Altiris IT Management Suite 7.1 SP1 from Symantec Planning and Implementation Guide

Transcription

1 Altiris IT Management Suite 7.1 SP1 from Symantec Planning and Implementation Guide

2 Altiris IT Management Suite 7.1 SP1 from Symantec Planning and Implementation Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version: 7.1 Legal Notice Copyright 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party ( Third Party Programs ). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec product for more information on the Third Party Programs. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

3 Symantec Corporation 350 Ellis Street Mountain View, CA

4 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our Web site at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level

5 Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals

6 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America

7 Contents Technical Support... 4 Section 1 Planning for IT Management Suite Chapter 1 Introducing IT Management Suite About IT Management Suite What you can do with IT Management Suite How IT Management Suite works What's new in IT Management Suite Where to get more information Chapter 2 Understanding the components of IT Management Suite About the Symantec Management Platform Core architectural components of IT Management Suite Components of the Symantec Management Platform About Notification Server About the Symantec Management Console About the Configuration Management Database About site services About the Symantec Management Agent Solutions of IT Management Suite About Asset Management Suite About Barcode Solution About CMDB Solution About Deployment Solution About Inventory Solution About IT Analytics Solution About Symantec Mobile Management About Monitor Solution About Monitor Pack for Servers About Out of Band Management Component About Patch Management Solution for Windows About Patch Management Solution for Linux... 46

8 8 Contents About Patch Management Solution for Mac About Real-Time System Manager About Symantec Endpoint Protection Integration Component About ServiceDesk About Software Management Solution About Symantec Workflow Chapter 3 Planning for IT Management Suite IT Management planning considerations About planning your SQL Server configuration About hard drive configuration for SQL Server Throughput metrics of SQL Server About database sizing for SQL Server About memory management for SQL Server considerations About planning your site servers About site maintenance About the task service How task server uses the tickle mechanism About the package service About the deployment site service Symantec Management Agent deployment planning How agent-based inventory communications work How Patch Management Solution data communications work Components of Deployment Solution How capturing master disk images works How deploying disk images works Methods of delivering preboot environments to computers How Deployment Solution imaging jobs work How asset management data communications work Chapter 4 Reference of topics about multi-notification Server environments About MultiCMDB reporting with IT Analytics What's new in IT Analytics 7.1 SP Adding and configuring external Symantec CMDB connections Editing external Symantec CMDB connections Editing the Report Integration URLs for an external Symantec CMDB Deleting external Symantec CMDB connections Including or excluding the local Symantec CMDB Updating the Solution Dependencies... 92

9 Contents 9 About global policy distribution What you can do with global policy distribution About hierarchy How global policy distribution works with hierarchy Hierarchy requirements About hierarchy topology About creating and managing hierarchical relationships Setting up a hierarchical relationship between two Notification Server computers How deployment site servers work in a hierarchy About hierarchy editable properties Global policy distribution implementation considerations for Software Management Solution Global policy distribution implementation considerations for Patch Management Solution Limitations of global policy distribution in a hierarchy Limitations of hierarchy Replication types in the Symantec Management Platform About hierarchy replication About hierarchy replication About hierarchy replication rules About configuring replication Replicating custom items in a hierarchy Configuring replication rules Replication rule settings Specifying destination Notification Servers in a replication rule Overriding the hierarchy differential replication schedule Replicating selected data manually Running a hierarchy report Section 2 Implementing IT Management Suite Chapter 5 Performance and scalabiltiy recommendations for IT Management Suite Symantec Management Platform performance factors About tuning the SQL Server computer for performance About tuning Notification Server Event processing for performance About predefined inventory policies Scheduling resource membership updates

10 10 Contents About tuning the Symantec Management Agent for performance Targeted Agent Settings: General tab Configuration settings based on managed endpoints Recommended ranges of component totals for IT Management Suite Recommended IT Management Suite 7.1 hardware operating systems for Notification Server and site servers SQL Server recommendations and third-party software requirements Chapter 6 Preparing for the installation of IT Management Suite About developing an installation plan About the migration guides About supported SQL Server collations Considerations before you install Notification Server Agent configuration considerations Chapter 7 Installing IT Management Suite About installing the Symantec Management Platform products Managing the installation of the Symantec Management Platform products Installing Symantec Installation Manager Starting Symantec Installation Manager Delaying the update of Symantec Installation Manager Overview of the installation process Installing the Symantec Management Platform products Install New Products page, Product Updates page, or Products page Install Readiness Check page Notification Server Configuration page Database Configuration page About installation tasks you can perform after the initial installation Reconfiguring an installed product Installing an update or an additional product About installing optional components Installing optional components Uninstalling or repairing optional components Applying licenses to a solution

11 Contents 11 Repairing the installation of an installed product Creating a support package Uninstalling the Symantec Management Platform products About modifying the installation of a product Adding a product listing file Updating the product listing Creating an installation package Chapter 8 Installing the Deployment Solution About installing Deployment Solution Preinstallation requirements for Deployment Solution Installing Deployment Solution components Installing Deployment Plug-in Installing an automation folder Installing Deployment site server components Setting up ACC Installation path of Deployment Solution tools Upgrading Deployment Solution components Uninstalling Deployment Solution components Enabling the uninstallation policy Uninstalling Deployment Solution through Symantec Installation Manager Repairing Deployment Solution Chapter 9 Configuring Notification Server About configuring Notification Server Configuring the Configuration Management Database Purging the Configuration Management Database Saving resource data history in the CMDB Configuring Notification Server settings Notification Server processing settings server and address settings Status message logging settings Opening the Log Viewer Proxy server settings Distribution point credential settings Configuring Notification Server settings with NS Configurator Performing a first-time setup configuration

12 12 Contents Chapter 10 Setting up managed computers Discovering computers Rolling out the Symantec Management Agent Agent and task setting options Collecting inventory information Deploying preboot environments Chapter 11 Configuring security About Symantec Management Platform security Setting up Symantec Management Platform security About security roles Predefined security roles About security privileges Connection Profile privileges Management privileges System privileges Credential privileges Workflow Directory privileges Symantec Management Console privileges Software Management Framework privileges Right-click Menu privileges Right-click Menu - Connector Samples privileges Right-click Menu - Hierarchy privileges Right-click Menu - Actions privileges Right-click Menu - Set Asset Status privileges About Symantec Management Platform user accounts Creating and configuring Symantec Management Platform user accounts Specifying general Symantec Management Platform user account details Configuring credentials for a Symantec Management Platform user account Assigning a Symantec Management Platform user account to a security role Configuring password complexity and lockout settings Unlocking locked out credentials About security role permissions Resource Management permissions System permissions Task Server permissions Report permissions Policy permissions

13 Contents 13 Folder permissions Filter permissions Connection Profile permissions Credential Manager permissions About the Security Role Manager Accessing the Security Role Manager Assigning security permissions to folders and items Customizing permission inheritance Role Selection window Taking ownership of a folder or item About credential manager Creating a credential Editing a credential Chapter 12 Configuring Schedules About Symantec Management Platform schedules About schedule active periods and time zones About schedule triggers About schedule modifiers How Symantec Management Platform uses schedules Managing shared schedules Configuring a schedule Viewing the Notification Server internal schedule calendar Chapter 13 Configuring site servers Managing sites Creating a new site Modifying a site Managing manually assigned agents Managing site servers Creating and modifying site servers Assigning a site server to a site manually About configuring the site service settings About package service settings About removing automatic site assignments Configuring package service settings About task service settings Configuring task service settings About package server for Linux About integrating Apache Web Server with package server for Linux About detecting the Apache Web Server

14 14 Contents Requirements to configure package server and the Apache Web Server Requirements to configure HTTPS and HTTP Package server configuration example that uses main web directory for package server links Package server configuration example using an alias for package server links Chapter 14 Getting started with IT Management Suite About the enhanced console views About the Computers view Finding a specific computer Creating and managing organizational views and groups Managing subnets Creating a new subnet About the Jobs / Tasks view Scheduling and running jobs and tasks About the Policies view Finding software Managing software About the Software Catalog window About resource scoping Considerations for resource scoping Design considerations for resource scoping Appendix A Symantec IT Management Suite Platform Support Matrix Introduction Current Shipping Information Symantec Management Platform Notification Server and Workflow Server Microsoft SQL Server Microsoft SQL Server Collations Microsoft IIS Microsoft.NET Console/Browser Workflow Designer Site Server Client Management Suite Client OS Support Matrix Server Management Suite Server OS Support Matrix

15 Contents 15 Language Support Core Localization Windows Agent Localization Index

16 16 Contents

17 Section 1 Planning for IT Management Suite Chapter 1. Introducing IT Management Suite Chapter 2. Understanding the components of IT Management Suite Chapter 3. Planning for IT Management Suite Chapter 4. Reference of topics about multi-notification Server environments

18 18

19 Chapter 1 Introducing IT Management Suite This chapter includes the following topics: About IT Management Suite What you can do with IT Management Suite How IT Management Suite works What's new in IT Management Suite Where to get more information About IT Management Suite IT Management Suite combines client and server configuration management with IT asset and service management. It promotes effective service delivery and helps reduce the cost and complexity of managing corporate IT assets. These assets may include desktops, laptops, thin clients, and servers in heterogeneous environments running Windows, Linux, UNIX, and Mac. You can manage all of the features of the suite through a central console on a common platform: the Symantec Management Platform. This common platform integrates management functions to accelerate automation for better service, value, and IT efficiency. See What you can do with IT Management Suite on page 20. IT Management Suite is comprised of the following management capabilities: Server management The server management capabilities support not only the Windows operating system, but also the UNIX and the Linux operating systems. In addition, the

20 20 Introducing IT Management Suite What you can do with IT Management Suite same management disciplines are applied to both physical systems and virtual systems, including both Microsoft Hyper-V and VMware. Client management The client management capabilities support Windows and a growing number of other platforms, including Mac OS and Linux operating systems. IT asset management IT asset management builds upon solid inventory foundations for configuration management. It helps you accurately value both your discoverable and non-discoverable assets, and track your assets and your asset-related information. You can manage contracts, software license compliance, and procurement processes as well as the configuration items that are associated with your assets. Service management IT Management Suite includes fully featured service management capabilities. It provides the necessary components for any ITIL-based service management initiative and covers key functions. These functions include incident and problem management, change management, self service options, and a service catalog. What you can do with IT Management Suite IT Management Suite helps you improve service delivery, increase efficiency, and reduce costs. See What's new in IT Management Suite on page 23. You can do the following with IT Management Suite: Manage remotely. One-to-one remote-management capabilities let you avoid desk-side visits. Automate tasks. The task engine lets you perform multiple remote-management tasks simultaneously. Automate policy enforcement. The policy engine lets you detect and remediate automatically, without human involvement. Automate processes. The workflow engine lets you automate human and system interactions to eliminate latency errors and omissions. Create self-service.

