System Administratin Guide This guide prvides infrmatin n...... The System Management View... Managing Multiple Organizatins... Adding, Editing, Remving Organizatins... Creating Administratr Rles... Creating Administratr Lgins... Grup Emailing... Server Signing Certificates... Server and Device Lgging... Plug-Ins... Database Task Scheduler... Update Management NtifyMDM Versin 3.x Accessing the Dashbard 1
Table f Cntents Accessing the Dashbard 3 Administratr Rles and Lgins 5 System Administratr Rles... 5 Predefined System Administratr Rles... 5 Custmized System Administratr Rles... 7 OpenID Cnfiguratin fr System Administratrs... 8 System Administratr Lgins... 9 Creating System Administratr Lgins... 9 Managing System Administratr Lgins... 14 Imprting System Administratr LDAP Grups... 15 Organizatin Administratr Rles and Lgins... 17 System Administratin 18 Managing Multiple Organizatins... 19 The Organizatin List... 20 Managing Organizatin Licensing... 22 Database Task Scheduler... 23 Plug-Ins... 24 System Grup Emailing... 26 System Settings... 27 Server Address... 27 Custm Dashbard and Lgin Lgs... 27 Signing Certificate Uplad: Server Level... 28 Enabling GCM Service fr the System... 29 APNs Settings... 30 Update Management... 31 Administratr Audit Trail... 32 Server Lgging 34 Synchrnizatin Lgs... 35 Database Task Scheduler Lg... 37 Device Lgs... 38 Errr Chain Lg (ios device specific)... 39 Licensing Lg... 40 Mail Message Lg... 41 Appendix A: Rle Permissins 42 Appendix B: System Maintenance 47 NtifyMDM Versin 3.x Accessing the Dashbard 2
Accessing the Dashbard Access the Dashbard NtifyMDM dashbard requirements: Micrsft Internet Explrer, Firefx, r Safari Adbe Flash Player 10.1.0 Minimum screen reslutin: 1024 x 768 Desktp cmputer running Windws OS In yur Web brwser, enter the server address f the NtifyMDM server fllwed by /dashbard Example: https://cmpany.mdm.server/dashbard On-Demand users enter: https://ndemand.ntifymdm.cm/dashbard Standard Lgin Lg in t the NtifyMDM dashbard using yur administrative lgin credentials in ne f the fllwing frmats: Lcally authenticated lgins enter: email address and passwrd LDAP authenticated lgins enter: dmain\ldap username and LDAP passwrd A system administratr can create additinal lgins t the dashbard with system administratr, rganizatin administratr, r supprt administratr privileges. See the System Administratr Lgins and Organizatin Administratr Lgins sectins in this guide fr details. OpenID Lgin NtifyMDM Versin 3.x Accessing the Dashbard 3
Use yur OpenID credentials t lg in. 1. At the NtifyMDM lgin screen, enter the Zne Name, an easy t remember name NtifyMDM uses t redirect yu t the OpenID prvider prtal. If yur prvider requires it, enter yur OpenID Username as well. 2. At the prvider site, enter yur OpenID credentials. Nte: If this is the first time yu have lgged in t NtifyMDM with an OpenID r yur OpenID infrmatin has changed, yu will be prmpted fr a PIN cde befre entering the NtifyMDM dashbard. Zne Name and new PIN cdes are emailed t yu frm the NtifyMDM server. NtifyMDM Versin 3.x Accessing the Dashbard 4
Administratr Rles and Lgins System Administratr Rles See als Organizatin Administratr Rles. Predefined System Administratr Rles There are six predefined rles built in t the NtifyMDM system. The permissins fr these rles cannt be altered. Yu can view the set permissins fr these rles via the Rle Permissins ptin in the System Management view: System Administrative Rles r Organizatin Administratin Rles. Three f the predefined rles are used fr rganizatin administratr lgins. (See Predefined Organizatin Administratr Rles.) The three predefined system administratr rles are defined belw. The three predefined system administratr rles are: Full System Admin There are n limitatins with this type f lgin credential. Gives full administrative permissins in every rganizatin created n the NtifyMDM server. An administratr with this type f lgin can add rganizatins and switch rganizatins withut lgging ff the NtifyMDM server. They can als apply NtifyMDM server updates via the NtifyMDM Update Manager applicatin and cnfigure the Database Task Scheduler. Supprt System Admin Gives limited administrative access r read nly access in every rganizatin created n the NtifyMDM server. System Administratrs can switch rganizatins withut lgging ut f the NtifyMDM server. Althugh they cannt apply NtifyMDM server sftware updates, they can access the Update Management page in the dashbard where they can check fr and dwnlad NtifyMDM patches in preparatin fr the applicatin f the update. Restricted System Admin Restricted frm viewing private data such as Lcatin, MMS/SMS Lg, Phne Lg, and File Archive. Has read nly permissins fr all ther views. Restricted administratrs can switch rganizatins withut lgging ff the NtifyMDM server. System administratr credentials give access t all rganizatins n the NtifyMDM server. System administratrs can switch rganizatins withut lgging ff the NtifyMDM server. Credentials can be authenticated via an LDAP server and can be assigned Full Admin, Supprt Admin (read nly), r Restricted Admin (limited read nly) permissins. System administratrs als have access t the Update Management infrmatin n the dashbard. System administratr credentials with Full Admin permissins are required t use the Update Manager applicatin. The administrative lgin created during the prcess f installing the NtifyMDM server applicatin is a system administratr lgin with the predefined Full Admin permissins. See the table belw fr details n the varius system administratr rles r view the permissins via the Rle Permissins ptin in the System Management view. Wh Shuld Have System Administratr Lgins. A system administratr lgin is required fr anyne wh needs access t all rganizatins n the NtifyMDM server. Sme examples are: NtifyMDM Versin 3.x Administratr Rles and Lgins 5
