Browsium Proton Administration Guide

Transcription

1 Browsium Proton Administration Guide Version Browser Management for Enterprise

2 1 Administration Guide This guide has been created for IT administrators to assist in installing, configuring, and deploying Browsium Proton. This is version of the guide is designed for use with Browsium Proton For more information about Browsium, or to contact customer support, please visit

3 2 Table of Contents 1. Introduction Browsium Proton Explained Browsium Proton Overview Browsium Proton Browser Integration Installation Proton Components Proton Setup Browsium Client Setup System Requirements Proton Express (Express Install) Proton Service & Database (Full Install) Browsium Client Proton Manager Installing Proton Server Express Install Full Install Installing Browsium Client Confirming Browser Extension Installation Command Line Switches for the Browsium Client Installer Installation Options Display Options Restart Options Logging Options... 45

4 Repair Options Using Proton Manager Dashboard Dashboard Navigation Controls Bar Chart View Clients Section Status Java ActiveX Client Registration Token And IP Filtering Activity Section Web Applications Performance Java ActiveX Rules Page Building a rule Editing a rule Configuration Page Client Configuration Data Retention Data Collection Options Users Page Password Policy Management Privacy Page Diagnostics Page Tutorial Connecting to Proton Manager for the First Time The Hosted Proton Manager

5 Connecting to the Proton Manager Self-Signed Certificate Errors Creating the First Account Exporting Proton Report Data Views Creating Rules Create and Test a Map Rule Create and Test an Ignore Rule Proton Deployment in the Enterprise Deploying Browsium Client Installing Browsium Client Enabling Browsium Client with the Proton Server URL Managing the Browsium Client Browser Extensions Enable the Browsium Internet Explorer Extension via Group Policy Enable the Browsium Client Extension for Google Chrome Enable the Browsium Client Extension for Mozilla Firefox Enable the Browsium Client Extension for Microsoft Edge Managing Browsium Client Logging Settings A. Troubleshooting A.1. Browsium Client fails to report data A.2. Proton Server appears to fail installation A.3. Proton not working with Microsoft Edge A.4. Proton reports not displaying properly A.5. Proton Server showing certificate warnings A.6. Can t reach Proton Server through a firewall

6 5 Section One Introduction In this section, you will learn: Where Browsium Proton fills the void left by traditional software management systems What components make up Browsium Proton How Browsium Proton seamlessly integrates into your desktop environment

7 6 1. Introduction Proton delivers the ability to know and understand more than ever before about web applications in the enterprise. Historically IT organizations have been forced to play catch up when it comes to managing web applications. On the modern desktop, business applications are nearly always run in the browser instead of as traditional executable programs. Most IT organizations are prepared with tools and processes that help them manage installed, executable programs as IT was able to definitively and tightly control the desktop. Applications could not be installed without IT permission. Dependencies could be managed, packaged and isolated to ensure high levels of desktop and application availability and meet internal SLAs or SLTs. Understanding the web based application management challenge requires understanding browser design constructs and how that relates to existing desktop application solutions. The web browser has revolutionized IT and driven a change in nearly all aspects of business application delivery. Early browser based applications were fairly straightforward and requirements relatively streamlined with web application development practices and languages limiting the complexity of designs. As browsers became more ubiquitous, driven mainly by the popularity of Internet businesses, browser capabilities needed to expand to offer the range of new features and capabilities. Commercial use cases were becoming more complex and enterprise software vendors began to understand the power of the browser, so vendors began to move away from client/server solutions and offer web based versions of their software. These complex business applications required not only an advanced set of web development languages and technologies but also included specific dependencies and software extensibility to deliver their full solution. Managing these powerful web applications requires following a similar, but uniquely different approach to end user workstation management. The client/server models, where applications can be packaged, bundled and even designed to dynamically load custom libraries without impacting other system resources, have given way to an entirely more open, flexible, and complex approach. Web based applications are designed such that the browser loads those components, making development easier as resources are readily available to consume but the browser design intentionally limits the ability for more than one version of the same component to be loaded simultaneously. But web based application management isn t all about controlling library loading. One of the major problems facing IT administrators trying to manage desktops is their lack of ability to control web based application proliferation. Business units can easily create a web application and make it part of their standard business process without ever talking to anyone in IT. Web

8 7 server software is readily available, if not already installed on many Windows SKUs. Contractors can be hired to create a small web portal and integrate that with other business systems to build a limitless set of functions desired by the business unit. Business unit owners enjoy this approach as it enables rapid deployment for a desired solution and allows for a more nimble business response to objectives and needs. For IT however, the ease at which these systems can be brought online creates seemingly endless challenges. The most critical issue is that IT is unaware the system even exists. IT is expected to ensure reliable desktop operations, including browser functionality, but lacks basic data about the environment to successfully meet that objective. For web applications where IT is made aware, they are then faced with understanding and documenting requirements. With that information in hand, IT can begin to evaluate how these new systems overlay with existing systems, technologies and dependencies. Finally, IT is close to a position where they can begin to understand how to ensure delivery of this business critical web application. More often than not during that process, IT uncovers conflicts in dependencies. These systems rarely go through any change control or standards reviews. The technologies used are often not in line with organizationally defined standards, creating a challenge to then modify the system to bring it in line with everything else. Another major challenge IT faces in managing the modern web based desktop environment is patch management and inventory control. Traditional desktop management tools easily enable an IT administrator to inventory systems to obtain library and patch version information. Similarly, they could pull usage statistics to understand what was being used and by whom. Browser based applications function differently and the traditional tools can t provide that information. Traditional desktop management tools can provide an inventory of installed browser extensions (generally just the binary package information) but they lack mechanisms to indicate which are actually being used. Or which web applications are using those components. From a security perspective the tools lack the ability to indicate which components are not needed, and can therefore be removed and reduce unnecessary attack surface. Proton was designed to fill these gaps and meet the unique challenges IT faces in modern desktop management and web based applications. The paradigm has shifted, the browser is here to stay and web applications need proper management tools for IT to deliver services. Browsium Proton is the tool for the job.

9 Browsium Proton Explained Browsium Proton is an advanced web application inventory and analysis software solution. It provides a critical set of tools and data unavailable using traditional desktop management tools. Unlike other browser based data harvesting tools, Proton is enterprise ready. It s designed to immediately record and report across an organization within minutes of deployment. Customizable data filters and dashboard analysis reporting views ensures Proton will deliver crucial ongoing management information as the organizations web based applications evolve and the desktop management challenges increase with it. Proton integrates seamlessly with client browsers, gathering and synchronizing activity and web application behavior. End users experience no impact from Proton, nor does it impact the web applications running inside the browser. As data is collected, the Proton functionality in the Browsium Client passes that information over secure channels to the Proton Server. The Proton Server communicates with the Proton Manager, a web application that displays reports and analyzes the collected data. Like traditional desktop management tools which install to the operating system to monitor and report on user settings and system activity, Proton works by being tightly integrated into the browser. This design enables Proton to go well beyond what traditional desktop management tools can offer using their external process monitoring approach. As a tightly coupled part of the browser, Proton is able to see data as it is passed to rendering components, providing a unique view of content and browser behaviors. Browsium Client also gathers data about other browser extensions, including state, version and usage activity. This information, along with many other data points, are fed up to the Proton server database which then correlates information for viewing. Proton Server is not just a database and reporting analysis engine it also provides client configuration rules and parameters. This design makes it easy to manage all aspects of Proton from one place reporting and configuration are part of the server system. Clients only need to be installed and setup once, changes and reconfigurations are picked up by the clients automatically, making management overhead minimal.

10 Browsium Proton Overview Organizations have long relied on software management systems to enable centralized and robust desktop management. Traditional software management systems were designed for either a client/server model or to manage standalone applications, concepts that were the norm before the modern desktop of today where most applications are run in the browser. As the browser evolved to be a killer app used by information workers on a nearly constant basis, the management tools didn t evolve to meet this new paradigm. Browsium Proton ( Proton ) was designed for the modern desktop management challenge, uniquely focused on the requirements and challenges of web based applications. In broad terms, the browser is more like an operating system than it is a traditional desktop application. Like an operating system, the browser provides a host environment to run a range of applications, written in a wide set of programming languages, utilizing a virtually limitless set of extensions/add-ons and APIs. In addition, browser based applications have security and other environmental settings requirements or restrictions to ensure they balance the right amount of access and restrictive controls. Existing and traditional software management tools simply can t address these challenges. Proton fills this gap by providing web application inventory and analysis data. Much like traditional systems monitoring software which looks at Windows system settings, Executable and Linked Library binaries, Proton delivers the same types of data and information but from within the browser environment. Residing in that part of the web application stack Proton is able to get unparalleled access to data and configuration information. Proton can see basic information such as which web application is being used, to specific details such as which version of Java is required by a specific web application. The data collected by Proton, combined with the analytical provided via the dashboard and drilldown reporting interface, enables an organization understand who uses which applications and what dependencies exist, determine active web application usage activity, and ensure desktop configurations are managed to ensure proper operations while minimizing security or support exposure.

11 Browsium Proton Browser Integration Much like traditional desktop management tools, the real value comes from the breadth of reach as much as depth. The modern desktop is browser based, and usually not just a single browser. Through the desire to offer end user choice, based on web application requirements, or even benchmark performance criteria, many organizations need to deal with at least two browsers on the desktop. No organization would select a desktop management solution that only supported one version of Windows. Similarly, no web application management platform can be built around a single browser. Proton supports the four most popular browsers in the enterprise: Microsoft Internet Explorer, Microsoft Edge Google Chrome, and Mozilla Firefox. Usage, setting and metric information is gathered seamlessly across the browser, regardless of which one the user has selected or was directed to use in the case of Browsium Catalyst. Proton goes further, and can be easily integrated with virtual desktops to enable the same high fidelity level of data collection and analysis on virtual or physical delivery mechanisms. Proton is truly built for the modern enterprise desktop environment.

12 11 Section Two Installation In this section, you will learn: About the Browsium Proton components Software requirements for Browsium Proton How to Install Browsium Proton How to configure command line switches for installation over a network

13 12 2. Installation Browsium Proton is straightforward and simple to install a basic evaluation implementation using Proton Express can be up and running in under an hour. A Full Install of Proton Server has much higher system requirements and is far more complex, including requiring an SSL certificate. You ll want to read section 2.3 before attempting a Full Install. To evaluate Proton in your environment, the first step is to install Proton Express on a server (or a powerful desktop used as a server for testing), then optionally install the standalone Browsium Client to selected desktop systems. Note that Proton Express includes the Browsium Client so you have a fully working server and client on a single system for rapid evaluation of the Proton software. Administrator rights are required for installation of Proton Express and the standalone Browsium Client. The Browsium Client EXE can also be packaged for use in a software distribution system with typical software installation settings. Refer to section 2.5 for the available command-line switches. The remainder of this section provides details on the individual components of Proton, along with important information to ensure a successful installation.

