System Administration

Transcription

1 System Administratin ZENwrks Mbile Management 2.6.x January 2013

2 Legal Ntices Nvell, Inc., makes n representatins r warranties with respect t the cntents r use f this dcumentatin, and specifically disclaims any express r implied warranties f merchantability r fitness fr any particular purpse. Further, Nvell, Inc., reserves the right t revise this publicatin and t make changes t its cntent, at any time, withut bligatin t ntify any persn r entity f such revisins r changes. Further, Nvell, Inc., makes n representatins r warranties with respect t any sftware, and specifically disclaims any express r implied warranties f merchantability r fitness fr any particular purpse. Further, Nvell, Inc., reserves the right t make changes t any and all parts f Nvell sftware, at any time, withut any bligatin t ntify any persn r entity f such changes. Any prducts r technical infrmatin prvided under this Agreement may be subject t U.S. exprt cntrls and the trade laws f ther cuntries. Yu agree t cmply with all exprt cntrl regulatins and t btain any required licenses r classificatin t exprt, re-exprt r imprt deliverables. Yu agree nt t exprt r re-exprt t entities n the current U.S. exprt exclusin lists r t any embarged r terrrist cuntries as specified in the U.S. exprt laws. Yu agree t nt use deliverables fr prhibited nuclear, missile, r chemical bilgical weapnry end uses. See the Nvell Internatinal Trade Services Web page ( fr mre infrmatin n exprting Nvell sftware. Nvell assumes n respnsibility fr yur failure t btain any necessary exprt apprvals. Cpyright Nvell, Inc. All rights reserved. N part f this publicatin may be reprduced, phtcpied, stred n a retrieval system, r transmitted withut the express written cnsent f the publisher. Nvell, Inc Suth Nvell Place Prv, UT U.S.A. Online Dcumentatin: T access the latest nline dcumentatin fr this and ther Nvell prducts, see the Nvell Dcumentatin Web page ( Nvell Trademarks Fr Nvell trademarks, see the Nvell Trademark and Service Mark list ( tmlist.html). Third-Party Materials All third-party trademarks are the prperty f their respective wners.

3 Table f Cntents Accessing the Dashbard 4 Organizatin Administratin 5 Updating Organizatin Infrmatin... 5 Signing Certificate Uplad... 6 APNs Certificate Uplad... 6 Organizatin Administratr Rles... 8 Predefined Organizatin Administratr Rles... 8 Custmized Organizatin Administratr Rles... 9 Organizatin Administrative Rles: User Privacy Prtectin Organizatin Administratr Lgins Creating Organizatin Administratr Lgins Managing Organizatin Administratr Lgins Server Lgging 16 Synchrnizatin Lgs Database Task Scheduler Lg Data Usage Lg Device Lgs Errr Chain Lg (ios device specific) Licensing Lg Mail Message Lg System Administratin 26 Managing Multiple Organizatins The Organizatin List License Database Task Scheduler Plug-Ins System Administratr Rles Predefined System Administratr Rles Custmized System Administratr Rles System Administratr Lgins Creating System Administratr Lgins Managing System Administratr Lgins System Grup ing System Settings Custm Dashbard and Lgin Lgs Signing Certificate Uplad Update Management Administratr Audit Trail Appendix A: Rle Permissins 44 Appendix B: System Maintenance 47 ZENwrks Mbile Management 2.6.x System Administratin Guide Accessing the Dashbard 3

4 Accessing the Dashbard Requirements ZENwrks Mbile Management dashbard requirements: Micrsft Internet Explrer r Firefx Adbe Flash Player Minimum screen reslutin: 1024 x 768 Desktp cmputer running Windws OS In yur Web brwser, enter the server address f the ZENwrks Mbile Management server, fllwed by /dashbard Example: Lgin Lg in t the ZENwrks Mbile Management dashbard by using the address and passwrd yu designated as administrative lgin credentials when installing the ZENwrks Mbile Management Web/Http Server Cmpnent. Yu can create additinal lgins t the dashbard with system administratr, rganizatin administratr, r supprt administratr privileges. See the System Administratr Lgins and Organizatin Administratr Lgins sectins in this guide fr details. ZENwrks Mbile Management 2.6.x System Administratin Guide Accessing the Dashbard 4

5 Organizatin Administratin This sectin f the guide dcuments tpics related t managing a single rganizatin. See Managing Multiple Organizatins fr infrmatin regarding management f a ZENwrks Mbile Management server with multiple rganizatins. Updating Organizatin Infrmatin Yu can update the rganizatin infrmatin if administrative cntacts r rganizatin defaults change. Select System > Organizatin and update the fllwing infrmatin: Organizatin name and cntact infrmatin Welcme letter enablement s a welcme letter EULA enablement - when this ptin is enabled, users must accept an End User License Agreement t cmplete ZENwrks Mbile Management app enrllment SMTP server name Signing Certificate Uplad buttn (see descriptin belw) APNs Certificate Uplad buttn (see descriptin belw) Hands-Off enrllment cnfiguratin Default Plicy Suite Default Device Cnnectin Schedule Default (Administrative) LDAP Server Default Liability ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 5