21 Introducing IT Management Suite How IT Management Suite works 21 The service catalog lets you avoid calls or requests entirely with best-practice self-service. How IT Management Suite works IT Management Suite is a bundling of Symantec products and software. IT Management Suite helps you deploy, manage, support, and retire the various computers, devices, servers, and IT assets in your organization. IT Management Suite includes IT asset management, client and server configuration management, and IT service management. See About IT Management Suite on page 19. All of the parts of IT Management Suite are built on a common foundation that is called the Symantec Management Platform. The Symantec Management Platform is a set of core services that all of the parts of IT Management Suite share. These services can include aspects such as security, reporting, communications, and data storage. The different parts of the platform can read and write from a common database. Even though IT Management Suite covers a wide variety of IT-related capabilities, you interact with all of its technologies through a common user interface. This interface is called the Symantec Management Console. IT Management Suite can discover the computers that are present in your environment. You can install the Symantec Management Agent on these computers. The agent lets you gather very detailed information about them. It regularly sends information about the computer to a management server computer called Notification Server. Notification Server processes the information about your computers and stores it in a common database. The database is called the Configuration Management Database (CMDB). You can use the data in the CMDB to manage your assets more efficiently. For example, you can use this information with reports and filters to gain visibility into and track metrics on the assets in your environment You can see what software is installed, how often it is used, and how many licenses for it you have purchased. This type of information can help you determine the IT assets you need to purchase. You can also use this information to determine how to maximize your software investment and when to replace or decommission software. In addition, you can use IT Management Suite to take action on the information that it gathers. For example, IT Management Suite may discover that certain software is installed and licensed but is not used. You can configure the suite to remove the unused software. The Symantec Management Agent gives you robust control and visibility into the hardware and software on your managed computers and servers. It helps you to

22 22 Introducing IT Management Suite How IT Management Suite works maintain your corporate standards and policies remotely from the Web-based Symantec Management Console. Notification Server has two components that are called the task engine and the policy engine. These components let you do work on your managed computers. You can use policies to maintain consistent standards, and you can use tasks to execute sequential steps. Policy-based management can allow the managed computer autonomy whether it is in a connected or disconnected state. Task-based management follows the traditional server to client communications paradigm. Managed computers regularly communicate with the Notification Server computer. When a managed computer contacts Notification Server, it checks to see if you have configured any work for it to do. The agent can check to see if the computer on which it is installed is compliant with a policy. For example you can set up a policy to ensure that all of your managed computers have the latest version of software. If it is not compliant, then the agent can download and install the software according to your settings. When software is remotely executed on target computers with Notification Server, this software is called a software package. You can use IT Management Suite to keep your computers secure, patched, and compliant. IT Management Suite lets you manage all aspects of applying Microsoft Windows security updates and patches. You can remotely provision and deploy standardized operating system images to your computers. This functionality includes bare-metal deployment and re-imaging computers to return them to known-good states. IT Management Suite also lets you monitor and maintain the health of your servers. You can monitor key metrics and indicators of your server health performance. These metrics can be viewed in real time. With the task engine, you can proactively manage your servers. For example, you can automate complex sequences of fail-safe measures such as provisioning a backup server in the event that a server crashes. You can configure the system to alert you if a specific metric starts to indicate a potential problem. You can then resolve that problem so that it does not manifest in the future. IT Management Suite includes many tools for incident management and resolution. The help desk capabilities cover ITIL-based key functions such as incident and problem management and change management. You can use the service catalog to create best-practice self-service mechanisms. This functionality can enable your users to safely and easily help resolve common issues and requests. IT Management Includes a workflow engine that lets you automate human and system interactions. You can set up robust workflows to automatically complete many of the sequential tasks that are required for efficient service management.

23 Introducing IT Management Suite What's new in IT Management Suite 23 What's new in IT Management Suite In addition to full server-side 64-bit support, IT Management Suite includes many new features. The new workflow engine lets you automate human and system interactions to help you complete the sequential tasks that are required for efficient service management. Imaging, deployment, and remote control features are now integrated. The central catalog, the software library, and the new user views deliver a deeper functional integration. New IT Analytics capabilities and the central Software Catalog provide greater intelligence. See What you can do with IT Management Suite on page 20. The following are some of the key new features in IT Management Suite: Intuitive management interface IT Management Suite 7.1 introduces an improved management interface that gets you where you want to be faster. The page load times are shorter and are more responsive. Common concepts such as managing computers, delivering software, and managing licenses and deployment are consolidated into an integrated experience. When you click on a computer, resource management details are immediately visible. Powerful search features help you drill down and build filters in a short period of time. You can quickly save the searches for future use. Drag-and-drop functionality lets you select tasks and drag them to one or more selected computers. Streamlined software management The Software Catalog interface is streamlined and redesigned. Any software that is found is stored in the newly discovered list. From this list you can quickly determine whether you want to make the identified software a managed product. If not, you can assign it to unmanaged software. After you identify software as a managed software product, you can manage all elements of it in a single interface. Inventory, metering, delivery, and license tracking are all presented in a single interface. In addition to improvements in the Managed Delivery interface, the Managed Delivery feature is more robust. The Managed Delivery feature now separates the schedule for delivery and the schedule for execution. You can first stage packages in advance, and then later schedule the execution. Simplified license management License management and asset management and usage are tightly integrated. Within the software display is an at-a-glance view of the current deployments and cost details. These details are based on the current installations and the purchasing details. A graphic can help you to determine if a software product is over-deployed or under-deployed, and evaluate its current usage. It gives visibility into the financial effect of a product. You can see the potential savings

24 24 Introducing IT Management Suite What's new in IT Management Suite from harvesting licenses, and you can see the cost effect when a product is over-deployed. Advanced reporting and IT Analytics The executive dashboard and trend analysis give you a representative view of your IT assets. Key performance indicators let you measure critical success factors for your organization and quickly assess trends of how these measures change over time. You can use ad-hoc data mining to construct pivot table reports. The reports are based on predefined measures and dimensions. The functionality allows for easy manipulation of the data so you do not have to be a SQL expert to access the information you need. Multidimensional analysis and robust graphical reporting are incorporated to help you arrive at your answers with very little customization and without waiting. The MultiCMDB feature provides global IT Analytics reporting across multiple CMDBs without the need to replicate large amounts of data. Optimized scalability and performance This release increases the overall scalability of the Symantec Management Platform. Each Notification Server computer now scales to support more endpoints than the previous versions supported. The overall goal is to streamline your implementations by using less hardware. In addition to numerous improvements in overall performance, the two key changes are to user interaction and to reporting. With the new management interface, page loads are significantly improved. The advanced IT Analytics features let you gain the efficiency of OLAP cubes. The features create faster reporting times by off-loading report data from the operational database. Microsoft Windows 7 application compatibility challenges addressed A key challenge to moving to Windows 7 is that many legacy Web applications depend on Internet Explorer 6. Symantec Workspace Virtualization includes a new update that solves this challenge. You can virtualize Internet Explorer 6 directly in Windows 7. This ability lets you concurrently run Internet Explorer 6, 7, and 8. You can also run multiple Java versions on the native operating system to achieve normal visibility. This approach enables side-by-side usage, and offers a secure implementation that is invisible to the user. You can determine which applications should have access to that specific browser. Users are never prompted to choose a browser. The correct version automatically opens for them based on policy. This option helps you move faster and more efficiently to Microsoft Windows 7. Browser plug-ins such as Acrobat and Flash can be installed into the base or into a virtual layer. Multiple Java versions can be installed in the base, or in a layer, and used by a virtual Internet Explorer. Workspace Virtualization automatically supports any group policy objects that your enterprise may have in place for Internet Explorer.

25 Introducing IT Management Suite Where to get more information 25 Built-in process automation Workflow capabilities are now included so you can automate the processes that are core to your IT business. In addition to form builders and drag-and-drop process designer capabilities, you can use the full component generator capability for access to third-party technologies. These technologies include HR or finance systems, and the Workflow portal. The Workflow portal lets you track the overall process as a workflow moves through the various stages. Migration and deployment enhancements Deployment Solution is now natively integrated with the Symantec Management Platform. Consequently, you work with Deployment Solution and Symantec Management Platform through a single console, database, and agent. IT Management Suite 7.1 provides many enhancements to the Deployment Solution console. The DeployAnywhere capability supports all plug-and-play driver types for hardware-independent imaging. This addition complements the support for hardware abstraction layers (HAL), network interface cards, and mass-storage-controller drivers to provide a complete hardware-independent imaging solution. Management for the driver database is now available through the console. You can consolidate driver management because both imaging and scripted operating system installations consume the drivers in the DeployAnywhere database. Ghost imaging supports the familiar style of RapiDeploy multicasting. PC transplant supports Microsoft Office 2010 (32-bit and 64-bit). Enhanced Virtual Machine Management capabilities streamline configuration and extend the virtual machine creation wizard. The wizard can execute any Deployment Solution job as part of the virtual machine creation process. This ability lets you leverage existing server provisioning jobs and apply them to virtual server provisioning. Where to get more information Use the following documentation resources to learn about and use this product. See About IT Management Suite on page 19.

26 26 Introducing IT Management Suite Where to get more information Document Release Notes User guides Table 1-1 Description Information about new features and important issues. Information about how to use this product, including detailed technical information and instructions for performing common tasks. Documentation resources Location The Product Support page, which is available at the following URL: When you open your product's support page, look for the Documentation link on the right side of the page. The Documentation Library, which is available in the Symantec Management Console on the Help menu. The ProductSupport page, which is available at the following URL: When you open your product s support page, look for the Documentation link on the right side of the page. Help Information about how to use this product, including detailed technical information and instructions for performing common tasks. Help is available at the solution level and at the suite level. The Documentation Library, which is available in the Symantec Management Console on the Help menu. Context-sensitive help is available for most screens in the Symantec Management Console. You can open context-sensitive help in the following ways: The F1 key when the page is active. The Context command, which is available in the Symantec Management Console on the Help menu. This information is available in HTML help format. In addition to the product documentation, you can use the following resources to learn about Symantec products. Resource Best practices Support Knowledgebase SymWISE Support Knowledgebase Table 1-2 Description Compilation of "how to" and best practice articles for IT Management Suite. Articles, incidents, and issues about Symantec products. Symantec product information resources Location

27 Introducing IT Management Suite Where to get more information 27 Resource Symantec Connect Table 1-2 Description An online resource that contains forums, articles, blogs, downloads, events, videos, groups, and ideas for users of Symantec products. Symantec product information resources (continued) Location

28 28 Introducing IT Management Suite Where to get more information

29 Chapter 2 Understanding the components of IT Management Suite This chapter includes the following topics: About the Symantec Management Platform Core architectural components of IT Management Suite Components of the Symantec Management Platform About Notification Server About the Symantec Management Console About the Configuration Management Database About site services About the Symantec Management Agent Solutions of IT Management Suite About Asset Management Suite About Barcode Solution About CMDB Solution About Deployment Solution About Inventory Solution About IT Analytics Solution