14 Proton Components Browsium Proton is comprised of four main components: Proton Service, Proton Database, Proton Manager and Browsium Client. Proton Service and Proton Database can be run on a single server, or distributed and clustered among multiple servers to increase scalability. For the purposes of this guide, Proton Server refers to the logical grouping of Proton Service and Proton Database. Each component can be seen in relation to the others in the following diagram and are explained in more detail below. Proton Service a web service, running on IIS (or IIS Express in the case of Proton Express) that communicates with all other Proton components to facilitate data collection, reporting, and client management. Proton Database a highly scalable database, built on Microsoft SQL Server, that holds all the data collected from clients and queries for the reporting system. Proton Manager a web application that provides the user interface into the Proton Server for reporting and configuration. Browsium Client a lightweight software agent used for gathering inventory and activity data and automatically (and silently) uploading it to the Proton Server. The Browsium Client also includes the agent functionality for Browsium Ion and Browsium Catalyst, resulting in a single client installation that works with all the modules in the Browsium suite Proton Setup Proton Setup (Proton-Setup.exe) is a single installer which allows you to choose whether you ll install Proton Express for evaluation use (Express Install) or the full Proton Server for a large pilot or enterprise deployment (Full Install). When running Express Install, the entire Proton solution, with a time- and client-limited server and Browsium Client, is installed on a single system. Installation begins with validation of prerequisites. If the installer determines certain required components are not present, the

15 14 installer will guide you through the download and installation of the missing components, such is IIS Express and SQL Express. Following that step, the process configures and installs the Proton web service and database. Lastly the installer will install Browsium Client on the server for easy, single-system testing. With Full Install, certain prerequisites will be automatically installed, including the server version of IIS on Windows Server. However, you must install your own version of SQL Server. By default, Proton server sets IIS to use HTTPS over port With Proton Express, the default SSL certificate is self-signed, which may cause errors or warnings when accessing the Manager from other systems. The Full Install of Proton Server requires an SSL certificate to be provided by the administrator during setup Browsium Client Setup Browsium Client Setup (Browsium-ClientSetup.exe) installs the browser extensions and the Browsium Controller (BrowsiumController.exe) on end user systems. Browsium Controller manages communications with the Proton Server, along with managing configuration and control of the extensions. Browsium Management Service (BrowsiumService.exe) runs as a Windows service with System privileges to handle content loading for Ion and Catalyst projects that require elevated permissions. Browsium Monitor (BrowsiumMonitor.exe) is responsible for ensuring that Browsium Controller is running reliably. o o o o Browsium Client Extension Microsoft Internet Explorer An extension to facilitate Proton communication between Microsoft Internet Explorer and the Browsium Controller. Browsium Client Extension for Microsoft Edge An extension to facilitate Proton communication between Microsoft Edge and the Browsium Controller. Browsium Client Extension for Google Chrome an extension to facilitate Proton communication between Google Chrome and the Browsium Controller. Browsium Client Extension for Mozilla Firefox An extension to facilitate Proton communication between Mozilla Firefox and the Browsium Controller. Browsium Client installation is integrated with Proton Express. The standalone Browsium- ClientSetup.exe is needed to enable Proton on additional client systems. This installer can be downloaded from the Proton Manager web page or extracted from the Browsium

16 15 Proton zip file that you downloaded from the Browsium website. See section 2.4 for more details on installing Browsium Client.

17 System Requirements Proton is designed to support a wide range of Windows systems and configurations. This section details the minimum requirements for each component of Proton Proton Express (Express Install) The following minimum configurations and versions are required to run Proton Express (the evaluation version of Proton): Operating System.NET Framework Additional Components Processor Memory Windows 7 or later Windows Server 2008 R2 or later Version 4.0 or later Microsoft IIS Express 7.5 (installed automatically) Microsoft SQL Server Express 2012 (installed automatically) 1 GHz or faster 32-bit (x86) or 64-bit (x64) processor 1 GB total system RAM 2 GB RAM for use on Windows Server Proton Service & Database (Full Install) Operating System.NET Framework Additional Components Processor Memory Windows Server 2008 R2 or later Version 4.0 or later Microsoft IIS 7 or later Microsoft SQL Server 2012 Web Edition or higher 1 GHz or faster 32-bit (x86) or 64-bit (x64) processor 2 GB RAM

18 Browsium Client Operating System Browsers.NET Framework Processor Memory Windows 7 or later Windows Server 2008 R2 or later (for terminal servers) Microsoft Internet Explorer 8, 9, 10, or 11 Microsoft Edge 40 or later (machine must be domain joined) Google Chrome 39 or later Mozilla Firefox 48 or later (41 or later with Browsium legacy extension) Version 3.5 SP1 or later (full version only) 1 GHz or faster 32-bit (x86) or 64-bit (x64) processor 1 GB RAM, 2 GB for multi-user terminal servers Proton Manager Proton Manager is a client-side web application hosted on a web server either at browsium.com (the hosted manager) or on your web server that you configure during Proton setup (the local manager). The manager provides the user interface to Proton, including the charts, reports, data, analytics, configuration, and administration interfaces. Because Proton Manager is a client-side web application, all the code necessary to render the user interface is run completely within your browser. No customer-specific Proton data is ever sent up to the web server running Proton Manager data is only transferred securely between your browser and your Proton Server. Because of this architecture, your Proton Server can be located on your intranet while still using a hosted Proton Manager on the Internet no connection is ever made between the two sets of servers. This is also why it makes no difference whether you run the manager hosted on browsium.com or install your own copy on a local web server the code that is executing in the browser is the same. Using the hosted version just ensures that you always get the very latest available version of the manager code as Browsium updates it. Because all the code runs in your browser, Proton Manager works best when accessed via the most modern, fastest browsers available. We recommend Internet Explorer 11 or the latest version of Chrome or Firefox.

19 Installing Proton Server Run Proton-Setup.exe to install the server side of Proton. Once you have a functioning server, then you may install Browsium Client using Browsium-ClientSetup.msi, which requires the address of your Proton server to complete setup. Express Install to install Proton Express should be used for evaluation purposes. If Browsium has already provided you with a license key, then you may perform a Full Install of the Proton server and database. Proton Express expires after 30 days and supports up to 50 clients for data collection. See section for instructions on installing Proton Express. See section for information on the full Proton Server installation Express Install This section covers the installation process for the Browsium Proton Express using the Proton- Setup.exe installation package. The installer guides through the process to obtain and install all prerequisites then creates the necessary IIS Express and SQL Server Express configurations. The steps for an Express Install are as follows: 1. Locate and run the Browsium Proton Setup Installation file (Proton-Setup.exe) which begins with a check for certain prerequisites required for Proton installation.

20 19 2. Review the list of prerequisites to download and install the required components. The installer setup process scans the host system looking for prerequisites and only marks missing components or those needing newer versions for installation. If there is a mistake in the selections, simply adjust the appropriate checkboxes and click Next to proceed. The installer will now download the specified components and prepare them for installation. Depending on download speed this step may take up to 5 minutes to complete all downloads. 3. You re now ready to continue with Proton setup.

21 20 4. Next, you ll choose the Installation Type. Select Express Install to install the evaluation version of Proton, called Proton Express. If you intend to perform a Full Install, and already have a license key from Browsium, skip ahead to section Review and confirm the license terms. You must accept the terms of the license agreement to continue. Not accepting the terms will force the installer to exit. Select your option and click Next to continue.

22 21

23 22 6. The next screen provides the ability to select specific portions of Proton Express for installation. Proton Express is designed as a single box setup and all server components are required on the same server for Proton Express or the system may not operate properly. Select the Typical option and click Next. If you do not want to run Browsium Client on your Proton Express server system, choose Custom and remove the Browsium Client from the list of components to be installed. However, Browsium recommends running all components of Proton Express on a single system for a seamless evaluation.

24 23 7. Defining the URL for the Proton Server is one of the more important steps in the setup process. The default value is set to your client or server machine name. Other computers in your local network should be able to connect to your server, but this is dependent on your network configuration. In order to connect multiple clients to this server across a large, complex network, this value should be renamed to the correct Fully Qualified Domain Name (FQDN) for your environment. Proton Express uses port by default. Proton Service installation automatically adds the selected port to Windows Firewall ruleset. Using your machine name as the Proton hostname: Using a fully qualified domain name as the Proton hostname:

25 24

26 25 8. Once all settings and options have been selected, the installation can begin. Click Install to proceed. 9. You ll need to install additional required prerequisites for Proton Express if they re not already installed, including IIS Express and SQL Server Express. All are free downloads from Microsoft and are performed automatically. Once all prerequisites have been downloaded, the Proton Setup installer automatically launches the individual installers. Complete each of the required setup wizards, selecting the default options. Installing the required components may take 30 minutes or longer, depending on the speed of your system and Internet connection. Be prepared to acknowledge individual license agreements and a large number of installation prompts generated by the Microsoft installers for each of the required components.

27 This completes the Proton Server, Manager, and Client setup on your server system. Any selected prerequisites should be installed and configured for default settings as needed. Click Finish to exit the installer. The Browsium Client is installed during the Proton Express installation process if you selected the Typical installation option; no extra steps are required for single-system testing. See section 2.4 for more information on installing Browsium Client on additional systems in your organization, and section 5 for guidance on enterprise deployment of Browsium Client.

28 Full Install Before attempting a Full Install, please review section Proton Service & Database system requirements. 1. Locate and run the Proton Setup Installation program (Proton-Setup.exe) to launch the Proton Setup Wizard. Click Next to continue through setup. If IIS is not already installed on your server, it will be installed as part of setup. 2. Select Full Install and click Next. If you don t have a license key, see section for details on how to run an Express Install.

29 28 3. When prompted, enter your Proton product license key and click Next. If you have never received a license key, you should instead run an Express Install (evaluation version) as detailed in section Contact Browsium Support if you are unable to find your license key. Note that your license key is unique for your organization and should not be shared with anyone else. 4. Accept the End User License Agreement and click Next.

30 29 5. Select the components to install and click Next. Both boxes are unchecked by default and you can only run Setup once on a given server. Check both boxes to install Proton Service ( Server in this setup screen) and Proton Database on the same server system. Install them on separate servers for increased scalability. Proton Database supports any edition of Microsoft SQL Server 2012 or higher. The Advanced Options button provides a checkbox to install the Proton Manager locally on your server (aka, the local manager ). The default is unchecked, which configures Proton to use the hosted manager running on browsium.com in a SaaS configuration. The hosted Proton Manager is the recommended configuration as Browsium will periodically update the software with new features and experience improvements that are compatible with the Proton Server and Database you are installing. If you choose to install the local manager, you may still access the hosted Proton Manager from You only need one installation of the local manager even if you run the Proton Service on multiple web servers for increased scalability.

