Installation Guide. Version Mobile Service Manager

Transcription

1 Installation Guide Version Mobile Service Manager

2 Contents Good Mobile Service Manager Installation Overview 4 What to Expect During Your Installation 4 Recommended Workflow for Single Server Environments 6 Recommended Workflow for Dual Server Environments 7 Know Your Resources 8 System Requirements/Prerequisites 10 Server Hardware Requirements 10 File System Configuration 10 Core System Requirements 11 Good Dynamics Requirements 15 GEMS Requirements 16 Exchange Requirements 17 Exchange Management Tools 18 Good Mobile Messaging Prerequisites 19 BlackBerry Enterprise Server Requirements 20 BES One-Click Fix-It Requirements (Optional) 21 GFE and BlackBerry User Self-Service (USS) 21 Security Management Module (MDM) 22 MDM Gateway Server Demilitarized Zone (DMZ) Requirements 24 Installing Good MSM in a Single Server Environment 26 Installing Good MSM in a Dual Server Environment: Repository Server 36 Installing Good MSM in a Dual Server Environment: Application Server 45 Installing the Latest Patch 56 Troubleshooting the Good MSM Installation 57 Configuring SSL Certs 59 Good MSM Technical Support Contact Information 62

3 Legal Notice This document, as well as all accompanying documents for this product, is published by Good Technology Corporation ( Good ). Good may have patents or pending patent applications, trademarks, copyrights, and other intellectual property rights covering the subject matter in these documents. The furnishing of this, or any other document, does not in any way imply any license to these or other intellectual properties, except as expressly provided in written license agreements with Good. This document is for the use of licensed or authorized users only. No part of this document may be used, sold, reproduced, stored in a database or retrieval system or transmitted in any form or by any means, electronic or physical, for any purpose, other than the purchaser s authorized use without the express written permission of Good. Any unauthorized copying, distribution or disclosure of information is a violation of copyright laws. While every effort has been made to ensure technical accuracy, information in this document is subject to change without notice and does not represent a commitment on the part of Good. The software described in this document is furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in accordance with the terms of those written agreements. The documentation provided is subject to change at Good s sole discretion without notice. It is your responsibility to utilize the most current documentation available. Good assumes no duty to update you, and therefore Good recommends that you check frequently for new versions. This documentation is provided as is and Good assumes no liability for the accuracy or completeness of the content. The content of this document may contain information regarding Good s future plans, including roadmaps and feature sets not yet available. It is stressed that this information is non-binding and Good creates no contractual obligation to deliver the features and functionality described herein, and expressly disclaims all theories of contract, detrimental reliance and/or promissory estoppel or similar theories. Legal Information Copyright All rights reserved. All use is subject to license terms posted at legal. GOOD, GOOD TECHNOLOGY, the GOOD logo, GOOD FOR ENTERPRISE, GOOD FOR GOVERNMENT, GOOD FOR YOU, GOOD APPCENTRAL, GOOD DYNAMICS, SECURED BY GOOD, GOOD MOBILE MANAGER, GOOD CONNECT, GOOD SHARE, GOOD TRUST, GOOD VAULT, and GOOD DYNAMICS APPKINETICS are trademarks of Good Technology Corporation and its related entities. All third-party technology products are protected by issued and pending U.S. and foreign patents.

4 01 Good Mobile Service Manager Installation Overview The Good MSM Installation Guide includes the requirements, recommended workflows, checks and steps to deploy Good MSM 8.3 in a single server or a dual server environment. What to Expect During Your Installation There are 5 main sections to this guide: System Requirements Single Server Installation Dual Server Installation-Repository Server Dual Server Installation-Application Server Patch Installation! Note: Though BoxTone is now officially Good Mobile Service Manager, the branding in certain areas of the product, such as the installers will change in an upcoming rolling patch. Some of the content (services & servers) in this guide will still reference BoxTone. Review the Requirements Good MSM strongly recommends reviewing the requirements before proceeding to the Installation sections. Compliance with the base requirements will help facilitate a smooth installation. Before initiating the installation, review all platform and module prerequisites to ensure that your system meets the requirements set forth by Good in the System Requirements Guide. Failing to meet the prerequisites may stall the installation process. Number of Devices in your Deployment The estimated number of monitored devices in the deployment will determine the recommended installation method. Deployments comprised of less than 5,000 managed devices may use a single or dual server installation (although single is recommended). Deployments containing 5,000-20,000 managed devices must use a dual server configuration. Deployments containing more than 20,000 devices should call Good MSM Client Services for assistance with the installation. Installation Guide 4

5 Installation Overview Run the Patch After completing the initial Installation, you will need to run the latest patch (section 6). This patch will include the most recent product updates. Configure Settings Lastly, Good MSM settings must be configured before running MSM for the first time. The last section of the document will provide a preview of the configurations and a list of resources for more information. What you Need to get Started Before you begin, there are a few items you will need to proceed. Upon licensing modules from Good MSM, you should have been sent a pre-installation . This would contain the following items : License Key Links to download the Good MSM software and the most recent patch Ensure that all DNS and IP address mappings are correct, as incorrect mappings could generate errors during installation. Review the recommended workflows for single and dual server installations to see the appropriate process for your installation. Current software version in your environment Required path to upgrade to Good MSM > 8.2 Latest SR (SR1) > 8.3 Patch > 8.1 Latest SR (SR1) > 8.3 Patch > 8.0 Latest SR (SR3) > 8.3 UP > 8.3 Patch > 7.5 Latest SR (SR13) > 8.3 UP > 8.3 Patch > 7.2 Latest SR (SR19) > 7.5 UP > 7.5 Latest SR (SR13) > 8.3 UP > 8.3 Patch > 7.0 Latest SR (SR24) > 7.2 UP > 7.2 Latest SR (SR19) > 7.5 UP > 7.5 Latest SR (SR13) > 8.3 UP > 8.3 Patch 6.X Any customers on 6.x or earlier versions are not advised to use the upgrade paths to come to 32. A new installation of 8.3 is required. Installation Guide 5