Administratrs f hsted r n-demand systems wuld require a System Administratr lgin. Administratrs f an n-premise system where users have been gruped int separate rganizatins. Administratrs wh will apply NtifyMDM server sftware updates require a full system administratin lgin. Administratrs wh will cnfigure database cleanup tasks. SYSTEM ADMINISTRATOR ROLES Dashbard View Supprt System Admin Restricted System Admin Activity Mnitr and Alerts Smart Devices and Users Read-nly access; Cannt disable r snze alerts Can add r remve users and perfrm all the functins in the right Details panel, except Shw Recvery Passwrd Can email an individual user, but cannt use Grup Emailing Can perfrm mst functins in the left panel f User Prfile View the grids in the Audit Data and Search Text Message Lg ptins (User Prfile), but cannt view the bdy r attachments f a text message Can chse the Visible Clumns fr the Smart Devices and Users list Read-nly access; Cannt disable r snze alerts Restricted frm adding r remving users and frm all functins in the right Details panel Restricted frm sending an email t an individual user r a grup Restricted frm the Lcatin Data, Audit Data, Search Phne Lg, Search Text Message Lg, and File Archive ptins in the left panel f User Prfile Read-nly access t ptins in the left panel f User Prfile Can chse the Visible Clumns fr the Smart Devices and Users list Organizatin Management Read-nly access Read-nly access User and Device Reprting Full access (view and exprt) Full access (view and exprt) System Management Read-nly access Can switch between rganizatins withut lgging ut f the NtifyMDM server Can view the Update Management page; Can check fr and dwnlad server sftware updates. Cannt apply updates, since Supprt Admins d nt have access t the Update Manager Read-nly access Can switch between rganizatins withut lgging ut f the NtifyMDM server Can view the Update Management page; Can check fr and dwnlad server sftware updates. Cannt apply updates, since Restricted Admins d nt have access t the Update Manager NtifyMDM Versin 3.x Administratr Rles and Lgins 6
Custmized System Administratr Rles Administratrs can create custmized system administratr rles t tailr the permissins assciated with NtifyMDM dashbard lgin credentials. Once a custm rle has been created, it appears as a chice in the drp-dwn list f the Add Administratr wizard s Rle field. See System Administratr Lgins. Administratrs wh are lgged in when changes are made t rle permissins must lg ut and lg in again fr permissin changes t take effect. Select System Management > System Administratin > System Administrative Rles > Rle Permissins > Add Rle 1. Chse a methd fr creating a System Administrative Rle: Use the sliders t determine the rle s initial settings. The new rle cpies the settings f the predefined System Full Admin, Supprt Admin, r Restricted Admin. Cpy the settings f an existing rle 2. Specify the rle permissins t cpy. 3. Enter a Rle Name and Descriptin. 4. Click Finish t save the new rle. 5. Find and select the rle in the System Administrative Rles grid. 6. Set the permissins assciated with dashbard access. See Appendix A: Rle Permissins fr a cmprehensive list. NtifyMDM Versin 3.x Administratr Rles and Lgins 7
OpenID Cnfiguratin fr System Administratrs OpenID is an pen standard that allws administratrs t lg in and authenticate using an utside surce. Cnfiguring the system includes defining the OpenID prvider settings and enabling r disabling the OpenID ptin fr each administratr. See als OpenID Cnfiguratin fr Organizatin Administratrs. Define the OpenID Prvider settings 1. Fr System Administratrs, define a prvider by selecting System Management > System Administratin > OpenID Prvider frm the dashbard. 2. At the Zne Name field, enter a friendly name fr the Prvider URL. Administratrs use this at lgin t access the prvider. If yu are defining a prvider fr bth system and rganizatin administratrs, this name must be unique. The Zne Name is emailed t the administratr alng with a PIN cde they will use the first time they lg in with OpenID credentials. 3. At the OpenID Prvider URL field, enter the URL f the OpenID prvider. If user name is part f the URL, insert the fllwing in the URL where it is required: {username} MyOpenID is an example f a prvider that includes user name in its URL: https://{username}mypenid.cm 4. At the OpenID Return URL field, enter the URL f the server t which the user is returned after successful prvider validatin. The default is the current NtifyMDM server URL. 5. The OpenID Pin reset buttn will reset all administratr pins and issue emails t administratrs with the new 4 character pin. The first time administratrs lg in t NtifyMDM with an OpenID they are prmpted fr a PIN cde befre entering the NtifyMDM dashbard. If any f the prvider settings are updated r yu reset pins with this buttn, new PIN cdes are generated and emailed t administratrs frm the NtifyMDM server. Enable the OpenID ptin fr each administratr yu will allw t lg in with OpenID credentials. See als System Administratr Lgins. NtifyMDM Versin 3.x Administratr Rles and Lgins 8
System Administratr Lgins See als Organizatin Administratr Lgins. Creating System Administratr Lgins A System Administratr with full admin privileges is created during the initial installatin f NtifyMDM. It is a lcal system administratr lgin in that it authenticates directly against the NtifyMDM server with the unique passwrd yu created during the installatin. Additinal system administratr lgins with assigned rles can be created thrugh the dashbard. Fr infrmatin n rles see System Administratr Rles. Lgin Passwrds: Administratrs can change their lgin passwrds frm an ptin lcated in the dashbard header. Best Practices: Always maintain at least ne lcal system administratr that authenticates directly against the NtifyMDM server and that des nt use LDAP r OpenID authenticatin. This will prvide access t the dashbard that is nt subject t the availability f external authrities. T create a System Administratr Lgin, select System Management > System Administratin > System Administratrs > Add System Administratr. Chse hw the administratr shuld be authenticated: Manual (lcal), LDAP, OpenID. The Add System Administratr wizard steps yu thrugh creating lgin credentials fr system administratrs. Add a Manually (lcally) Authenticated Administratr Lgin Add an LDAP Authenticated Administratr Lgin Add an OpenID Authenticated Administratr Lgin Enter the administratr details, then chse the accunt settings. NtifyMDM Versin 3.x Administratr Rles and Lgins 9