6 Signing Certificate Uplad The signing certificate is a security measure that authenticates the server and allws ios devices t recgnize it as a trusted surce. The signing certificate Uplad buttn allws yu t add a signing certificate fr the rganizatin. This must be a CA signed certificate; because self-signed certificates are currently nt supprted. A Signing Certificate designated here fr the rganizatin verrides the system-wide Signing Certificate defined in System Settings. 1. Select System > System Administratin > Organizatins. 2. Select an rganizatin frm the list and click the Uplad buttn next t the signing certificate field. 3. Click the Brwse buttn, then navigate t and select the file cntaining the certificate. 4. Enter the Private Key assciated with the file and click Uplad. 5. Click Save Changes n the gray ptin bar. APNs Certificate Uplad Apple Push Ntificatin Service (APNs) is a highly secure and efficient service fr prpagating infrmatin t the ios devices in yur envirnment. An APNs certificate applied t the ZENwrks Mbile Management server prvides Apple ios MDM functinality fr ios devices in yur envirnment. Functinality includes: Devices supprt Selective Wipe, Lck Device, and Clear Passcde Full Wipe and Lck Device cmmands are applied immediately Yu can recrd and access installed applicatins n devices Yu can recrd and access installed cnfiguratin prfiles n devices Yu have access t additinal device statistics Cnfiguratin prfile updates require n user interactin The APNs Certificate Uplad buttn allws yu t apply the APNs certificate that yu generated n the Apple Develpment prtal. Yu need: The APNs certificate file (the.pfx frmat) The passwrd yu set when exprting the certificate The APNs certificate settings can be edited if necessary. Hwever, a change t the APNs certificate settings requires ios device users t relad the APN prfile n the device. ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 6

7 T Uplad the APNs Certificate: 1. Select System > Organizatin. 2. Click the Uplad buttn next t the APNs Certificate field. 3. Click the Brwse buttn, then navigate t and select the.pfx file cntaining the APNs certificate. 4. In the Private Key field, enter the passwrd yu set when exprting the certificate. 5. Select the Use Default URLs bx t ppulate the Server URL and Check in URL fields This is the required frmat f the URLs. Verify that the <ServerAddress> is the external address f the ZENwrks Mbile Management server. If yu have nt accessed the Web site externally, d nt use the default check bx. Enter the URLs manually, in the frmat nted abve. 6. Click the Submit buttn. After yu have upladed an APNs certificate, it appears under the APN Certificate field n the dashbard. Nte: The APNs certificate must be renewed annually. Use the Test Nw buttn t check the certificate s validity. The test will return the certificate s activatin and expiratin dates. 7. Click Save Changes when yu are finished. ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 7

8 Organizatin Administratr Rles See als System Administratr Rles Predefined Organizatin Administratr Rles There are three predefined Organizatin Administratr rles. The permissins fr these rles cannt be altered. Yu can view the set permissins fr these rles via the Rle Permissins ptin in the System view: Organizatin Administratin Rles. The three predefined rganizatin administratr rles are: Full Organizatin Admin - Gives full administrative permissins in nly ne rganizatin n the ZENwrks Mbile Management server. The ZENwrks Mbile Management System view n the dashbard is limited t the Organizatin, Organizatin Administratrs, Organizatin Administrative Rles, View Lgs, and Abut ZENwrks menu ptins. Supprt Organizatin Admin Gives limited administrative access r read nly access in nly ne rganizatin n the ZENwrks Mbile Management server. Organizatinal Supprt Administratrs can individual users, but nt grups f users. Restricted Organizatin Admin Restricted frm viewing private data such as Lcatin, MMS/SMS Lg, Phne Lg, and File Archive. Gives Read nly permissins fr all ther views in nly ne rganizatin n the ZENwrks Mbile Management server. Organizatin administratr credentials give access t ne specific rganizatin n the ZENwrks Mbile Management server. Credentials can be authenticated via an LDAP server and can be assigned Full Admin, Supprt Admin (read-nly), r Restricted Admin (limited read-nly) permissins. Wh Shuld Have an Organizatin Administratr Lgin Organizatin Administratr Lgins are ideal fr thse respnsible fr cnfiguring and maintaining a single rganizatin n a system with grups f users that have been divided int separate rganizatins. ORGANIZATION ADMINISTRATOR ROLES Dashbard View Supprt Organizatin Admin Restricted Organizatin Admin Activity Mnitr Users Read-nly access; cannt disable r snze alerts Can add r remve users and perfrm all the functins in the right-hand Details panel, except Shw Recvery Passwrd Can an individual user, but cannt use Grup ing Can perfrm mst functins in the left-hand panel f User Prfile Can view the grids in the Audit Data and Search Text Message Lg ptins (User Prfile), but cannt view the bdy r attachments f a text message Can chse the Visible Clumns Read-nly access; cannt disable r snze alerts Restricted frm adding r remving users and frm all functins in the right Details panel Restricted frm sending an t an individual user r a grup Restricted frm the Lcatin Data, Audit Data, Search Phne Lg, Search Text Message Lg, and File Archive ptins in the left panel f User Prfile Read-nly access t ptins in the left panel f User Prfile Can chse the Visible Clumns fr the Users list ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 8

