VMware AirWatch Advanced Remote Management Guide Installing, configuring, and using the Remote Management Service v4.1

Transcription

1 VMware AirWatch Advanced Remote Management Guide Installing, configuring, and using the Remote Management Service v4.1 AirWatch v9.1 Have documentation feedback? Submit a Documentation Feedback support ticket using the Support Wizard on support.air-watch.com. This product is protected by copyright and intellectual property laws in the United States and other countries as well as by international treaties. VMware products are covered by one or more patents listed at VMware is a registered trademark or trademark of VMware, Inc. in the United States and other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. 1

2 Table of Contents Chapter 1: Overview 3 Introduction to Remote Management v4.1 4 Remote Management v4.1 Components 4 Remote Management v4.1 Supported Platforms 5 Remote Management v4.1 Requirements 5 Typical Deployment of the Remote Management v4.1 Server 12 Chapter 2: Remote Management Service Configuration and Installation 13 Remote Management v4.1 on-premises Installation Overview 14 Generate the Remote Management v4.1 Certificates 14 Create the Common Name from the AirWatch Database 15 Configure the Remote Management Installer 16 Install the Remote Management Server Components 18 Configure the AirWatch Console 20 Chapter 3: Remote Management v Start a Remote Management v4.1 Connection 23 Remote Management v4.1 Client Tools 23 Remote Management Server Installation PowerShell Scripts 25 Accessing Other Documents 30 2

3 Chapter 1: Overview Introduction to Remote Management v4.1 4 Remote Management v4.1 Components 4 Remote Management v4.1 Supported Platforms 5 Remote Management v4.1 Requirements 5 Typical Deployment of the Remote Management v4.1 Server 12 3

4 Chapter 1: Overview Introduction to Remote Management v4.1 Remote Management v4.1 allows you to connect to end-user devices remotely to aid in troubleshooting and maintenance. Remote Management v4.1 is a premium upgrade that uses a new remote management client with enhanced functionality. The Remote Management v4.1 client also has additional support tools and device information available. The combination of remote control and information allows you to troubleshoot any issues on devices quickly and accurately. Remote Management v4.1 is already configured for SaaS customers who have purchased the upgrade. Remote Management v4.1 requires devices to have the AirWatch Agent and the Remote Management client installed. Remote Management v4.1 Components Remote Management v4.1 uses multiple components to facilitate the communication between admins and end-user devices. The core components are as follows. Database The database handles system and tenant configuration, operations, and logging such as the accrual of historical device enrollment data. Portal Services The Portal Services component handles the administrative and management services for Remote Management v4.1. The Management Website is installed as part of the portal services component. T10 Interface The T10 interface is the part of the Management website under Portal Services that defines an integration portal between AirWatch and the Remote Management server. The T10 interface uses Representational State Transfer (REST) communication with a JavaScript Object Notation (JSON) payload. The T10 interface allows AirWatch to make a mobile device eligibility call. The T10 interface can also start a remote support session using the Remote Management tool and delete the device from the Remote Management system. Core Services The Core Services component provides service discovery and auxiliary services for the Remote Management solution through Web services and Windows services. Connection Proctor The Connection Proctor component uses the Windows Connection Proctor service to manage device connections to the Remote Management server. The component also simultaneously handles multiple requests for sessions. 4

5 Chapter 1: Overview Remote Management v4.1 Supported Platforms Remote Management v4.1 supports Windows Rugged and Android devices running the proper AirWatch Agent and Remote Management service. Remote Management v4.1 supports the following platforms. Windows Mobile/CE running.net 2.0+ with the AirWatch Agent v installed. Android devices with the AirWatch Agent v7.0 installed. You must also download the required Remote Management CAB or APK from Accessing Other Documents on page 30. Remote Management v4.1 Requirements You must meet the listed requirements before using Remote Management v4.1. General Requirements For SaaS customers, the general requirements are the only requirements that must be met. The Remote Management v4.1 requires the following on the admin side. Requirements Supported Browsers AirWatch version Minimum Latest version of Google Chrome, Safari, Internet Explorer, or Edge. AirWatch v with the AirWatch Rugged EMM Bundle. Ensure that your version of AirWatch includes these features by contacting your account representative. Active Directory Requirements Remote Management v4.1 requires specific Active Directory users and groups. Requirement AD Group Description Create an Active Directory group. Consider naming this group RMAdminGroup. 5