Add a Manually (lcally) Authenticated System Administratr Lgin Add a system administratr lgin that authenticates directly against the NtifyMDM server with a unique passwrd. 1. Use the administratr s email address fr the Administratr Lgin. 2. Enter a Display Name. 3. Enter the administratr s Email Address. 4. Create and cnfirm a Passwrd fr the administratr lgin. 5. Mark the checkbx t prmpt the administratr fr a Passwrd Change at his/her first lgin. 6. Click Next. 7. Enter the Accunt Settings. NtifyMDM Versin 3.x Administratr Rles and Lgins 10
Add an LDAP Authenticated System Administratr Lgin Add a system administratr lgin that authenticates using the administratr s LDAP credentials. 1. Select an LDAP server and brwse the LDAP flders/grups t select the administratr, r manually enter the administratr s LDAP server user name in the LDAP Administratr Lgin field. 2. Click Next. 3. Enter a Display Name and the Email Address fr the administratr. 4. Enter the remainder f the Accunt Settings. NtifyMDM Versin 3.x Administratr Rles and Lgins 11
Add an OpenID Authenticated System Administratr Lgin Add a system administratr lgin that authenticates using the administratr s OpenID credentials. 1. Enter the Display Name fr this lgin. 2. Enter the administratr s Email Address. 3. Click Next. 4. Enter the Accunt Settings. NtifyMDM Versin 3.x Administratr Rles and Lgins 12
System Administratrs Accunt Settings Rle Assign a permissins level t the lgin. Chse frm: Predefined Full Admin Full administrative permissins Predefined Supprt Admin Read-nly permissins with limited editing capabilities Predefined Restricted Admin Read-nly permissins with private data restrictins; cannt view Lcatin Data, Audit Data, MMS/SMS r Phne Lgs, and File Archive Any custm System Administratr rle created fr the system Default View Select the default view at lgin System Timeut Select an inactivity timeut in minutes fr this lgin Active Status Mark the checkbx t enable this administrative lgin Passwrd Assign a passwrd if yu are creating a lgin that des nt use LDAP authenticatin. NtifyMDM Versin 3.x Administratr Rles and Lgins 13
Managing System Administratr Lgins Yu must be lgged int the NtifyMDM server with system administratr (Full Admin) credentials in rder t edit r remve a System Administratr. Best Practices: Always maintain at least ne System Administratr that authenticates directly against the NtifyMDM server and that des nt use LDAP r OpenID authenticatin. Managing Individual Administratr Lgins 1. Select System Management > System Administratin > System Administratrs 2. Select an administratr frm the list. Edit the settings and click Save Changes. Yu can als remve the administratr by clicking Remve Administratr. NtifyMDM Versin 3.x Administratr Rles and Lgins 14
Imprting System Administratr LDAP Grups Imprting system administratr LDAP grups int the NtifyMDM server eliminates the need t create administratr lgins. Any member f the imprted LDAP grup can lg in t the NtifyMDM dashbard as lng as their LDAP credentials are successfully authenticated. At the first successful lgin, an accunt n the NtifyMDM server is created fr the administratr using the prvisining settings assciated with the grup. 1. Select System Management > System Administratin > System Administratrs. Click the Administratr Grups tab. 2. T imprt an LDAP administratr grup, select an LDAP server frm the drpdwn list. Click the Imprt LDAP Grup buttn t select an administratr grup t imprt. Administratrs shuld familiarize themselves with the LDAP server structure and verify that grups they chse fr use with the NtifyMDM server cntain the fllwing necessary attributes: User Identificatin Attribute, Grup Membership Attribute, Grup Object Class, and User Object Class. Grups withut these attributes shuld nt be used. 3. Select a grup t imprt and click Finish. NtifyMDM Versin 3.x Administratr Rles and Lgins 15
4. T chse prvisining settings fr members f this grup, select an Administratr Grup frm the grid and cnfigure these settings fr the grup. Enfrced Rle Default View System Timeut Is Alert Recipient (administratrs receive NtifyMDM SMS/email alerts) Carrier (required if administratrs are an alert recipients) 5. If there are administratrs that belng t multiple grups, use the arrws t the right f the grup grid t priritize the grups. The grup with the highest pririty will determine an administratr s prvisining assignments when he r she is added at the first successful lgin. NtifyMDM Versin 3.x Administratr Rles and Lgins 16
Organizatin Administratr Rles and Lgins Wh shuld have an rganizatin administratr rle and lgin. Organizatin Administratr Rles and Lgins are ideal fr thse respnsible fr cnfiguring and maintaining a single rganizatin n a hsted server r n a system with grups f users that have been divided int separate rganizatins. See full dcumentatin n this tpic at: Organizatin Cnfiguratin and Management: Organizatin Administratr Rles and Lgins Rles Like System Administratr rles, there are three predefined Organizatin Administratr rles: Full Admin, Supprt Admin, and Restricted Admin. The permissins fr these rles cannt be altered. In additin, administratrs can create custmized rganizatin administratr rles t tailr the permissins assciated with NtifyMDM dashbard lgin credentials. Yu can set permissins fr these rles via the Rle Permissins ptin under the System Management view: Select Organizatin Administratin Rles > Rle Permissins OpenID Authenticatin OpenID is an pen standard that allws rganizatin administratrs t lg in and authenticate using an utside surce. Cnfiguring the system includes defining the OpenID prvider settings and enabling r disabling the OpenID ptin fr each administratr. Best Practices: Maintain at least ne lcal rganizatin administratr that authenticates directly against the NtifyMDM server and that des nt use LDAP r OpenID authenticatin. This will prvide access t the dashbard that is nt subject t the availability f external authrities. Lgins An rganizatin administratr lgin gives access t nly ne rganizatin. It can authenticate against the NtifyMDM server, an LDAP server, r an OpenID prvider. NtifyMDM Versin 3.x Administratr Rles and Lgins 17