9 fr the Users list Organizatin Read-nly access Read-nly access Reprting Full access (view and exprt) Full access (view and exprt) System Read-nly access Restricted frm the System Administratin ptin in the left panel Read-nly access Restricted frm the System Administratin ptin in the left panel Custmized Organizatin Administratr Rles Administratrs can create custmized rganizatin administratr rles t tailr the permissins assciated with ZENwrks Mbile Management dashbard lgin credentials. When a custm rle has been created, it appears as a chice in the drp-dwn list f the Add Administratr Wizard s Rle field. See Organizatin Administratr Lgins. Administratrs wh are lgged in when changes are made t rle permissins must lg ut and lg in again fr permissin changes t take effect. Select System > Organizatin Administrative Rles > Rle Permissins > Add Rle 1. Chse a methd fr creating an Organizatin Administrative Rle: Use the sliders t determine the rle s initial settings. The new rle cpies the settings f the predefined Organizatin Full Admin, Supprt Admin, r Restricted Admin. Cpy the settings f an existing rle 2. Specify the rle permissins t cpy. 3. Enter a Rle Name and Descriptin. 4. Click Finish t save the new rle. 5. Find and select the rle in the Organizatin Administrative Rles grid. ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 9

10 6. Set the general permissins fr the rle: Prevent rle frm managing administratr accunts, rles and user privacy prtectins Lcks the rle ut f mdifying administratr accunts, administratr rles, and user privacy prtectin. Mst rles shuld be lcked, except thse fr administratrs requiring full privileges. If set t YES, this permissin verrules the System Sectin Permissins, regardless f hw they are set. Defaults t YES when creating a rle with the sliders. If yu are cpying an existing rle, the setting f the cpied rle is the default. Prevent rle frm viewing prtected data as defined in User Privacy Prtectin Blcks administratrs assigned this rle frm viewing the prtected data f nly the users r plicy suites designated in User Privacy Prtectin. (Autmatically places the rle in the Restricted clumn f the Restrict Organizatin Administrative Rles list. See User Privacy Prtectin.) Defaults t YES when creating a rle with the sliders. If yu are cpying an existing rle, the setting f the cpied rle is the default. 7. Set the permissins assciated with dashbard access. See Appendix A: Rle Permissins fr a cmprehensive list. ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 10

11 Organizatin Administrative Rles: User Privacy Prtectin Private data includes a user s SMS/MMS cntent, lcatin data, phne lgs, and file list. User Privacy Prtectin prvides a way t prtect the private data f individual users r users assigned t a particular plicy suite withut restricting rganizatin administrative rles frm viewing the private data f all users. Example: Yu assign a rle t an administratr with permissins fr viewing private data. Hwever, rganizatin administratrs in this rle must be restricted frm viewing the private data f yur executive staff. Yu can add the executive staff users t the User Privacy Prtectin list and designate the administrative rle as ne that is restricted frm viewing the private data f users n this list. Administratrs wh are lgged in when changes are made t the User Privacy Prtectin list r the Restrict Organizatin Administrative Rles list must lg ut and lg in again fr permissin changes t take effect. ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 11

12 Select System > Organizatin Administrative Rles > User Privacy Prtectin > Add User Privacy Prtectin. Adding Users t the Privacy Prtectin List User Privacy Prtectin prvides a way t prtect the private data f individual users r users assigned t a particular plicy suite. Administrative rles can be blcked frm viewing the private data f users n this list, even if their rle permissins allw them t view private data assciated with the general user base. 1. Select the User r Plicy Suite ptin. An individual user r the grup f users assigned t a Plicy Suite. 2. If yu are adding an individual user t the privacy prtectin list, enter the user s Dmain and User Name. 3. If yu are adding users assigned t a plicy suite, select a plicy suite frm the drp-dwn list. 4. Select the bx beside the Privacy Prtectins yu wish t enable: 5. Click Finish t save. Prtect SMS Prtect MMS Prtect Lcatin Prtect Phne Lgs Prtect File List ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 12

13 Adding Administratr Rles t the Restricted/Nt Restricted List Designate each custmized administrative rle as ne that is Restricted r Nt Restricted frm viewing the private data belnging t users n the User Privacy Prtectin list. All predefined and custmized rles are listed in either the Nt Restricted r Restricted list. The predefined rles cannt be mved frm ne clumn t anther. The predefined Full Admin rle is always Nt Restricted. The predefined Supprt Admin and Restricted Admin rles are always Restricted. 1. Select an administrative rle n either side f the list. (Hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item). 2. Click Add t mve a rle frm Nt Restricted t Restricted. 3. Click Remve t mve a rle frm Restricted t Nt Restricted. 4. Click Save Changes n the ptin bar at the tp f the page. ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 13