6 Chapter 1: Overview Requirement Description Portal Admin User Create a user with the following settings. First name: Portal. Last name: Admin. Full name: PortalAdmin. User login name: PortalAdmin. Create a password that the user cannot change and which does not expire. Add this user to the RMAdminGroup. T10 Interface User Create a user with the following settings. First name: T10. Last name: User. Full name: T10User. User login name: T10User. User the same password as PortalAdmin. Hardware Requirements Hardware CPUs Memory Hard Drive IOPS Hard Drive Space Hard Drive Space Minimum Remote Management Server 2.4 GHz Processors, 4 Logical Processors, 2 CPU 2 Core 2x2 or 4 Physical depending on machine type VM vs Physical. 16 GB 15,000 SAS minimum 100 GB for OS drive Remote Management Database 200 GB for databases 200 GB for backups and logs Remote Device Maximum Given a single server deployment with the above minimum specifications, the maximum number of concurrent remote device sessions is

7 Chapter 1: Overview Software Requirements Ensure that you meet the following on-premises installation requirements. To ensure proper configuration of the roles and features, use the Remote Management installation PowerShell scripts. For more information, see Remote Management Server Installation PowerShell Scripts on page 25. Requirements Operating System Microsoft Windows 2012 R2. Software Microsoft.NET Framework 4.5. Remote Management Server Microsoft Report Viewer 2012 Redistributable Package. Server Roles Application Server. Web Server IIS. To ensure proper configuration of the roles and features, use the Remote Management installation PowerShell scripts. For more information, see Remote Management Server Installation PowerShell Scripts on page 25. 7

8 Chapter 1: Overview Requirements Features.NET Framework 3.5 Features. o.net Framework 3.5 (includes.net 2.0 and 3.0). o o o HTTP Activation. Non-HTTP Activation. IIS Management Console..NET Framework 4.5 Features. o.net Framework 4.5. o ASP.NET 4.5. o WCF Services. HTTP Activation. Message Queuing (MSMQ) Activation. Named Pipe Activation. TCP Activation. TCP Port Sharing. Message Queuing Services. Windows Process Activation Service. o Process Model. o.net Environment 3.5. o Configuration APIs. Operating System Microsoft Windows 2012 R2. MS SQL Server 2012 Standard. Remote Management Database MS SQL Management Studio Microsoft.Net Framework Microsoft SQL Server Management Objects (SMO) DLL. Microsoft Report Viewer 2010 Redistributable Package. Server Roles Bulkadmin. Dbcreator. 8

9 Chapter 1: Overview Requirements User Mapping Dbowner. Dbbackupoperator. SQLAgent dependent. servergroup dependent. Network Requirements Source Component Destination Component Protocol Port AirWatch Console Remote Management Server TCP 443 or 8446 End-User Devices Remote Management Server TCP 443 or 8446 Console User Remote Management Server TCP 443 or 8446 Remote Management Server Remote Management Database TCP 1433 Remote Management Server Active Directory TCP 389/53 9

10 Chapter 1: Overview Domain Name Service The Remote Management server requires a forward lookup zone and three DNS records within the forward lookup zone. These records enable devices to communicate properly with the components within the Remote Management server. The forward lookup zone, the host record, and service records all must point to the Remote Management server. Consider using the PowerShell Script for creating controlplane Forward Lookup Zone. For more information, see Remote Management Server Installation PowerShell Scripts on page 25. Requirement Forward Lookup Zone Description Create a forward lookup zone that points to your Remote Management server. The forward lookup zone must be named. controlplane.aetherpal.internal Host Record Create a host record in your DNS that points to your Remote Management Server. The host record must be named admin. Service Coordinator Service Records Create a service record for the Service Coordinator. Record type: SRV. Domain: Enter the forward lookup zone of your Remote Management server. Service: _svc. Protocol: _tcp. Priority: 0. Weight: 0. Port number: Host Offering this service: Enter your Remote Management server hostname. Data Tier Proxy Service Record Record type: SRV. Domain: Enter the forward lookup zone of your Remote Management server. Service: _dtp. Protocol: _tcp. Priority: 0. Weight: 0. Port number: Host Offering this service: Enter your Remote Management server hostname. 10