30 30 Understanding the components of IT Management Suite About the Symantec Management Platform About Symantec Mobile Management About Monitor Solution About Monitor Pack for Servers About Out of Band Management Component About Patch Management Solution for Windows About Patch Management Solution for Linux About Patch Management Solution for Mac About Real-Time System Manager About Symantec Endpoint Protection Integration Component About ServiceDesk About Software Management Solution About Symantec Workflow About the Symantec Management Platform The Symantec Management Platform provides a set of services that IT-related solutions can leverage. Solutions plug into the platform and take advantage of the platform services, such as security, reporting, communications, package deployment, and Configuration Management Database (CMDB) data. Because solutions share the same platform, they can share platform services as well as data. Shared data is more useful than data that is only available to a single solution. For example, one solution collects data about the software that is installed on company computers and another solution uses the data to manage software licenses. A third solution can also use this data to help you update software. This close integration of solutions and the platform makes it easier for you to use the different solutions because they work in a common environment and are administered through a common interface. The platform provides the following services: Role-based security Client communications and management Execution of scheduled or event-triggered tasks and policies Package deployment and installation Reporting

31 Understanding the components of IT Management Suite Core architectural components of IT Management Suite 31 Centralized management through a single, common interface Configuration Management Database (CMDB) Software Management Framework When you install a solution or suite, the platform is also installed if it is not already installed. See Components of the Symantec Management Platform on page 32. Core architectural components of IT Management Suite IT Management suite has four main architectural components. See IT Management planning considerations on page 51. The core architectural components of IT Management Suite are as follows: Notification Server See About Notification Server on page 33. SQL Server See About the Configuration Management Database on page 35. Site servers Site servers can include task servers, package servers, and deployment site servers. See About site services on page 36. Managed computers See About the Symantec Management Agent on page 36.

32 32 Understanding the components of IT Management Suite Components of the Symantec Management Platform Figure 2-1 Core architectural components of IT Management Suite Components of the Symantec Management Platform The Symantec Management Platform includes the following core components: Notification Server The Symantec Management Platform service that processes events, facilitates communications with managed computers, and coordinates the work of the other Symantec Management Platform services. See About Notification Server on page 33. See About configuring Notification Server on page 185. Symantec Management Console A Web-based user interface that lets you monitor and manage Notification Server and its solutions. See About the Symantec Management Console on page 34. Configuration Management Database (CMDB)

33 Understanding the components of IT Management Suite About Notification Server 33 The database that stores all of the information about managed computers. See About the Configuration Management Database on page 35. See Configuring the Configuration Management Database on page 186. Site servers The Symantec Management Platform can host several types of middleware components, such as package servers and task servers. The official name for a middleware component is "site service." Any component that hosts a site service is known as a site server. See About site services on page 36. Symantec Management Agent The software that is installed on a computer to enable Notification Server to monitor and manage it. After the Symantec Management Agent is installed, that computer becomes a managed computer. See About the Symantec Management Agent on page 36. Software Management Framework An interface that lets you create and manage the software resources that are in the Software Catalog. It also lets you manage the packages that are in the Software Library. The Software view provides a central location for initiating the software-related tasks that are performed in your organization. Reports A way to gather automated information. You can view reports for any managed computer from the Symantec Management Console. See About the Symantec Management Platform on page 30. About Notification Server Notification Server is the primary server component within the Symantec Management Platform. Notification Server coordinates the various solutions and provides the primary user interface, policy-based administration, reporting, and notification. Notification Server hosts the Web-based management console that lets you manage the components of your Symantec Management Platform. See Components of the Symantec Management Platform on page 32. See About configuring Notification Server on page 185. Notification Server is responsible for managing the predefined policies and tasks that are available in each installed solution. These policies and tasks activate components of Notification Server that process several functions. Notification Server functions include the following:

34 34 Understanding the components of IT Management Suite About the Symantec Management Console Discovering resources on the network Installing and configuring the management agent on the endpoints Collecting client-reported information and storing it in the CMDB Generating detailed Web Reports Sending policy information to the endpoints Distributing software packages About the Symantec Management Console The Symantec Management Console (usually referred to as "the console") is a Web-based user interface that is the primary tool for interacting with Notification Server and its components, and for managing resources. The Symantec Management Console is divided into the following areas: Header The top portion of the console that includes the following: Menus, which let you access console pages and dialogs that provide the management functionality for Notification Server. Symantec solutions that are installed on the system may add new items to the menu. Search box, which lets you search the resource data for the resources that you want. When you perform a search, a search panel appears under where you input the search. A breadcrumb bar that shows the menu path to the currently displayed page. Content area The portion of the console that is below the header can show one of the following: View A view is composed of a tree view and content pane. The tree view, in the left pane, shows a hierarchical arrangement of items that you can select and work with. The content pane, on the right, displays pages based on tree view selections. Portal page A portal page displays a collection of different pieces of information that are contained in Web parts. Notification Server includes predefined portal pages, and other portal pages might be included with solutions. You can also create your own portal pages. Full page A full page has a single content pane without the treeview.

35 Understanding the components of IT Management Suite About the Configuration Management Database 35 Some console pages support personalization, which is the ability for a console page to preserve the state of its controls on a per-user basis. For example, one day user A may open a filter page and, to suit their personal preference, re-order the columns in the grid. Meanwhile, user B opens the same page but leaves the grid in its default configuration. The following day, when the users open that filter page, user A sees the page as they configured it on the previous day. User B still sees the default view as they left it on the previous day. Personalization is currently applied to the reporting pages and filter pages, and to the state of the navigation tree in the view pages. In addition, the My Portal page is personalized for each user. About the Configuration Management Database Database processing is one of the largest consumers of resources on the Symantec Management Platform. The number of solutions that are installed in your environment and how they are used influences the database requirements. The number of managed computers that report to each Notification Server computer also influences the database requirements. Each Notification Server computer can be configured to use a local Configuration Management Database (CMDB) or to use a remote CMDB. A Notification Server computer with a local database requires more resources than a Notification Server computer with a remote database configuration. See Configuring the Configuration Management Database on page 186. See About planning your SQL Server configuration on page 53. You can use the following configurations for the CMDB: Local CMDB configuration In a local CMDB server configuration, you install the CMDB on the same computer as Notification Server. This configuration is acceptable for the environments that have 1,000 to 5,000 endpoints. In these environments there is minimal contention of resources between Notification Server services and the CMDB services. Remote CMDB configuration In a remote CMDB configuration, you install the CMDB on a different computer from the Notification Server computer. This configuration is recommended for most environments. In this configuration the workload of the CMDB is offloaded from the Notification Server computer. The CMDB server and Notification Server computer must have a high-speed network connection between them. Symantec recommends 1GB Ethernet.

36 36 Understanding the components of IT Management Suite About site services About site services The Symantec Management Platform can host several types of middleware components, such as package servers, task servers, and boot servers. Middleware components can be installed on computers other than the Notification Server computer. These services act as the first point of contact for the Symantec Management Agents, thus reducing the load on Notification Server. The official name for a middleware component is site service. Any computer that hosts a site service is known as a site server. A site server can have one or more site services installed on it. For example, if you install the package server site service (the "package service") onto a computer, that computer becomes a site server. Site servers can assist Notification Server. Site servers can extend the architecture, improve distribution efficiency, and reduce network bandwidth requirements. Notification Server handles the deployment, configuration, and ongoing maintenance of site services. Package service, task service, and the boot service provide the Symantec Management Agents with packages, tasks, and PXE broadcasts. Notification Server performs the following functions for site management: Handles the deployment and removal of site services to and from site servers Ensures that the site service is installed only on the computers that satisfy the minimum system requirements You use site maintenance to create logical groups of endpoints to balance the load on site servers. For example, you can distribute packages efficiently to your Symantec Management Agents with multiple package servers. The package servers handle most of the package distribution functions, which frees up Notification Server to perform other activities. See About site maintenance on page 59. About the Symantec Management Agent The Symantec Management Agent is the software that establishes communication between Notification Server and the computers in your network. Computers with the Symantec Management Agent installed on them are called managed computers. Notification Server interacts with the Symantec Management Agent to monitor and manage each computer from the Symantec Management Console. Notification Server and the Symantec Management Agent work together to provide the following types of functionality for managed computers:

37 Understanding the components of IT Management Suite Solutions of IT Management Suite 37 Monitoring hardware and software Scheduling software installations and file updates Collecting basic inventory information Managing policies and packages You can install the Symantec Management Agent on Windows, Linux, UNIX, and Mac computers. The Symantec Management Agent also lets you install and manage solution agent plug-ins that add additional functionality to the agent. For example, installing the Inventory Solution agent plug-in lets you gather detailed hardware and software information from all of your managed computers. Solutions of IT Management Suite IT Management Suite includes many solutions and components. Table 2-1 IT Management Suite 7.1 solutions and components Suite/Platform Symantec Management Platform 7.1 Solution/Component Includes the components such as Network Discovery, Notification Server, Symantec Management Console, and Symantec Management Agent Symantec Workflow Solution 7.1 IT Analytics 7.1 Asset Management Suite 7.1 Client Management Suite 7.1 Asset Management Solution 7.1 Barcode Solution 7.1 CMDB Solution 7.1 Deployment Solution 7.1 SP1 with a license for 6.9 SP5 Inventory Solution 7.1 IT Analytics Client and Server Pack 7.1 IT Analytics SEP Pack 7.1 Out-of-Band Management Component 7.1 Patch Management Solution 7.1 pcanywhere Solution 12.6 Real-Time System Manager 7.1 Software Management Solution 7.1 Symantec Endpoint Protection Integration Component 7.1 Wise Connector 7.1 Workspace Virtualization 7.1 Wise Connector 7.1

38 38 Understanding the components of IT Management Suite About Asset Management Suite Table 2-1 IT Management Suite 7.1 solutions and components (continued) Suite/Platform Server Management Suite 7.1 Other Solution/Component Deployment Solution 7.1 SP1 with a license for 6.9 SP5 Inventory Solution 7.1 Inventory Pack for Servers IT Analytics Client and Server Pack 7.1 IT Analytics SEP Pack 7.1 Monitor Pack for Servers 7.1 Monitor Solution 7.1 Patch Management Solution 7.1 Real-Time System Manager 7.1 Software Management Solution 7.1 Symantec Endpoint Protection Integration Component 7.1 Virtual Machine Management 7.1 Wise Connector 7.1 Symantec ServiceDesk 7.1 IT Analytics ServiceDesk Pack 7.1 See About IT Management Suite on page 19. About Asset Management Suite Asset Management Suite provides a management console, a database environment, and a suite of solutions that let you track assets and asset-related information. The suite includes Asset Management Solution, Barcode Solution, and CMDB Solution. Asset Management Suite specializes in tracking IT-related assets, such as computers and software. You can also use it to track other types of assets, such as furniture and company cars. In association with assets, you can record and track many types of documents and documented details. For example, you can track lease schedules, NDAs (non-disclosure agreements), SLAs (Service Level Agreements), and warranty information. Contracts and contract details can be associated with assets so that you can easily view the contractual information that is related to specific assets. You can also configure the software so that it notifies you of the upcoming actions that are specified in a contract. You can use the Symantec Management Console to view the value of an asset or a group of assets. You can use it to view the department, cost center, and user that is assigned to an asset. You can use it to improve your ability to allocate software and hardware costs to specific users and departments. You can also use