14 Organizatin Administratr Lgins See als, System Administratr Lgins Creating Organizatin Administratr Lgins Select System > Organizatin Administratrs > Add Administratr. The Add Administratr Wizard steps yu thrugh creating lgin credentials fr rganizatin administratrs. The Wizard asks fr the fllwing infrmatin: LDAP Server the server with which this user is assciated (ptinal) if yu are creating LDAP authenticatin lgins. (Administratr Lgin and Passwrd fields will be disabled if yu chse this ptin.) Administratr Lgin Enter the administratr s address t be used as a username (if nt using LDAP authenticatin). LDAP Administratr Lgin Enter the administratr s LDAP server user name if using LDAP authenticatin. Display Name Enter the name that will display fr this lgin. address Enter the cntact address f the user. Carrier Carrier f the administratr s mbile device (ptinal - needed fr receiving SMS ntificatins fr system alerts). Phne Number Phne number f the administratr s mbile device (ptinal - needed fr receiving SMS ntificatins fr system alerts). Add t Alert Recipient List Check this bx t make this administratr a recipient f Cmpliance Management r SMS alerts. Passwrd Assign a passwrd if yu are creating a lgin that des nt use LDAP authenticatin. Rle Assign the permissins level t the lgin. Chse frm: ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 14

15 Predefined Full Admin Full administrative permissins fr a single rganizatin; Restricted frm System Administratin Predefined Supprt Admin Read-nly permissins with limited editing capabilities fr a single rganizatin Predefined Restricted Admin Read-nly permissins with private data restrictins fr a single rganizatin; cannt view Lcatin Data, Audit Data, MMS/SMS r Phne Lgs, and File Archive Any custm Organizatin Administratr rle created fr the system Default View Select the default view at lgin System Timeut Select an inactivity timeut in minutes fr this lgin Active Status Select the bx t enable this administrative lgin Managing Organizatin Administratr Lgins Yu must be lgged int the ZENwrks Mbile Management server with Full Admin rganizatin administratr credentials r Full Admin system administratr credentials in rder t edit r remve an Organizatin Administratr. 1. Select System > Organizatin Administratrs. 2. Select an administratr frm the list. Edit the settings and click Save Changes. Yu can als remve the administratr by clicking Remve Administratr. ZENwrks Mbile Management 2.6.x System Administratin Guide Organizatin Administratin 15

16 Server Lgging System level lgs assist administratrs with diagnsing prblems and in understanding the cmmunicatins between devices and the server. Bth server and device lgging ptins are available. Viewing Organizatin and System-Wide Lgs Select the System view and expand the View Lgs ptin in the left panel. Chse ne f the lgs. The fllwing lgs can be selected fr viewing system-wide infrmatin, infrmatin frm ne r mre rganizatins, r infrmatin fr ne r all devices. ActiveSync Lg Allws yu t view events lgged during cnnectins between the ZENwrks Mbile Management server and the ActiveSync server and between the devices ActiveSync client and the ZENwrks Mbile Management server. ios MDM Sync Lg Allws yu t view successful events lgged during cnnectins between the ZENwrks Mbile Management server and the Apple ios MDM server and between the ZENwrks Mbile Management server and the device s ios MDM functins. Unsuccessful events (errrs) are lgged in the Errr Chain Lg. (ios device specific) ZENwrks Sync Lg - Allws yu t view events lgged during cnnectins between the device s ZENwrks Mbile Management app and the ZENwrks Mbile Management server. Data Usage Lg Allws yu t track the amunt f data being exchanged: Between the device s ZENwrks Mbile Management app and the ZENwrks Mbile Management server Between the device s ActiveSync client and the ZENwrks Mbile Management server As ios MDM traffic between the device and the ZENwrks Mbile Management servers Between the ZENwrks Mbile Management and ActiveSync servers. Device Lg Allws yu t view a list f the device lgs that have been previusly requested. T request a new lg, use the user level Device Lg ptin assciated with a user s prfile. Errr Chain Lg Allws yu t view detailed messages fr errrs lgged in the ios MDM Sync lg. (ios device specific) The fllwing lg can be selected fr viewing infrmatin fr ne r mre rganizatins. Mail Message Lg Allws yu t view recrds f grup s sent frm the dashbard. The fllwing lgs nly display system-wide infrmatin. Database Task Scheduler Lg Allws yu t view all database task scheduler tasks that executed successfully r that gave an errr. ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 16

17 Licensing Lg Allws yu t view server license validatins that executed successfully r that gave an errr. Synchrnizatin Lgs Synchrnizatin lgs give administratrs the ability t view events lgged during cnnectins between servers and events lgged during device cnnectins with servers. There are three lgs f this type: The ActiveSync Lg lgs events that ccur during cnnectins between the ZENwrks Mbile Management server and the ActiveSync server and between the devices ActiveSync client and the ZENwrks Mbile Management server. The ios MDM Sync Lg lgs successful events that ccur during cnnectins between the ZENwrks Mbile Management server and the Apple ios MDM server and between the ZENwrks Mbile Management server and the device s ios MDM functins. Unsuccessful events (errrs) are lgged in the Errr Chain Lg. (ios device specific) The ZENwrks Sync Lg lgs events that ccur during cnnectins between the device s ZENwrks Mbile Management app and the ZENwrks Mbile Management server. The lgs display: Organizatin Organizatin name DeviceSAKey A device s internal identifier Lg cde Cde number assciated with the lgged event Descriptin Descriptin assciated with the lg cde Functin Name Displays a returned errr; blank when lg event is successful Details Descriptin r reasn fr the errr; blank when lg event is successful Time stamp Date and time f the lg event Select ActiveSync Lg, ZENwrks Sync Lg, r ios MDM Sync Lg. The Lg Level defaults t Nrmal and the lg ppulates the grid with system-wide data frm the past hur. If yu change the lg level t Verbse, click Search. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the server lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 17