System Administratin This sectin f the guide dcuments tpics related t system level management f the NtifyMDM server. The dashbard areas where system tasks are perfrmed require system administratr lgin credentials. System Administratin can include the management f multiple rganizatins. In additin t all the rganizatin administratin permissins dcumented in this guide, a system administratr with full admin status has the fllwing system level permissins: View all rganizatins n the NtifyMDM server Add, edit r remve rganizatins Switch rganizatins withut lgging ut and back in t anther rganizatin Create administrative rles and administrative lgins Send grup email t ne r all rganizatins; administratrs, and users Access System Settings View server and device lgs Set database cleanup tasks Apply a plug-in Check fr and dwnlad NtifyMDM server sftware updates System management tasks are perfrmed frm the dashbard s System Management view. This view is nly accessible with a system administratr lgin. The lgin yu create when installing the NtifyMDM server sftware is a system administratr lgin. NtifyMDM Versin 3.x System Administratin 18
Managing Multiple Organizatins Multi-Tenant NtifyMDM Systems A single instance f the NtifyMDM server applicatin supprts a multi-tenant architecture, allwing an enterprise t manage ne r multiple rganizatins. Multiple rganizatins systems are desirable in several envirnments: On-demand r hsted systems, where the administratr is a partner-reseller f the NtifyMDM prduct. On-premise systems that have categrized varius divisins f a cmpany by creating multiple rganizatins. Fr example: Prductin/Sales/Management departments may each be an rganizatin n the same NtifyMDM server r Seattle/Chicag/Bstn divisins may each be a separate rganizatin. Switching Organizatins When yu are lgged in t the NtifyMDM system with a system administratr lgin, yu initially chse the rganizatin yu want t view. Yu als have access t all ther rganizatins existing n the server thrugh the System Administratin menu. Switching frm ne rganizatin t anther is accmplished by using the Switch Organizatins ptin. In the right crner f the dashbard header, click Switch Org The Switch Organizatins ptin can als be accessed frm the System Management view. Select System Administratin > Organizatins, then click Switch Organizatins in the gray ptin bar. NtifyMDM Versin 3.x System Administratin 19
The Organizatin List The rganizatin list gives yu access t the cnfigured settings f each rganizatin n the server. Select an rganizatin frm the list t view r edit the cnfigured settings fr the rganizatin. Organizatin name and cntact infrmatin Welcme letter enablement Emails a welcme letter when users are added EULA enablement - When enabled, users must accept an End User License Agreement t cmplete NtifyMDM app enrllment Maximum Number f Devices Per User limits the number f devices users can enrll SMTP server name Signing Certificate Uplad buttn (descriptin) Hands-Off enrllment cnfiguratin Plicy Enfrcement Type Plicy Schedule Plicy Suite(s) Device Cnnectin Schedule (Administrative) LDAP Server Liability Lcal Grups NtifyMDM Versin 3.x System Administratin 20
Signing Certificate Uplad: Organizatin Level The signing certificate is a security measure that authenticates the server and allws ios devices t recgnize it as a trusted surce. The signing certificate Uplad buttn allws yu t add a signing certificate fr the rganizatin. This must be a CA signed certificate, because self-signed certificates are currently nt supprted. The SSL certificate being used n the server can als be used as the signing certificate. Exprt the SSL certificate t a file, checking the bx that ensures that the private key gets exprted with the certificate. Then uplad it t the NtifyMDM server. A signing certificate designated here fr the rganizatin verrides the system-wide signing certificate defined in System Settings. See als, Signing Certificate Uplad: Server Level. 1. Select System Management > System Administratin > Organizatins 2. Select an rganizatin frm the list and click the Uplad buttn next t the Signing Certificate field. 3. Click the Brwse buttn, then navigate t and select the file cntaining the certificate. 4. Enter the Passwrd assciated with the certificate and click Uplad. 5. Click Save Changes n the ptin bar. NtifyMDM Versin 3.x System Administratin 21
Managing Organizatin Licensing NtifyMDM autmatically checks the validity f licenses nce every 24 hurs. The Validate License ptin allws yu t initiate a license validatin if necessary. Validating the license requires full admin lgin credentials. Yu may need t initiate a license validatin in the fllwing situatins: Yu have added mre seats t yur license and yu need them t be available sner than when the daily validity check ccurs. The license had previusly been deactivated fr sme reasn and yu must synchrnize the reactivatin. The license did nt validate because f a cnnectivity issue and the issue has been reslved. Additin r remval f users in an rganizatin des nt update the displayed number f available seats until license validity is checked. Use the Validate License ptin t update this number. T access the License page, select System Management > License. The License Key, Seats Available, and the Validate License buttn display. Click the Validate License buttn t initiate a license validatin. Licenses fr Multiple Organizatins If there are multiple rganizatins n the NtifyMDM server, System Administratrs can view a list f rganizatins and the assciated licenses. Any ne f the licenses can be validated frm this page, as lng as the administratr has full system admin lgin credentials. 1. T access the Organizatin Licensing page, select System Management > System Administratin > Organizatin Licensing. 2. The grid displays each rganizatin n the server, its License Key, Status, Available Seats, and Ttal Seats. 3. T validate a license, select it n the grid and click the Validate License buttn. NtifyMDM Versin 3.x System Administratin 22