39 Understanding the components of IT Management Suite About Barcode Solution 39 it to keep track of software license details so that you avoid paying for the licenses that you do not need. Additionally, Asset Management Suite aligns with IT Infrastructure Library (ITIL) standards. It also helps you comply with international IT standards such as COBIT and U.S. federal laws such as the Sarbanes-Oxley Act and HIPAA. About Barcode Solution Barcode Solution provides your organization with a simpler, more accurate way of gathering and verifying asset information in the field. This solution integrates information directly into Altiris Asset Management Solution and Altiris CMDB Solution so that data input errors, accounting irregularities, and redundancies are eliminated. Barcode Solution lets you do the following: Speed up asset data entry and reduce errors Manual data collection is slow and error prone. For example, a well-trained data entry operator makes a data entry error once every 300 keystrokes. Barcode Solution saves you time and money by increasing the input speed and accuracy. A barcode system is significantly faster (approximately 15 times faster) and more accurate (approximately 10,000 times more accurate) than manual data entry systems. Track and audit assets Manage inventory Assets that cannot be automatically discovered through network connections can be easily tracked within the enterprise application with Barcode Solution. Your asset data can be downloaded to a barcode device that is taken to the asset location and then is verified. New asset data can also be collected while in the field. Barcode Solution makes it easy to synchronize data with the enterprise application. The barcode system makes the inventory in the field visible to the warehouse regardless of where your assets are located. Your warehouse can prepare accurate replacements and orders by using an up-to-the-minute inventory of your stock availability. About CMDB Solution CMDB (Configuration Management Database) Solution is a component of Asset Management Suite. This solution lets you model configuration items for any component in your environment and the relationships between them in a centralized database.

40 40 Understanding the components of IT Management Suite About Deployment Solution CMDB Solution lets you identify all components and relationships and to instigate any required changes. The solution actively manages configuration items according to user-specified instructions in jobs, tasks, configuration policies, and custom CMDB rules. About Deployment Solution Deployment Solution lets you integrate standard deployment features with Symantec Management Platform. It helps reduce the cost of deploying and managing servers, desktops, and notebooks from a centralized location in your environment. The solution offers OS deployment, configuration, PC personality migration, and software deployment across hardware platforms and OS types. The following are the key features of Deployment Solution: Lets you mass-deploy hardware-independent images to new systems and existing systems using Symantec Ghost and RapiDeploy imaging tools. Lets you migrate to the latest Windows version; migrates user data, personality settings, and OS and application settings to the new operating system. Lets you configure each system based on standardized criteria, such as job function, user type, or location. Lets you change the system and the network settings. Supports the deployment of heterogeneous client and server operating systems, including Windows and Linux. Supports the deployment of heterogeneous client and server operating systems such as Windows and Linux on client and server computers. Lets you easily create the jobs and tasks that automate deployment and migration functions such as imaging, scripted OS installations, configurations, and software deployments. Supports industry-standard hardware-management capabilities such as Intel vpro, Pre-boot execution Environment (PXE), and Wake on LAN technologies. Lets you use role- and scope-based security to secure management features from unauthorized personnel. Supports the WinPE and the Linux preboot environments. Integrates with many Symantec products built on Symantec Management Platform: for example, Altiris solutions and security, backup and recovery, virtualization, data loss prevention, vulnerability assessment, and and other products. The following are the key benefits of Deployment Solution:

41 Understanding the components of IT Management Suite About Inventory Solution 41 Reduces the costs that are associated with deploying, migrating, and provisioning desktops, laptops, and servers throughout the organization. Saves time and reduces human error over traditional PC deployments. Reduces end-user downtime by automating the deployment process. Increases IT efficiency through automated, repeatable deployment tasks. Provides tools for zero-touch migrations to reduce the costs that are associated with moving to a new operating system. About Inventory Solution Obtaining and analyzing accurate inventory data is an important part of managing and securing your network. Inventory Solution lets you gather inventory data about computers, users, operating systems, and installed software applications in your environment. An application metering feature also lets you monitor and deny the usage of applications on your network. You can collect inventory data from the computers that are running the following platforms: Windows, UNIX, Linux, and Mac. You use policies and tasks to perform inventory and application metering functions. The policies and tasks are easily configured and managed using a central Web console. The inventory data is stored in the Configuration Management Database (CMDB). The CMDB provides a central store of data that is used across the Symantec Management Platform. For more information, see the topics about the CMDB in the Symantec Management Platform Help. After you have gathered inventory data or metered applications, you can analyze the data using predefined or custom reports. You can collect the following kinds of inventory data: Hardware and operating system. Software. File properties. Predefined inventory policies let you gather inventory with little effort. See About predefined inventory policies on page 117. To help maximize your investment, Inventory Solution does more than gather data. By providing a Web-based management console, policies to alert you about critical information, and professional quality Web reports, Inventory Solution

42 42 Understanding the components of IT Management Suite About Inventory Solution includes the tools that you need to transform your inventory data into useful information. Inventory Solution also has the following features: Supports zero-footprint configuration. Operates in always connected, sometimes connected, and stand-alone computing environments. Can be installed to run on a recurring basis with the Symantec Management Agent. Posts data through SMB and/or HTTP. You can use the application metering feature within Inventory Solution to monitor and control the use and availability of applications on managed computers. You can meter applications that are running on Windows-based managed computers. When metering applications, you define the applications you want to monitor or deny by creating application definitions. You can use broad or specific product definitions. For example, you can use one definition to meter all Microsoft applications or you can use a specific definition to meter Word version 12. The rules for metering applications are controlled through Notification Server policies. The Application Metering Plug-in runs within the Symantec Management Agent on the managed device and enforces the properties of the policies. An application metering policy can meter one or more applications. You can use the application metering features of Inventory Solution to do the following: Discover applications. Application metering records the first time an application starts. This lets you identify the software, including its version, that is used on managed computers. You can use the information about discovered applications when you create monitoring policies. Monitor specific applications. You can create policies to monitor applications. The policies let you perform the following actions: Monitor activity Deny usage You can track when an application is started, stopped, or both to determine duration. You can deny the use of an application. You can have a denial event sent to Notification Server.

43 Understanding the components of IT Management Suite About IT Analytics Solution 43 Harvest unused software licenses Determine unused applications, so that you can reuse licenses elsewhere. For more information, see the topics about managing software licenses in the Asset Management Suite Help. You can use Inventory Pack for Servers, which is a separate product that lets you gather server-based inventory data from servers. You can also use additional Symantec products to gather inventory data from handheld computers, network devices, and Windows, UNIX, Linux, and Mac servers. About IT Analytics Solution IT Analytics Solution software complements and expands upon the reporting that is offered in many Symantec solutions. It brings multi-dimensional analysis and robust graphical reporting features to Symantec Management Platform. This functionality allows users to explore data on their own, without advanced knowledge of databases or third-party reporting tools. It empowers users to ask and answer their own questions quickly and easily. About Symantec Mobile Management Symantec Mobile Management lets you manage, secure, and troubleshoot the mobile devices in your organization. Using Mobile Management, you can automate repetitive tasks to reduce the resources that you spend to control your IT environment. You can also see what mobile devices you have, where each device is located, and what state each device is in. The flexible reporting tools in Mobile Management let you identify any problems in your IT framework. You can then take immediate action to fix those problems from within the reports. About Monitor Solution Monitor Solution lets you monitor various aspects of computer operating systems, applications, and devices. These aspects can include events, processes, and performance. This ability helps you ensure that your servers and your devices work and reduces the costs of server and network monitoring. Monitor Solution lets you do the following tasks:

44 44 Understanding the components of IT Management Suite About Monitor Pack for Servers Identify the health of your environment by collecting detailed data from servers, applications, and network devices. Analyze trends and isolate recurring issues by collecting comprehensive real-time and historical performance data. Pinpoint problems, define their cause, and take automated actions to resolve them. Monitor Solution supports both agent-based and agentless monitoring methods. It runs on the Symantec Management Platform and is a key component of Server Management Suite. About Monitor Pack for Servers Monitor Pack for Servers works with the Monitor Solution core components of the Symantec Management Platform. It lets you monitor operating system performance, services, and events of your Windows, Linux, or UNIX server environment. This pack includes several reports to help you evaluate and tune the performance of your server components. About Out of Band Management Component Altiris Out of Band Management Component software (formerly known as Altiris Out of Band Management Solution) lets you discover computers with ASF, DASH, and Intel AMT in your environment and configure the computers for out-of-band management. Out-of-band management is the ability to manage client computers regardless of the state of their power, operating system, or management agents. You can remotely change the power state of the computer, collect hardware inventory, and perform other management tasks that would normally require a visit to a client computer.

45 Understanding the components of IT Management Suite About Patch Management Solution for Windows 45 Figure 2-2 Out of Band Management Component features About Patch Management Solution for Windows Patch Management Solution for Windows takes inventory of managed computers to determine the operating system and software updates (patches) they require. The solution then downloads the required patches and provides wizards to help you deploy patches. The solution enables you to set up a patch update schedule to ensure that the software on the managed computers is kept up-to-date. Managed computers are then protected on an on-going basis. Key features include a software repository that provides comprehensive data on software bulletins, software updates, and inventory rules, such as technical details, severity ratings, and number of executables. The process of populating the information repository from the patch management metadata files can be started after you complete the installation of the solution. To reduce labor, the software update plug-in automatically analyzes managed computers. The software update plug-in gathers patch-specific inventory of applications, their versions, and service pack information. The inventory data is used to determine whether a patch is required. Inventory results populate predefined filters. The Distribute Software Updates wizard then lets you automatically assign software updates to relevant filters. The wizard also simplifies

46 46 Understanding the components of IT Management Suite About Patch Management Solution for Linux the management of distribution. Instead of creating a policy for each individual software update, you create a single policy for the relevant software bulletin. For example, if three software bulletins with seven software updates address various operating systems in various languages, you only have to manage three distribution policies. If you want to, you can modify any default settings and command-line options in a software update policy. Integration with Notification Server 7.x includes features such as hierarchy and maintenance windows. Hierarchy lets you configure features and settings for a parent Notification Server computer, then pass the settings down to child Notification Server computers. About Patch Management Solution for Linux Patch Management Solution for Linux lets you scan Red Hat and Novell Linux computers for security vulnerabilities. The solution then reports on the findings and lets you automate the downloading and distribution of needed software updates. Only SUSE updates are supported for Novell. This solution downloads the required software updates and provides wizards to help you deploy them. During configuration, you can set up an automatic update schedule to ensure that managed computers are up-to-date and protected on an on-going basis. About Patch Management Solution for Mac Patch Management Solution for Mac lets you scan Mac computers for the updates that they require. The solution then reports on the findings and lets you automate the downloading and distribution of needed software updates. You can distribute all or some of the updates. Patch Management Solution for Mac can update only the software that the Mac OS X software update utility supports. The solution integrates with the software update utility, and lets you collect needed update information from the target Mac computers and initiate a software update. Mac computers download software updates from Apple Web site or from a Software Update Server (SUS) and report installation status information to Notification Server. Patch Management Solution for Mac provides you with the preconfigured rollout jobs that let you automate installing a large number of updates. For example, the preconfigured rollout jobs can install all updates, all recommended updates, and so on.