11 Chapter 1: Overview Security Certificates Requirements To deploy the Remote Management tool and make it work alongside AirWatch, you need multiple SSL certificates installed on the Remote Management server. Site Certificate The site certificate secures HTTPS binding for the management website for port 443 and allows a secure connection. This secure connection is between the admin and Web services. Also, the site certificate secures the connection to the Connection Proctor on port The customer provides the site certificate as a wildcard certificate. You must use a PFX file containing the public/private key and certificate chain during installation. Enrollment Certificate The enrollment certificate is an SSL certificate that enables remote management devices to enroll or register with the Remote Management server. The enrollment certificate also secures the connection to the server. AirWatch provides the certificate in a PFX file containing the private and public key and the certificate chain. T10 Interface Certificate The T10 interface certificate contains two major certificates that enable AirWatch to communicate with the T10 portal. These major certificates are the Root certificate and the AirWatch portal intermediate certificate in a p7b file. You must install these certificates on the Remote Management server in the appropriate certificate authorities. 11

12 Chapter 1: Overview Typical Deployment of the Remote Management v4.1 Server Most users typically deploy the Remote Management v4.1 server in an enterprise network to facilitate the communication between the various components. This sample diagram is a typical deployment. 1. Queue RM Command 2. Queuing Command to Connect to RMS 3. Confirm Command 4. Create Remote Management Session 5. Send Session URL 6. Request Remote Management Session URL 7. Admin Joins Remote Management Session 8. Device Joins Remote Management Session 9. Send Commands/Get Frames 12

13 Chapter 2: Remote Management Service Configuration and Installation Remote Management v4.1 on-premises Installation Overview 14 Generate the Remote Management v4.1 Certificates 14 Create the Common Name from the AirWatch Database 15 Configure the Remote Management Installer 16 Install the Remote Management Server Components 18 Configure the AirWatch Console 20 13

14 Chapter 2: Remote Management Service Configuration and Installation Remote Management v4.1 on-premises Installation Overview On-premises customers must run the Remote Management installer on a server to use Remote Management v4.1. After installation, you must configure AirWatch to communicate with the new Remote Management server. The Remote Management installer works in two parts, the Configure portion and the Install portion. The Configure part creates an install.config file that contains the configuration settings for the different components of the Remote Management v4.1 server. The Install portion uses the install.config file to install the components onto the server. Before running the installer, you must configure the database server and the server that hosts the Remote Management components. This configuration includes setting up an Active Directory group for Remote Management. To facilitate configuration, consider running the PowerShell scripts. For more information, see Remote Management Server Installation PowerShell Scripts on page 25. After running the installer, you must configure AirWatch to communicate with the server. This process includes configuring the AirWatch tenant and configuring the T10 interface website. SaaS customers do not need to install a Remote Management server. Generate the Remote Management v4.1 Certificates As part of deploying the Remote Management v4.1 server, generate the root and intermediate certificates used during installation. Prerequisites Download the Remote Management v4.1 Certificate Generator. Gather the Common Name for the certificates. o Run a SQL script against the AirWatch Database to get the CN. For more information, see Create the Common Name from the AirWatch Database on page 15. Procedure 1. Open the Remote Management v4.1 Certificate Generator. Be certain to use the correct version of the tool according to the version of AirWatch you are using. AirWatch Version Pre 9.2 Certificate Generator Tool Version RemoteManagementCertificateGenerator_Before_9_2 9.2 and above RemoteManagementCertificateGenerator_9_2 2. Set the following values. Setting Certificate Type Deployment Certificate Common Name Value Remote Management. On-premises. Paste the Certificate Common Name. 3. Select Generate Certificates. 14