Database Task Scheduler Fr full dcumentatin n the Database Task Scheduler, see the Database Table Maintenance guide. When devices make a cnnectin t the NtifyMDM Server, infrmatin regarding thse cnnectins is lgged in the database and stred fr ptential trubleshting purpses. The amunt f infrmatin that is lgged is depends n several factrs such as the number f users n the NtifyMDM Server, the type f traffic being sent back and frth, the amunt f lgging taking place, and the frequency f device cnnectin intervals. Over time, this infrmatin can build up in the database and will grw excessively. Administratrs with full admin lgin credentials can use the Database Task Scheduler t set clean-up jbs t run at regular intervals in rder t clear excess data and maintain ptimal database perfrmance. T access the Database Task Manager, select System Management > System Administratin > Database Task Scheduler. NtifyMDM Versin 3.x System Administratin 23
Plug-Ins The NtifyMDM Plug-Ins feature allws administratrs t plug a SWF file int the NtifyMDM dashbard. This lets yu add a way t interface with anther cnsle frm the NtifyMDM dashbard. Frm the System Management page f dashbard, administratrs can define the lcatin f any SWF they have created. T further custmize the NtifyMDM server pages, administratrs can insert custm lgs and icns via the System Settings that appear n the NtifyMDM lgin page and in NtifyMDM s dashbard navigatin menu. T access Plug-Ins, select System Management > System Administratin > Plug-Ins. Yu must be a system administratr with full admin lgin credentials. Sample NtifyMDM dashbard with SWF plugged in NtifyMDM Versin 3.x System Administratin 24
Add a Plug-In 1. Click Add Plug-In in the ptin bar. 2. Enter a Display Name and Descriptin. The name yu enter appears in the NtifyMDM dashbard navigatin menu under the plug-in s icn. 3. In the SWF File field, enter a URL fr a remte strage lcatin r stre the SWF file n the NtifyMDM server and enter the file name. A file stred lcally shuld be in /NtifyMDM Server/web/dashbard/plugins/swfs/ 4. In the Icn File field, enter a URL fr a remte strage lcatin r stre the icn file n the NtifyMDM server and enter the file name. This icn will appear in the NtifyMDM dashbard navigatin menu. Clicking n this icn in the NtifyMDM menu will pen the Plug-In display area. A file stred lcally shuld be in /NtifyMDM Server/web/dashbard/plugins/icns/ Acceptable file frmats are.png,.jpg, r.gif Image size: W:32px, H:32px 5. If yu are using URLs, place an XML Crss Dmain Plicy File in the rt f the hsting server. S that Adbe Flash des nt prevent NtifyMDM frm accessing data n the remte lcatins yu have designated, the crss plicy file must define exceptins. Click Dwnlad Example t dwnlad a template that assists yu in creating an XML file with the apprpriate cntent. 6. Mark the plug-in as Active in rder fr it t take effect. Sample f the plug-in display area NtifyMDM Versin 3.x System Administratin 25
System Grup Emailing System Grup E-mailing gives the administratr the ability t send a system-wide email t ne r multiple rganizatins and can include administratrs, users r bth. The sender can als elect t cpy the rganizatin cntacts. T send a grup email, select System Management > System Grup E-mailing NtifyMDM Versin 3.x System Administratin 26
System Settings Server Address The external address f the NtifyMDM server can be defined frm the System Settings page. The lcal server address is autmatically added t this field when APNs is enabled. When NtifyMDM is integrated with Cisc Identity Services Engine (ISE), the Server Address field als prvides the URL t which ISE will redirect an unregistered user. Custm Dashbard and Lgin Lgs T custmize the NtifyMDM server pages, administratrs can insert custm lgs and icns that appear in NtifyMDM s dashbard navigatin menu and n the NtifyMDM lgin page. T insert lgs, select System Management > System Administratin > System Settings. Yu must be a system administratr with full admin lgin credentials. At the Dashbard Lg File field, enter a URL fr a remte strage lcatin r stre the file n the NtifyMDM server and brwse t select the file name. This lg appears in the upper left crner f the NtifyMDM dashbard, next t the navigatin menu. A file stred lcally shuld be in /NtifyMDM Server/web/dashbard/plugins/lgs/ Acceptable file frmats are.png,.jpg, r.gif Image size: W:223px, H:58px NtifyMDM Versin 3.x System Administratin 27
At the Lgin Lg File field, enter a URL fr a remte strage lcatin r stre the file n the NtifyMDM server and enter the file name. This lg appears n the NtifyMDM lgin page. A file stred lcally shuld be in /NtifyMDM Server/web/dashbard/lgs/icns/ Acceptable file frmats are.png,.jpg, r.gif Image size: W:288px, H:83px Sample NtifyMDM lgin page with custmized lgin lg Signing Certificate Uplad: Server Level The signing certificate is a security measure that authenticates the server and allws ios devices t recgnize it as a trusted surce. The Signing Certificate Uplad buttn in System Settings allws yu t add a signing certificate fr any rganizatin acrss the NtifyMDM system. This must be a CA signed certificate, as self-signed certificates are currently nt supprted. A signing certificate defined fr a single rganizatin will verride this system-wide signing certificate. See als, Signing Certificate Uplad: Organizatin Level. 1. Select System Management > System Administratin > System Settings. 2. Click the Uplad buttn next t the Signing Certificate field. 3. Click the Brwse buttn, then navigate t and select the file cntaining the Certificate. 4. Enter the Passwrd assciated with the certificate and click Uplad. 5. Click Save Changes n the gray ptin bar. NtifyMDM Versin 3.x System Administratin 28