18 Sample Sync Lg Grid ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 18

19 Database Task Scheduler Lg The Database Task Scheduler Lg enables the administratr t view all database cleanup jbs that executed successfully r that gave an errr. The lg displays: Database Task Name Name assigned t the database cleanup task Lg Cde Cde number assciated with the lgged event Descriptin Descriptin assciated with the lg cde Functin Name Displays a returned errr; blank when the lg event is successful Details Descriptin r reasn fr the errr; blank when the lg event is successful Time stamp Date and time a database cleanup jb was executed Select Database Task Scheduler Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by editing the Frm/T filter. Click Search. When yu edit the date/time filter, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the database task scheduler lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 19

20 Data Usage Lg The data usage lg displays the amunt f data being exchanged between the device and servers; and the amunt f data assciated with the device that is prxied t and frm the ActiveSync server. The types f data traffic that are lgged include: Data between the device s ZENwrks Mbile Management app and the ZENwrks Mbile Management server Data between the device s ActiveSync client and the ZENwrks Mbile Management server ios MDM traffic between the device and the ZENwrks Mbile Management servers (ios devices nly) Data between the ZENwrks Mbile Management and ActiveSync servers A summary reprt f data usage statistics is als available in the Reprting sectin. The lg displays: Organizatin Organizatin name DeviceSAKey A device s internal identifier Traffic Type ActiveSync, ios MDM Sync, r ZENwrks Directin Incming r Outging Size (Bytes) Size f the data transferred Time stamp Date and time f the data transfer Select Data Usage Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the data usage lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 20

21 ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 21

22 Device Lgs The Device Lgs ptin at the system level is simply a list f previus requests fr device lgs. The dashbard grid des nt display lg recrds, but gives infrmatin n when lgs were received. Device lgs are available frm any device running the ZENwrks Mbile Management app. The grid displays: Organizatin Organizatin name DeviceSAKey A device s internal identifier Time Requested and Requester Received Whether r nt lg has been received Time Received Date and time a respnse was received Errr Errr message if lg culd nt be btained Select Device Lg. The lg ppulates the grid with system-wide ntificatins f lg receipts frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter t filters the time stamp f the lgs (nt the recrds in the lg) Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. Device Lg Grid Select a lg file and click the Dwnlad Lg buttn. Save the lg file n the desktp r in anther designated flder. The file can be viewed in the.txt frmat. ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 22

23 Errr Chain Lg (ios device specific) The errr chain lg prvides a view f messages detailing errrs lgged in the ios MDM Sync lg. The lg displays: Organizatin Organizatin name DeviceSAKey A device s internal identifier Errr Cde Cde number assciated with the errr Errr Dmain Cntains internal cdes used by Apple useful fr diagnstics (may change between Apple releases) Lcalized Descriptin Descriptin f cdes Time stamp Date and time the errr ccurred Select Errr Chain Usage Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the errr chain lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 23

24 Licensing Lg The licensing lg is a lg f license validatins that executed successfully r that gave an errr. The lg displays: Lg Cde Cde number assciated with the lgged event Descriptin Descriptin assciated with the lg cde Functin Name Displays a returned errr; blank when lg event is successful Details Descriptin r reasn fr the errr; blank when lg event is successful Time stamp Date and time the license validatin ccurred Select Licensing Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by editing the Frm/T filter. Click Search. When yu edit the date/time filter, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the licensing lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 24

25 Mail Message Lg The mail message lg prvides an administratr with a methd t view the recrds f grup s sent frm the dashbard. The lg displays: Organizatin Organizatin name t which the was sent Administratr The administratr wh sent the SMTP Server The SMTP server thrugh which the was sent Subject subject Message Bdy text f the message Recipients s addresses f recipients f the Timestamp Date and time the was sent Ownership Whether device wnership was specified as criteria fr recipients; cmpany/persnal/any Liability Whether device liability was specified as criteria fr recipients; crprate/individual/any Select Mail Message Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the mail message lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.6.x System Administratin Guide Server Lgging 25

26 System Administratin This sectin f the guide dcuments tpics related t system level management f the ZENwrks Mbile Management server. The dashbard areas where system tasks are perfrmed require system administratr lgin credentials. System administratins can include the management f multiple rganizatins. In additin t all the Organizatin administratin permissins dcumented in the first part f this guide, a system administratr with full admin status has the fllwing system level permissins: View all rganizatins n the ZENwrks Mbile Management server Add, edit r remve rganizatins Switch rganizatins withut lgging ut and back in t anther rganizatin Create administrative rles and administrative lgins Send grup t ne r all rganizatins, administratrs, and users Access System Settings t uplad a signing certificate View server and device lgs Set database cleanup tasks Apply a plug-in Check fr and dwnlad ZENwrks Mbile Management server sftware updates System management tasks are perfrmed frm the System view. This view is nly accessible with a system administratr lgin. The lgin yu create when installing the ZENwrks Mbile Management server sftware is a system administratr lgin. ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 26