15 Chapter 2: Remote Management Service Configuration and Installation 4. Navigate to the folder on your device holding the Remote Management v4.1 Certificate Generator. Find the generated certificates in the Artifacts\public folder. 5. In the Artifacts folder, find the "Certificate Seed Script.sql". Run this script against the AirWatch Database to seed the generated certificates into the AirWatch database. 6. Install the certificates onto the Remote Management server into the appropriate certificate stores. a. Add the file named "root_cert.cer" to the Root cert store. b. Add the file named "intermediate_cert.cer" to the Intermediate cert store. 7. Switch to the Cert Store and find the file you just added called "intermediate_cert.cer" 8. Right click the "intermediate_cert.cer" file and select Export. Now choose P7B as the export type. 9. This P7B file is needed for when you Configure the Remote Management Installer on page 16. Create the Common Name from the AirWatch Database You must run an SQL script against the AirWatch Database to create the Common Name. Use the generated CN to create the root and intermediate certificates for Remote Management v4.1. Prerequisites Download the Remote Management v4.1 Certificate Generator. Procedure To create the Common Name. 1. Open the Remote Management v4.1 Certificate Generator. 2. Select the Question Mark button. 3. Copy the displayed text. This text is the SQL script to run against the AirWatch Database. 4. On the AirWatch Database server, open SQL Server Management Studio. 5. Create a query with the copied text. 6. On the fist line of the query, replace the NULL value with the GroupID for the customer type OG that you want to use. The OG you choose must be a customer type, it cannot be of any other type including global, partner, container, and so on. For example, NVARCHAR(20) = NULL; becomes 15

16 Chapter 2: Remote Management Service Configuration and Installation NVARCHAR(20) = 'RemoteManagement'; 7. In the Results, copy the created Common Name. The Common Name is used to generate the root and intermediate certificates for Remote Management v4.1. For more information, see Generate the Remote Management v4.1 Certificates on page 14. Configure the Remote Management Installer The Remote Management v4.1 installer requires configuring the installer settings before starting installation. The configuration file allows you to save the configuration for use with multiple servers. Prerequisites Install the proper certificates onto the server. For more information on the certificates, see Remote Management v4.1 Requirements on page 5. Install the Site certificate to secure HTTPS binding for the server. Install the AirWatch portal certificate onto the server. Install the root certificate into the Root Trusted Certificate Authorities store and the intermediate certificate into the Intermediate Trusted Certificates store. For information on generating the certificates, see Generate the Remote Management v4.1 Certificates on page 14. Install the Enrollment certificate onto the server. Install the root certificate into the Root Trusted Certificate Authorities store. Next, install the intermediate certificate into the Intermediate Trusted Certificates store. Then install the client certificate into the Personal store. Procedure Configure the installer. 1. On the database server, extract the contents of the installer ZIP file into C:\temp. Important: Extract all contents from the ZIP file into c:\temp. Do not move the files around inside the temp folder as the installer needs all the files in their extracted locations. Do not rename or move the temp folder. 2. Start the installer. 3. Select Next. 4. Select Configure to configure the server settings before installation. 5. Enter the Database credentials. Setting Database Server Name Description Enter the server hostname, IP address, or loopback address (as it is a single server). 16

17 Chapter 2: Remote Management Service Configuration and Installation Setting DB Owner user name DB Application user name Description Enter the user name of the internal Remote Management Database user that the installation automatically creates in the database. Enter the user name of the internal Remote Management Database user that the installation automatically creates in the database. 6. (Optional) Select the Advanced button to configure the Port, LDF, MDF, and NDF paths for the database. 7. Select Next. 8. Configure the Portal Server settings. Setting IP Address Description Enter the IP address for the webserver. Port Enter the port. The default is 80. Enable HTTPS Binding Domain Name Group User name Enrollment Certificate Select Next. Webserver Select Check to validate the port. If you leave the IIS Default website bound to port 80, you must either remove the Default website or use a different port. This setting is required. The port defaults to 443. Enter your Active Directory domain name. Active Directory Enter the Active Directory group created for remote management. Enter the Active Directory user name created for remote management. Enrollment Certificate Select the... Button to browse for the AirWatch enrollment certificate. When you select the certificate, the installer asks for the certificate password. After entering the password and selecting OK, if the Enrollment Certificate setting remains empty, the password did not validate. Select the certificate again and reenter the password. 9. Configure the App Service settings, including: Setting Enable T10 Service Description Select to enable the T10 service. 17

