Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes

Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes

Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes This document includes the following topics: About Mobile Management for Configuration Manager What's New in Mobile Management for Configuration Manager 7.2 MR1 Installing Symantec Mobile Management for Configuration Manager Upgrading Symantec Mobile Management for Configuration Manager Fixed Issues Known Issues

4 Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes About Mobile Management for Configuration Manager About Mobile Management for Configuration Manager Symantec Mobile Management for Configuration Manager provides device management for Windows Mobile/CE, BlackBerry, ios, and Android mobile devices using the Microsoft System Center Configuration Manager Console. Software package creation and assignment are available for Windows Mobile/CE devices. Profile management, profile payload configuration, profile assignment, and Mobile Library Feed creation/assignment is available for ios and Android devices. Access to Live Support Session, which enables the remote viewing of current information on Windows Mobile, Windows CE devices, BlackBerry smartphones, and Android devices is also available. What's New in Mobile Management for Configuration Manager 7.2 MR1 New Features in version 7.2 ios 5.1 Capabilities (application deployment is not part of this release) Touchdown Integration (Android) Enterprise Mobile Library security update Symantec Enterprise Licensing Symantec Mobile Management branding for software and documentation Classify devices as corporate or personally owned Device compliance and remediation

Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes What's New in Mobile Management for Configuration Manager 7.2 MR1 5 Changes in version 7.2 MR1 Google announced a new push service named Google Cloud Messaging for Android (GCM). Google also announced that Google Cloud to Device Messaging (C2DM) Service has been officially deprecated and has stopped accepting new C2DM user accounts and quota requests. This means that new customer deployments will not be able to create a C2DM account for use by Symantec Mobile Management for Configuration Manager. Even though existing customer deployments will not be affected until Google terminates the C2DM service, GCM is required for all new deployments and upgrades. Some customers have discovered that Recovery Option Full on the Athena Database without a DBA doing Log Truncation results in many hundreds of gigabytes in SQL Transaction Log file(s). Actually, Transactional Logging is not used to the extent that Full Recovery is needed. A statement is added to the Services installer during Create and follow-on updates (for existing upgrades) that sets the Athena Database Recovery model to Simple. An incorrect URL generated by the MobileLibraryFileProxy.aspx has occurred. When a plisttemp plist URL is sent to the device, and the item is selected from the agent, a forward slash is missing between Athena and MobileLibraryProxy portions of the virtual path If a Mobile Library feed is created and assigned to the All Apple Mobile Devices collection and the All Android Mobile Devices collection, the feed can be seen on an ios device but not on an Android device. The difference is the language: the Android device has en_us. In the database, the language is listed as en. The Symantec Mobile Management for Configuration Manager Exchange Active Sync Management Services installer previously provided in the v7.2 release is not being included in the MR1 release. It will be available through Professional Services if requested.

6 Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Installing Symantec Mobile Management for Configuration Manager Installing Symantec Mobile Management for Configuration Manager The components and installation order are listed in this section. See the Symantec Mobile Management for Configuration Manager v7.2 MR1 Installation Guide for complete installation instructions. Installers for Symantec Mobile Management for Configuration Manager v7.2 MR1 are available on FileConnect. Symantec Mobile Management for Configuration Manager v7.2 MR1 runs in Microsoft System Center Configuration Manager 2007 R2 Service Pack 1, Service Pack 2, or R3. The Symantec Mobile Management for Configuration Manager installation includes the following components: Push Services- includes the APNS Web Service, Google Cloud Messaging (GCM) Service, and Feedback Web Service. These Windows and Web services are required for ios and Android device management. Console- administrator console integration components for device management, which includes Symantec Mobile Management utilities for interactive troubleshooting and live support, device data inventory/history (Device Explorer), package creation (Device Software Package Wizard), and package distribution (Software Distribution Wizard). Services- management point integration for mobile device communication. Includes servers and database configuration, ios/android setup, and the Athena Tunnel Server installation. The Athena Tunnel Server is a secure HTTPS tunnel which uses two-way SSL certificate-based authentication to provide a custom connection gateway from a site to Windows Mobile, Windows CE, BlackBerry Smartphone, and Android devices. Replication Services- creates a copy of the Athena database for recovery purposes and provides synchronization of data across multiple database environments. See the Symantec Mobile Management for Configuration Manager v7.2 MR1 Replication Services Installation Guide for complete installation instructions. Reporting Services (optional)- standard set of reports for Symantec Mobile Management Windows Mobile/CE and BlackBerry devices and/or collections. Additional report packs are also available for creating custom reports.

Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Installing Symantec Mobile Management for Configuration Manager 7 See the Symantec Mobile Management for Configuration Manager v7.2 MR1 Reporting Services Installation Guide for complete installation instructions. Feature Packs (optional)- feature packs for Positioning (GPS), Phone, and Security Essentials (Lock and Wipe) device functionality. See the Symantec Mobile Management for Configuration Manager v7.2 MR1 Windows Mobile/Windows CE Feature Pack Installation Guide for complete installation instructions. The following outline shows the server, installation order, and Symantec Mobile Management component for installation. Internet-facing Server Push Services Note: If all components reside on one server, upgrade Push Services after upgrading the Console and Services. Central Server Console ISV Proxy (first time only) Services Reporting Services (optional) Feature Packs (optional) Replication Services Primary Server Console Services Feature Packs (optional) Replication Services Secondary Server Console (optional) Services Note: It is recommended to restart the Configuration Manager Console after the Console and Services installers have completed successfully.