27 Managing Multiple Organizatins Multi-Tenant ZENwrks Mbile Management Systems A single instance f the ZENwrks Mbile Management server applicatin supprts a multi-tenant architecture, which allws an enterprise t manage ne r multiple rganizatins. Multiple rganizatins might be used t categrize varius divisins f a cmpany. Fr example: Prductin/Sales/Management departments can each be an rganizatin n the same ZENwrks Mbile Management server r Seattle/Chicag/Bstn divisins can each be a separate rganizatin. Switching Organizatins When yu are lgged in t the ZENwrks Mbile Management system with a system administratr lgin, yu initially chse the rganizatin yu want t view. Yu als have access t all ther rganizatins existing n the server thrugh the System Administratin menu. Switching frm ne rganizatin t anther is accmplished by using the Switch Organizatins ptin. Frm the System view, select System Administratin > Organizatins. Click Switch Organizatins in the gray ptin bar. The Organizatin List The rganizatin list gives yu access t the cnfigured settings f each rganizatin n the server. Select an rganizatin frm the list t view r edit the cnfigured settings fr the rganizatin. Organizatin name and cntact infrmatin Welcme letter enablement s a welcme letter EULA enablement - when this ptin is enabled, users must accept an End User License Agreement t cmplete ZENwrks Mbile Management app enrllment SMTP server name Signing certificate Uplad buttn (see descriptin belw) Hands-Off enrllment cnfiguratin Default Plicy Suite Default Device Cnnectin Schedule Default (Administrative) LDAP Server Default Liability ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 27

28 Signing Certificate Uplad The signing certificate is a security measure that authenticates the server and allws ios devices t recgnize it as a trusted surce. The signing certificate Uplad buttn allws yu t add a signing certificate fr the rganizatin. This must be a CA signed certificate, because self-signed certificates are currently nt supprted. The SSL certificate being used n the server can als be used as the signing certificate. Exprt the SSL certificate t a file, selecting the bx that ensures that the private key gets exprted with the certificate. Then uplad it t the ZENwrks Mbile Management server. A signing certificate designated here fr the rganizatin verrides the system-wide signing certificate defined in System Settings. 1. Select System > System Administratin > Organizatins. 2. Select an rganizatin frm the list and click the Uplad buttn next t the Signing Certificate field. ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 28

29 3. Click the Brwse buttn, then navigate t and select the file cntaining the certificate. 4. Enter the Private Key assciated with the certificate and click Uplad. 5. Click Save Changes n the gray ptin bar. License If yu are extending a ZENwrks Mbile Management sftware evaluatin license r mving an rganizatin t a license fr a purchased cpy f the sftware, yu must enter a new license key fr the server. Updating the license requires full system admin lgin credentials. 1. T access the License page, select System > License. 2. The License Type and number f Days Remaining n the license display. 3. Enter the license key prvided by yur Nvell Sales Representative in the Update License Key field and select Save Changes. ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 29

30 Database Task Scheduler Fr full dcumentatin n the Database Task Scheduler, see the Database Table Maintenance guide. When devices make a cnnectin t the ZENwrks Mbile Management Server, infrmatin regarding thse cnnectins is lgged in the database and stred fr ptential trubleshting purpses. The amunt f infrmatin that is lgged depends n several factrs, such as the number f users n the ZENwrks Mbile Management Server, the type f traffic being sent back and frth, the amunt f lgging taking place, and the frequency f device cnnectin intervals. Over time, this infrmatin can build up in the database and grw excessively. Administratrs with full admin lgin credentials can use the Database Task Scheduler t set clean-up jbs t run at regular intervals in rder t clear excess data and maintain ptimal database perfrmance. T access the Database Task Manager, select System > System Administratin > Database Task Scheduler. ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 30

31 Plug-Ins The ZENwrks Mbile Management Plug-Ins feature allws administratrs t plug a SWF (Adbe Flash file) int the ZENwrks Mbile Management dashbard. This lets yu add a way t interface with anther cnsle t the dashbard. Frm the System page f dashbard, administratrs can define the lcatin f any SWF (Adbe Flash file) they have created. T further custmize the ZENwrks Mbile Management server pages, administratrs can insert custm lgs and icns via the System Settings that appear n the ZENwrks Mbile Management lgin page and in ZENwrks Mbile Management dashbard navigatin menu. T access Plug-Ins, select System > System Administratin > Plug-Ins. Yu must be a system administratr with full admin lgin credentials. Sample ZENwrks Dashbard with SWF Plugged In ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 31