31 30 6. The Proton server connection URL can be customized or left to the default (the machine name of the local server). Proton uses port 443 by default, the well-known HTTPS port for use on a dedicated server. If you re running Proton on a server with another web service that is already using port 443 (not recommended for deployment), you can choose another port. The Proton Service installation automatically adds the selected port to Windows Firewall ruleset. In a hosted environment, (e.g., Microsoft Azure), an additional step may be required to open the port (or endpoint ) using the hosting manager for that environment. 7. For security, Proton only operates over HTTPS. Installing Proton requires an SSL certificate. Proton supports trusted CA-issued or self-signed certificates (in.pfx format). Browsium recommends CA-issued certificates for maximum security. If needed, follow our guidance to create a self-signed certificate. Select the certificate file and provide the password, then click Next.

32 31

33 32 8. Proton Server requires an existing SQL Server on which it can create and access a database. Enter the SQL Server hostname and instance name, and then configure a database name (the default is Proton ). You can also customize the location of the data and log directories if desired. Then click Next to continue. If SQL Server is installed locally, use (local) as the Hostname. Please install SQL Server prior to running Proton Setup if you plan to run SQL Server on the same server as Proton Service. Be sure you are running the Proton Setup wizard with an account that has access to your SQL database. Proton Setup will create the necessary databases, tables, objects, permissions, etc. 9. In this dialog the installer establishes which account the Proton server will use to communicate with the SQL Server after Proton is installed. The defaults should work well for most SQL installations, but you can use this dialog to customize and specify the login credentials for SQL Server as necessary. Confirm settings, then click Next.

34 33 Browsium recommends changing the defaults only for organizations that have formally defined specific security and user account requirements. 10. Setup is now ready to continue. Click Install to allow setup to proceed. Setup may take several minutes to complete even longer if you re upgrading to a new version of Proton as the database upgrade process can take quite a long time. Please do not disturb the setup process while it is running. During this phase of installation, you may see additional dialogs and status messages pop up as Proton Setup configures your server, but none of them should require interaction. 11. When setup is complete, select Finish to close the wizard. Proton Server is now installed. See section 4.1 for instructions on how to connect to the Proton Manager.

35 Installing Browsium Client This section covers manual installation of Browsium Client. Network and command line installation options can be found in Command Line Switches for the Browsium Client Installer. Administrator rights are required to run the Client Installer. Once installed, the Browsium Client runs under any user account and does not require special user permissions or elevation. The Browsium Client can be downloaded from the Proton Manager or copied from the Proton Program Files directory on the server computer where you installed Proton Server. You ll also find it in the zip file containing the Browsium Proton software that you downloaded from Browsium.com. 1. To start the Browsium Client installer process, double-click on the Browsium- ClientSetup.exe file. Administrative rights are required to properly complete the installation process. The first screen provides a basic introduction. Click Next to get started.

36 35 2. The next screen contains the End User License Agreement (EULA) for Browsium software. Read and accept the terms of the EULA in order to proceed, then click Next. 3. This next screen is only displayed if there are active and open browser windows on the client system at this stage of the installation process. Close any open browsers manually or simply click Next and the installer will close them automatically.

37 36 4. To function properly, the Browsium Client requires browser extensions must be installed and enabled. All supported Web browser extensions are installed during Setup and enabled during first run of the Browsium Client. To ensure proper operation in deployment, the Browsium Client will periodically monitor extensions state and enable them if they become disabled. Installing and enabling extensions often requires open browser windows to be closed. Click Yes to allow the Browsium Client to enable the extensions and retain control over the setting once deployed. Selecting No only installs the browser extensions, the Browsium Client extensions will not be automatically enabled or setup for ongoing management. Clicking either the Yes or No options will require all open browser windows be closed, and the installer will close them automatically. If you don t want to close open browser windows select Cancel at this time. Closing browser windows automatically may cause unsaved work to be lost. Verify browser window activity prior to allowing the installation process to close any browser window.

38 37 5. Selecting Typical installs the Browsium Client Extensions for Microsoft Internet Explorer, Microsoft Edge, Google Chrome, and Mozilla Firefox, and installs the software in the default Program Files directory for 32-bit applications Program Files on 32-bit systems and Program Files (x86) on 64-bit systems. If you don t need to change these defaults, select Typical, then Next to proceed with the Browsium Client installation. Selecting Custom enables manual selection of browser extensions to be installed, as well as the installation directory. Optionally specify the Client Configuration, or click Next to keep the default, blank values for the Proton Server URL, Catalyst License Key, and Ion License Key. These values can be set using the command line switches as detailed in section 2.5. They can also be set via

39 38 Group Policy or other remote registry configuration tools in an enterprise deployment as detailed in section 5 Deploying Browsium Client.

40 39 6. Selecting the Client Configuration button presents a dialog that accepts the URL of the Proton Server, the Catalyst License Key, and the Ion License Key. The Proton Server URL is required for the Browsium Client to communicate with a Proton server. In this example, we ve used the Proton Test Drive site which is a valid Proton server that you can test with. This Proton server uses port 443, which is the default for HTTPS, so no port number declaration is needed in the server URL. The Catalyst and Ion license keys, provided to you by Browsium, are required for production use of Catalyst and Ion. Leaving those keys blank will result in the software running in 30-day evaluation mode. However, both Catalyst and Ion functionality in the Browsium Controller will be turned off if those services are not configured with a project file pointer in the registry. See the Catalyst and Ion Admin Guides for more information on configuring these services. If the Proton Server is configured to require all clients to authenticate themselves, then the Client Registration Token (more details in Proton Server Registration section) required for authentication is entered here. Click OK and then Next to continue. If you are entering a Proton Server URL, it must be specified using HTTPS, the Fully Qualified Domain Name (or Machine Name) and port (if other than 443), followed by /server to ensure Browsium Client can communicate with your Proton server. The

41 40 Catalyst and Ion license keys must be valid keys received from Browsium (or be left blank for 30-day evaluation mode).

42 41 7. Browsium Client is now ready to install. Click Install to proceed. 8. The following screen will display to indicate success when the Browsium Client installation process has finished.

43 Confirming Browser Extension Installation To confirm the Browsium Client installation has completed properly, launch Internet Explorer and select Tools->Manage Add-ons and ensure the Browsium Internet Explorer Extension is listed and Status is set to Enabled. To confirm the Browsium Client installation has completed properly for Google Chrome, launch Chrome and open the Settings menu. Select the More Tools / Extensions menu item and verify the Browsium Client Extension is installed and the Enabled checkbox is set. You may also enter chrome://extensions in the address bar to navigate directly to the Extensions page.

44 43 To confirm the Browsium Client installation has completed properly for Mozilla Firefox, launch the browser and open the Settings menu and select Add-ons (or navigate directly to about:addons in the address bar). Select the Extensions item from the left column and verify the Browsium Proton Client Extension is installed and Enabled (which means the Disable button is visible; when Disabled, the Enable button is visible). Browsium Client can be deployed using enterprise software distribution systems, including scripting of the Proton Server URL, Catalyst License Key, and Ion License Key, along with automatically enabling the Internet Explorer and Chrome extensions. See section 5.1 for details.

45 Command Line Switches for the Browsium Client Installer Browsium Client setup (Browsium-ClientSetup.exe) supports network-based installations using Windows Installer for organizations that use software distribution systems or want to deploy via installation scripts and logon applications. Browsium Client setup passes through command line parameters to Windows Installer (msiexec.exe), and as such, is able to provide all of the standard Windows Installer command line functionality as documented by Microsoft. The constant // may be used any place the command line requires the package name. Documented below are some examples of common options: Installation Options Switch </uninstall // /x //> APPDIR=<path> SERVER_URL=<Proton Server URL> ION_PRODUCT_KEY CATALYST_PRODUCT_KEY KEEP_EXTENSIONS_ENABLED Description Uninstalls the product Installs product to a specific directory, other than the default location Installs the Proton Server URL in ConfigurationServerURL value in the registry Installs an Ion license key in the registry Installs a Catalyst license key in the registry 1 or 0. Enables the automatic management of the Browsium Client extension Display Options Switch /quiet /passive /q[n b r f] /help Description Quiet mode, no user interaction Unattended mode - progress bar only Sets user interface level, where: n - No User Interface b - Basic User Interface r - Reduced User Interface f - Full User Interface (Default) Shows help information

46 Restart Options Switch /norestart /promptrestart /forcerestart Description Do not restart after the installation is complete Prompts the user for restart if necessary Always restart the computer after installation (the default if no other option is selected) Logging Options Switch /l[i w e a r u c m o p v x +! *] <LogFile> /log <LogFile> Description Install keeping a log file, where: i - Status messages w - Nonfatal warnings e - All error messages a - Start up actions r - Action-specific records u - User requests c - Initial UI parameters m - Out-of-memory or fatal exit information o - Out-of-disk-space messages p - Terminal properties v - Verbose output x - Extra debugging information + - Append to existing log file! - Flush each line to the log * - Log all information, except for v and x options Equivalent of /l* <LogFile> Repair Options Switch /f [p][o][e][d][c][a][u][m][s][v] {Package ProductCode} Description Install keeping a log file, where: p - Reinstalls only if file is missing o - Reinstalls if file missing or older version installed e - Reinstalls if file missing or equal or older version is installed d - Reinstalls if file missing or different version installed c - Reinstalls if file is missing or the stored checksum does not match the calculated value a - Forces all files to be reinstalled u - Rewrite all user-specific registry entries m - Rewrites all computer-specific registry entries s - Overwrites all existing shortcuts v - Runs from source and re-caches the local package

47 46 Section Three Introduction to Proton Reporting In this section you will learn: More about the Proton reporting system Where to find configuration settings in Proton How to filter data and view reports in Proton

48 47 3. Using Proton Manager The Browsium Proton Manager is the front-end for Proton data reporting. The Manager also provides basic administrative tools for managing Proton clients reporting behavior Dashboard The Browsium Proton Manager s default view is the dashboard, which provides a high-level view of the latest data collected by Proton clients in the organization. By default, the charts will update in real time so long as the auto refresh option remains selected. There are 3 main elements to the default Dashboard view: the navigation ribbon on the left side, the controls bar along the top, and the chart view in the middle.

49 Dashboard Navigation Users and administrators can navigate through the Manager via this navigation ribbon. Click on any line to change the Chart View to the desired view. The navigation ribbon can be collapsed or expanded by clicking on the hamburger button in the control bar: The following screenshots show the nagivation ribbon s default view and collapsed view for Proton for each user type. Administrator Power User User Each of the options available in the navigation panel will be discussed in detail below. Proton Administrator accounts have access to view and modify three pages Users, Privacy, and Diagnostics that non-administrative users will not see. Power Users have access to view and modify the Configuration and Rules pages while (standard) Users can only view these pages in read-only mode.