6 Installation Overview Recommended Workflow for Single Server Environments To achieve a smooth installation, the diagram below contains the suggested workflow for single server installations (less than 5,000 devices in the deployment). Section Step Description Section 2: Requirements 1 Þ Review System Requirements Section 2B: SSL Certs 1b Þ Configure SSL Certificates Section:3 Single Server Installation 3 Þ 4 Þ 5 Þ 6 Þ 7 Þ 8 Þ 9 Þ 10 Þ 11 Þ 12 Þ 13 Þ Bypass Sections 4 & 5 Þ Section 6: Patch 14 Þ Run the Installer Read the Introduction Screen Enter the License Key Estimate the number of mobile devices Choose the Installation type Choose the Installation location Configure the service account Enter the Dashboard IP address Prerequisite Summary Pre-Installation Summary Installation Complete Bypass guide sections 5 & 6 as they do not apply to single server installations Patch Installation Instructions Section 7: Next Steps-Admin Console v An overview of steps to configure the necessary settings before running Good MSM for the first time Installation Guide 6

7 Installation Overview Recommended Workflow for Dual Server Environments To achieve a smooth installation, the diagram below contains the suggested workflow for dual server installations (more than 5,000) devices in the deployment). Section Step Description Section 2: Requirements 1 Section 2B: SSL Certs 1b Þ Þ Bypass Section 3 Þ Section 4 :Dual Server -Repository Server 4 5 Þ Þ 6 Þ 7 Þ 8 Þ 9 Þ 10 Þ 11 Þ 12 Þ 13 Þ Review System Requirements Configure SSL Certificates Bypass guide Section 3. This content does not apply to dual server installations Dual Server Install-Repository Server Run the Installer Read the Introduction Screen Enter the License Key Estimate the number of mobile devices Choose the Installation type Locate App Server Review Prerequisite Summary Review Pre-Installation Summary Installation Complete Installation Guide 7

8 Installation Overview Section Step Description Section 5:Dual Server-Application Server 14 Þ Dual Server Install-Application Server 15 Þ Reopen the Installer 16 Þ Enter the License Key 17 Þ Accept License Agreement Section 6: Patch 27 Section 7: Next Steps-Admin Console 28 Þ Þ Þ Þ Þ Þ Þ Þ Þ Þ v Estimate the number of mobile devices Choose the installation type Locate App Server Locate Oracle Database Configure Good MSM Service Account Enter the Dashboard IP address Review Prerequisite Summary Review Pre-Installation Summary Installation Complete Patch Installation Instructions An overview of steps to configure the necessary settings before running Good MSM for the first time Know Your Resources Troubleshooting Help Troubleshooting tips are available in the appendices of this document. Appendix A: Troubleshooting the Good MSM Installation Appendix B: Configuring SSL Certificates Appendix C: Good MSM Technical Support Contact Information Appendix D: Requirements Checklist User Guides Installation Guide 8

9 Installation Overview Good MSM publishes guides to help navigate our product s interface and leverage all of the tools available to you in the dashboards. Guide Name Description Primary Guides System Requirements & Installation Use this guide to learn the prerequisites required to install Good MSM software and complete a single server or a dual server installation. Configuration and System A comprehensive guide created to help you configure Good MSM settings before you Administrator run the software for the first time and tune, maintain, and edit the Good MSM system. Operations and Monitoring Guide and maintaining your environments. Provides system description information and step-by-step instructions for monitoring Upgrade Installation Provides detailed step-by-step instructions for upgrading to Good MSM 8.2 on a system with a previous version of Good MSM. Secondary Guides Reports Guide Provides an in-depth overview of the reports available for Asset, Operations, MDM, and BlackBerry modules. Service Desk Microsoft System Center Operations Manager (SCOM) Install Guide: Good MSM Connector for Microsoft System Center Operations Manager (SCOM) User Guide: User Self-Service Overview Guide Security Management Provides step-by-step instructions for using the Good MSM Service Desk Module to enhance the help desk s ability to troubleshoot and remediate end-user problems. Provides information on installing the Good MSM connector for MS SCOM. Provides information on using the Good MSM connector for MS SCOM. Provides an overview to show administrators the range of actions that may be taken within the USS web console. Provides system description information and step-by-step instructions for using Security Management features. Installation Guide 9

10 02 System Requirements/Prerequisites This section outlines the minimum requirements and lists other provisions necessary to complete your Good MSM installation. Good MSM strongly recommends reviewing the requirements before proceeding with the installation. The following prerequisites are recommendations to build your Good MSM servers. Noncompliance with system requirements could result in compromised system performance or an unsuccessful installation.! Note: Though BoxTone is now officially Good Mobile Service Manager, some of the content in this guide will still reference BoxTone to remain consistent with system file, server, account, and directory names. Server Hardware Requirements Below are the minimum hardware requirements to operate Good MSM in your environment. Use the table to determine the proper hardware configurations for your enterprise. File System Configuration The recommended file system configuration will optimize Good MSM system performance. RAID 10 or SAN storage are recommended for Database Storage and Redo logs. Deployments with more than 5,000 devices are required to use a dual server configuration. For large deployments exceeding 20K devices, please call Good MSM Client Services to assist with your installation. The file system configurations shown below are recommendations. The XX signifies the letter(s) of the drive. Monitored Devices Server #CPU Core CPU GHz RAM Recommended File System Configuration 1-2,000 App/Database GHz 8GB XX: - Windows OS:40 GB XX: - Good MSM App: 30 GB XX: - Good MSM DB: 200 GB 2,000-5,000 App/Database GHz 16GB XX: - Windows OS: 40 GB XX: - Good MSM App: 30 GB XX: - Good MSM DB: 200 GB Installation Guide 10

