, click the Browse button then select the image file you copied. 3. The OS Type and Template Name boxes automatically populated. Modify if needed, and then click Import. Figure 17. Import Image File. 15

16 4. In the resulting Package Description Editor, enter the size of the image file in bytes in the Installation Space (bytes) box. Select WES09 for OS Type, because XPe is not an available option, and then select t5740 for the Thin Client Models. Add a description if desired, and then click Generate. Figure 18. Package Description Editor. 5. Click OK after the image has transferred. It might take a few minutes after the transfer for the new template to become available. Cached Imaging option does not work The Cached Imaging option appears in the task template editor, but this option is not supported. If you select the Cached Imaging option, tasks using the template fail. There is no workaround for this issue. Do not select the Cached Imaging option. Other HPDM 4.5 features This section provides quick descriptions of the results for some of the more common HPDM 4.5 tasks that have been put through basic testing. Unless otherwise noted, all testing was done after successfully updating the HPDM Agent and SEP firewall rules. Details are provided when other changes to the thin client are needed. Note: The HPDM Quality Assurance team verified all tasks for XPe with the current version of HPDM. Agent tasks Configure Agent The mechanism for agent configuration has not changed. A quick test to change all parameters available in Configure Agent task editor completed without issue. Task Deferment A quick test to change the task deferment settings completed successfully. Sending a task with the deferment option enabled revealed that the changed settings were in place and that task deferment works as expected. Connections task Pull Connection Configuration A quick test to pull only RDP connections succeeded without issue. The contents of the template generated were verified and sent back to same device and the task completed without issue. 16

17 File and registry tasks File and registry The File and registry task works to deploy files, execute commands, and pause taks. Also tested were tasks to capture the agent log file, delete the Internet Explorer shortcut file for All Users Desktop, apply registry settings to update grouping data, and add a program record. All tasks completed successfully. Get Registry A quick test to capture the HKLM\SOFTWARE\HP\DM Agent key from a thin client completed without issue. The contents of the template generated were verified and sent back to same device and the task completed without issue. Operations tasks Get Asset Information A quick test to execute the Get Asset Information task completed without issue and correctly updated device properties. Shutdown\Reboot Both the Shutdown and Reboot power-management tasks were tested and work properly. Send Message A quick test to perform a Send Message task completed successfully. Resource Monitor When sent to a XPe thin client, the _Start Resource Monitor task succeeded, but resource information did not update in the Resource Monitor window on the HPDM Console even though ports were configured on both the thin client and server. This is because the rule that allows the outbound ports for HPDM is limited to the HPDM Agent process only and the Resource Monitor feature uses a separate application to send the resource data. To resolve this issue, you need to use the procedure in the Symantec Endpoint Protection (SEP) Firewall section to add and deploy the following application to the rule titled Allow HPDM Agent TCP: C:\Windows\XPEAgent\winmon.exe Figure 19. Advanced Rule Settings 17

18 Wake on LAN Settings tasks Apply Settings The apply VNC to enable the VNC service on the thin client worked without issue. No other settings were tested. Although no issues are expected with the Apply settings task, HP recommends testing any custom settings tasks with one or more test units prior to deployment. Clone Settings A quick test to send a Clone Settings task for all available settings of the Administrator account completed without issue. The hostname, time zone, and Internet Explorer home page were modified in the resulting template and applied to same device. The task completed successfully and the modified settings were verified on device. Hostname and IP A quick test to send a Hostname and IP task to change the hostname and set a static IP completed successfully and changed the settings, verified on device. Set Domain A quick test to change the workgroup completed successfully and the change was verified on thin client. Another quick test to join the thin client to a domain completed successfully and was verified by the domain logon on the device. Note that after setting the domain on the device, it is set to automatically log on as the local User account unless modified. Set Password A quick test to change the password for the Administrator account completed successfully and changed the passwordword. Write Filter Settings Quick tests were performed to enable and disable both the partition and file-based write filers (EWF, FBWF). All tasks completed successfully and the changes were verified on the device. Untested HPDM 4.5 features Not all features were tested for this document. These features were either not tested or not verified because either the feature is not applicable or resources were not available. Take TPM Ownership Because the HP t5740 thin client does not have a Trusted Platform Module, the Take TPM ownership task is not applicable. PXE imaging PXE imaging was not tested for this document. Use this document to image devices without using PXE. Templates imported from FTP Component Browser Although none of the items available in the FTP Component Browser are targeted for XPe, some items targeted for WES might work. Because of resource contraints, no packages available in the FTP Component Browser have been test deployed to XPe thin clients. If there is an interest or need for a particular package, HP recommends that you first test the deployment on a single device or small test group to see if task succeeds and the package is deployed correctly. Settings and Connections The changes made to the device in the Settings tasks section were not verified due to resource constraints. Easy Tools Settings and Configurations Because HP Easy Tools is not compatible with XPe, no tests were performed to import of Easy Tools settings or connections and apply to devices. Summary Most HPDM 4.5 features work XPe thin clients, but they are not verified by the HPDM Quality Assurance team. The biggest issues are the SEP firewall on the thin client and imaging. Using this document, you can still use most features (and even some new features) and successfully manage your HP t5740 thin clients running XPe. 18

19 For more information To read more about HP Device Manager, go to hp.com/go/hpdm. Sign up for updates hp.com/go/getupdated Copyright 2014 Hewlett-Packard Development Company, L.P. Microsoft and Windows are U.S. registered trademarks of the Microsoft group of companies. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. First Edition: April 2014