50 Controls Bar The Controls Bar contains a variety of links and controls for Proton Manager. The hamburger control ( ) will collapse or expand the left-most Navigation bar. The server URL ( in the screenshot above) shows which Proton server the Manager is currently connected to. The settings control ( ) provides access to advanced features including downloading the Browsium Client, changing the password for the user currently logged into the Manager, and logging out of the Manager. Use Log out to connect to a different Proton server. User accounts and passwords are stored in the Proton server (in the database), not in the Manager. The Manager application can be used to log into various Proton servers, but only one at a time for each browser instance. If the Auto-refresh button is enabled, then any data updates made by active Proton clients will be automatically reflected in the current view (charts and graphs will update automatically when new data is uploaded and processed).

51 50 The date picker control allows you to select a date range, in UTC time, to filter Proton data in the current view. The date picker will automatically compute {Today} and {Yesterday} and replace them with month and day. Note that any given date in UTC time may be different than the date in your local time zone. The following table provides the details on what you will see for each date picker selection. Selection {Today} {Yesterday} Last 7 Days Last 30 Days This Month Last Month Custom Range Description Only data collected since 12:00 midnight UTC will be shown Only data collected between 12:00 midnight and 11:59pm UTC the day before will be shown All data collected in the previous 7 days (including today) will be shown. This is the default data filter for Proton All data collected in the previous 30 days (including today) will be shown Only data collected since the 1 st of the current month will be shown Only data collected during the previous month will be shown Allows the administrator to designate custom start and end dates for the view Once a date range is selected, the Chart View will update automatically to display only data from the user s selection.

52 Chart View The Chart View area displays the data currently selected by the navigation ribbon. By default, the Dashboard shows a high-level summary from all Proton clients per the date range selected in the date picker. This page is useful for seeing at-a-glance the breadth of connected Proton clients and their installed software (Java, Browsers, etc.). Clicking on any graph or header will navigate the user to the appropriate page to drill in to further details. These widgets can be reorganized or collapsed for user preference. Additional widgets will be added in future Proton releases

53 Clients Section The Clients section of the navigation bar provides access to detailed client data for the PCs connected to your Proton server. The five sub-pages provide client connectivity and inventory information for Status, Cloud Clients, Java, ActiveX, and Synced Files Status The Status page will display all Proton clients that are, or have, connected to the server.

54 53 You can narrow the list of clients by typing search criteria into the search bar To disable data collection from a specific client, check the box next to it in the list and click the Disable button. This will prevent that client from uploading any data in the future. Note that existing data already uploaded by that client will remain and will not be removed or filtered. Client data upload can be re-enabled by selecting the appropriate clients and selecting Enable. For a full report on a specific client, click it from the list to see a summary view of installed software, with access to additional information via the Cloud, Java, ActiveX, and Web Activity tabs. The following screenshot provides an example of a client running Windows 7 with a variety browsers installed. This client has all the Browsium modules active and Browsium extensions enabled. The Java tabs shows us the versions of Java installed on this client.

55 54

56 55 The ActiveX tabs shows us the ActiveX controls installed on this client. Web Activity provides easy access to a filtered view of the web applications access by this client.

57 Java The Java page displays a list of all Java versions installed on Proton clients throughout your organization. Clicking on any specific row will display the list of clients with that version of Java installed.

58 ActiveX The ActiveX page displays a list of all ActiveX controls installed on Proton clients across your entire organization.

59 58 The table lists all installed ActiveX controls and version information as well as a list of how many clients have that particular ActiveX control installed and enabled. In addition, Proton collects and reports on ActiveX control security data, as well as related usage/activity data for each client. Click on any ActiveX control in the table for the list of clients that have that control installed Client Registration Token And IP Filtering The Registration page shows a list of all clients registered and authorized to submit data to the server. This page is designed to provide both an active view of systems (and associated machine/user names) as well the ability to delete clients and manage the client registration process. The Client registration token section includes the ability to view the existing token or create a new token to invalidate existing tokens. The client registration token is passed by clients to the server during initial registration to authorize the request. The token value should be kept confidential. If the token has been compromised, a new token can be generated and distributed to the clients by placing the Client Registration Token (accessed by clicking View client registration token ) file in %SYSTEMDRIVE%:\programdata\Browsium\Proton folder on the machine where Browsium Client is installed. The Advanced settings option offers the ability to control if older clients or tokenless client registration is allowed. If you need to restrict Proton Server registrations to client with registration token, then turn off Allow tokenless client registration. To allow Proton 4.3 or earlier clients to connection to a 4.4 Proton server, enable Allow older clients to register.

60 59 The Client IP filtering section provides the ability to restrict client connection by IP. The feature is disabled by default, so clients can connect from anywhere. To enable the feature simply turn on the switch and enter the IP range or Single IP desired, then hit Save.

61 60 The final section on the page is to view and manage client registrations. The listing provides a view of all clients, machine IDs and users registered to the Proton server. In addition there is a button to unregister all clients. Clicking the Unregister all clients button will force all clients to reregister and provide the correct token (if required).

62 Activity Section The Activity section of the navigation bar provides access to detailed activity data for your organization s web applications. The four sub-pages provide usage reports for Web Applications, Performance, Java, and ActiveX. These reports provide very granular data in easy-to-read tables and graphs that provide key insights on a wide range of scenarios. These include reporting which web applications are most frequently accessed by which users, which applications are performing abnormally, and which web applications utilize specific versions of Java or ActiveX controls. The following sections provide a drilldown on the reports found in each sub-page Web Applications The Web Applications page provides a view of accesses to each web application, sorted by the largest number of accesses by default, along with the number of users and machines from which those accesses occurred and any script errors occurring for that web application. The script errors data collection switch must be enabled on a per-web application basis, in the Summary tab of the Activity Detail view it is off by default.

63 62 This report is comprised of a visualization of popular applications at the top (in graph form), and the full list of applications visited at the bottom (in table form) in the Accesses section. A filter at the top of each Activity page allows you to easily limit the results displayed by zone, browser, machine name or domain user, Client IP, AD Site, or User OU values: Usage Graph

64 63 Hover the mouse pointer over any element in the graph to see more information: This will display both the application / site name as well as the number of times that particular application was accessed in the date range currently being viewed Accesses View The table lists results based on filters applied and date range chosen in the date picker control: Name of unique web applications visited Number of times in total that web application has been visited Number of unique users who have visited that web application Number of unique machines that have visited that web application (as machines can have more than one user) Script errors that have been logged by users access that web application Users can find information in the list by typing relevant web application names or sub-strings in the search box. The search box is limited to searching the web application name field today. Filters can be used to filter the view by browser, zone, and many other parameters.

65 64 Click on any row in the table for detailed information about that web application. Additional details on page level activity can be accessed by clicking any row of the Activity Detail page to access the Web Application Details for a given web application. Page level Activity Detail reporting includes additional information about Document Mode, X-UA-Compatibility/META Tags, and User Agent values Browser View Selecting the Browsers view of the table will instead show which browsers, document modes, Ion profiles, and Internet Explorer Zones have been used to access the web applications Activity Detail View Proton includes a granular display of the details for every web application. Select any web application from the Access or Browsers view, then click to open the Activity Detail view. The Summary tab of the Activity Detail view includes the name and description of the web application, along with the option to edit the fields so that they re more relevant to your organization. You ll also see summary usage stats, displaying the number of accesses, users,

66 65 URLs, and user accounts (if user account tracking is enabled) during the date range selected in the data picker control. Data collection options provides granular control, per web application, for enabling collection of performance analytics, script errors, and server IP addresses. Each of these settings has a master control on the Configuration page, which must be enabled before you can enable the data collection option for a given web application. The Users tab provides details on unique user accesses, including org unit, and machine names. This information can be anonymized using Privacy Mode.

67 66 The Users tab also includes web application performance data that is collected on the client with each web application access. In this view, you can see data for web page load times for each user of the web application including the count of measurements, minimum, mean, and maximum values. Sorting by this column (descending) is an easy way to see which users are having a slower experience with this web application. You can often pick out patterns here users with the same org unit, for example. Keep in mind that the load times shown here are aggregate across all URLs in the web application, so it might simply be that some users have different usage profiles (e.g. a tendency to access more complex pages in the web app). Drilling down from here into the actual accesses will enable you to explore that data in more detail. The URLs tab includes details on rule matches (see the Rules Page for more information on rules), accesses, load times, browsers used, document modes invoked, Java versions used, Ion profiles invoked, Internet Explorer zones, and script errors. This tab also includes page load times, although the view here is grouped by URL rather than user. Sorting by page load time (descending) here will show you what URLs tend to be loaded more slowly and drilling down from here will show you the actual accesses (with all the user, component, browser, and timing data) that have contributed to the load time data that is displayed. Clicking on any row in the URLs table will display the detailed activity for that URL. You ll be presented with rows of activity data, each representing a unique access to that web application

68 67 by an individual user. Complete details of these data tables are found in the Activity for URL section of this guide. The Performance tab provides detailed graphs of accesses, page load times, and total time for each web application for the period selected in the date picker control. This is called the Performance History report and is detailed in the Performance section of this guide.

69 Activity for URL In addition to the details for a given web application, Proton offers an even greater level of detail of each page access. Clicking on any URL value in the Web Application Details page will bring up the Accesses page. The default view for the Activity for URL page is the User view, where each row provides detailed info on the URL accessed. The data includes: Date of access Activity ID (an internal Proton value to uniquely identify each navigation) Machine and User information AD Site (if domain joined) IP Address Proton assigns an Activity ID to each navigation to ensure statistical and analytical consistency when Privacy features have been enabled. The Activity ID is unique to an action but when Privacy is enabled and user/machine data is anonymized, the Activity ID ensures report and data integrity while maintaining user anonymization. The next view, Components, displays detailed access information of any extension/add-ons used on the given pages. The data includes: Date of access

70 69 Activity ID (an internal Proton value assigned to navigations) Java Version (Requested and Used) ActiveX Control (Requested and Used The Browser view provides detailed access information about the browser criteria, modes and settings used to render the given pages. The data includes: Date of access Activity ID (an internal Proton value assigned to navigations) Detailed Browser version number (if greater than IE8) Document Mode (If using Internet Explorer) X-UA Compatible Meta Tag (If using Internet Explorer) User Agent value Ion Profile used (if applicable)

71 70 Switching to the Performance view includes the same date, and Activity ID, as well as more details on specific page load timing behaviors. The Total column provides information on the total page load time (in seconds). Total page load is defined as the sum of the Fetch and Process times. The Fetch column shows the time to retrieve the page (in seconds). The Fetch value is calculated from the time the navigation begins until the response is ended. The Process column provides the time to process and render the page (in seconds). The Process value is calculated from the time the response is ended until the DOM is completely loaded Performance Understanding how web applications are performing in your environment is essential to running an efficient enterprise. Business critical web applications suffering from poor performance can have a very significant cost impact to your company from lost end user productivity and generation of support tickets. For web applications used by employees in customer facing disciplines (e.g., customer support, sales, etc.), performance problems with the web application can directly impact the customer s experience with the company and the bottom line. On the IT side, web applications that are not scaled correctly for their loads can likewise have a significant cost in time and attention of IT employees due to extra monitoring and frequent emergency maintenance activity. Proton provides a very simple and powerful set of data and insights to assist you in troubleshooting and isolating web application performance issues, as seen by the actual client endpoints in your enterprise, at a granular level. Using this data, you can determine if performance problems exists on web applications for a single user, grouping of users, geographic basis, or if the issue is impacted by time of day or even by other browsing activity. This data identifies issues and anomalies that would otherwise be invisible to existing performance monitoring solutions.