47 Understanding the components of IT Management Suite About Real-Time System Manager 47 About Real-Time System Manager The Altiris Real-Time System Manager software lets you manage a single computer from the Symantec Management Console in real time. Real-Time System Manager can connect to the target computer using the following protocols: WMI - Microsoft Windows Management Instrumentation ASF - Alert Standards Format 2.0 Intel AMT - Intel Active Management Technology DASH - Desktop and mobile Architecture for System Hardware SNMP - Simple Network Management Protocol IPMI - Intelligent Platform Management Interface With Real-Time System Manager, you can view detailed real-time information about the managed computer and remotely perform various administrative tasks. For example, you can restart the computer, reset a password, run a port scan, terminate a process, and more. Real-Time System Manager also lets you run some of the management tasks on a collection of computers, immediately or on a schedule. About Symantec Endpoint Protection Integration Component About ServiceDesk The Symantec Endpoint Protection Integration Component combines Symantec Endpoint Protection with your other Symantec Management Platform solutions. You can inventory computers, update patches, deliver software, and deploy new computers. You can also back up and restore your systems and data, manage DLP agents, manage Symantec Endpoint Protection clients. You can do this work from a single, Web-based Symantec Management Console. You can perform common Symantec Endpoint Protection client management operations from the Symantec Management Console. Symantec ServiceDesk is an ITIL-compliant service management tool that lets you improve your IT infrastructure and provide a higher level of service. It incorporates Symantec Workflow technologies to manage service tickets, provide reports, and integrate with other Symantec products such as the Configuration Management Database (CMDB).

48 48 Understanding the components of IT Management Suite About ServiceDesk ServiceDesk requires a completed installation and implementation of a Symantec Management Platform 7.1 product. Such products include Client Management Suite and Server Management Suite. The ServiceDesk solution software is installed using the standard Symantec Management Platform mechanisms. ServiceDesk includes all the primary ITIL Service Management processes. Processes in ServiceDesk include Incident Management, Problem Management, Change Management, and a Knowledge Management system. ServiceDesk also includes a Service Catalog. After you install ServiceDesk, it is ready to use. However, you might choose to customize some aspects of ServiceDesk to meet your organization s specific requirements. Because all ServiceDesk processes are based on workflows, you can customize the processes without making code-level changes. For information about the kinds of modifications you can perform, see the ServiceDesk Customization Guide. Table 2-2 Key features of ServiceDesk Feature ITIL-based processes Ready-to-use workflows and processes Easy customization Description All ServiceDesk processes are fully ITIL-based, which lets you implement a full ITIL solution. ServiceDesk includes a set of high-quality, ITIL-based processes that have undergone extensive testing and development effort. All ServiceDesk processes and forms are easy to customize using the Workflow Designer tool. Process-driven forms Time zone support Business hours support The default forms that ServiceDesk contains are process-driven rather than data-driven. The user is not shown all of the available information for the form. Instead, the user is shown what is relevant for the particular point they are at in the process. The user is shown the information they need to see to move forward with the process. This narrowing of focus helps ensure that the process is followed correctly, and makes following the processes easier for new users. The date and time that appear in tickets, alerts, and s are displayed in the appropriate time zone for the current user s location. This time zone support allows for world-wide support capabilities and supports virtual help desks. You can define the normal business hours for your organization, which accounts for holidays and weekends. This business hours support allows for accurate Service Level Agreement reporting and accurate reporting of average response time and resolution time.

49 Understanding the components of IT Management Suite About Software Management Solution 49 Table 2-2 Key features of ServiceDesk (continued) Feature notifications Escalation rules Integration with other products Advanced reporting mechanisms Full-featured knowledge management Security at a granular level Description notifications are built into the ITIL processes. notifications keep users aware of changes to ticket status, and allow users to verify that an issue is fixed. In any process, notifications can be used to notify the contacts that are associated with a ticket, assign tasks, and send alerts. Escalation rules can be configured so that escalations are triggered when certain types of events occur. For example, an escalation might trigger when an incident approaches the Service Level Agreement limitations. When a user has not responded to a Change Management approval task, an escalation may also be triggered. ServiceDesk can integrate with other products through the actions and URL calls that can trigger events in other systems. ServiceDesk Web services can also be used to display ServiceDesk processes and forms in third-party applications such as Microsoft SharePoint. Advanced reporting mechanisms are included in ServiceDesk. Reports are easy to create and customize. In addition, report templates can be created to let groups and users customize and save their own reports. Reports can be defined and scheduled to run periodically, and can be ed to a distribution list. Reports can also be published as a Web service to expose report data. A full-featured knowledge management solution is included. You can secure processes, forms, and data at the user, group, role, and organizational unit level. About Software Management Solution Software Management Solution provides intelligent and bandwidth-sensitive distribution and management of software from a central Web console. It significantly reduces desktop visits and lets you easily support your mobile work force. Software Management Solution also lets users directly download and install approved software or request other software. Software Management Solution integrates with the Software Catalog and the Software Library that are part of the Symantec Management Platform. By leveraging this information, Software Management Solution ensures that the correct software gets installed, remains installed, and runs without interference from other software. This integration lets your administrators focus on delivering

50 50 Understanding the components of IT Management Suite About Symantec Workflow the correct software instead of redefining the packages, command lines, and so on for each delivery. For more information, see the topics about the Software Catalog and the Software Library in the Symantec Management Platform Help. Software Management Solution combines the functionality of earlier versions of Software Delivery Solution and Application Management Solution. It also supports the software virtualization technology that was available in Altiris Software Virtualization Solution. Software Management Solution supports packages for the Windows, UNIX, Linux, and Mac operating systems. With few exceptions, all the functions in Software Management Solution work the same for all platforms. For example, you use the same method to create a delivery task for a Windows, UNIX, Linux, or Mac OS package. For a complete list of the platforms that Software Management Solution supports, see the Software Management Solution Release Notes. About Symantec Workflow Symantec Workflow is a graphical.net application development tool that provides advanced logic and workflow to the Symantec Management Platform and the solutions that integrate with the platform. You can use it to edit and implement pre-built workflows. You can also build your own workflows. You can use Workflow to create an application that does not require human interaction. You can also use Workflow to create an application that includes human interaction. You can create an application that takes input from multiple parties to accomplish a business goal. You can also design your applications to communicate with disparate technologies. The applications that you design can create human interaction through a variety of user interfaces. You can create human interaction through , Web forms, handheld devices, or a task list. In addition to basic Workflow capability, Workflow includes Process Manager. Process Manager is a Web portal for managing the various parts of a workflow process, such as tasks, documents, data, and so on. Process Manager can be integrated with Active Directory for user authentication, proper access control, and user management. You can also customize Process Manager. For example, you can change pages, symbols, Web parts, and so on to create an interface that works for you. You can also add new pages to Process Manager that embed Process Manager content or content from the Web or other servers.

51 Chapter 3 Planning for IT Management Suite This chapter includes the following topics: IT Management planning considerations About planning your SQL Server configuration About planning your site servers Symantec Management Agent deployment planning How agent-based inventory communications work How Patch Management Solution data communications work Components of Deployment Solution How asset management data communications work IT Management planning considerations Many factors and considerations may influence an implementation plan. To design your Symantec Management Platform infrastructure, you must assess your specific organizational features and requirements. See Core architectural components of IT Management Suite on page 31. Your requirements can include several variables. Some of these variables may include the following: The geographic implications of the environment. A centralized management design uses multiple Notification Server computers to support a variety of IT distribution models. For example, you can have

52 52 Planning for IT Management Suite IT Management planning considerations central corporate office with thousands of managed computers as well as both large branches and small branches. The centralized design can be effective for managing global policies and tasks. If your IT organization is primarily centralized, then the Symantec Management Platform can be designed to support it. In such an environment, the platform may use a parent Notification Server computer that is connected to additional child Notification Server computers in a hierarchy. A decentralized management design consists of multiple dispersed sites and network segments that support subordinate sites and network segments. The decentralized design does not use hierarchy but instead it uses multiple Notification Server computers that operate independently. The future growth of the organization. The infrastructure design may require room for growth. If possible the architecture should reflect both the current organization and the vision for the organization in the coming years. The IT management team's distribution and its policies. The operations that IT manages centrally and locally influence design. Some IT tasks may need to be done from a central location or some tasks may need to be done from local sites. The security policies of the organization influence the design. Your organizational structure may determine the component placement and design of the infrastructure. How the organization s staff works on a daily basis and how the business process is established influences the plan. Different branches of the organization, security requirements, or geographical requirements may all require separate Notification Server management domains. Different groups and roles managing endpoints may require Notification Server role and scope-based security. Role and scope-based security adds load on the Notification Server computer. The connectivity ranges of the environment. The connectivity ranges of the environment may determine the placement of components. For example, there may be a first-tier site that is well connected, but the second tier sites are poorly connected. Traveling users may dial in or use a VPN from a remote location. The installed solutions and how actively they are used. The number of installed and actively used solutions influences the number of managed computers that a Notification Server can support. For example, a server with only Inventory Solution installed can serve more managed endpoints than a server with all of IT Management Suite. The concurrent console usage and reporting needs.

53 Planning for IT Management Suite About planning your SQL Server configuration 53 Concurrent use of the console can add additional processor utilization for heavy use of the Symantec Management Console. You can use the console to create custom reports to view information about the environment. Many custom reports are written with advanced Structured Query Language (SQL) statements that require significant database processing power. Having many users run these reports concurrently on the Notification Server computer can degrade its performance. If the organization requires heavy custom reporting, consider implementing a separate Reporting Notification Server. While it does mean that the organization needs to invest in an additional server, it provides for the separation of duties in the infrastructure. The Notification Server computer responsible for managing endpoints is able to dedicate its processing to that function. The Notification Server computer responsible for providing reports dedicates its process to that other function. With this configuration, you can use stand-alone replication to forward resource inventory information from the agent-facing Notification Server computer to the reporting Notification Server computer. Another consideration is the memory cost of each of the concurrent console sessions from IIS on the Notification Server computer. You can calculate this memory requirement at approximately 20MB per console connection. About planning your SQL Server configuration The following information provides guidelines for SQL server configuration for a Symantec CMDB computer. You can follow these guidelines to tune the performance of the SQL Server computer that hosts the Configuration Management Database (CMDB). These guidelines are not exclusive, and additional configuration options may be appropriate depending on the specifics of your environment. For detailed information about SQL Server configuration, refer to Microsoft s documentation. Many additional articles about SQL server setup, configuration, and maintenance are available on the SymWISE Support Knowledgebase. The SymWISE Support Knowledgebase is available at For additional resources, see the article Links to Notification Server/SQL Server Maintenance and Tuning Articles on the SymWISE Support Knowledgebase.