18 Chapter 2: Remote Management Service Configuration and Installation Setting T10 Certificate Auto generate a user in Local Users and Groups Description Browse for the T10 certificate by selecting the... Button. Consider using a P7B format for this certificate. The P7B format includes the whole certificate chain and does not require a password to install. The P7B format also places the Root and Intermediate certificates into the correct certificate stores automatically. Create a user for the T10 service in the machine's Local Users and Groups. 10. Select Finish. After selecting Finish, the installer creates the install.config file. This file contains all the configuration settings for the Remote Management v4.1 installer. You can skip the configuration step when installing on multiple Remote Management v4.1 servers by exporting this file to other systems. Next, start the Install portion of the installer. For more information, see Install the Remote Management Server Components on page 18. Install the Remote Management Server Components After running the Configure portion of the Remote Management v4.1 installer, run the Install portion to install the components. Prerequisites Copy the install.config file created during the Configuration portion of the Remote Management v4.1 onto the server hosting the Remote Management v4.1 components. For more information, see Configure the Remote Management Installer on page 16. Procedure 1. On the server, extract the contents of the installer ZIP file into C:\temp. Important: Extract all contents from the ZIP file into c:\temp. Do not move the files around inside the temp folder as the installer needs all the files in their extracted locations. Do not rename or move the temp folder. 2. Start the installer. 3. Select Next. 4. Select Install. 5. Select the components you want to install on the server. For example, if you are installing the Database component on a separate server, select only Database when selecting components. Install the following components on the same server. 18

19 Chapter 2: Remote Management Service Configuration and Installation Core Services Portal Services Application Services Connection Proctor 6. Select Next. 7. If you are installing the database component, configure the Database Credentials settings. Setting Server Name Authentication User name Password Database Owner Password Database User Password Description Enter the Database server hostname. SQL Database Select the database account authentication. The authentication can be either Windows Authentication or SQL Authentication. Enter the user name of the database account. This user name is used by the installer to automatically create all the databases required to install Remote Management. Enter the password of the database account. Application Access Set the password for the Remote Management database owner SQL account. This account does not have system-wide permissions. The account only has permissions within the Remote Management databases. Set the password for the Remote Management database user SQL account. This account does not have system-wide permissions. The account only has permissions within the Remote Management databases. 8. Select Next. 9. If you are installing the remaining components, configure the Authentication Credentials. Setting Enrollment Certificate Password User name Password Description Enrollment Certificate Details Enter the password for the enrollment certificate added during the Configuration portion. Active Directory Authentication Enter the Active Directory user name. Enter the Active Directory password. 10. Select Next. 11. If you are installing the remaining components, configure the Portal Credentials. 19

20 Chapter 2: Remote Management Service Configuration and Installation Setting SSL Certificate 12. Select Next. Description Select the... Button to browse for the Site certificate installed before starting the Configuration portion. For more information, see Remote Management v4.1 Requirements on page If you are installing the remaining components, configure the Connection Proctor Credentials. Setting CP Binding (Local) Description This setting is auto-populated. Port This setting is a verification which you can use to check for port CP FQDN Enter the server fully qualified domain name. For example, "<hostname>" Port Enter the actual port number used for the Connection Proctor component. Consider using CP certificate 14. Select Next. Select the... Button to browse for the Site certificate installed before starting the Configuration portion. For more information, see Remote Management v4.1 Requirements on page 5. This certificate is the same one used on the Authentication Credentials screen in the previous step. 15. Select OK to confirm that you have opened the firewall ports. 16. After installation completes, select Close. After completing installation, configure the AirWatch Console to communicate with the Remote Management v4.1 server. For more information, see Configure the AirWatch Console on page 20. Configure the AirWatch Console After installing the Remote Management v4.1 server and all its components, configure the AirWatch Console to communicate with the Remote Management v4.1 server. To configure the AirWatch Console. 1. In the AirWatch Console, ensure that you are in the Global OG. 2. Navigate to Settings > System > Advanced > Site URLs > External Remote Management. 20

21 Chapter 2: Remote Management Service Configuration and Installation 3. Complete the Remote Management settings. Settings Console Connection Hostname Description Enter your Remote Management server hostname plus "/t10" For example. Device Connection Name Enter the Remote Management server fully qualified domain name. For example, " 4. Select Save. The Remote Management server is now ready to handle remote management sessions with end-user devices. 21