72 71 Proton achieves this by collecting detailed performance metrics, including how long each page load takes on each client PC. With this data, Proton can summarize the performance of multiple web applications, including historical and current page load times, and surface how the current load times compare with the historical average. This is displayed on the main Performance page in the Activity section. The charts on this page allow you to quickly answer questions about web application performance in your enterprise. The chart on the left (Total Time) shows the total amount of time in minutes that end users are currently spending in each web application waiting for pages to load. This is a compound measurement that takes into account both the frequency of use and the speed of the web application, allowing you to focus on performance issues for the web applications that matter most to your organization. The green bar is the expected total time, based on the historical mean, while the yellow represents the unexpected total time, in excess of the historical mean. This allows you to answer the question which frequently used applications in my enterprise are currently significantly slower than usual? and gives you the ability to drill down and find out why. The chart on the right (Accesses), shows total number of accesses for each web application. The higher the count, the more popular, or heavily used, the web application is and the more relevant it is to your organization. If you see an application with a moderate yellow bar (unexpected load time) in the chart on the left, but a very high accesses count in the chart on the right, troubleshooting may be a high priority as a lot of users, or a smaller set of very active users, are affected. Conversely, if you see an application with a large unexpected load time in the chart on the left, but a small number of accesses on the right, that tells you that this application

73 72 is currently much slower than its historical average, but not very heavily used, and therefore may be a lower priority for troubleshooting.

74 73 You can control the time interval using the dropdown above the charts. The default time interval is 5 minutes. A good practice is to set the time interval to be roughly 50% of the data push interval, set on the Configuration page. As with most charts in Proton, the underlying table is sortable by any column and will affect the chart display. By default, the table is sorted by Unexpected Load Time, with the highest first by default. When you sort the table by Total Time (descending), the charts allow you to answer the question where are my employees currently spending the most time?. You can also filter the table using the Filters at the top of the page or by searching for a specific web application using the Search box.

75 74 Selecting any row in the table will look up the activity detail for that web application, displaying the Performance History report (also found in the Performance tab within the Web Application Details View in section ).

76 75 The Performance History report is a quick and easy way to recognize patterns in performance over time for any given web application. On this page, you see a compound chart that displays number of accesses, page load time, and total time at an hourly granularity. Selecting any time period on the charts will highlight that period across all three charts and display a set of tables under the charts with the user and access details for that time period. Selecting anywhere else on the chart will de-select that time period. Because these three charts are synchronized on the axis of time, it s easy to see your usage patterns for the web application time of day, days of the week, along with the corresponding performance of the web application. For example, if you see that a web application page load time tends to increase regularly as accesses increase, you might want to look further at whether that web application is scaled appropriately for its load. These charts are also subject to the same top level filters as many other pages in Proton Manager, so it s easy to restrict the data to slices of your enterprise by geography, network topography, org unit, browser, or individual and see how the patterns change. This can help you diagnose performance issues affecting specific individuals, locations, or business units. After you have an interesting time slice identified, the tables below contain the data that you need to dive in and analyze the issue in more detail. As with other tables in Proton, you can even export the data to do more complex analytics in a tool of your choice.

77 Java With the many uses of Java, detailed reporting becomes critical. Accordingly, this report includes several breakout tabs to offer easily consumed views of the complex use cases for Java. The tab options are Activity by Version, Activity by URL, Ion Remediation, and Requested vs. Used. The Java report provides a view of all discrete Java versions used across all Proton client systems. On the Activity by URL, Ion Remediation and Requested vs. Used views, Clicking the link in the URL column will copy that value to the clipboard. Clicking any other data in that row brings up the Access detail page view for that URL Java Activity by Version The default view for this page is Activity by Version: Each row represents a unique Java version. Clients indicates the total number of clients that have that version of Java installed. This is useful for answering the question What s the most prevalent version of Java installed in my org? Times Used is a count of how many times that version of Java has been instantiated by clients. This is useful for answering the question What s the most used version of Java in my org? The Used by Apps column indicates the number of distinct applications that have used that version of Java. This is useful for answering the question What is the version of Java that most applications use?

78 Java Activity by URL Each row represents a web application as a group of URLs, all of which are broken out within the grouped row. URL is the specific and detailed list of all URL associated with the specific web application. The Version column displays which Java version was used by the specified URL. Clicking this item brings up the Access detail page view for that URL. Clients indicates the total number of clients that have that version of Java installed. This is useful for answering the question What s the most prevalent version of Java installed in my org? The Accesses column displays the number of times that URL was accessed Java Ion Remediation Browsium customers using Ion for Java management require this report to understand where Ion is used to replace Java versions for specific web applications. Each row represents a web application as a group of URLs, all of which are broken out within the grouped row.

79 78 URL is the specific and detailed list of all URL associated with the specific web application. Ion Profile indicates the name of the Ion Profile that was used to invoke a specific version of Java. Note that Ion Profile will only be displayed for Full profiles, not Limited Java profiles. The Version column displays which Java version was used by the specified URL. Clicking this item brings up the Access detail page view for that URL. Clients indicates the total number of clients that have that version of Java installed. This is useful for answering the question What s the most prevalent version of Java installed in my org? The Accesses column displays the number of times that URL was accessed Java Requested vs. Used Each row represents a web application as a group of URLs, all of which are broken out within the grouped row. URL is the specific and detailed list of all URL associated with the specific web application. The Requested column indicates the version of Java requested by that specific web application/url. The value in Requested may be listed as Not Specified, which indicates the web application indicated a generic value for Java rather than a specific version value ID. The Used column indicates the version of Java actually used by the client for that specific web application/url. Clients indicates the total number of clients that have that version of Java installed.

80 79 Some Java web applications will request a specific version of Java be used, but if that version is not available, the default version of Java will be run instead. This may explain why the versions of Java requested vs the versions of Java used are different in your organization Java Applications by Version New to Proton 4.1 is the ability to track Java usage instantiated from within the browser but running outside as a standalone application. Some examples of these applications would be applications launched using Java Web Start ActiveX The ActiveX Usage report provides a view of all discrete ActiveX controls installed on any Proton client systems, including ActiveX control security values. The data can be viewed in several different ways, based on Activity usage.

81 ActiveX Activity by Control The first view provides a row by row listing of each ActiveX control and the following specifics: Detailed version number Number of client systems on which it is installed Number of times that control was accessed by any visited web application Number of unique web applications where the ActiveX control was accessed Security marker values for the given control: Safe for Scripting and Safe for Initialization Click any row in the report for more detailed information about that particular ActiveX control:

82 81 A filter at the top of the chart allows users to easily find Java versions as instantiated by zone, browser, machine name or domain user, Client IP, AD Site, or User OU values: In addition, columns can be sorted in ascending or descending order by clicking on the arrow sort button next to the column label ActiveX Activity by URL This view provides a view of the ActiveX control data by URL, enabling an easy way for administrators and security staff to see what is required (or requested) for a given web application. The items on this view are: Web application (name if defined, otherwise the TLD) URL (detailed path value) Name of the ActiveX control referenced Specific version of the ActiveX control loaded Number of client systems on which the ActiveX control was used

83 82 Number of accesses for the given URL Clicking the detail in a row brings up the Access view page for the given URL ActiveX Requested vs. Used Another way Proton can help an organization is through audit and compliance validation. The Requested vs. Used report provides a navigation level view of which ActiveX controls were requested by a given URL, correlated to that control actually being loaded. This data is essential to ensure validation of internal controls, as well as provide a resource when attempting to investigate when and where a specific control is needed so the use can be locked down or eliminated. The data in this chart includes: Web application (name if defined, otherwise the TLD) URL (detailed path value) Name of the ActiveX control referenced Specific version of the ActiveX control loaded (or not used ) Number of client systems on which the activity occurred Clicking the detail in a row brings up the Access view page for the given URL.

84 83

85 Rules Page The rules engine allows Proton administrators to either ignore specific web applications or map a URL to a specific web application. Enabled rules are applied to all Proton clients and are processed and updated on clients each time they report data to the Proton server. By default, no rules are enabled or configured in Proton. To add a new rule, select the New Rule button. Two types of rules supported in Proton: Map and Ignore. Map rules allow Proton administrators to assign URLs to a specific web application. This is useful when a single Web application has multiple URLs and allows the administrator to make them appear as a single web application in the Proton reports. Ignore rules allow Proton administrators to filter out web applications that are of no interest, for example search web sites such as Google.com, Bing.com or Yahoo.com. You may want to exclude a range of activity to categories of sites, such as social media or search engines, etc., accessed by Proton clients. Proton enables you to define multiple Map or Ignore rules in one step. To upload a premade or custom set of rules, select the Upload Rules button. When uploading rules, be sure to select the desired append or replace option. Selecting Append new rules will add any rules after all existing rules. Replace all rules will overwrite any existing rules, without additional warning. The bulk rules file should be in tab-separated format with each line having the following fields: Match string, Match type (simple, regex or Zone), Action (map or ignore), Enabled

86 85 (0 or 1), Web application name (blank for ignore rules), and Description (optional). The format of the upload file is the same as the Full Export option available on the Rules page Building a rule The rule builder allows great flexibility in building a rule: Match Type allows you to select between a simple match or a SQLLike match. Simple matches to simple prefix matching, e.g. will match any URL under but will not match a subdomain like maps.google.com. In SQLLike, a specific character string is matched to a specified pattern. A pattern can include regular characters and wildcard characters. During pattern matching, regular characters must exactly match the characters specified in the character string. However, wildcard characters can be matched with arbitrary fragments of the character string. Please refer to Microsoft s documentation of LIKE Operator under T-SQL at Enter the appropriate URL or URL fragment in the Match String field, e.g., google.com. For Map rules, you are then presented with a list of web applications that have already been reported by Proton clients in the system, or you can enter a new name to represent a new web

87 86 application. Ignore rules are not associated with existing web applications and this option does not appear for Ignore rules. A specific rule can be enabled or disabled at any time by flipping the Enabled button. The default for a new rule is Disabled, so be sure to enable the rule prior to saving changes. Finally, enter descriptive text for any new rules (to help administrators identify rules) and select the Save changes button. Once saved, Rules will appear in the view: Editing a rule Existing rules can be modified by using the four buttons: From left to right, these buttons are Edit, Delete, Move up, and Move down. Edit will allow the administrator to modify the behavior of that particular rule using the same rule building UI used to create the rule. Delete will permanently delete the rule from the list. For rules that you wish to temporarily remove, it is recommended that you simply disable them (via the Edit button) so they can be easily restored when necessary. Rules are executed in order that they are listed, from top to bottom. As soon as a rule match is found for a specific web application, that rule takes affect and subsequent rules are ignored. For this reason, you should make sure that the rules are in the correct order; typically, from most specific (at the top) to most general (at the bottom). Use the Move up or Move down buttons on the rule list to re-order your rules.