11 System Requirements/Prerequisites Monitored Devices Server #CPU Core CPU GHz RAM Recommended File System Configuration 5,000-15,000 Database GHz 16GB XX: - Windows OS:40GB XX: - Good MSM App: 20 GB XX: - Good MSM DB Storage: 300 GB XX:-Redo logs : 10GB App GHz 16GB XX:- Win OS: 40 GB XX: -Good MSM App: 50 GB 15,000-20,000 Database GHz 32GB XX: - Win OS: 40GB XX: - DB App: 20 GB XX: - DB Storage: 500 GB XX: - Redo logs: 10 GB App GHz 32GB XX:- Win OS: 40 GB XX: - Good MSM App: 50 GB 20,000+ Please consult your Good Sales Engineer or TAM Optional Remote Log Collector GHz 4GB XX:- Win OS: 40 GB XX: - Good MSM App: 20 GB Core System Requirements Prerequisite Operating System Requirement Good MSM supports the following operating systems (English version): Windows Server 2008 R2 Windows Server 2012 R2 Standard Note: The most recent service pack should be installed on the server. Note: There is an issue that causes IP addresses on a single network adapter to be registered improperly within DNS. The following Microsoft hotfix should be applied. Windows 2008 SP2: Windows 2008 R2: Region/Location Settings The Region and Location Format (Control Panel -> Region and Language -> Formats) must be set to United States. Anti-Virus Scanning Must be disabled during the installation and for all Good MSM application and database directories during operation. Installation Guide 11

12 System Requirements/Prerequisites Server Service Ports Remotely Accessible Listen Outbound Local TCP Ports App App Broker Service Action Gateway Note: In a dual-server X deployment, the Good MSM repository server must be able to connect X to the Good MSM application server on this port. App Log Collector X App HTTP Load Balancing Service 4925 X App Collector Server 5354 X App Admin Services X App WMI Gateway Service 8825 X App Console X X Repository Oracle Repository X X X X App Integrator X Broker (BES/GFE/GD 1433 App User Sync App BBUAT 1433 X X App App App GFE Web Services Log Collector WMI Gateway 135 X X X App SCOM Connector (Optional/BES Only) 5724 X Installation Guide 12

13 System Requirements/Prerequisites Prerequisite File System Backups Requirement Must be disabled on all Good MSM application and database directories. Good MSM Backup Utility will be installed during Good MSM implementation for environment backup. Internet Information Services (IIS) Microsoft PowerShell Disk Contention IIS Services must NOT be installed or enabled on the Good MSM Server. Servers must not have the Web Server role enabled to avoid port conflicts with Good MSM consoles. Microsoft PowerShell v2 or greater Good MSM recommends that each logical drive (C:, D:, E:, etc) be on separate physical arrays to maximize disk I/O performance, and minimize contention among BoxTone services. Temp Directory Data Retention Policy Service Account IPv6 Static IP Address.NET Framework Virtualization Adobe Flash At least 20GB of free space must be available on the drive of the temp directory (typically C:) prior to installation of Good MSM. File system requirements listed above assume you are using the default Good MSM data retention settings. Additional space may be required if the data retention policies are changed. Service Account (BTAdmin) is required to run Good MSM services Domain User Local Administrator on Good MSM Server Local Security Policy Requires the following privileges: o Log on as a service o Log on as a batch job o Log on locally IPv6 Support must be disabled on the Good MSM server The core Good MSM installation requires a static IP address. Additional IP addresses may be required if additional modules are enabled. (See requirements sections for modules being installed)..net Framework 2.0 or greater with the latest published service pack. When running Good MSM on a VM, it is recommended that 75% of the RAM required for your implementation (see Server Hardware Requirements table above) be reserved/dedicated on the host. See KB for additional details. Adobe Flash v10 or greater is required to access Good MSM s web consoles. It may be necessary to manually enable the Flash plugin on the newest Firefox releases. Installation Guide 13

14 System Requirements/Prerequisites Prerequisite Requirement Web Browser The following web browsers are certified in Good MSM 8.3: Internet Explorer 9 & 11.x Chrome (Latest Version) Firefox (Latest Version) Mobile Device Users Group All ad blocking extensions should be disabled or a rule excluding the MSM application server must be created for Admin users. Please see KB for additional information. An AD group should exist that contains all users who have a mobile device associated with your environment. This group will be mapped to the MobileDeviceUsers role in Good MSM. If this AD group does not exist in your environment, create it before proceeding to installation. The MDU group should only be mapped to all mobile users in deployments with Security Management. If AD Optimal Sync Mode is enabled, the MDU must be mapped to monitored/vip users. If Full AD Sync is enabled (required for Security Management/MDM), a security group,( in Active Directory or a local Windows Group on the MSM App Server) must be created. This group must include all users that have or will have a monitored mobile device. If Optimal AD Sync is enabled, then an Active Directory or a local Windows Group must be created that includes all users for which VIP monitoring is desired. Installation Guide 14

15 System Requirements/Prerequisites Good Dynamics Requirements Please review the monitored GD Prerequisites to ensure you have assigned the proper roles and permissions and obtained the certified software versions for all associated GD requirements. Prerequisite Good Control (GC) SQL Database Access Good Control (GC) Log Monitoring Good Proxy (GP) Service Monitoring GP Log Monitoring GP App Name Discovery (Optional) Good Dynamics Software Version Requirement Good MSM requires read access to the Good Control database (GC). This requirement can be met via one of the following: o Windows Integrated Authentication - The Service Account must be granted the db_datareader role within the database. o SQL Authentication - Provide a SQL account that has the db_datareader role within the database. Identify the port (default=1433) and instance that the GC SQL database is bound to. Ensure the database has remote IP access enabled. Good MSM currently supports only a single GC database per SQL server. The following are required for Good MSM to monitor Good Contorl diagnostic nformation via log files: The GC s diagnostic log directory must be shared on the Good Proxy Server. The default location is C:\Good\GCLogs. The Service Account requires read access to the shared log directory The Service Account must be a member of Administrators group on each monitored GP and GC to monitor service status via WMI. * Monitoring via WMI is optional. The following are required for Good MSM to monitor Good Dynamics application information via log files: The Good Proxy Server s diagnostic log directory must be shared. The default location is C:\Good\GPSLogs. The Service Account requires read access to the shared log directory In order to discover the common names of Good Dynamics applications, it is necessary to connect to the Good Dynamics NOC. This connection is made on port 443 to the following host gdmdc.good.com This connection must be unproxied. The following Good Dynamics software versions are supported in Good MSM 8.3: Good Control 2.0+ (certified) Good Proxy 2.0+ (certified) Installation Guide 15