Enabling GCM Service fr the System NtifyMDM can use the Ggle Clud Messaging service t let Andrid devices knw that it is time t synchrnize. Whenever ntificatins fr the device are available, the NtifyMDM server cnnects with GCM servers. GCM then pings the Andrid device telling it t synchrnize with NtifyMDM. This methd f initiating synchrnizatin is used in place f the NtifyMDM app s device cnnectin schedule, eliminating delayed updates t the device. Obtain yur GCM Credentials. Yu must first create a Ggle API prject and btain GCM credentials via the Ggle APIs Cnsle (see the GCM fr Andrid Setup guide). Only ne set f credentials is required per system, regardless f the number f rganizatins the system hsts. The GCM service can be turned n r left ff fr each individual rganizatin. Once the GCM credentials have been btained, the GCM service must be enabled fr the system n the NtifyMDM server under System Settings. GCM credentials (Sender ID and API Key) are als entered here. 1. Frm the NtifyMDM dashbard, select System Management > System Administratin > System Settings. 2. Check the bx next t Enable GCM. 3. Enter the Sender ID and the API Key that were generated via the Ggle API Cnsle. 4. Click Save Changes. 5. Frm the Organizatin Settings, turn n the service fr each rganizatin that will use GCM. Tggle the service n fr each rganizatin that will use GCM Once the GCM credentials have been entered in the System Settings, the GCM service can be turned fr individual rganizatins in Organizatin Settings. 1. Frm the NtifyMDM dashbard, select System Management > Organizatin. 2. Check the bx next t Use GCM t turn n the service fr the rganizatin. NtifyMDM Versin 3.x System Administratin 29
APNs Settings If yu have System Administratr privileges, yu can apply an existing APNs certificate t multiple rganizatins n the NtifyMDM server. Fr example, n-premise systems that have categrized varius divisins f a cmpany by creating multiple rganizatins can allw thse rganizatins t share ne APNs certificate. Frm the NtifyMDM dashbard, select System Management > System Administratin > System Settings. A list f rganizatins appears in the APNs Settings grid. If there is an APNs certificate assciated with the rganizatin, the Apple ID, Expiratin Date, and Certificate Tpic (certificate file) are listed beside it. There are several functins yu can perfrm frm this grid. Set Up an APNs certificate fr the first time fr ne r multiple rganizatins See als, APNS Certificate Generatin. Renew an APNs certificate fr ne r multiple rganizatins (click Setup) See als, APNS Certificate Generatin. Disable/Enable r Delete an APNs certificate fr ne r multiple rganizatins Cpy an existing APNs certificate frm ne rganizatin t ne r multiple rganizatins (Cpy T) Cautin: Cpying a certificate will verwrite any existing certificate assciated with the rganizatin(s) selected. T select multiple cnsecutive rganizatins in the grid, hld the SHIFT key and click n the first and last rganizatin. T select multiple randm rganizatins in the grid, hld the CTRL key and select rganizatins. NtifyMDM Versin 3.x System Administratin 30
Update Management The NtifyMDM server prduct has integrated update management features that facilitate smth and cnvenient sftware updates t the NtifyMDM server. These features cnsist f the dashbard s Update Management page and the Update Manager applicatin which is used n the physical NtifyMDM server(s) t apply updates. Update Management in the dashbard prvides: Sectins that display current infrmatin abut available updates and histrical infrmatin abut versins already applied using the Update Manager applicatin An ptin t check fr updates An ptin t dwnlad the available update(s) Updates cannt be applied frm the dashbard. A system administratr must use the NtifyMDM Update Manager applicatin t install the updates. Fr mre infrmatin n the Update Management page and the NtifyMDM Update Manager applicatin, see the Update Management Guide. Checking fr Updates and Update Ntificatins The NtifyMDM server autmatically checks fr updates nce every 24 hurs and whenever yu initiate a license validatin (using the Validate License buttn n the License page). Yu can als initiate an ndemand check by using the Check Fr Updates buttn in the Update Management page f the dashbard. When an update is available, system administratrs lgging int the NtifyMDM dashbard see a ntificatin fr the update in the lwer left crner f the dashbard. The ntificatin fades away autmatically r the administratr can dismiss it. Clicking n the ntificatin navigates t the Update Management sectin f the dashbard where the administratr can view infrmatin abut the available updates r dwnlad the updates. The Update Management Page The Update Management page is lcated under the System Management view f the dashbard and is nly accessible with a system administratr lgin. There are tw sectins f this page, the Manager sectin and the Histry sectin. Update Management: Manager Frm the Manager sectin, yu can view infrmatin abut the updates that are currently available. The server autmatically checks fr updates every 24 hurs, hwever, yu can initiate an n-demand check fr updates frm this page. Althugh updates cannt be applied frm this page, yu can dwnlad updates in preparatin fr a scheduled maintenance. Yu can als relad updates. This remves updates that have been dwnladed, but nt installed. Available updates are then autmatically reladed. This might be used in a case where an update became crrupted fr sme reasn and culd nt be installed. Update Management: Histry Frm the Histry sectin, yu can view statistics abut sftware updates that have already been applied via the NtifyMDM Update Manager applicatin. NtifyMDM Versin 3.x System Administratin 31