54 54 Planning for IT Management Suite About planning your SQL Server configuration Table 3-1 Consideration Hardware Considerations for planning your SQL Server configuration Description You can use recommended hardware guidelines to help tune the performance of your SQL Server computer. Hard drive configuration The way that you configure the hard drives of your SQL Server computer influences your overall performance. You can use disk configuration recommendations to maximize throughput and tune the performance of your SQL Server computer. See About hard drive configuration for SQL Server on page 54. Database sizing You can use database sizing guidelines to help tune the performance of your SQL Server computer. See About database sizing for SQL Server on page 56. Memory management You can use memory management guidelines to help tune the performance of your SQL Server computer. See About memory management for SQL Server considerations on page 58. About hard drive configuration for SQL Server The throughput of the SQL Server is a primary consideration for Symantec Management Platform performance. The way that you configure your hard drives on SQL Server influences throughput. The hard drive speed also has an influence on throughput. It is recommended to use high performance hard disks: for example, 10k rpm to 15k rpm SAS drives in a striped array. See About planning your SQL Server configuration on page 53. See About the Configuration Management Database on page 35. For the best performance, make sure that the operating system, SQL data file, TempDB database, and the log file each has a dedicated array. To improve performance further, you can split the data file and the TempDB database across multiple arrays. The number of arrays that you use should match the number of processor cores in your SQL Server. A recommendation for high performance is to use parallelism with the same number of disk arrays as the number of processor cores. You can split the SQL data file and the TempDB database to match the number of processor cores.

55 Planning for IT Management Suite About planning your SQL Server configuration 55 The data file requires both high read-write performance and redundancy. RAID 10 and RAID 0+1 are good configurations for the data file. RAID 0+1 has similar throughput as RAID 10, but its configuration helps simplify additional storage growth. RAID level 5 is not ideal for the CMDB performance because it requires additional Read/Write activities for parity. The TempDB database needs high read-write performance, but redundancy is not necessary. The TempDB database acts as a temporary working area for many processes. The TempDB database requires very high speed; however, it is not used for storage and it is cleared regularly. The transaction log and the operating system do not require high disk throughput for optimal system performance. If only one SQL database is hosted on the computer, then a RAID 1 Mirror is adequate for the transaction log. If additional databases are hosted, then the transaction logs require RAID 10. Table 3-2 Component Operating system Data file TempDB database Transaction log Example of a SQL server disk configuration for a single CMDB database Configuration RAID 1 Mirror RAID 10 or RAID 0+1 RAID 0 (Striping) RAID 1 Mirror Throughput metrics of SQL Server The Symantec Configuration Management Database (CMDB) has high throughput requirements. Input/Outputs per second (IOPS) are used to measure the throughput. You can use the following IOPS metrics to select the right disk performance for your SQL Server. It represents SQL performance statistics during a one hour time period during peak hour processing. The database that is represented here serves 20,000 endpoints and 20 concurrent console sessions and 45 maximum persistent connections over 2311 concurrent transactions. See About planning your SQL Server configuration on page 53. Table 3-3 SQL data file I/O per second Metric Number of I/O per second. Value 238.7

56 56 Planning for IT Management Suite About planning your SQL Server configuration Table 3-3 SQL data file I/O per second (continued) Metric Percent of write I/O per second. Percent of read I/O per second. Value 98% 2% Table 3-4 TempDB database I/O per second Metric Number of I/O per second. Percent of write I/O per second. Percent of read I/O per second. Value % 51% Table 3-5 Log files I/O per second Metric Number of I/O per second. Percent of write I/O per second. Percent of read I/O per second Value % 0% About database sizing for SQL Server You can use database sizing guidelines to help tune the performance of your SQL Server computer. A Symantec Management Platform installation with no solutions and no managed computers creates a database size of about 300 MB. This size is about 7 percent of the maximum database size of SQL Express. An additional 500 managed computers can increase the size to approximately 500 MB. Databases also grow as solutions are introduced and used. See About the Configuration Management Database on page 35. See About planning your SQL Server configuration on page 53. Allow between 750KB and 1 MB of space in the database for every managed computer. This sizing does not account for database fragmentation beyond initial creation. Actual sizes vary based on the solutions that are installed and the specific configuration of policies, tasks, and schedules. The database maintenance strategy that you use also influences your database size.

57 Planning for IT Management Suite About planning your SQL Server configuration 57 When suites are installed in a large environment, you can expect the database to grow up to 6 GB to 12 GB. When choosing a database growth strategy, be sure to account for data growth. Autogrow is a SQL Server setting you can use to help with unexpected data growth. However, do not rely on autogrow to manage your database file sizes. You should monitor the files and re-size them according to your projected needs during maintenance. To choose your autogrow setting, estimate the expected maximum sizes of the data file and the transaction log file. To estimate this size you can monitor the growth of these files in a pre-production environment. Set the autogrow increment for your data file and transaction log files to 10 to 20 percent higher than your initial estimate. Do not use the autoshrink feature with the Symantec Management Platform. Auto shrink runs periodically in the background. It consumes CPU and I/O cycles which can cause unexpected performance degradation. Autoshrink can continually shrink and re-grow the data files. This process causes fragmentation of the database file. This fragmentation may degrade both sequential transfers and random accesses. After you have estimated the approximate size of the database, you should create a database file of this size before you install Notification Server. This step ensures that adequate space is available. It also reduces negative performance from a database that continually grows. To further improve performance, you should defragment and re-index the database after its initial installation. The CMDB SQL Server should not host additional third-party database applications because Symantec Management Platform has very high performance demands. However, additional CMDB databases can be hosted on the same SQL Server because each database has similar traffic requirements and hardware configuration needs. You can have a single SQL instance that shares a single TempDB database, or multiple database instances can each have a dedicated TempDB database. Multiple database instances minimize risk for potential contention but require more disk arrays. You may require the individual databases of each Notification Server computer to exist on a separate instance. They may need to be separate instances to avoid TempDB database contention.

58 58 Planning for IT Management Suite About planning your SQL Server configuration About memory management for SQL Server considerations Memory management is an important part of tuning SQL Server performance. Memory management is especially important when SQL is run locally on the Notification Server computer. See About the Configuration Management Database on page 35. See About planning your SQL Server configuration on page 53. Consider the following memory configuration options for SQL Server: 3GB This 32-bit Windows boot option limits the operating system to 1GB of RAM, reserving 3GB for applications. Maximum server memory This SQL setting limits the memory that SQL can consume. PAE This 32-bit Windows boot option allows SQL Server to use more than 4GB of RAM. AWE This SQL option allows SQL Server to use more than 2GB of RAM. If the server has more than 2GB of physical memory, enable AWE memory in SQL Server. This memory mode is recommended. When AWE is enabled, SQL Server always attempts to use AWE-mapped memory. It uses wrapped memory for all memory configurations, including computers that provide applications with less than 3 GB of user mode address space. If AWE memory is enabled in SQL, make sure that the SQL Server account has the correct Lock Pages in Memory setting. Both AWE and the Lock Pages in Memory setting can benefit 64-bit SQL Servers as well as 32-bit SQL Servers. Windows memory usage Set Windows memory usage to favor Programs over System Cache. SQL Server does its own data caching to improve performance. 32-bit OS If you use a 32-bit OS, make sure that PAE is enabled at the hardware level. Enabling PAE lets SQL Server use AWE to map physical memory addresses higher than 4 GB. 64-bit SQL This option eliminates the memory limitations that are associated with 32-bit systems. By using a 64-bit operating system (Windows 2003 or 2008) and 64-bit SQL, you do not need to use PAE or AWE. SQL Server 2008 x64 is recommended for dedicated SQL Servers with more than 4 GB of physical memory.

59 Planning for IT Management Suite About planning your site servers 59 About planning your site servers About site maintenance A site is a management construct that allows mappings of subnets to site services. Site services are an extension of the Symantec Management Agent. When a site service is installed on a managed node, it promotes the Symantec Management Agent to a site server. Task, package, and deployment site services are all site server roles. These site services can be deployed in multiple combinations to meet endpoint demands. A remote site may only need a package server. A task server may be needed only at the datacenter. However, a deployment site server requires that the task service and package services be installed on the same computer. Your topology and your use of solutions determines if you should combine site services onto a single computer or use dedicated computers. Site servers may use either a Windows workstation operating system or a Windows server operating system. Distributed and large environments may require numerous site servers to meet configuration management demands. Notification Server makes sure that the site service is installed only on the computers that satisfy the minimum requirements. Your primary consideration is the number of concurrent sessions that you need when you choose between a server operating system and a workstation operating system. A Windows workstation is limited to 10 concurrent TCP connections and a server OS does not have the same limitations. A site with fewer than 100 endpoints may only require 10 sessions; however; a Windows server may be required for larger remote sites. If you install a site service on a Windows 7/2008 computer, you must install the IIS 6 compatibility mode services on it. See About the package service on page 64. See About the task service on page 60. See About the deployment site service on page 65. Site maintenance is the management of sites, subnets, and site services in your organization. You can manage your computers according to site and subnet, which lets you control groups of computers while you minimize bandwidth consumption. A site is typically a physical location in your organization (such as a particular building, or a level of a building). A subnet is a range of logical addresses on your network. Under normal operating conditions, each package server or task server services only the Symantec Management Agents that exist within the assigned sites. If no

60 60 Planning for IT Management Suite About planning your site servers sites have been defined, all site servers are available to service all Symantec Management Agents (although this method is not recommended). If no sites are defined for a package server or a task server, Notification Server uses the following rules: Notification Server first tries to find any site servers on the same subnet as the requesting computer. If any are found, these site servers are returned to the Symantec Management Agent. If no site servers are in the same subnet as the requesting computer, all site servers are returned to the Symantec Management Agent. If no site servers are available, the agent is directed to the Notification Server computer. You can assign site servers to sites by using the following methods: Assign the subnet that contains the site server to a site. See Managing subnets on page 297. Assign the site server to a site. See Assigning a site server to a site manually on page 268. Use Connector for Active Directory to perform the task. Connector for Active Directory overrides any subnets and sites that conflict with it. For example, if you manually assign subnets to a site that conflicts with what is in Connector for Active Directory, the Active Directory information is used. After the list of available site servers is returned to the Symantec Management Agent, the agent chooses the most suitable site server. Site servers and managed computers may have multiple NICs and IP addresses; therefore, they may belong to more than one site through subnet assignment. See About site services on page 36. See Managing sites on page 261. See Managing site servers on page 265. See Managing subnets on page 297. About the task service Task communications are unique from policy communications. Managed computers start policy communications, and the server starts task communications. You can do the following with the task service:

61 Planning for IT Management Suite About planning your site servers 61 Execute multiple tasks in a defined sequence that is called a Job. Provide logic to handle task errors or other return codes. Deliver command-line and VBscript capabilities to managed computers. Provide out-of-the-box power management. Execute client-side and server-side tasks. Reuse tasks in multiple Jobs. Tasks can be cloned and modified as required. Symantec recommends at least one task server per Notification Server. Tasks place a high performance demand on the Notification Server computer s processor and memory because it must regularly send tickle packets and receive execution status. This demand can negatively influence SQL data loading and user interface responsiveness. You can offload the handling of tasks to a task server. A dedicated task server handles agent tickle communications, task sequencing, and automation capabilities. Distributing the handling of tasks to a task server reduces the load on Notification Server. It reduces the load by minimizing the interruption to Notification Server. See About planning your site servers on page 59. Task servers use a high number of operating system sessions. If a task server supports more than 100 managed computers, a Windows Server operating system is recommended. Use the Windows Server operating because it supports many more concurrent operating system sessions. If a task server supports less than 100 managed computers, a workstation operating system might be adequate. Task servers do not require high-performance hardware. A moderate speed processor is adequate. Disk IO is not a significant factor in task server performance. However; task communications can consume multiple concurrent connections to task server. A Windows workstation is limited to only 10 concurrent TCP connections and a Windows Server OS does not have the same limitations. Therefore, you may require a Windows Server operating system on your task server. Symantec recommends a Windows Server operating system for the task servers that support more than 100 managed computers. Task servers are good at offloading performance demands from Notification Server. They are not designed to address network bandwidth limitations. You can put a task server in the same subnet as Notification Server because it has little influence on minimizing network traffic. Use the following guidelines to configure task services within your infrastructure: Symantec recommends at least one task server per Notification Server. After the initial dedicated task server, add additional task servers for every 5,000 to 7,500 endpoints.

62 62 Planning for IT Management Suite About planning your site servers You can load-balance multiple task servers within large sites to make sure that agents have the latest task execution. You can reduce the load on task servers if you increase the Task Update Interval and the Maximum Time Between Tickle Events settings. By default these are set to every 5 minutes. Consider changing these settings to a value greater than 10 minutes. You must use site management to force computers to use the task server if Notification Server and the task server are in the same site. How task server uses the tickle mechanism The tickle server is a component of Task Management. The tickle server component runs only on the Notification Server computer and is responsible for notifying task servers of pending tasks for their client computers. Task servers also have the native ability to tickle their registered client computers. This tickle ability is separate from the tickle server component on the Notification Server computer. The tickle server sends IP tickle packets to task servers when any of their registered client computers have a job or task to run. After the tickle packet is received, the task server immediately requests the task or the job information from Notification Server for its registered client computers. It also tickles its client computers. When the Client Task Agent receives the tickle packet, it requests the job or the task information from its registered task server. Only after the Client Task Agent receives the task information is the task executed. Status events for completed tasks are sent back to the registered task server upon completion. If the tickle packets are blocked or otherwise cannot reach the destination, the Client Task Agent automatically checks back to its registered task server for any new job information. It performs this check every 5 minutes. This Task Request Interval is configurable in the Symantec Management Console. Task Server task and job information is not received through the Symantec Management Agent configuration policy. It is received directly by the Client Task Agent from its registered task server. If you force the Symantec Management Agent to update its configuration policy, it does not force the Client Task Agent to receive pending task information. By default, the Tickle Server uses port for task servers and task servers use port to tickle Client Task Agents. The following example assumes the Client Task Agent for ComputerA is registered with RemoteTaskServer1.

63 Planning for IT Management Suite About planning your site servers 63 Table 3-6 Sequence One Two Three Four Five Six Seven Eight Nine Sequence for how the task server tickle works Description A Notification Server administrator assigns a task to run immediately on ComputerA. The Tickle Server on the Notification Server computer sends a tickle packet to notify RemoteTaskServer1 of the pending task. RemoteTaskServer1 receives the tickle packet and immediately requests the job information from Notification Server. RemoteTaskServer1 tickles ComputerA to notify it of the pending task. ComputerA receives the tickle packet and immediately requests the job information from its registered task server RemoteTaskServer1. ComputerA receives the job information and executes the task. Upon completion of the task, ComputerA sends a status event back to RemoteTaskServer1. RemoteTaskServer1 caches the status event and immediately attempts to forward it back to Notification Server. Notification Server receives the status event from RemoteTaskServer1 and records the information in the database.

64 64 Planning for IT Management Suite About planning your site servers Figure 3-1 Sequence for how task server tickle works About the package service Package servers are deployment mechanisms to efficiently move data into a site. They work with Notification Server as local file servers for managed computers at a site. Package servers do not require server-class hardware and software. Package servers help you reduce network traffic by allowing a package to copy across the network only once per site. You can place a package server locally at a site to store and deliver packages. This architecture can help you manage sites with low-bandwidth connections to Notification Server. See About planning your site servers on page 59. When you enable a package on Notification Server, it is copied to all of the package servers that Notification Server knows about. Once the copy is successful, managed computers download the packages from the local package server instead of the remote Notification Server. The number of package servers that you require is dependent on your network topology and bandwidth. It also depends on the size of your packages and frequency of the packages to be delivered. You can stagger the deployment of packages to the package servers to reduce load. You can deploy a limited number of packages at a time to all package servers. You can also only deploy to select group of package servers at a time.

65 Planning for IT Management Suite About planning your site servers 65 A constrained package server can operate only within the sites to which it is assigned. An unconstrained package server can get packages and other resources from anywhere in the system. The unconstrained package server collects any required resources from outside the site and makes them available to all of the constrained package servers. A site server can function as a package server only when there is at least one unconstrained package server that is assigned to it. There must be at least one unconstrained package server in a site with one or more constrained package servers. About the deployment site service A deployment site server's purpose is to provide PXE Boot services and boot packages for network segments. The most common purpose is for restoring a standard image for support or for rolling out new computers during initial provisioning. Typically, PXE protocol is controlled on a network. It may be limited to work within a subnet or other defined range based on IP helpers. If many systems must be reimaged simultaneously, you can place deployment site servers within each network subnet and add more in a large subnet. In addition to providing PXE services, a deployment site server is similar to a package server in that it hosts packages called boot images. See About planning your site servers on page 59. You must enable deployment, package, and task site services on the deployment site server. Each subnet must have access to a deployment site server. However, routers normally block PXE broadcast packets. You can use the following three methods to provide each subnet with access: Use DHCP forced mode, which is a DHCP setting that forwards client PXE requests to the closest deployment site server. This method works even when the client computer is on a different subnet than the deployment site server. DHCP determines the correct server by using subnet mask and ping tests. Use IP Helpers, which is a setting you can configure at each router that lets you forward PXE requests across subnets. Install a deployment site server on each subnet. This method is not recommended because it creates unnecessary overhead. A deployment site server contains the following objects: PXE service Boot images The deployment share with the imaging executables The driver database

66 66 Planning for IT Management Suite About planning your site servers When new settings are applied to an existing boot image, an updated boot image is compiled locally at each deployment site server. These changes are delivered with a policy and are dependent on the Symantec Management Agent update schedule. A deployment site server requires that you also install task services and package services locally. Table 3-7 Sequence One Two Three Sequence for deployment site server configuration Description Deployment Solution is installed on the Notification Server computer. The administrator configures and manages deployment jobs and tasks from the Symantec Management Console. The administrator enables and configures the deployment site server on a site server computer. The DHCP server can route PXE requests from the client computers to the deployment site servers that are on multiple subnets.

67 Planning for IT Management Suite Symantec Management Agent deployment planning 67 Figure 3-2 Sequence for deployment site server configuration Symantec Management Agent deployment planning In some environments, computers are set up with a corporate software image or a standard base list of software. If you add the agent image to the computer image, you can save time and effort. The Symantec Management Agent can be preinstalled and placed in a directory with a Run Once operating system directive. See About tuning the Symantec Management Agent for performance on page 120. You can also use scripting mechanisms to install the agent. You can push the Symantec Management Agent from the Symantec Management Console if you do not want to add the agent to an image build. Push requires less outside intervention than other methods of deploying the agent to computers already in service. With this method Notification Server contacts the client computer, and then the client computer requests the agent from Notification Server. The push method requires you to disable the file-sharing setting.

68 68 Planning for IT Management Suite How agent-based inventory communications work You can still deploy the agent with file-sharing enabled. The client computer still has the ability to initiate this request itself. For example, with , either a script can be ed or a Web link can be sent to pull the agent. How agent-based inventory communications work Inventory Solution lets you see detailed reports about the hardware and software in your environment. You can target computers for policies and tasks based on this information. It includes predefined inventory policies. Some predefined inventory policies are enabled by default. However, you can modify them to meet your specific needs. See About Inventory Solution on page 41. These policies include the following settings: What to inventory. When to run. Which computers to run on (targets); by default, this setting targets all computers with the Inventory Solution plug-in installed. Optional advanced settings. Notification Server delivers the initial inventory task-based policy to the managed computer. The Inventory Solution plug-in runs its first inventory immediately. After the Inventory Solution plug-in has its policy settings, it continues to run the inventory task. It runs the task according to the settings and the schedule that are defined in the policy. If a policy setting is ever changed, then the task server pushes the new settings to the plug-in immediately. The Inventory Solution plug-in then immediately runs an inventory collection. Inventory Solution runs independent of the Symantec Management Agent's configuration request. It uses tasks and task servers to perform its operations. The time that the inventory runs applies to the time zone of the managed computers. It does not use the time zone of the Notification Server computer. You can create your own custom schedules in the policy or you can use one of the following predefined schedules: Daily. This time is at 6:00 P.M. every day. Weekly. This time is at 6:00 P.M. every Monday. Monthly. This time is at 6:00 P.M. on the first Monday of each month. When the Inventory Solution plug-in runs, it gathers hardware inventory, file scans, Microsoft add or remove programs and UNIX, Linux, and Mac software listings. The Inventory Solution plug-in immediately sends the data to Notification

69 Planning for IT Management Suite How agent-based inventory communications work 69 Server. The data is compiled as Notification Server Events (NSEs). Notification Server stores the NSEs in the Configuration Management Database. The data is then available for reporting from the Symantec Management Console. Table 3-8 Sequence One Two Three Four Five Figure 3-3 Sequence for Inventory communications Description Predefined inventory policies are available for managed computers on Notification Server. After the initial Inventory plug-in deployment, inventory tasks are pushed to the managed computer from task services. By default the Inventory plug-in runs ASAP. The Inventory plug-in then gathers the inventory according to its defined schedule. After inventory is gathered, by default it is immediately sent to the Notification Server computer. The Notification Server computer stores the inventory in the CMDB. Sequence for Inventory communications