22 Chapter 3: Remote Management v4.1 Start a Remote Management v4.1 Connection 23 Remote Management v4.1 Client Tools 23 Remote Management Server Installation PowerShell Scripts25 22

23 Chapter 3: Remote Management v4.1 Start a Remote Management v4.1 Connection Connect to devices for troubleshooting and maintenance using the Remote Management v4.1 connection tool. This tool starts a remote management session and controls the connection to the remote device. To start a Remote Management v4.1 connection. 1. Navigate to Details View for the device you want to create a remote connection with. Select the More Actions dropdown menu and select Remote Management. 2. In the Remote Support window, select Launch Session after the connection process completes. After selecting Launch Session, a new tab opens and the connection steps display. Once the connection is made, the remote management client opens and the device is ready for use. Remote Management v4.1 Client Tools The Remote Management client provides support tools to facilitate troubleshooting and remotely controlling end-user devices. The tools are located around the device view. Watch a tutorial video on the Remote Management v4.1 client tools: Remote Management v4.1 does not have the same functionality as Remote Management v3.0. The following features are not currently available in Remote Management v4.1. Registry Manager Macros during the session. Remote Control The main section of the Remote Management client is a device screen view that allows you to control the end-user device remotely. 23

24 Chapter 3: Remote Management v4.1 Control the device by clicking or dragging on the displayed screen and buttons. You can send keystrokes to the device and copy and paste information onto the device during a session. If a user needs privacy, they can pause a remote control session. Device Whiteboard (Android Only) The device whiteboard functionality allows you to highlight a specific item to the user. The whiteboard allows you to draw, highlight, and point to areas on the screen. To use the whiteboard, select the whiteboard icon ( The whiteboard menu consists of the following items. ) in the bottom right of the device screen view. Shortcuts The Remote Management client provides a shortcuts menu to navigate quickly to a screen or menu item on the device. 24

25 Chapter 3: Remote Management v4.1 The shortcuts icon is on the bottom right, near the whiteboard icon. Navigate to that screen by selecting an item from the shortcuts menu. Device Summary The Remote Management client provides a device summary of information similar to Device Details. Use this information to diagnose issues on a device while connected without navigating away from the Remote Management client. The Device Summary pane provides at-a-glance information to use during troubleshooting. The pane displays signal strength, battery, network status, storage, and main memory information. Display additional information not displayed in the information by selecting the Additional Information ( ) icon. Detailed Device Information The Additional Information screen provides detailed information on the device, applications, processes, and remote control history. Select each information list from the left navigation bar. The Device information displays Device make and model, battery details, storage, connection, RAM, and more. Minimize the pane and manage which panes are visible by clicking each device details section header. You may also search for specific information with the search bar in the top right corner. The application list provides a list of applications installed on the device and application details such as the version number and package name. You can kill any running app from this list. The process list displays the current processes running on the device and detailed information. You can kill any running process from this list. Remote Management Server Installation PowerShell Scripts Simplify the installation of the Remote Management server with PowerShell scripts designed to provide shortcuts in the process. These scripts gather information or create settings on the server. PowerShell Commands for enabling PowerShell script execution on the local machine Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force Set-ExecutionPolicy Unrestricted -Scope LocalMachine -Force Set-ExecutionPolicy Unrestricted -Scope Process -Force 25