32 Adding a Plug-In 1. Click Add Plug-In in the ptin bar. 2. Enter a Display Name and Descriptin. The name yu enter appears in the ZENwrks Mbile Management dashbard navigatin menu under the plug-in s icn. 3. In the SWF File field, enter a URL fr a remte strage lcatin r stre the.swf file n the ZENwrks Mbile Management server and enter the file name. A file stred lcally shuld be in /Nvell/ZENwrks/mbile/web/dashbard/plugins/swfs/ 4. In the Icn File field, enter a URL fr a remte strage lcatin r stre the icn file n the ZENwrks Mbile Management server and enter the file name. This icn appears in the ZENwrks Mbile Management dashbard navigatin menu. Clicking n this icn in the ZENwrks menu pens the Plug-In display area. A file stred lcally shuld be in /Nvell/ZENwrks/mbile/web/dashbard/plugins/icns/ Acceptable file frmats are.png,.jpg, r.gif Image size - W:34px, H:35px 5. If yu are using URLs, place an XML Crss Dmain Plicy File at the rt f the hsting server. S that Adbe Flash des nt prevent ZENwrks Mbile Management frm accessing data n the remte lcatins yu have designated, the crss plicy file must define exceptins. Click Dwnlad Example t dwnlad a template t assist yu in creating an XML file with the apprpriate cntent. 6. Mark the plug-in as Active fr it t take effect. Sample f the plug-in display area ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 32

33 System Administratr Rles See als Organizatin Administratr Rles Predefined System Administratr Rles There are six predefined rles built in t the ZENwrks Mbile Management system. The permissins fr these rles cannt be altered. Yu can view the set permissins fr these rles via the Rle Permissins ptin in the System view: System Administrative Rles r Organizatin Administratin Rles. Three f the predefined rles are used fr rganizatin administratr lgins. (See Predefined Organizatin Administratr Rles.) The three predefined system administratr rles are: Full System Admin There are n limitatins with this type f lgin credential. It gives full administrative permissins in every rganizatin created n the ZENwrks Mbile Management server. An administratr with this type f lgin can add rganizatins and switch rganizatins withut lgging ff the ZENwrks Mbile Management server. They can als apply ZENwrks Mbile Management server updates via the ZENwrks Mbile Management Update Manager applicatin and cnfigure the Database Task Scheduler. Supprt System Admin Gives limited administrative access r read nly access in every rganizatin created n the ZENwrks Mbile Management server. System Administratrs can switch rganizatins withut lgging ut f the ZENwrks Mbile Management server. Althugh they cannt apply ZENwrks Mbile Management server sftware updates, they can access the Update Management page in the dashbard where they can check fr and dwnlad ZENwrks Mbile Management patches in preparatin fr the applicatin f the update. Restricted System Admin Restricted frm viewing private data such as Lcatin, MMS/SMS Lg, Phne Lg, and File Archive. Has Read nly permissins fr all ther views. Restricted administratrs can switch rganizatins withut lgging ut f the ZENwrks Mbile Management server. System Administratr credentials give access t all rganizatins n the ZENwrks Mbile Management server. System Administratrs can switch rganizatins withut lgging ff the ZENwrks Mbile Management server. Credentials may be authenticated via an LDAP server and may be assigned Full Admin, Supprt Admin (read nly), r Restricted Admin (limited read nly) permissins. System Administratrs als have access t the Update Management infrmatin n the dashbard. System administratr credentials with Full Admin permissins are required t use the Update Manager applicatin. The administrative lgin created during the prcess f installing the ZENwrks Mbile Management server applicatin is a System Administratr Lgin with the predefined Full Admin permissins. See the table belw fr details n the varius System Administratr rles r view the permissins via the Rle Permissins ptin in the System view. Wh Shuld Have System Administratr Lgins A system administratr lgin is required fr anyne wh needs access t all rganizatins n the ZENwrks Mbile Management server. Sme examples are: Administratrs f a system where users have been gruped int separate rganizatins. Administratrs wh will apply ZENwrks Mbile Management server sftware updates. Administratrs wh will cnfigure database cleanup tasks. ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 33

34 SYSTEM ADMINISTRATOR ROLES Dashbard View Supprt System Admin Restricted System Admin Activity Mnitr Users Read-nly access; cannt disable r snze alerts Can add r remve users and perfrm all the functins in the right-hand Details panel, except Shw Recvery Passwrd Can an individual user, but cannt use Grup ing Can perfrm mst functins in the left panel f User Prfile Can view the grids in the Audit Data and Search Text Message Lg ptins (User Prfile), but cannt view the bdy r attachments f a text message Can chse the Visible Clumns fr the Users list Read-nly access; cannt disable r snze alerts Restricted frm adding r remving users and frm all functins in the right Details panel Restricted frm sending an t an individual user r a grup Restricted frm the Lcatin Data, Audit Data, Search Phne Lg, Search Text Message Lg, and File Archive ptins in the lefthand panel f User Prfile Read-nly access t ptins in the left panel f User Prfile Can chse the Visible Clumns fr the Users list Organizatin Read-nly access Read-nly access Reprting Full access (view and exprt) Full access (view and exprt) System Read-nly access Can switch between rganizatins withut lgging ut f the ZENwrks Mbile Management server Can view the Update Management page; Can check fr and dwnlad server sftware updates. Cannt apply updates, because Supprt Admins d nt have access t the Update Manager Read-nly access Can switch between rganizatins withut lgging ut f the ZENwrks Mbile Management server Can view the Update Management page; Can check fr and dwnlad server sftware updates. Cannt apply updates, because Restricted Admins d nt have access t the Update Manager Custmized System Administratr Rles Administratrs can create custmized system administratr rles t tailr the permissins assciated with ZENwrks Mbile Management dashbard lgin credentials. When a custm rle has been created, it appears as a chice in the drp-dwn list f the Add Administratr wizard s Rle field. See System Administratr Lgins. Administratrs wh are lgged in when changes are made t rle permissins must lg ut and lg in again fr permissin changes t take effect. ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 34