Administratr Audit Trail NtifyMDM s administratr audit trail prvides traceability and accuntability fr changes, adjustments, and actins perfrmed by NtifyMDM administratrs. Audit trail recrds can assist administratrs in: Determining the cause f unexpected behavir r system states Identifying cmprmised administratr accunts Identifying malicius administratr activity Tracking the surce f changes Finding trends Maintaining general crprate auditing recrds Phase One f the Administratr Audit Trail feature audits administratr lgin/lgut activity, updates t Plicy Suites, and administratr initiated security and device cmpliance actins. These lgs can be accessed frm the database and include sufficient details t restre the histric state f the system. Phase One functinality des nt prvide dashbard accessibility. Ntify Technlgy Technical Supprt Staff, hwever, can assist NtifyMDM administratrs with techniques in using the raw data fr trubleshting and restratin purpses, where applicable. Phase One f the Administratr Audit Trail feature audits the fllwing activities: Administratr lgin/lgut activity Deletin f an rganizatin Updates t plicy suites Security actins perfrmed frm the dashbard Lck Device Selective Wipe Full Wipe Shw Recvery Passwrd Wipe Strage Card Disable/Enable Device Administratr actins Clear Device Enrllment Clear Passcde Send Welcme Letter Clear NtifyMDM Authrizatin Failures Clear ActiveSync Authrizatin Failures Clear SIM Card Remved r Changed Vilatin View Device Vilatin Details NtifyMDM Versin 3.x System Administratin 32
Accessing the Data Althugh Phase One des nt prvide dashbard accessibility, the infrmatin listed abve is lgged and can be viewed in the database r accessed via database queries. Please cntact ur Ntify Technlgy Technical Supprt Staff, fr assistance with techniques in using the raw data fr trubleshting and restratin purpses. Yu can als reference, Accessing Administratr Audit Recrds in the Knwledge Base, which prvides a script t get the audited infrmatin and several stred prcedures that an administratr can run t view the recrds. Future develpment f NtifyMDM s Administratr Audit Trail will prvide further functinality. The fllwing features are planned fr several phases f develpment: In additin t traceability fr actins perfrmed by administratrs, future functinality will als track actins perfrmed by users via the Desktp and Mbile User Self-Administratin Prtals. Additinal lg entries fr: Creating/remving rganizatins and users Server cnfiguratins and changes Cmpliance Manager cnfiguratins and changes File Share and Managed Apps updates Certificate uplads r remvals Update Manager usage Device Cnnectin Schedule updates Custm Clumns updates ios user resurce cnfiguratins, changes, and assignments Administratr lgin/lgut Dashbard access View audit trail lg entries in the UI Custm srting/filtering/searching functinality Audit trail exprt functinality View detailed recrd values NtifyMDM Versin 3.x System Administratin 33
Server Lgging System level lgs assist administratrs with diagnsing prblems and in understanding the cmmunicatins between devices and the server. Bth server and device lgging ptins are available. Viewing Organizatin and System-Wide Lgs Select the System Management view and expand the View Lgs ptin in the left panel. Chse ne f the lgs. The fllwing lgs can be selected fr viewing system-wide infrmatin, infrmatin frm ne r mre rganizatins, r infrmatin fr ne r all devices. ActiveSync Lg View events lgged during cnnectins between the NtifyMDM server and the ActiveSync server and between the devices ActiveSync client and the NtifyMDM server. GCM Lg Allws yu t view successful events lgged during cnnectins between the NtifyMDM server and the Ggle Clud Messaging (GCM) server and between the NtifyMDM server and Andrid devices using GCM service. ios MDM Sync Lg View successful events lgged during cnnectins between the NtifyMDM server and the Apple ios MDM server and between the NtifyMDM server and the device s ios MDM functins. Unsuccessful events (errrs) are lgged in the Errr Chain Lg. (ios device specific) NtifyMDM Sync Lg - View events lgged during cnnectins between the device s NtifyMDM app and the NtifyMDM server. Device Lg View a list f the device lgs that have been previusly requested. T request a new lg, use the user level Device Lg ptin assciated with a user s prfile. Errr Chain Lg View detailed messages fr errrs lgged in the ios MDM Sync lg. (ios device specific) The fllwing lg can be selected fr viewing infrmatin fr ne r mre rganizatins. Mail Message Lg View recrds f grup emails sent frm the dashbard. The fllwing lgs nly display system-wide infrmatin. Database Task Scheduler Lg View all database task scheduler tasks that executed successfully r that gave an errr. Licensing Lg View server license validatins that executed successfully r that gave an errr. NtifyMDM Versin 3.x Server Lgging 34
Synchrnizatin Lgs Synchrnizatin lgs give administratrs the ability t view events lgged during cnnectins between servers and events lgged during device cnnectins with servers. There are three lgs f this type. The ActiveSync Lg lgs events that ccur during cnnectins between the NtifyMDM server and the ActiveSync server and between the devices ActiveSync client and the NtifyMDM server. The GCM Lg lgs successful events that ccur during cnnectins between the NtifyMDM server and the Ggle Clud Messaging server and between the NtifyMDM server and Andrid devices using GCM service. The ios MDM Sync Lg lgs successful events that ccur during cnnectins between the NtifyMDM server and the Apple ios MDM server and between the NtifyMDM server and the device s ios MDM functins. Unsuccessful events (errrs) are lgged in the Errr Chain Lg. (ios device specific) The NtifyMDM Sync Lg lgs events that ccur during cnnectins between the device s NtifyMDM app and the NtifyMDM server. The lgs display: Organizatin Organizatin name DeviceSAKey A device s internal identifier Lg cde Cde number assciated with the lgged event Descriptin Descriptin assciated with the lg cde Functin Name Displays a returned errr; blank when lg event is successful Details Descriptin r reasn fr the errr; blank when lg event is successful Timestamp Date and time f the lg event Select ActiveSync Lg, NtifyMDM Sync Lg, GCM Lg, r ios MDM Sync Lg. The Lg Level defaults t Nrmal and the lg ppulates the grid with system-wide data frm the past hur. If yu change the lg level t Verbse, click Search. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the server lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. NtifyMDM Versin 3.x Server Lgging 35