26 Chapter 3: Remote Management v4.1 PowerShell Script for Application and Web Server Roles and Features Install Features Install-WindowsFeature AD-Domain-Services, DNS, Application-Server, AS-NET-Framework, AS-TCP-Port- Sharing, AS-Web-Support, AS-WAS-Support, AS-HTTP-Activation, AS-MSMQ-Activation, AS-TCP-Activation, FileAndStorage-Services, File-Services, FS-FileServer, Storage-Services, Web-Server, Web-WebServer, Web-Common-Http, Web-Default-Doc, Web-Dir-Browsing, Web-Http-Errors, Web-Static-Content, Web-Http- Redirect, Web-DAV-Publishing, Web-Health, Web-Http-Logging, Web-Custom-Logging, Web-Log-Libraries, Web-ODBC-Logging, Web-Request-Monitor, Web-Performance, Web-Stat-Compression, Web-Dyn-Compression, Web-Security, Web-Filtering, Web-Basic-Auth, Web-CertProvider, Web-Client-Auth, Web-Digest-Auth, Web-Cert-Auth, Web-IP-Security, Web-Url-Auth, Web-Windows-Auth, Web-App-Dev, Web-Net-Ext45, Web- AppInit, Web-ASP, Web-Asp-Net45, Web-CGI, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Mgmt-Tools, Web-Mgmt- Console, Web-Scripting-Tools Install-WindowsFeature NET-Framework-Features, NET-Framework-Core, NET-Framework-45-Features, NET- Framework-45-Core, NET-Framework-45-ASPNET, NET-WCF-Services45, NET-WCF-HTTP-Activation45, NET-WCF- MSMQ-Activation45, NET-WCF-Pipe-Activation45, NET-WCF-TCP-Activation45, NET-WCF-TCP-PortSharing45, GPMC, MSMQ, MSMQ-Services, MSMQ-Server, RSAT, RSAT-Role-Tools, RSAT-AD-Tools, RSAT-AD-PowerShell, RSAT-ADDS, RSAT-AD-AdminCenter, RSAT-ADDS-Tools, RSAT-DNS-Server, FS-SMB1, Telnet-Client, User- Interfaces-Infra, Server-Gui-Mgmt-Infra, Desktop-Experience, Server-Gui-Shell, PowerShellRoot, PowerShell, PowerShell-V2, PowerShell-ISE, WAS, WAS-Process-Model, WAS-Config-APIs, WoW64-Support 26

27 Chapter 3: Remote Management v4.1 Remove Features Remove-WindowsFeature AD-Domain-Services, DNS, Application-Server, AS-NET-Framework, AS-TCP-Port- Sharing, AS-Web-Support, AS-WAS-Support, AS-HTTP-Activation, AS-MSMQ-Activation, AS-TCP-Activation, FileAndStorage-Services, File-Services, FS-FileServer, Storage-Services, Web-Server, Web-WebServer, Web-Common-Http, Web-Default-Doc, Web-Dir-Browsing, Web-Http-Errors, Web-Static-Content, Web-Http- Redirect, Web-DAV-Publishing, Web-Health, Web-Http-Logging, Web-Custom-Logging, Web-Log-Libraries, Web-ODBC-Logging, Web-Request-Monitor, Web-Performance, Web-Stat-Compression, Web-Dyn-Compression, Web-Security, Web-Filtering, Web-Basic-Auth, Web-CertProvider, Web-Client-Auth, Web-Digest-Auth, Web-Cert-Auth, Web-IP-Security, Web-Url-Auth, Web-Windows-Auth, Web-App-Dev, Web-Net-Ext45, Web- AppInit, Web-ASP, Web-Asp-Net45, Web-CGI, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Mgmt-Tools, Web-Mgmt- Console, Web-Scripting-Tools Remove-WindowsFeature NET-Framework-Features, NET-Framework-Core, NET-Framework-45-Features, NET- Framework-45-Core, NET-Framework-45-ASPNET, NET-WCF-Services45, NET-WCF-HTTP-Activation45, NET-WCF- MSMQ-Activation45, NET-WCF-Pipe-Activation45, NET-WCF-TCP-Activation45, NET-WCF-TCP-PortSharing45, GPMC, MSMQ, MSMQ-Services, MSMQ-Server, RSAT, RSAT-Role-Tools, RSAT-AD-Tools, RSAT-AD-PowerShell, RSAT-ADDS, RSAT-AD-AdminCenter, RSAT-ADDS-Tools, RSAT-DNS-Server, FS-SMB1, Telnet-Client, User- Interfaces-Infra, Server-Gui-Mgmt-Infra, Desktop-Experience, Server-Gui-Shell, WAS, WAS-Process- Model, WAS-Config-APIs, WoW64-Support 27