88 87

89 Configuration Page The Configuration page allows Proton administrators and power users (but not standard users) to control client configuration settings (for heartbeat, data push, and inventory), data retention settings, cloud service definition settings, data collection options, and cloud file data collection (uploads and synced files) Client Configuration For the Client Configuration options, administrators can specify the frequency in which Proton clients will interact with the Proton server. Standard Proton user accounts will not be able to view or modify the settings on this page. The available settings for Client Configuration are as follows. Note that there are different defaults for a Full Install of Proton server vs. Proton Express. The full Proton server is designed to

90 89 scale to a large number of client systems, with higher Client Configuration values adding to the server s scalability. Proton Express uses much lower defaults as it s designed for evaluation only and near-real-time data collection will enable evaluators to experience the capabilities of Proton much more quickly. Value Description Proton Server Default Heartbeat The interval at which clients poll the server (for new interval settings, rules, etc.) Data push The interval at which clients push data to the interval server. Inventory interval The interval at which clients perform an inventory of installed ActiveX controls, Java versions, etc. Proton Express Default 5 minutes 0.1 minutes 60 minutes 0.1 minutes 1440 minutes 0.5 minutes Data Retention Proton offers the ability to define data retention policies to support organizational or regulatory compliance requirements, as well as serve to ensure organizations have the ability to limit unbounded growth of the Proton dataset. The default settings for Proton are to automatically delete data on a rolling 90-day window, each night at midnight. The values can be adjusted by using the drop-down menu. Alternatively, data retention policies can be entirely disabled by switching the button to the left (off) position. If no data retention policy is defined, the data set will continue to grow, eventually resulting in certain Proton reports taking an extended time to display Data Collection Options Data Collection Options provide the ability to control what data is collected from client systems. This provides the ability to turn on or off the collection of Java inventory (versions installed), Java usage details, ActiveX inventory (controls and versions installed), ActiveX usage details, page

91 90 load performance metrics, server IP addresses, and script errors. All options are enabled by default. The first four, Java inventory, Java usage, ActiveX inventory, and ActiveX usage,, are globally controlled, either on or off for all clients and web applications. The last three, performance analytics, server IP addresses, and script errors, have a global control with more granular control per web application. When enabled on the Configuration page, performance analytics and server IP address data collection defaults to enabled for each new web application. However, script errors and user accounts work differently. When enabled on the Configuration Page, the per-web-application script errors setting will default to disabled and must be manually enabled for each web application. This is done to minimize extraneous and potentially private user data. In the case of script errors, many web applications generate harmless script errors in various browsers, so this feature should be turned on only for web applications where you re investigating specific error conditions reported by users or testers.

92 Users Page The Users page allows Proton administrators to view and control the list of approved Proton user accounts. Proton User and Power User account types are not able to view this page. See section for details on the pages each account type has access to. User account requests are made by end users at Manager login screen see section Pending requests can be approved by clicking on the pending account name and then selecting the Approve button. Accounts can be promoted to administrator or power user status (or demoted to user status) by clicking on the account name and selecting User, Power User or Administrator. After the initial installation of Proton Server, the first account created is automatically promoted to administrator status. Select a user account to modify it. Select Edit to change the user account type.

93 Password Policy Management Proton has a range of user account password policy management features, some configured by default (which can be modified) and others that are off by default but can be enabled by a Proton administrator. Password policies can only be configured in the Web.config file on the Proton server, not in Proton Manager. More on how to locate and edit the Web.config later in this section. Proton provides password and login policies for the following attributes: Session Timeout sets the number of minutes until an idle session of Proton Manager ends and displays the logon screen. The Web.config attribute is timeout, located in the system.web/authentication/forms section. The default value is 2880 minutes (2 days). Minimum Required Password Length sets the minimum length of the password The Web.config attribute is minrequiredpasswordlength and the default value is 8 characters. Minimum Required Non Alpha Numeric Characters sets the minimum number of special characters that the password must have. The Web.config attribute is minrequirednonalphanumericcharacters and the default value is 1 character. Maximum Invalid Password Attempts sets the maximum number of invalid password entries before the user s account is locked out. The Web.config attribute is maxinvalidpasswordattempts and the default value is (virtually unlimited). Password Attempt Window sets the number of minutes to keep track of invalid password attempts. After the window has expired, the number of invalid password attempts is reset. The Web.config attribute is passwordattemptwindow and the default value is 1. Password Expiration sets the number of days until a new password expires, forcing the user to change the password before logging on. The Web.config attribute is PasswordExpiration and there is no default value for this attribute. Password Strength Regular Expression sets a regular expression that every password must match. This can be used to set custom password policies. The Web.config attribute is passwordstrengthregularexpression and there is no default value for this attribute. You ll find a series of regular express examples in the Web.config file. An example using many of the above attributes is: minrequiredpasswordlength="12" minrequirednonalphanumericcharacters="1" passwordstrengthregularexpression="(?=(.*[a-z]){1,})(?=(.*\d){1,})"

94 93 The preceding example sets a password policy requiring that all passwords be at least 12 characters long and contain at least one upper-case letter, at least one digit, and at least one special character. When the passwordstrengthregularexpression attribute is used, you should set an InsecurePasswordMessage in the appsettings element in Web.config so that your users will know what the password requirements are. The default InsecurePasswordMessage is The password must be at least <minrequiredpasswordlength> characters long and contain at least <minrequirednonalphanumericcharacters> special character(s). To locate the Web.config file on your Proton server, navigate to C:\Program Files (x86)\browsium\proton\server\sites\server (or C:\Program Files\ if you re using a 32-bit Windows server). You ll find Web.config in this directory. It can be edited with any text editor, including Notepad. Familiarize yourself with the various sections of Web.config as the entries to control the password configuration outlined earlier in this section are found in various places inside the file. Once you ve made your edits to Web.config, save the file. IIS will automatically restart with the web service to immediately apply your new configuration. If you deploy Proton across a farm of load-balanced web servers, you ll need to make the same changes to Web.config on each server to ensure the password policies are enforced consistently. To simplify this process, change Web.config on one server and copy the file to the other servers in your server farm. Note: This guidance assumes all web servers are communicating with a single Proton database. Web.config is replaced when upgrading to a new version of Proton Server. You ll need to save a copy of your Web.config file (or keep a separate document with the edits you have made) before upgrading and apply your custom settings to the new file. You should not assume that the old Web.config file will work on the new version of Proton as other aspects of Web.config may have changed to support new features in Proton.

95 Privacy Page Proton includes a Privacy mode to comply with certain international regulations on tracking specific activity to specific users. When Privacy is enabled, Proton will remove all information that can be used to trace user activity back to an individual. Proton will remove all personally identifiable information from all client user accounts that meet any of the criteria established in the Privacy settings. Privacy is disabled by default. To enable Privacy for all client user accounts, select the Privacy enabled for all users button. Then select the scope either Anonymize users to only anonymize user names and IP addresses, or Anonymize users and machines to also anonymize machine names. Then Save Changes to commit the Privacy setting. This will anonymize all client user accounts, IP addresses, and (optionally) machine names for all activity from this point forward. It will not retroactively anonymize any prior activity. If you ve already collected activity data, it will remain in the database and be visible on reports until that data is purged by the data retention policy settings.

96 95 Anonymized activity data will be evident in three fields: User, IP Address, and (optionally) Machine. In the example below, the user who accessed has been anonymized to Anonymous155. (The next anonymized user seen by this Proton server will be Anonymous156.) The IP Address has also been anonymized, zeroing out the last octet. Machine anonymization is not enabled in this example. Maintaining unique anonymized user and machine names is key to Proton s ability to track access counts and other data for each web application used by your organization. So while the activity can t be tracked to an individual user, it can be correlated with other data to help you to make informed decisions when managing your web browser and web application environment. To enable more granular control over which client user accounts are anonymized on your Proton server, select the Privacy enabled for some users button. This expands the controls available on the privacy page.

97 96 You now have the ability to limit the privacy settings by Organizational Unit, Active Directory Sites, or IP Address ranges. You can read from existing data to add OU or AD Sites filtering, or add new entries based on your knowledge of your Active Directory structure. You can add multiple IP address ranges by clicking the Add Range button.

98 Diagnostics Page The Diagnostics page provides administrators with information on the internal health of the Proton system and processes. This data is useful for administrators to review for troubleshooting, and may be required when contacting Browsium support. Value Data retention Process incoming activities Rule mapping Description The data retention process is set by default to run at midnight each night. This item shows the status of the data retention enforcement and cleanup process. Proton performs regular indexing and aggregation of incoming client data. This item shows if the aggregation process is performing properly or if maintenance or intervention is needed to correct a system error condition. As needed, customers can modify and re-sort the Proton rules. When the rule structure is modified, Proton processes the new ordering and re-indexes (as needed) the dataset. This value shows the status and health of that process. When an error condition occurs, the task switches to status Error. The task will remain in status Error until the task runs again without triggering an error. However, the Last Error Message will remain indefinitely so Proton administrators can see the most recent error, even if status returns to OK. The Last Error Message can be cleared from the Diagnostics display via the green Clear last error button. However, all errors are written to the Browsium log in Event Viewer so you can retain a copy for future troubleshooting. When a task has an active error, you ll also see the status on the Proton Dashboard in the System Status section.

99 98

100 99 Section Four Proton Tutorial In this section, you will learn: Best practices for configuring your Proton Server

101 Tutorial 4.1. Connecting to Proton Manager for the First Time Congratulations on getting setup and ready to go with Proton. While Proton was designed to be easy to setup and use, this section can help answer questions that may come up when using Proton the first time. This section focuses on getting started with Proton Manager, including finding the server URL, creating user accounts, and other basic elements on the administrative side of the system. Some of the connection settings and experiences differ between Express and Full Install and any specific issues for a given version will also be addressed here The Hosted Proton Manager By design, the Proton Manager web application should be accessed via the hosted Proton Manager at This approach ensures you receive the best user experience possible, have access to the most recent reports and product features, as well as avoid maintaining additional software in your organization. Unless directed by Browsium Support, you should not select the option to locally install the Proton Manager application during the setup process. This section addresses issues only when Proton Manager is being accessed via the Proton Manager on browsium.com Connecting to the Proton Manager Accessing the administrative console and reporting screens of the Proton Manager is easy. All you need is a modern browser (latest Internet Explorer, Edge Chrome, or Firefox recommended), the Proton Server URL (configured during setup) and lastly, network access to both the Internet (to reach proton.browsium.com/manager) and your Proton Server (to access your server data). During installation, an Internet shortcut (.lnk file) is created on the server to enable easy access to Proton Manager for your server. This shortcut connects to Proton Manager while setting the managed Proton Server to the one for your organization. To access the Proton Manager from other systems, or to provide access to other administrators, simply provide the shortcut.lnk file. While.lnk files are very helpful when accessing a web server with a complex URL, systems typically block these files. Therefore, sharing them with other administrators of your Proton Server can be difficult. The following paragraph provides an alternative for sharing this URL.