16 System Requirements/Prerequisites GEMS Requirements Prerequisite GEMS EWS Database Access GEMS Connect Database Access GEMS Service Monitoring GEMS Log Monitoring Good Enterprise Mobility Server Version Requirement Good MSM requires read access to the GEMS EWS database (EWS). This requirement can be met via one of the following: o Windows Integrated Authentication - The Service Account must be granted the db_datareader role within the database. o SQL Authentication - Provide a SQL account that has the db_datareader role within the database. Identify the port (default=1433) and instance the GEMS EWS database is bound to. Ensure the database has remote IP access enabled. Good MSM requires read access to the GEMS Connect database (Connect). This requirement can be met via one of the following: Windows Integrated Authentication - The Service Account must be granted the db_ datareader role within the database. SQL Authentication: Provide a SQL account that has the db_datareader role within the database. Identify the port (default=1433) and instance that the GEMS Connect database is bound to. Ensure the database has remote IP access enabled. The Service Account must be a member of Administrators group on each monitored GEMS to monitor service status via WMI. * Monitoring via WMI is optional. The following are required for Good MSM to monitor GEMS information via log files: For GEMS EWS monitoing, the following log folder must be shared and will typically appear in one of the following locations. GEMS 1.4 and below: \Program Files\Good Technology\Good Enterprise Mobility Server\Good Server Distribution\gems-karaf-1.X.X\data\log. GEMS 1.5 : \Program Files\Good Technology\Good Enterprise Mobility Server\ Good Server Distribution\gems-quickstart-1.5.XX\data\log For GEMS Connect monitoring, the following service log folder must be shared and will typically appear in one of the following location. \Program Files\Good Technology\Good Enterprise Mobility Server\Good Connect\ logs The Service Account requires read access to the shared log directories. The following GEMS version(s) are supported in Good MSM 8.3: 1.6+ (certified) Installation Guide 16

17 System Requirements/Prerequisites Exchange Requirements Please review the Exchange Requirements to ensure you have allowed access to logs and assigned the proper ports, roles, and permissions as required. Prerequisite Service Monitoring Exchange Version Log Monitoring BoxTone Service Account Requirement For Exchange 2007 and Exchange 2010 the Service Account must be a member of the local Administrators group on each server with the Client Access role to monitor service availability via WMI.For Exchange 2013 the Service Account must be a member of the local Administrator group on each server with the Mailbox role to monitor service availability via WMI. * Monitoring via WMI is optional. Good MSM Supports Exchange 2007, 2010, 2013 with the latest service pack installed. The following is required for Good MSM to read the IIS transaction (W3SVC) and HTTPERR logs: Microsoft Exchange CAS, Mailbox (Exchange 2013 only) and HTTPERR log folders must be shared (default locations are listed below). a. HTTPERR: C:\Windows\System32\LogFiles\HTTPERR b. CAS: C:\inetpub\logs\LogFiles\W3SVC1 c. Mailbox (Exchange 2013 only): C:\inetpub\logs\LogFiles\W3SVC2 The service account requires read access to the log folder Validate that logs are accessible from the Good MSM server Logging should be configured as follows: o Format: W3C o Encoding: UTF-8 o Rollover schedule: Daily The BoxTone Service Account must have the following roles to collect ActiveSync connected device information from the Exchange environment. o Exchange 2007 View-Only Exchange Administrator Role o Exchange View-Only Organization Management Role o Exchange View-Only Organization Management Role The PowerShell RemoteSigned Execution policy must be in place. To check, run the following in PowerShell: 1. get-executionpolicy 2. if RemoteSigned is not returned, run the following command to set the policy to RemoteSigned 3. set-executionpolicy remotesigned Installation Guide 17

18 System Requirements/Prerequisites Exchange Management Tools Please review the corresponding versions of the Exchange Management Tools based upon the version(s) of Exchange that will be monitored. Exchange Environment Exchange 2007 EMS 2007 Exchange 2010 Exchange 2013 Exchange 2007 and Exchange 2010 EMS 2007 Exchange 2010 and Exchange 2013 Exchange 2007 and Exchange 2013 EMS 2007 Exchange Management Shell (EMS) Tools required n/a n/a n/a To learn more about the Microsoft Exchange Tools, select one of the links below. The following Microsoft Knowledge Base (KB) articles provide details about the installation of these tools: Installation Guide 18

19 System Requirements/Prerequisites Good Mobile Messaging Prerequisites Please review the monitored Good Mobile Messaging requirements to ensure you have assigned the proper roles and permissions and met registry key requirements. Prerequisite Requirement GMC SQL Database Access GMM Log Monitoring GMM Service Monitoring GMM server registry keys Good MSM requires read access to the Good Mobile Control database (GMCDB) This requirement can be met via one of the following: o Windows Integrated Authentication - The Service Account must be granted the db_datareader role within the database. o SQL Authentication - Provide a SQL account that has the db_datareader role within the database. Identify the port (default=1433) and instance that the Good SQL database is bound to. Ensure the database has remote IP access enabled. The following is required for BoxTone to monitor GMM server health and mail flow via log files. GMM log folder must be shared Service Account requires read access to the shared log directory Service Account must be a member of Administrators group on each monitored GMM to monitor service status via WMI. * Monitoring via WMI is optional. The following registry keys are required on any monitored Good Mobile Messaging server. All keys will be located in HKLM\SYSTEM\CurrentControlSet\Services\GoodLinkServer\ parameters\diagnostics. NOTE: If the Diagnostics key does not exist, you must create it and then create the appropriate string values as stated below: To decrypt the log files and ensure they flush in real-time, set the following registry values. encrypt =0 expand =1 cachesize =0 GFE One-Click Fix It The Service Account should be added to the Service Administrator role on the GMC. Port must be open on the GMC to allow the Good MSM Service Account to communicate with web services for GFE Fix-It. Installation Guide 19