28 Chapter 3: Remote Management v4.1 PowerShell Script for creating Active Directory Objects Import-Module ActiveDirectory $DomainName = Get-ADDomain Select Forest -ExpandProperty Forest $GroupName = "RMAdminGroup" $PUDN = "Portal Admin" $PUFN = "Portal" $PULN = "Admin" $PUSAM = "PortalAdmin" $PUUPN = $PUSAM + "@" + $DomainName Write-Host "Enter Password for Portal Admin User: " -ForegroundColor White -BackgroundColor Black "`n" $PUPassword1 = Read-Host -AsSecureString New-ADGroup -Name $GroupName -SamAccountName $GroupName -GroupCategory Security -GroupScope Global - DisplayName $GroupName New-ADUser -Name $PUDN -AccountPassword $PUPassword1 -DisplayName $PUDN -Enabled $True -GivenName $PUFN -Surname $PULN -SamAccountName $PUSAM -PasswordNeverExpires $True -UserPrincipalName $PUUPN Add-ADGroupMember $GroupName $PUSAM 28

29 Chapter 3: Remote Management v4.1 PowerShell Script for creating controlplane Forward Lookup Zone Write-Host "Please select the correct default zone" -ForeGroundColor Yellow -BackGroundColor Black Write-Host "Example: 4" -ForeGroundColor Yellow -BackGroundColor Black $DNSZones = Get-DnsServerZone Select ZoneName -ExpandProperty ZoneName $Count1 = 0 ForEach ($DNSZone in $DNSZones) { $Count1++; Write-Host $Count1")" $DNSZone } $Selection1 = Read-Host $GetRootZone = $DNSZones[$Selection1-1] "`n`n`n" $ARecord = "Admin" $DTPRecord = "_dtp._tcp" $SVCRecord = "_svc._tcp" $Priority = "0" $Weight = "0" $DTPPort = "8865" $SVCPort = "8870" $FLZoneName = "controlplane.aetherpal.internal" $FLZoneName1 = "admin.controlplane.aetherpal.internal" Write-Host "Please enter the IP address of the Admin/Anchor/APP Server." -ForeGroundColor Cyan -BackGroundColor Black Write-Host "If each server is seperate please enter the IP Address of the APP Server" -ForeGroundColor Cyan -BackGroundColor Black Write-Host "Example: " -ForeGroundColor Cyan -BackGroundColor Black $Result4 = Read-Host $DNSServerName = Get-DnsServerSetting Select ComputerName -ExpandProperty ComputerName $FLZoneExist1 = Get-DnsServerZone Where { $_.ZoneName -eq $FLZoneName } Select ZoneName -ExpandProperty ZoneName IF ($FLZoneExist1 -ne $Null) { Add-DnsServerResourceRecordA -Name $ARecord -ZoneName $FLZoneName -AllowUpdateAny -IPv4Address $Result4; Add- DnsServerResourceRecord -Srv -Name $DTPRecord -ZoneName $FLZoneName DomainName $FLZoneName1 Priority $Priority Weight $Weight Port $DTPPort; Add-DnsServerResourceRecord -Srv -Name $SVCRecord -ZoneName $FLZoneName DomainName $FLZoneName1 Priority $Priority Weight $Weight Port $SVCPort } ELSE { Add-DnsServerPrimaryZone -Name $FLZoneName -ReplicationScope "Forest" -PassThru; Add- DnsServerResourceRecordA -Name $ARecord -ZoneName $FLZoneName -AllowUpdateAny -IPv4Address $Result4; Add-DnsServerResourceRecord -Srv -Name $DTPRecord -ZoneName $FLZoneName DomainName $FLZoneName1 Priority $Priority Weight $Weight Port $DTPPort; Add-DnsServerResourceRecord - Srv -Name $SVCRecord -ZoneName $FLZoneName DomainName $FLZoneName1 Priority $Priority Weight $Weight Port $SVCPort } 29

30 Accessing Other Documents Accessing Other Documents While reading this documentation you may encounter references to documents that are not included here. The quickest and easiest way to find a particular document is to navigate to and search for the document you need. Each release-specific document has a link to its PDF copy on AirWatch Resources. Alternatively, you can navigate to AirWatch Resources on myairwatch (resources.air-watch.com) and search. When searching for documentation on Resources, be sure to select your AirWatch version. You can use the filters to sort by PDF file type and AirWatch v