102 101 Another option for sharing the Proton Manager URL with other administrators is to provide the shortcut URL itself rather than the.lnk file. The URL is: where SERVERNAME is the machine name (or Fully Qualified Domain Name) of the Windows system where you installed Proton and PORT is for Proton Express and 443 for a full install of Proton Server. If you are using port 443, you can leave PORT blank as 443 is the default port for all HTTPS traffic. SERVERNAME and PORT are referenced in the following sections using the same definitions used above Self-Signed Certificate Errors Proton Express setup automatically create a self-signed certificate used to encrypt communication to and from the Proton Server. The Full Install of Proton Server supports the ability to specify either a self-signed certificate or one signed by known authorities. During the secure connection process with the Proton Server, Proton Manager may trigger certain browser error notifications if the Proton Server was installed with a self-signed certificate and the Manager is being accessed from a system not running Proton Server. Both Express Install and Full Install installs the certificate on the local system, so access to the Manager from that system will not generate these errors. For the best remote management experience, perform a Full Install of Proton Server using certificate signed by a known authority. The following error message is generated by the Proton Manager to validate the secure connection to the Proton Server when the Proton Server is using a self-signed certificate. Click Verify to complete the validation and then log into the Proton Manager.

103 102 Other certificate errors you may experience only impact connections to the Proton Manager. The errors can be safely bypassed without creating any security exposure or risk to the organization once the certificate details have been verified as indicated below. Internet Explorer users may see this certificate error if the certificate is self-signed: Click the More Information link to verify the URL (IP address or name), then click Continue to this website if the details are correct. When viewed with Google Chrome, the certificate error screen looks like this:

104 103 Verify the URL (IP address or name) is the right location, then click the Proceed link to continue. Users should only see these certificate errors once for each browsing session when connecting to the Proton Manager Creating the First Account Once connected to Proton Manager, user accounts are required for access control. Administrator, Power User, and Standard User account types are possible. The first account created will be an Administrator. Select the Create an account button the first time you access Proton Manager. Proton Manager accounts are stored in Proton database and self-contained. Single Sign- On (SSO) access is not supported at this time. Contact Support for more information.

105 104

106 105 Then create a username and password, using a well-formed address for the username and a strong password. Then select Register. The default Proton password policy enforces a minimum of 8 characters, including 1 special character. Supported special characters are ] [? / < ~ # $ % ^ & * ( ) + = } : " ; ', > { To change the defaults and enforce stricter password policies, including account lockout and password expiration, see Password Policy Management in the Users Page section. Once your account is created, you ll be able to log in directly with the credentials you created.

107 106 Additional accounts can be created using this same screen and permission levels are managed on the Users page in Proton Manager Exporting Proton Report Data Views The data and insights Proton can provide an organization have a broad set of uses and value to numerous teams. To enable easier sharing or integration of the data sets into other applications and existing internal reports, Proton offers several export options of the currently active view: - Copy to Clipboard - Save as CSV - Print Any of these export options can be accessed by clicking the Page Export button in the Export Bar interface to the right of the Search box. You may also export the entire dataset for the current report to CSV only using the Full Export button. Exported data will be in the same layout and format as the on-screen report. Column headers, ordering and labeling is preserved in the export. CSV exported data contain a header row defining the columns. The Copy (to clipboard) option contains all text, but formatting is lost due to limitations of the copy/paste process. The Export View feature is available on any of the Client, Activity and Rules pages.

108 Creating Rules Once Browsium Proton has been installed on your server, and you ve installed Browsium Client on a few client PCs (configured to communicate with your Proton server via the ConfigurationServerURL registry key), you can begin creating rules. Rules serve two functions: 1) Map rules govern web application mappings to make it easier to combine and track accesses to specific web applications. 2) Ignore rules allow you to choose sites to ignore, so they don t appear in activity reports and are no longer sent from Proton Clients to the Proton Server Create and Test a Map Rule Map rules are very useful if you have web applications that have complex or non-obvious URLs. Map rules allow you to create a friendly name for those URLs so they re much easier to read and analyze in Proton s activity reports. For this example, we have identified a website, yourang.us, which has a number of web applications, each performing a different function. YouRang also has a few web applications that use non-continuous URLs that is, the same application has a few unique URLs (/order_phone.htm and /purchase_phone.htm) that cannot be easily string-matched to aggregate them into a single view of usage of that application. Map rules will be very helpful in turning a variety of end user accesses of this section of the YouRang website into meaningful information. To create the map rules needed for the YouRang phone ordering application, use the following steps: 1. Visit the Rules node of the Proton Manager 2. Select New Rule to create a new rule.

109 The New Rule dialog pops up with its default values. 4. Keep the default values for Action: Map and Match Type: Simple, and enter yourang.us/order_phone.htm (without quotes) as the Match String. Then choose New web application for the Map to Web Application value and enter YouRang Order Phone with an appropriate description. Enable the rule, and add a description for the rule.

110 Next, repeat the steps above for the purchase_phone.php page, assigning it to the web application YouRang Order Phone created in the prior step. 6. We now have two map rules, aggregating all accesses to yourang.us/order_phone.htm and yourang.us/purchase_phone.php to a single web application called YouRang Order Phone. 7. Viewing the Activity node and filtering the view to the Order Phone application shows us the aggregate results, at both the summary and detail level.

111 Create and Test an Ignore Rule Ignore rules are very useful if you have users accessing websites that you don t want to track in Proton (such as social media or e-commerce sites though many organizations would love to know how much of that activity is happening during work hours). Another common scenario for ignore rules is to ignore accesses to the Proton Manager as that traffic can dwarf accesses to other web applications if you re accessing the Manager multiple times a day to view reports or monitor Proton tracking activity in your organization. For this example, we will create an ignore rule for our Proton Manager using the following steps: 1. First, let s have a look at the traffic to our Proton Manager without an ignore rule. We can do this by searching for the string proton in the Activity page. We see a single access by 1 user. 2. Now let s create some ignore rules. Select New Rule to create a new rule.

112 The New Rule dialog pops up with its default values. 4. Next we ll change the Action from the default Map to Ignore. We ll leave Match Type as Simple. For the Match String, enter the server URL. For this example, we ll use protondemo.browsium.com. We ll set the rule to Enabled and give our rule a description.

113 After saving changes, we visit our Activity node and again search for activity containing the text proton. No results are found, thanks to our ignore rule. Ignore rules not only suppress activity from the Activity reports, but they also instruct Proton Clients to no longer send activity to the server that matches the ignore rule. It s important to note that data already stored in the Proton Server is not deleted by an ignore rule; it s simply invisible to reports.

114 113 Section Five Browsium Client Deployment in the Enterprise In this section you will learn: How to use Group Policy to manage Proton extension settings for each browser To automatically enable and lock down the Proton extensions on remote systems To configure other settings to improve the Proton experience for end users

115 Proton Deployment in the Enterprise Like any enterprise software deployment, Proton deployment in the enterprise requires careful planning. This begins with the Browsium Client, which is designed to be centrally deployed and managed by IT, and be completely invisible to end users. Proton configuration information required by the Browsium Client, such as how often to send inventory and browsing activity data to the Proton server and which sites to ignore (not send to the server), is centrally managed on the Proton server. So once the Browsium Client is installed on all PCs in the enterprise, and configured with the URL of the organization s Proton Server, no additional direct management is necessary. However, readying client systems for central management requires a bit of planning. To communicate with your organization s Proton server, the Browsium Client must be deployed to end user PCs with the Proton server URL. This can be set during installation or via a postinstallation registry edit using desktop management tools or Group Policy. In addition, the Browsium Client extensions for Microsoft Internet Explorer, Microsoft Edge, Google Chrome, and Mozilla Firefox must be enabled and (optionally) locked down so end users don t disable or remove them. In this section, we ll examine the best practices for enterprise deployment of the Browsium Client and provide guidance for enabling and locking down browser extensions.

116 Deploying Browsium Client The Browsium Client is automatically installed on systems running Proton Express for easy, onebox evaluation and testing. Proton Express supports up to 50 clients, so you ll want to plan your client deployment to make the evaluation process easy for your organization. The full install of Proton Server does not install the Browsium Client, but makes it readily available to install throughout your organization with a reasonably sized server supporting up to 10,000 clients. (Multiple servers can be grouped together in clusters to scale to hundreds of thousands of clients.) To get the most out of Proton, you ll want to install Browsium Client on every PC in your enterprise. This is easy to do using Browsium-ClientSetup.exe and some careful planning. Proton seat licenses are required for each PC so check your Browsium license agreement before deploying. It is assumed that the reader of this guide is familiar with enterprise deployment of client software and has available tools to perform a scaled deployment. Section 2.5 of this guide details the command line switches available when installing Browsium Client in an enterprise environment. These options range from silent installation with no installation user interface visible to end users to pre-configuring the Proton Server URL in the client registry Installing Browsium Client To deploy Browsium-ClientSetup.exe, along with the Proton Server URL, there are two simple steps: 1) Retrieve a copy of Browsium-ClientSetup.exe from the Browsium Proton zip file you received from Browsium, the Proton Manager web page, or from the Proton Program Files directory where you installed Proton Express or Proton Server. This is found in C:\Program Files (x86)\browsium\proton Express\Server\Sites\Server for Proton Express and C:\Program Files (x86)\browsium\proton\server\sites\server for Proton Server. 2) Identify the URL to your Proton Server to include in your installation command line script as the value for SERVER_URL. This URL must be the Fully Qualified Domain Name and port (if other than 443). You may leave this blank and add it later via Group Policy, as detailed in section The SERVER_URL value must end with the /server so the clients can communicate with the Proton server. Failure to set the SERVER_URL value properly may result in errors or unexpected client performance.