Sample Sync Lg Grid NtifyMDM Versin 3.x Server Lgging 36
Database Task Scheduler Lg The Database Task Scheduler Lg enables the administratr t view all database cleanup jbs that executed successfully r that gave an errr. The lg displays: Database Task Name Name assigned t the database cleanup task Lg Cde Cde number assciated with the lgged event Descriptin Descriptin assciated with the lg cde Functin Name Displays a returned errr; blank when lg event is successful Details Descriptin r reasn fr the errr; blank when lg event is successful Timestamp Date and time a database cleanup jb was executed Select Database Task Scheduler Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by editing the Frm/T filter. Click Search. Once yu edit the date/time filter, the system maintains the changes as preferred settings fr all system level lg views unti l yu change the settings r lg ut f the dashbard. When the database task scheduler lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. NtifyMDM Versin 3.x Server Lgging 37
Device Lgs The Device Lgs ptin at the system level is simply a list f previus requests fr device lgs. The dashbard grid des nt display lg recrds, but gives infrmatin n when lgs were received. Device lgs are available frm any device running the NtifyMDM app. The grid displays: Organizatin Organizatin name DeviceSAKey A device s internal identifier Time Requested and Requester Received Whether r nt lg has been received Time Received Date and time a respnse was received Errr Errr message if lg culd nt be btained Select Device Lg. The lg ppulates the grid with system-wide ntificatins f lg receipts frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter t filters the timestamp f the lgs (nt the recrds in the lg) Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null). Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. Sample Device Lg Grid Select a lg file and click the Dwnlad Lg buttn. Save the lg file n the desktp r in anther designated flder. The file can be viewed in the.txt frmat. NtifyMDM Versin 3.x Server Lgging 38
Errr Chain Lg (ios device specific) The errr chain lg prvides a view f messages detailing errrs lgged in the ios MDM Sync lg. The lg displays: Organizatin Organizatin name DeviceSAKey A device s internal identifier Errr Cde Cde number assciated with the errr Errr Dmain Cntains internal cdes used by Apple useful fr diagnstics (may change between Apple releases) Lcalized Descriptin Descriptin f cdes Timestamp Date and time the errr ccurred Select Errr Chain Usage Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the errr chain lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. NtifyMDM Versin 3.x Server Lgging 39
Licensing Lg The licensing lg is a lg f license validatins that executed successfully r that gave an errr. The lg displays: Lg Cde Cde number assciated with the lgged event Descriptin Descriptin assciated with the lg cde Functin Name Displays a returned errr; blank when lg event is successful Details Descriptin r reasn fr the errr; blank when lg event is successful Timestamp Date and time the license validatin ccurred Select Licensing Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by editing the Frm/T filter. Click Search. When yu edit the date/time filter, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the licensing lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. NtifyMDM Versin 3.x Server Lgging 40
Mail Message Lg The mail message lg prvides an administratr with a methd t view the recrds f grup emails sent frm the dashbard. The lg displays: Organizatin Organizatin name t which the email was sent Administratr The administratr wh sent the email SMTP Server The SMTP server thrugh which the email was sent Subject Email subject Message Bdy text f the email message Recipients Emails email addresses f recipients f the email Timestamp Date and time the email was sent Ownership Whether device wnership was specified as criteria fr recipients; cmpany/persnal/any Liability Whether device liability was specified as criteria fr recipients; crprate/individual/any Select Mail Message Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the mail message lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. NtifyMDM Versin 3.x Server Lgging 41
Appendix A: Rle Permissins Rle permissins assciated with dashbard access are listed in a directry tree. There are five parent categries that crrespnd t the five dashbard views. The ability t edit a permissin in a subset depends n whether r nt the categry(ies) abve the permissin are enabled. Fr example, in rder t enable Lck Device, Full Access needs t be enabled fr bth the Smart Users and Devices and Administratin categries abve it. Parent Categry Activity Mnitr & Alerts Smart Devices and Users First Subset Level Secnd Subset Level Third Subset Level Full Access Add User Administratin Clear Activatin Lck Clear Passcde Disable Device Diswn Device Email Unlck PIN Full Wipe Lck Device Pwer Off Rebt Remte Ring Reset fr Enrllment Reset PIN Reset t Shared Prfile Selective Wipe Send VPP Invitatin Send Welcme Letter Shw Recvery Passwrd Suspend Device Read Only NtifyMDM Versin 3.x Appendix A: Rle Permissins 42
Parent Categry First Subset Level Secnd Subset Level Third Subset Level Full Access Apple DEP Devices Trigger APN Trigger GCM Unblck Passwrd Entry Wipe Strage Card Manage Prfile Name Device Sync Apple DEP Devices Device Cmpliance Read Only Clear ActiveSync Authrizatin Failures Clear Data Usage Statistics Reset by User Vilatin Clear NtifyMDM Authrizatin Failures Clear SIM Card Remved r Changed Vilatin View Device Vilatin Details Device Reprting Discvered Devices Allw Quarantined Device Hide Email E-mail User Lcatin Lgging Messaging Remve User Send Ntificatin User Prfile All Devices Summary Assign Access Pint Names Assign CalDAV Assign CardDAV Assign Exchange Servers Assign LDAP Servers Assign Mail Servers NtifyMDM Versin 3.x Appendix A: Rle Permissins 43