35 1. Select System > System Administratin > System Administrative Rles > Rle Permissins > Add Rle. 2. Chse a methd fr creating a System Administrative Rle: Use the sliders t determine the rle s initial settings. The new rle cpies the settings f the predefined System Full Admin, Supprt Admin, r Restricted Admin. Cpy the settings f an existing rle 3. Specify the rle permissins t cpy. 4. Enter a Rle Name and Descriptin. 5. Click Finish t save the new rle. 6. Find and select the rle in the System Administrative Rles grid. 7. Set the permissins assciated with dashbard access. See Appendix A: Rle Permissins fr a cmprehensive list. ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 35

36 System Administratr Lgins See als, Organizatin Administratr Lgins Creating System Administratr Lgins Select System > System Administratin > System Administratrs > Add System Administratr. The Add Administratr Wizard steps yu thrugh creating lgin credentials fr system administratrs. The Wizard asks fr the fllwing infrmatin: LDAP server with which this user is assciated (ptinal) if yu are creating LDAP authenticatin lgins. (Administratr Lgin and Passwrd fields are disabled if yu chse this ptin.) Administratr Lgin Enter the administratr s address t be used as a username (if the user is nt using LDAP authenticatin). LDAP Administratr Lgin Enter the administratr s LDAP server user name if the user is using LDAP authenticatin. Display Name Enter the name t display fr this lgin. address Enter the cntact address f the user. Passwrd Assign a passwrd if yu are creating a lgin that des nt use LDAP authenticatin. Rle Assign a permissins level t the lgin. Chse frm: Predefined Full Admin Full administrative permissins Predefined Supprt Admin Read-nly permissins with limited editing capabilities Predefined Restricted Admin Read-nly permissins with private data restrictins; cannt view Lcatin Data, Audit Data, MMS/SMS r Phne Lgs, and File Archive Any custm System Administratr rle created fr the system Default View Select the default view at lgin System Timeut Select an inactivity timeut in minutes fr this lgin ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 36

37 Active Status Select the bx t enable this administrative lgin Managing System Administratr Lgins Yu must be lgged int the ZENwrks Mbile Management server with system administratr (Full Admin) credentials in rder t edit r remve a System Administratr. 1. Select System > System Administratin > System Administratrs. 2. Select an administratr frm the list. Edit the settings and click Save Changes. Yu can als remve the administratr by clicking Remve System Administratr. ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 37

38 System Grup ing System Grup ing gives the administratr the ability t send a system-wide t ne r multiple rganizatins and can include administratrs, users r bth. The sender can als elect t cpy the rganizatin cntacts. T send a grup , select System > System Grup . ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 38

39 System Settings Custm Dashbard and Lgin Lgs T custmize the ZENwrks Mbile Management server pages, administratrs can insert custm lgs and icns that appear in ZENwrks Mbile Management s dashbard navigatin menu and n the ZENwrks Mbile Management lgin page. T insert lgs, select System > System Administratin > System Settings. Yu must be a system administratr with full admin lgin credentials. In the Dashbard Lg File field, enter a URL fr a remte strage lcatin r stre the file n the ZENwrks Mbile Management server and brwse t select the file name. This lg appears in the upper left crner f the ZENwrks Mbile Management dashbard, next t the navigatin menu. A file stred lcally shuld be in Nvell/ZENwrks/mbile/web/dashbard/images/CustmLgs/ Acceptable file frmats are.png,.jpg, r.gif Image size: W:34px, H:35px Sample Custmized Dashbard Lg ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 39

40 In the Lgin Lg File field, enter a URL fr a remte strage lcatin r stre the file n the ZENwrks Mbile Management server and enter the file name. This lg appears n the ZENwrks Mbile Management lgin page. A file stred lcally shuld be in /Nvell/ZENwrks/mbile/web/dashbard/images/CustmLgs/ Acceptable file frmats are.png,.jpg, r.gif Image size: W:256px, H:129px Sample ZENwrks Mbile Management Lgin Page with Custmized Lgin Lg Signing Certificate Uplad The signing certificate is a security measure that authenticates the server and allws ios devices t recgnize it as a trusted surce. The signing certificate Uplad buttn in System Settings allws yu t add a signing certificate fr any rganizatin acrss the ZENwrks Mbile Management system. This must be a CA signed certificate, because self-signed certificates are currently nt supprted. A signing certificate defined fr a single rganizatin will verride this system-wide signing certificate. 1. Select System > System Administratin > System Settings 2. Click the Uplad buttn next t the signing certificate field. 3. Click the Brwse buttn, then navigate t and select the file cntaining the Certificate. 4. Enter the Private Key assciated with the certificate and click Uplad. 5. Click Save Changes n the gray ptin bar. ZENwrks Mbile Management 2.6.x System Administratin Guide System Administratin 40