20 System Requirements/Prerequisites BlackBerry Enterprise Server Requirements Please review the BlackBerry Enterprise Server Guidelines below to ensure you have assigned the proper roles and permissions as required. Prerequisite Requirement BES Version The following BES versions are certified in Good MSM 8.3: BES BES SQL Server Access Good MSM requires read access to the BlackBerry Configuration Database (BESMgmt). This requirement can be met via one of the following: o Windows Integrated Authentication - The Service Account must be granted the db_datareader role within the database. o SQL Authentication - Provide a SQL account that has the db_ datareader role within the database. Please be sure to identify the port (default=1433) and instance that the BES Configuration Database (BESMgmt) is bound to. Ensure the database has remote IP access enabled. BES Service Monitoring BES Log Monitoring The Service Account must be a member of Administrators group on each monitored BES to monitor service status via WMI. * Monitoring via WMI is optional. The following bullets are required for Good MSM to read the BES Logs: BlackBerry Enterprise Server log directory must be shared Service Account requires read access to the shared log directory BES Log Levels must be set DEBUG on BES The following BES logs must be set to debug -MAGT -SYNC -POLC -DISP -CTRL Validate that the BES Logs are accessible from the Good MSM Server Installation Guide 20

21 System Requirements/Prerequisites BES One-Click Fix-It Requirements (Optional) Please review the Good MSM One-Click Fix-It requirements below to download and install the BES User Administration tool. Once installed, ensure that the proper roles and permissions have been assigned. Good MSM BES Fix-It Requirements BES Domain Requirement To configure Good MSM One-Click Fix-It, download the BlackBerry Enterprise Server User Administration Tool. This download is available from blackberry.com/brk. Ensure the version that you download matches your BES version. Good MSM requires BlackBerry Enterprise Server Resource Kit version 5.0 Service Pack 4. Install the BlackBerry Enterprise Server User Administration Tool on the Good MSM Server. The Service Account should be given the proper permissions on the BES SQL Server (One-Click Fix-it requires the Enterprise Administrator role.) The BlackBerry Administration Service (BAS) must be listening on the default TCP Port (443). One-Click Fix-It is not supported with other port configurations. GFE and BlackBerry User Self-Service (USS) Prerequisite DNS Entry for Cross-Platform USS Requirement A DNS entry should be created for the USS hostname that will point to the core IP address of the BoxTone server. Please Note: BlackBerry User Self-Service (BB USS) is featured in BoxTone versions prior to 7.5. Customers upgrading to 8.3 may continue to use their previous versions of BB USS. However, only Cross-Platform USS will be licensed for new installations of Good MSM 8.3. Installation Guide 21

22 System Requirements/Prerequisites Security Management Module (MDM) Prerequisite DNS and Static IP Port Requirements Requirement The Good MSM Server requires 2 additional Static IP addresses. 1 static IP for Device Enrollment 1 static IP for Device Management DNS entries must also be made for IP address to hostname mapping on internal networks. Example: enroll.<company>.com and mdm.<company>.com The following ports are required to be open on the Good MSM Server. Outbound Port 2195 Send requests to Apple Push Notification Service (APNS) In an Exchange 2010 environment, TCP Port 80 is required to be open for outbound connections between the Good MSM server and all Exchange 2010 mailbox servers in order to retrieve device information: For details, see technet.microsoft.com/en-us/library/dd297932(v=exchg.141).aspx SSL Certificate for Security Management Generate an APNs Certificate Service Account Good MSM 8.3 requires the purchase of an SSL Certificate for use with the Activation Application. This SSL Certificate must be purchased from an Applerecognized certificate vendor. Additional details can be found in the Configuration and Administration Guide. This is required for Good MSM Security Management. The following permissions are required for the service account to perform Exchange Actions: Exchange 2007 o Local Administrator on each of the 2007 Exchange servers o Exchange View-Only Administrator Role o Exchange Recipient Management Role (required to enable or disable ActiveSync) o Exchange Server Administrator on all Exchange Mailbox Servers (required to wipe device) Exchange 2010 o View-Only Organization Administrator Role o Exchange Recipient Management Role (required to enable or disable ActiveSync & wipe device) Exchange 2013 o View-Only Organization Administrator Role o Exchange Recipient Management Role (required to enable or disable ActiveSync & wipe device) Write privileges for msexchomaadminwirelessenable in the user objects category Installation Guide 22

23 System Requirements/Prerequisites Prerequisite Non-Exchange Environments Volume Purchasing Program (VPP) Requirement To enable ActiveSync configuration within non-exchange environments, the following must be configured: Users must authenticate utilizing Active Directory credentials. o The Users primary SMTP address must populated in the AD attribute mail In order to utilize the VPP distribution capabilities of Good MSM, a valid Apple VPP for Business account must be set-up. Please refer to Apple s Volume Purchasing Program for Business guide found at for details. Certificate Authorities To enable Good MSM to distribute identity certificates from a Microsoft Certificate Authority, please set-up permissions and templates as outlined in the document Good MSM Certificates Technical Overview which can be found in the \Good MSM\ Documentation directory on your server. Installation Guide 23