70 70 Planning for IT Management Suite How Patch Management Solution data communications work How Patch Management Solution data communications work Patch Management Solution takes inventory of managed computers to determine the operating system and software updates (patches) they require. The solution then downloads the required patches and provides wizards to help you deploy patches. The solution enables you to set up a patch update schedule to ensure that managed computers are kept up-to-date with the latest vendor security updates. Managed computers are then protected on an on-going basis. See About Patch Management Solution for Windows on page 45. You can schedule Patch Management Solution to automatically download critical security bulletins into the CMDB. Symantec recommends setting this schedule to daily for Windows computers and weekly for Linux computers. This schedule does not download the patch installation files, only the information about them in the security bulletins. This download is called the software updates catalog. The first software updates catalog import on a new platform can take several hours. However, subsequent imports typically take less than an hour because each import only performs delta downloads of often only a few MBs. If you choose to enable multiple languages, then the number of security bulletins to download, the size of downloads, and the time to download increases. You can customize software updates catalog updates by creating exclusions for the software that you do not want to patch. You can create custom schedules for the download. By default, every four hours the Software Update Plug-in contacts Notification Server to check for patches. If new security bulletins are added to the CMDB by the software updates catalog, the Software Updated Plug-in checks to see if they are applicable. It also checks if the updates have already been installed. It sends the results of the check to the Notification Server computer. The data is available for compliance reporting. After the software updates catalog import has completed, you can select which security bulletins you want to stage on Notification Server. This staging processes triggers a download of the patch installation files to a folder on the Notification Server computer. After the download of the patches has finished, you can create and enable your patch distribution policy. If you use multiple package servers, your site management settings for package distribution determine how the patch installation files get distributed to the package servers. The policy is not applied until the Symantec Management Agent has checked in. By default, every hour the Symantec Management Agent contacts the Notification Server computer and requests its configuration updates. However, your schedule may be different.

71 Planning for IT Management Suite How Patch Management Solution data communications work 71 The Notification Server computer sends the patch distribution policy to the Symantec Management Agent. The Notification Server computer advertises the location of the package server to the Symantec Management Agent. The Symantec Management Agent connects to the package server and downloads the patches. After the patches are downloaded, the installation waits for the next scheduled maintenance window to run. It waits unless you set it to ignore the maintenance windows for zero-day exploits. It then does the following: Verifies that patches have been downloaded. Installs the patches and restarts the computer. You can configure restart settings so that servers do not restart immediately after patching updates. A no restart window may be given to client computers so that users can defer the restarts. Runs a vulnerability analysis. If a restart has not occurred, the computer may still appear in reports as vulnerable. After the patching process completes, the Software Update Plug-in sends the updated vulnerability analysis to Notification Server and stores it in the CMDB. You can use the compliance reports to view vulnerability information from the Symantec Management Console. The patching process has multiple dependencies, so order of operations is important. The Software Update Plug-in is used to determine vulnerability. The Symantec Management Agent performs the software update. They each may have a different update schedule. The larger schedule defines the window for patches to be delivered to managed computers. The maintenance window defines when the patches are installed. Compliance reports do not show success until after these steps are completed. Table 3-9 Sequence One (a) Two (a) Three (a) Sequence for patch communications Description Import runs automatically on Notification Server and pulls security bulletins into the CMDB. You select the patches from the security bulletin and they are staged to a local folder on the Notification Server computer. You create a patch delivery policy and include the patches that were downloaded.

72 72 Planning for IT Management Suite How Patch Management Solution data communications work Table 3-9 Sequence Four (a) One (b) Two (b) Three (b) Four (b) Five (b) Sequence for patch communications (continued) Description After the agents have completed, you run a compliance report to check the patch status. Patch plug-in checks in every four hours by default. It uses the latest patch management import data and runs a vulnerability scan. The scan is dependent on patch management import being complete. The Symantec Management Agent checks in and receives the latest Patch policies and the location of the patches. The Symantec Management Agent downloads the patch packages from the Notification Server computer or its assigned packaged server. During the next maintenance window, the Symantec Management Agent installs the patches. After installation, the computer restart settings are run. After the package is installed, a vulnerability analysis is run again and the information is sent to the Notification Server computer.

73 Planning for IT Management Suite Components of Deployment Solution 73 Figure 3-4 Sequence for patch communications Components of Deployment Solution When you install Deployment Solution on Symantec Management Platform, the Deployment Solution components get integrated with Symantec Management Platform. The Deployment Solution leverages the platform capabilities to execute and schedule tasks, jobs, and policies, and set up site servers, use filters, and generate reports. The components of Deployment Solution help you manage the client computers in your environment.

74 74 Planning for IT Management Suite Components of Deployment Solution Table 3-10 Component Deployment Solution components Description Deployment Plug-in The Deployment Plug-in is installed on client computers to manage deployment tasks. This plug-in enables you to create and deploy disk images, perform remote OS installation, change your system settings, and migrate the personality settings. The Deployment Plug-in replaces the former Deployment Solution 6.X agents, such as AClient, DAgent, or ADLAgent. If you need them, AClient and DAgent can coexist with the Deployment Plug-in. You can enable the Symantec firewall on the client computer and enable the Windows firewall on Notification Server. However, to install the Deployment Plug-in by pushing it to computers, you need to disable one of these firewalls. See Installing Deployment Plug-in on page 174.

75 Planning for IT Management Suite Components of Deployment Solution 75 Table 3-10 Component Deployment Solution components (continued) Description Deployment site server component Deployment site server components let you offload some of the traffic and workload from your primary Symantec Management Platform. You can set up multiple task servers and Deployment site server components to handle your jobs and tasks. Symantec Management Agent then uses the assigned Deployment site server components for all deployment processes. These processes include imaging, scripted OS installation, Copy file, and the tasks that are associated with packages. See Installing Deployment site server components on page 176. Deployment site server components can be installed on the site servers that are configured with both Package Services and Task Services. For more information, search for task server topics in the Symantec Management Platform Help. The components also include all of the tools that Deployment Solution needs. These tools include RapiDeploy, Ghost, and Boot Disk Creator. A Deployment share is created when the Deployment site server component is installed on a site server. The Deployment share is the location where all the tools, such as Ghost and RapiDeploy, other utilities, and images that are created are stored. The site server components also include the PXE service.

76 76 Planning for IT Management Suite Components of Deployment Solution Table 3-10 Component Automation folder Deployment Solution components (continued) Description Automation folder stores the preboot environment. With the help of the preboot environment (WinPE and Linux PE) the client computers are rebooted to the automation environment. The PXE server and automation folder can be used to reboot the client computer to the automation environment to perform deployment tasks. See Installing an automation folder on page 175. The preboot environment (WinPE) contains the Boot.wim file. This file is used to execute Deployment tasks. To reboot the client computer to an automation environment, the DNS should be configured on the network. Also, all computers in the network should be able to perform a Name Server Lookup. WinPE 2.1 and Linux are the only automation operating systems that Deployment Solution supports. Both preboot operating systems are installed with Deployment Solution. PXE server The PXE server can be configured on Symantec Management Platform and the site server. This configuration helps to reboot the client computers to WinPE and Linux PE environments using the network interface.

77 Planning for IT Management Suite Components of Deployment Solution 77 Table 3-10 Component Imaging tools Boot Disk Creator Deployment Solution components (continued) Description RapiDeploy: RapiDeploy is a disk imaging tool that runs on the Windows (x86, x64, ia64) and Linux (x86, x64, ia64) operating systems. It supports NTFS, FAT (12, 16, 32), EXT2/3, and RAW file system. It also supports HTTP and multicast imaging options. Ghost: Ghost is a disk imaging tool that can also be used for creating backup disk images and disk partitions. It supports hardware-independent disk imaging for Windows only. These images can be deployed to diverse client computers by using drivers from a centrally managed driver database. Boot Disk Creator creates a boot disk using Windows and Linux preboot environment. Boot Disk Creator is run on the client computer to boot it in WinPE or LinuxPE. It can also create a bootable CD or USB. Resource Import Tool The Resource Import tool is used for importing existing Windows and Linux images. It is also used for adding Windows-scripted OS installation files. Driver Manager Driver Manager provides the interface to perform driver operations such as adding and deleting data from the DeployAnywhere driver database and the Boot Disk Creator driver database. DeployAnywhere Deploy Anywhere enables you to deploy the Windows operating system image to dissimilar hardware. It also enables you to perform a Windows-scripted installation on bare metal hardware.

78 78 Planning for IT Management Suite Components of Deployment Solution How capturing master disk images works You capture a master disk image of a managed computer with Deployment Solution in the Symantec Management Console. You do this task by creating a disk imaging task. When you create the disk imaging task, you should use a meaningful name to identify the disk image. When you later select the disk image to deploy, you must rely entirely on the image name to locate it. See About Deployment Solution on page 40. The master image of the computer can already contain the Symantec Management Agent. Adding the agent to the image eliminates the need to roll out new agents every time a computer is deployed or reimaged. When you restore the image, the Symantec Management Agent in the image attempts to connect to the same Notification Server computer as the source computer. To force the agent to connect to a new Notification Server computer, you must include a run-script task in the deployment job. The run-script task runs in the preboot environment and reconfigures the agent with the location of the correct Notification Server computer. If you have multiple Notification Server computers in your environment, it may be easier to create a separate deployment job for each Notification Server computer. The disk image is captured and stored on its assigned package server. The disk imaging task creates a disk image package, and then creates a resource object for the package in the CMDB. You leverage the relationship between the image file and its resource in the database. The relationship lets you create, manage, and deploy all of your disk images from the console. Use a dedicated package server to store and host your master disk images. A dedicated server addresses growth issues because each image is uniquely identified, and images do not overwrite each other. Every time you capture an image, a new package is created that is not related to any earlier versions. You should not manually delete any master disk images from the package server because it creates orphaned resources in the CMDB. Table 3-11 Sequence One Two Three Sequence for capturing a master disk image Description The administrator uses the Symantec Management Console to create a master disk image of a managed computer. The administrator stores the disk image package on a dedicated deployment site server. Notification Server creates a resource object for the disk image package in the CMDB.

79 Planning for IT Management Suite Components of Deployment Solution 79 Figure 3-5 Sequence for capturing a master disk image How deploying disk images works A deployment site server is a package server; it must include the package services. Site management, package settings, and package servers all determine how your disk images are distributed to the package servers. By default, package servers check for updates every 15 minutes. See About Deployment Solution on page 40. You must use site management to select one of the following global package distribution settings: Wait for a managed computer to request a specific package (default) This method is called manual pre-staging. When a managed computer gets a policy or task that requires a package, it then requests its package information. Site management distributes the package to the applicable package server(s) only. Tasks can track the availability of the package and know when the package is available on the package server execution. Copy to all package servers This method copies your packages to all of the package servers in your production environment. Copy to specific package servers This method copies your packages only to the servers that you define. You can create a custom distribution setting for specific packages.