117 116 The following example will install Browsium-ClientSetup.exe with a Proton Server URL in quiet mode with no user interface. This command can be scripted to deploy to hundreds or thousands of client PCs using a variety of enterprise management tools. Open Command Prompt as Administrator, enter the path to Browsium-ClientSetup.exe (located in C:\Browsium in this example), add the /qn switch, and substitute the SERVER_URL value with your FQDN/server. Include :<your server port> before /server if using any port other than Enabling Browsium Client with the Proton Server URL To facilitate client deployment scenarios, Browsium Client can be deployed in a dormant state. By default, all Browsium Client installations will be dormant until a Proton Server URL value is defined in the registry (or a Catalyst or Ion configuration file pointer in the appropriate LoadFromFileName registry entry). Setting SERVER_URL at install time will populate the ConfigurationServerURL registry value and Browsium Client will be immediately enabled for communication with your Proton server. If no SERVER_URL value is passed during the client installation, or no value is set using Group Policy, the Browsium Client processes will silently terminate immediately after startup and failing to find this value (unless Catalyst or Ion configuration file pointers are found in the registry). This option is especially useful for organizations to deploy the Browsium Client during a maintenance window and then activate the clients at any time outside that period. To activate Browsium Client at a later time, populate the appropriate registry key location and value. The Proton service will activate automatically when Browsium Controller starts (at reboot or user logoff/logon) and detects a ConfigurationServerURL value in the registry. Proton follows the standard Windows registry hive precedence hierarchy to load the configuration that will be used on a given end user system. Once a valid configuration is found, Proton will stop searching and that configuration will be used. Deploying different Proton server URL values on a single PC may cause unpredictable results as only the configuration highest in the hierarchy will be used.

118 117 The following table provides the hierarchy of Proton Server URL precedence in the Windows registry. The string (Wow6432Node) in the registry path denotes the Wow6432Node registry key that will be included in the path on 64-bit Windows systems. 32-bit Windows systems do not contain this key, hence the use of parentheses in the example. HKEY_LOCAL_MACHINE\SOFTWARE\(Wow6432Node)\Browsium\Proton\ConfigurationServerURL Proton Server URL for all user accounts, deployed via Browsium Client installation. HKEY_LOCAL_MACHINE\Software\(Wow6432Node)\Policies\Browsium\Proton\ConfigurationServerURL Proton Server URL for all user accounts, deployed via registry editor or Group Policy. HKEY_CURRENT_USER\Software\Policies\Browsium\Proton\ConfigurationServerURL Proton Server URL for current user, deployed via registry editor or Group Policy. This registry location may be deprecated in a future release. The following example shows ConfigurationServerURL populated during Browsium Client installation (1 st in the hierarchy above). This next example shows ConfigurationServerURL populated by Group Policy (2 nd in the hierarchy above).

119 118

120 Managing the Browsium Client Browser Extensions It is important to develop a strategy to properly deploy and manage the Browsium Client software on end user PCs. As part of your strategy, two important system configuration options should be considered. The first is to ensure the Browsium Client browser extensions are enabled for all browsers on each client PC. This is a must as the Browsium Client will not capture or send data to the Proton Server without the extensions enabled. The second is to block end users from disabling or removing the Browsium browser extensions once they ve been enabled. This is optional but highly recommended. These important configuration options can be managed by Group Policy in both Internet Explorer and Google Chrome. Mozilla Firefox does not natively support Group Policy today. Alternatively, you can manage the enforcement of the browser settings for Internet Explorer and Chrome by adding or changing registry settings manually. To modify settings manually in the local PC registry, administrators will need to use a registry editor. The default Windows registry editor which must be launched from the Run command is regedit.exe. For a large organization, registry edits can be scripted and applied using a variety of enterprise management tools. The remainder of this section covers management of the Browsium Client browser extensions Enable the Browsium Internet Explorer Extension via Group Policy Recent versions of Internet Explorer require user confirmation before any new extension (or add-on ) is enabled, unless that extension is set to enabled during the deployment process. The most common way to enable the Browsium Internet Explorer Extension during deployment is by utilizing Group Policy to make the necessary registry changes on client PCs. Alternative methods to modify the registry on client PCs, such as using a registry editing tool, a Visual Basic Script or making the changes to the registry with software distribution tools. Group Policy - Understanding the Add-on List Policy Administrators can control the use of specific browser extensions through the add-on list policy. Administrators can choose to enable or disable an extension as well as allow a specific extension to be managed by the user. Policy Name: add-on list

121 120 Path: User Configuration or Computer Configuration node; Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management. To set this policy, an administrator can enable the policy and enter the GUID/CLSID of the Browsium extension to the Add-on List and set the value to 1. Determining the GUID/CLSID of the Browsium Internet Explorer Extension After installing the Browsium Client, go to the Tools menu in Internet Explorer and choose Manage add-ons.

122 121 You ll then be presented with the Manage Add-ons interface where you should see Browsium Internet Explorer Extension in the list among the Toolbars and Extensions that are currently loaded in Internet Explorer. Right Click on the Browsium Internet Explorer Extension and choose More Information from the dropdown menu. The CLSID, (Class ID) will appear in the dialog box. Click the Copy button and then paste the contents of this dialog box (including the Class ID) to Notepad for later reference and save the text file. When you make the registry changes documented above, you will need to use the Class ID to identify the extension in the policy. To set this policy with a manual or automated registry entry, an administrator can create a registry value based on the GUID/CLSID of the extension in either of the following keys and then

123 122 set the desired value. When you enter the GUID/CLSID be sure to include the open brace at the beginning and the close brace at the end. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{CLSID} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{CLSID} Each add-on is a value in this registry key with the following properties. Name: GUID of add on which is {B3A6DA E9-AF2E-52F4FF155B9D} Type: REG_SZ Value: 0 - Add-on is disabled and cannot be managed by the end user. 1 - Add-on is allowed and cannot be managed by the end user. The Add-on (CLSID) lists are empty by default.

124 Enable the Browsium Client Extension for Google Chrome To ease your Group Policy setup, several templates can guide you through the configurable options. Group Policy templates, and associated guidance, are provided by Google and can be found on Google s support site. You may find additional settings (beyond those documented here) that you may wish to enforce or enable based upon your organization s preferences. By default, Chrome automatically disables all extensions that are side-loaded (installed by a 3 rd party program, like the Browsium Client installation package), requiring users to enable them manually. The only way to centrally enable the Browsium Client Extension for Chrome for enterprise deployment is via Group Policy for domain-joined systems. The policy Configure the list of force-installed extensions (a.k.a. ExtensionInstallForcelist) allows you to specify a list of extensions that will be installed silently and enabled by default, without user interaction. This policy also works for side-loaded extensions, effectively overriding the default behavior in Chrome. Each item of the list is a string that contains an extension ID and an update URL, separated by a semicolon (;). The extension ID is the 32-letter string found e.g. on chrome://extensions when in Developer mode. The update URL must point to an Update Manifest XML document as described at Note that the update URL set in this policy is only used for the initial installation; subsequent updates of the extension will use the update URL indicated in the extension's manifest. For each item, Google Chrome will retrieve the extension specified by the extension ID from the update service at the specified update URL and silently install it. Users will be unable to uninstall extensions that are specified by this policy. If you remove an extension from this list, it will be automatically uninstalled by Google Chrome. Extensions specified in this list are also automatically whitelisted for installation; the Configure extension installation blacklist (a.k.a. ExtensionInstallBlackList) does not affect them. A by-product of the ExtensionInstallForceList policy is that managed extensions are silently installed in Chrome, enabled by default, and block users from disabling or removing them. This is desired for enterprise deployment of Browsium Client. If this policy is Not Configured, users can delete any extension in Chrome, including Browsium Client Extension, from the Extensions page. This is undesirable, as side-loaded extensions that are deleted are automatically blacklisted and re-enabling them is tricky (but achievable). Contact Browsium Support if this happens.

125 124 To force-enable the Browsium Client Extension for Chrome, and lock it down so users can t disable or delete it, you will use the Configure the list of force-installed extensions policy. This process requires an XML Manifest, which references the Proton extension s.crx file. Both must be available on a server or in the Chrome web store. Browsium is hosting these files for all customers on browsium.com. Follow these steps to ensure that this method is properly configured using Group Policy for your domain-joined systems. These instructions assume you re using the ADM template. The Group Policy location will change if using ADMX. As of Chrome 33, the ExtensionInstallForceList policy is only enforced for domain-joined systems. All client PCs in your environment must be joined to a Windows domain or you will not be able to centrally manage the Browsium Client Extension. Attempting to configure ExtensionInstallForceList via the Local Policy Editor will result in unpredictable behavior of the extension. 1. Install Browsium Client software. 2. Download the Group Policy templates for Chrome from the Google support site. 3. Import the Google Chrome Group Policy template into your Group Policy editor. 4. Enable the policy Configure the list of force-installed extensions. 5. Enter the following value by selecting the Show button in the Options window and apply the setting. (This is the Browsium Client Extension ID followed by the URL for the manifest XML document, with no spaces in the string.) hapohonmkgjaeinnoibbjanenodbdlpd; The Browsium Client Extension for Chrome may have a different version number from the other Browsium Client and Proton components as maintenance versions are released. See the version number section of the Proton Version History KB article for details on the release date and version number for the Browsium Client Extension for Chrome Enable the Browsium Client Extension for Mozilla Firefox Mozilla Firefox does not allow client software to install an extension and enable it by default. Nor does it contain a centralized management facility to keep users from tampering with

126 125 extensions like Internet Explorer and Chrome. However, Browsium Client includes a facility to automatically enable the extension every time the user logs onto the system, so administrators can ensure that the Firefox extension is always enabled. To enable the Browsium Client Extension for Firefox automatically, create the following registry value: for 32-bit Windows systems: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Enable Browsium Extension (REG_SZ) = "C:\Program files\browsium\client\browsiumcontroller.exe" /ef for 64-bit Windows systems: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Enable Browsium Extension (REG_SZ) = "C:\Program Files (x86)\browsium\client\browsiumcontroller.exe" /ef Enable the Browsium Client Extension for Microsoft Edge Microsoft Edge requires systems to be domain joined and logged in with a domain user account to use the Browsium Client extension. In addition, application sideloading needs to be enabled. To do this, you will need to configure the following Group Policy setting: Local Computer Policy\Computer Configuration\Administrative Templates\Windows Components\App Package Deployment\Allow all trusted apps to install This setting must be set to Enabled or the Browsium Client extension will not be installed and enabled for Microsoft Edge.

127 Managing Browsium Client Logging Settings In a default installation, Browsium Client logs Warning level information which will provide basic information about the Proton configuration and any important errors that may occur on client systems, includes errors from Ion and Catalyst if configured on the client. Browsium Client can be configured to record more detailed logging information to troubleshoot problems or validate Ion configuration settings on the local system. Browsium Client logging is written to the standard Windows event log under an application-level source named Browsium. The Logging Level setting determines the amount and type of data collected in the Windows event log. This table summarizes the various levels and data collected: Value Level Description 1 Error Writes Error entries 2 Warning Writes Warn and Error entries (Default) 4 Info Writes Info, Warn and Error entries To adjust the level of logging, a registry value must be configured on the target system. Once the logging value is created, the Browsium Controller must be restarted to recognize the specified logging value. Browsium Controller looks in the Windows registry for the presence of the logging setting at HKEY_CURRENT_USER\Software\Browsium\Client. The value is a REG_DWORD type, with value name LogLevel. The data in that value can be 1, 2 or 4 (see chart above). If no LogLevel registry value is present in the defined registry location (the default Browsium Client state), or any invalid values are found at that location, Browsium Client will revert to using the default Level 2 Warning.