24 System Requirements/Prerequisites MDM Gateway Server Demilitarized Zone (DMZ) Requirements If MDM is being used with externally connected ios devices (via cellular or remote Wi-Fi access points), a separate MDM Gateway Server in the perimeter network/demilitarized Zone (DMZ) is strongly recommended. Prerequisite MDM Gateway Server Hardware Requirements DNS and Static IP Requirement The Good MDM Gateway Server accepts inbound connections from MDM devices. Hardware requirements are listed below: 4 CPU 2.66 GHz 4 GB RAM Recommended File System Configuration: o C: - Windows OS 40 GB o D: - Apache App 40 GB The Good MDM Gateway Server requires 2 Static IP addresses in the DMZ. 1 static IP for device enrollment 1 static IP for device management These IP addresses must be publicly routable or must have publicly routable IP addresses referencing them via NAT. Port requirements Public Internet to DMZ Port requirements DMZ to Internal Network DNS Entries must also be made for IP address to hostname mappings to public Internet and to Internal Network. Good MSM recommends the following naming scheme: Device Enrollment IP Address: enroll.<company>.com Device Management IP Address: mdm.<company>.com The following ports are required to be open from the public Internet to IP addresses on the Good MDM Gateway Server enroll.<company>.com o 80 and 443 HTTP(S) mdm.<company>.com o 443 HTTPS The following ports are required to be open from the DMZ server to the Good MSM server on the internal network. 80 and 443 HTTP(S) AJP/SCEP Good MSM requires allowing traffic on these ports from all IP address on the DMZ server to both Security Management IP address (Enroll and MDM) on the internal server. Installation Guide 24

25 System Requirements/Prerequisites Prerequisite Port requirements Internal Server to Apple Requirement The following ports are required to be open for outbound connections from the Good MSM server on the internal network to Apple s network ( /8) 2195 APNs Apache Download The Good MDM Gateway Server requires the most recent 2.2 release version of Apache HTTP Server with OpenSSL to be installed. As of the writing of this document this is openssl-0.9.8t.msi). Download Apache HTTP Server (httpd) Win32 binary includingopenssl 1.0.1m (MSI Installer) Installation Guide 25

26 01 03 Installing Good MSM in a Single Server Environment The Good MSM application is delivered via downloaded compressed files. All files from the download must be extracted at one time in order to maintain the required folder and directory structure. 1. Log onto the server using the Good MSM Service Account.! Note: Due to a third-party installation package limitation, the Good MSM Installer does not support installing the software while logged in with a username that contains special characters. See Appendix A: Troubleshooting the Good MSM Installation for the recommended solution. 2. Download the Good MSM installation files. 3. Extract the downloaded file to a temporary location. 4. Navigate to the extracted file location. Double-click the \install.bat file. The InstallAnywhere Wizard dialog box will open and display the progress. When the system preparation is complete, the Good MSM Suite Install wizard opens and displays the Introduction screen. The left side of the installation screen will help you track your progress through the installation process. Use the buttons at the bottom of the screen to navigate through the installation process. Installation Guide 26

27 Single Server Installation! Note: You may select Cancel at any time to terminate the installation; however, you will need to uninstall all Good MSM content that has been partially installed up to that point and then restart the installation process. 5. Press Next. 6. Enter the license key into the designated space below the onscreen directions. Good MSM provides a one-time, 17-digit license key via . Use this unique key to populate the field. Good MSM will provide a new installation key for all major and minor releases; previous keys from earlier Installation Guide 27

28 Single Server Installation releases of Good MSM will be deactivated in Good MSM Press Next The License Agreement will open. In order to continue with the installation, you must consent to the terms of the software license agreement. If you do not accept the terms of the license agreement, you will not be able to install the software, concluding the installation process. 8. Select I accept the terms of the License Agreement radio button. To configure your settings properly, Good MSM needs to know the estimated number of devices within your environment. The range of users selected will determine the installation type. For a single server installation, the number of devices may not exceed 5,000. The option buttons will allow you to select the number of smartphone users in this Good MSM deployment. The system requirements and prerequisites will change depending on the number of users selected.! Note: For deployments including more than 5,000 devices, you must complete a dual-server install. If you select > 5000, you will not be able to select the Single Server install option on the following screen. See Sections 5 and 6 to complete a dual installation. 9. Select the radio button that most closely reflects the number of mobile devices in your deployment. Installation Guide 28

29 Single Server Installation The Choose Install Set screen opens. Single server installation is ideal for most deployments with less than 5,000 devices. 10. Press Single Server, then select Next. Good MSM Application Location To ensure that Good MSM has the proper resources available during the installation and to run the application, Installation Guide 29

30 Single Server Installation Good MSM should be installed on a drive other than C:\. Enter a location to install the Good MSM application. Good MSM will pre-populate the box with a suggested or default location, such as D:\ or E:\ drives. 11. Enter the location to install Good MSM or select Choose to browse a different location. Or, to use the default folder, select next. To optimize performance, the repository or database data files should be placed on a different physical drive than the application files. 12. Enter the location for the data files or select Choose to browse a different location. Or, to use the default folder, select next. The redo logs save a history of all changes made to the database in order to prevent data loss. For this reason, the redo logs should not reside on the same physical drive as the database data files. 13. Enter the location for the data files or select Choose to browse a different location. Or, to use the default folder, select next! Note: The file name should not contain any spaces or special characters. As a best practice, Good MSM recommends that the Good MSM application and operating system should be placed on separate physical drives. Installation Guide 30

31 Single Server Installation After completing all of the fields above, you will advance to Service Account Configuration screen. The Good MSM Service Account will be used to configure the services and settings after the installation. The Good MSM Service Account must be registered to a local administrator on the Good MSM server and all monitored servers. The user domain is a Windows or Active Directory domain in which the Good MSM service account resides. Installation Guide 31

32 Single Server Installation 14. Enter the Good MSM Service Account credentials. If incorrect credentials are entered, or if the user is not listed as a member of the local administrators group, you will receive an error message.if the Error screen appears, re-enter the service account credentials or ensure that the user is a member of the local administrators group. 15. Click Next to continue. The Dashboard IP Address screen opens. The installer identifies the IP addresses associated with Good MSM and displays them in a drop down list. 16. Select the IP address from the drop down menu. 17. Enter the DNS Hostname. Ping and Fully Qualified Domain Name (FQDN) will be validated in the background. It is imperative to ensure that the DNS hostname and IP addresses are properly mapped. Incorrect mappings may require a reinstallation to recreate the certificates. Installation Guide 32

33 Single Server Installation 18. Click Next to continue. The Prerequisite Checks screen opens. This screen will provide a summative list of all prerequisite checks performed on your system. All subheadings should display a green Pass message underneath them. If any fields display a red Fail message, resolve the issue(s) before proceeding with the installation. In most instances, receiving a failed prerequisite will prevent you from moving ahead with the installation. Advancing to the next screen without resolving the Failed status could result in a system error. After passing the prerequisite checks, the Pre-Installation Summary screen will open. This screen will give you a final opportunity to review all configurations before completing the installation. Review Installation Guide 33

34 Single Server Installation this carefully to ensure that all items are correct and the proper drives have been selected..! Note: If you find incorrect information in your review, select Previous as many times as necessary to navigate back to the appropriate screen to reconcile any errors. After you complete your revisions, press Next as many times as necessary to proceed forward to the Pre-Installation Summary. Review the Summary screen to ensure that your changes were saved, and then select Install. The Installation Complete screen will appear. This screen summarizes the results of the installation. If you receive a failure message, you may have failed one of the prerequisite checks. If there are errors in the logs, these will also display on the Installation Complete Screen. Installation Guide 34

35 Single Server Installation If you have errors or an incomplete installation, check to ensure you have met all of the requirements. For more information, see Appendix A: Troubleshooting the Good MSM Installation. Installation Guide 35

36 01 04 Installing Good MSM in a Dual Server Environment: Repository Server The Good MSM application is delivered via downloaded compressed files. All files from the download must be extracted at one time in order to maintain the required folder and directory structure. In a dual-server environment the repository server must be installed before the application server. 1. Log onto the Repository server using the Good MSM service account.! Note: Due to a third-party installation package limitation, the Good MSM Installer does not support installing the software while logged in with a username that contains special characters. See Appendix A: Troubleshooting the Good MSM Installation for the recommended solution. 2. Download the Good MSM installation files from the links provided. 3. Extract the downloaded file to a temporary location. 4. Navigate to the extracted file location. Double-click the \install.bat file. The InstallAnywhere Wizard dialog box will open and display the progress. When the system preparation is complete, the Good MSM Suite Install wizard opens and displays the Introduction screen. The left side of the installation screen will help you track your progress through the installation process. Use the buttons at the bottom of the screen to navigate through the installation process. Installation Guide 36

37 Dual Server Installation- Repository! Note: You may select Cancel at any time to terminate the installation; however, you will need to uninstall all Good MSM content that has been partially installed up to that point and then restart the installation process. 5. Press Next 6. Enter the license key into the designated space below the onscreen directions. Good MSM provides a one-time,17-digit license key number via . Use this unique key to populate the field below. Installation Guide 37

38 Dual Server Installation- Repository Good MSM will provide a new installation key for all major and minor releases; previous keys from earlier releases of Good MSM will be deactivated for Good MSM Press Next. The License Agreement will open. In order to continue with the installation, you must consent to the terms of the software license agreement. If you do not accept the terms of the license agreement, you will not be able to install the software, concluding the installation process. 8. Select I accept the terms of the License Agreement radio button. Installation Guide 38

39 Dual Server Installation- Repository To configure your settings properly, Good MSM needs to know the estimated number or devices within your environment. The range of users selected will determine the installation type (single or dual server). The option buttons will allow you to select the number of devices in this Good MSM deployment. Choose the correct range, as this will control the options available to you on the Choose Installation Type screen. The system requirements and prerequisites will change depending on the number of users you select. Select the radio button that most closely reflects the number of mobile devices in your deployment. The Choose Install Set screen opens. Select Two Server - Repository Server installation. Dual server installation is ideal for larger deployments Installation Guide 39

40 Dual Server Installation- Repository (deployments with more than 5,000 devices). 9. Press Dual Server-Repository Server, then press Next. Good MSM Application Location Installation Guide 40

41 Dual Server Installation- Repository To ensure that Good MSM has the proper resources available during the installation and to run the application, Good MSM should be installed on a drive other than C:\. Enter a location to install the Good MSM application. Good MSM will prepopulate the box with a suggested or default location, such as D:\ or E:\ drives. 10. Enter the location to install Good MSM or select Choose to browse a different location. Or, to use the default folder, select next. To optimize performance, the repository or database data files should be placed on a different physical drive than the application files. 11. Enter the location for the data files or select Choose to browse a different location. Or, to use the default folder, select next. The redo logs save a history of all changes made to the database in order to prevent data loss. For this reason, the redo logs should not reside on the same physical drive as the database data files. 12. Enter the location for the data files or select Choose to browse a different location. Or, to use the default folder, select next! Note: The folder name should not contain any spaces or special characters. As a best practice, Good MSM recommends that the Good MSM application and operating system should be placed on separate physical drives. Installation Guide 41

42 Dual Server Installation- Repository 13. Enter the FQDN for the App Server. 14. Press Next to continue. The Prerequisite Checks panel opens. Installation Guide 42

43 Dual Server Installation- Repository This screen will provide a summative list of all prerequisite checks performed on your system. All subheadings should display a green Pass message underneath them. If any fields display a red Fail message, resolve the issue(s) before proceeding with the installation. Advancing to the next screen without resolving the Failed status could result in a system error. After passing the prerequisite checks, the Pre-Installation Summary screen will open. This screen will give you a final opportunity to review all configurations before completing the installation. Review this carefully to ensure that all items are correct and the proper drives have been selected.! Note: If you find incorrect information in your review. Select Previous as many times as necessary to navigate back to the appropriate screen to reconcile any errors. After you complete your revisions, press Next to proceed forward to the Pre-Installation Summary. Review the Summary screen to ensure that your changes were saved, and then select Install. Installation Guide 43

44 Dual Server Installation- Repository Preinstallation Summary The Installation Complete screen will appear. This screen indicates the results of the installation. If you receive a failure message, you may have failed one of the prerequisite checks. If there are errors in the logs, these will also display on the Installation Complete Screen. Installation Guide 44

45 01 05 Installing Good MSM in a Dual Server Environment: Application Server The Good MSM application is delivered via downloaded compressed files. All files from the download must be extracted at one time in order to maintain the required folder and directory structure. 1. Log onto the server using the Good MSM service account.! Note: Due to a third-party installation package limitation, the Good MSM Installer does not support installing the software while logged in with a user name that contains special characters. See Appendix A: Troubleshooting the Good MSM Installation for the recommended solution. 2. Download the Good MSM installation files. 3. Extract the downloaded file to a temporary location. 4. Navigate to the extracted file location. Double-click the \install.bat file. The InstallAnywhere Wizard dialog box will open and display the progress. When the system preparation is complete, the Good MSM Suite Install wizard opens and displays the Introduction screen. The left side of the installation screen will help you track your progress through the installation process. Use the buttons at the bottom of the screen to navigate through the installation process. Installation Guide 45

46 Dual Server Installation-Application! Note: You may select Cancel at any time to terminate the installation; however, you will need to un-install all Good MSM content that has been partially installed up to that point and then restart the installation process.. 5. Press Next 6. Enter the license key into the designated space below the onscreen directions. Good MSM provides a one-time, 17-digit license key number via . Use this unique key to populate the field below. Installation Guide 46

47 Dual Server Installation-Application Good MSM will provide a new installation key for all major and minor releases; previous keys from earlier releases of Good MSM will be deactivated for Good MSM Press Next The License Agreement will open. In order to continue with the installation, you must consent to the terms of the software license agreement. If you do not accept the terms of the license agreement, you will not be able to install the software, concluding the installation process. 8. Select I accept the terms of the License Agreement radio button. 9. Press Next to Continue. Installation Guide 47

48 Dual Server Installation-Application To configure your settings properly, Good needs to know the estimated number or devices within your environment. The range of users selected will determine the installation type. The option buttons will allow you to select the number of smartphone users in this Good MSM deployment. Choose the correct range, as this will control the options available to you on the Choose Installation Type screen (Figure X-X). The system requirements and prerequisites will change depending on the number of users you select. Select the radio button that most closely reflects the number of mobile devices in your deployment. Installation Guide 48

49 Dual Server Installation-Application The Choose Install Set screen opens. Select Two Server-Application Server installation. Dual server installations are ideal for larger deployments (deployments with more than 5,000 devices). The Repository server must be installed and configured before the Application Server. 10. Press Dual Server-Application Server, then click Next. Good MSM Application Location Installation Guide 49

50 Dual Server Installation-Application To ensure that Good MSM has the proper resources available during the installation and to run the application, Good MSM should be installed on a drive other than C:\. Enter a location to install the Good MSM application. Good MSM will prepopulate the box with a suggested or default location, such as D:\ or E:\ drives. 11. Enter the location to install Good MSM or select Choose to browse a different location. Or, to use the default folder, select next.! Note: The folder name should not contain any spaces or special characters. As a best practice, Good recommends that the Good MSM application and operating system should be placed on separate physical drives. Installation Guide 50

51 Dual Server Installation-Application Field Description SID Oracle database System Identification (SID). A valid Service Identifier is required. Note: Enter boxtone as the valid Service Identifier for the Good MSM Database. TNS Name Oracle database Transparent Network Substrate (TNS) name. Note: Enter boxtone as the valid TNS name for the Good MSM Database. Host The address of Oracle database host (use the FQDN). Port Oracle database port number (default 1521). User Repository owner username. Password Repository owner password User Console is located on the database host check box. User Console is located on the database host check box. Check to indicate that the User Console is located on the database host. Check to indicate that the User Console is running on the default port. After completing all of the fields above, you will advance to Service Account Configuration screen. The Good MSM Service Account will be used to configure the services and settings after the installation. For this reason, this account must be registered to a local administrator on the Good MSM server and all monitored servers. The user domain is a Windows or Active Directory domain in which the Good MSM service account resides. 12. Enter the Good MSM Service Account credentials. Installation Guide 51

52 Dual Server Installation-Application If incorrect credentials are entered, or if the user is not listed as a member of the local administrators group, you will receive the following error message. If the Error screen appears, re-enter the service account credentials or ensure that the user is a member of the local administrators group. Use the Windows Server Manager to review the membership of the Administrators group to ensure that the Service Account (user account) appears in the Administrators membership list. The Dashboard IP address opens. The installer identifies the IP addresses associated with Good MSM and displays them in a drop down list. 13. Select the IP address from the drop down menu. Installation Guide 52

53 Dual Server Installation-Application 14. Enter the DNS Hostname. Ping and Fully Qualified Domain Names (FQDN) will be validated in the background. It is imperative to ensure that the DNS hostname and IP addresses are properly mapped. Incorrect mappings may stall the installation. 15. Press Next to continue. The Prerequisite Checks screen opens. This screen will provide a summative list of all prerequisite checks performed on your system. All subheadings Installation Guide 53

54 Dual Server Installation-Application should display a green Pass message underneath them. If any fields display a red Fail message, resolve the issue(s) before proceeding with the installation. Advancing to the next screen without resolving the Failed status could result in a system error.! Note: If you find incorrect information in your review. Select Previous as many times as necessary to navigate back to the appropriate screen to reconcile any errors. After you complete your revisions, press Next to proceed forward to the Pre-Installation Summary. Review the Summary screen to ensure that your changes were saved, and then select Install. After passing the prerequisite checks, the Pre-Installation Summary screen will open. This screen will give you a final opportunity to review all configurations before completing the installation. Review this carefully to ensure that all items are correct and the proper drives have been selected. Review the full Pre-Installation Summary and then press Install. Installation Guide 54

55 Dual Server Installation-Application The Installation Complete screen will appear. This screen indicates the results of the installation. If you receive a failure message, you may have failed one of the prerequisite checks. If there are errors in the logs, these will also display on the Installation Complete Screen. Review the results of your installation. Press done to exit the installation. Installation Guide 55