8 Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Upgrading Symantec Mobile Management for Configuration Manager Upgrading Symantec Mobile Management for Configuration Manager You should upgrade Symantec Mobile Management for Configuration Manager in the same order that the installation was done using the same site environment (servers, ports) information that was entered during the installation. When upgrading, the ISV proxy certificate installation and the ios profile setup post installation procedures do not need to be done. Set up the GCM service to support Android devices in Symantec Mobile Management for Configuration Manager before upgrading. See the Google Cloud Messaging (GCM) for Android Setup Guide for complete information. Upgrades from Athena for Configuration Manager v5.2 must use the same port number and certificate for IIS when installing v7.2 MR1. Any changes made to these values in the installer dialog will prevent devices from enrolling. Upgrades from Athena for Configuration Manager v5.2 to Symantec Mobile Management for Configuration Manager v7.2 MR1 will always use the existing database. Any customer that wants to upgrade and create a new database should call customer support for assistance. Component Upgrade Order The following outline shows the upgrade order and each component for site environments with multiple servers: Internet-facing Server 1. Push Services Note: If all components reside on one server, upgrade Push Services after upgrading the Console and Services. Central Server 1. Console 2. Services 4. Reporting Services (optional) 5. Feature Packs (Windows Mobile/CE optional) 6. Replication Services

Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Upgrading Symantec Mobile Management for Configuration Manager 9 Primary Server 1. Console 2. Services 3. Feature Packs (Windows Mobile/CE optional) 4. Replication Services Secondary Server 1. Console (optional) 2. Services Push Services Upgrade To perform the Push Services upgrade: 1. Locate the executable and start the wizard by double-clicking the Symantec Mobile Management Push Services icon. 2. The Welcome screen appears. Click Next to run the wizard. 3. Use the same folder that was used for the installation. Click Next to continue. 4. Both the Feedback and Push Services are selected for upgrade by default. Click a service to change the upgrade selection. When finished, click Next to continue. Note: Be sure to upgrade the service(s) that were originally installed. 5. Click Browse and locate the APNS certificate. Make sure that this certificate is current and has not expired. Then, enter the password for the certificate. If this password is incorrect, a warning message will appear when the installation processes and the installation will stop. Note: If Push services > APNS web services was not selected in the previous step, the APNS Service Configuration screen does not display. 6. Enter the project ID in Google API Project ID and server key in Server API Key which were created during the Android GCM setup procedure.

10 Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Upgrading Symantec Mobile Management for Configuration Manager 7. Enter the names of the Central or Primary database server and the Central database server where the APNS and GCM services reside. If the Feedback Service is located on a different server than the Push Services, enter the Fully Qualified Domain Name (FQDN) of the server in Server where device Push services are running. This entry only appears if the Push Services are installed on a different server. Console Upgrade Note: If C2DM was used for the installation, you will be prompted to replace the C2DM credentials with GCM credentials 8. Click Install to start the upgrade using the settings specified in the previous steps. 9. Click Finish to exit the wizard and complete the Push Services upgrade. Optionally, click Show the Windows Installer log to view the log upon exiting the wizard. The Installer Log shows any errors or other events that occurred during the upgrade. The Console upgrade must be done for each console residing in the site environment. Use the same site environment (servers, ports) information that was entered during the installation. To upgrade the Administrator Console: 1. Locate the executable and start the wizard by double-clicking the Symantec Mobile Management Console icon. Note: For Windows Vista and Windows 7 systems, right-click on the icon and select Run as administrator. 2. The Welcome screen appears. Click Next to run the wizard for the Console portion of the upgrade. 3. Use the same folder that was used for the installation. Click Next to continue.

Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Upgrading Symantec Mobile Management for Configuration Manager 11 4. Enter the fully qualified domain name of the Central server. The Symantec Mobile Management Database Name field contains the recommended name of Athena. This entry is the database name of the Central server as the console will pull data from the Central server. If a different database was used for the installation, enter its name. Services Upgrade Note: The existing database will be used for the upgrade. If you want to create a new database, contact customer support for assistance. 5. Locate and select the Central server database by clicking Browse or type the Central server database name. If the current user is a Configuration Manager administrator, use the default Windows authentication credentials of current user. If using SQL server logins, select Server authentication using the Login ID and password below to create the SQL server login. 6. Click Install to start the upgrade of the Console. 7. Click Finish to exit the wizard and complete the Console upgrade. Optionally, click Show the Windows Installer log to view the log upon exiting the wizard. The Installer Log shows any errors or other events that occurred during the upgrade. Perform the Services upgrade on all (one or multiple) Management Point servers to which the devices are reporting. For multiple server sites, the Services upgrade should be done following the site hierarchy. For example, starting with the highest level server and then proceeding to the lower level servers. Note: The computer account must have system administrator access to the database server for creation of the Athena database and permissions assignment. The following steps must be done on each Configuration Manager server: 1. Log in as a Configuration Manager administrator. 2. Locate the executable and start the wizard by double-clicking the Symantec Mobile Management Services icon.

12 Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Upgrading Symantec Mobile Management for Configuration Manager 3. The Welcome screen appears. Click Next to run the wizard for the Services portion of the Symantec Mobile Management for Configuration Manager upgrade. 4. Both the Tunnel Server and Symantec Mobile Management Services are selected for upgrade. Click the Tunnel Server and/or Symantec Mobile Management Services components to change the upgrade selection. Note: Be sure to upgrade the component(s) that were originally installed. 5. Use the same folder that was used for the installation. Click Next to continue. 6. For the Tunnel Sever component upgrade, enter the names of the three security groups that were created for use with Tunnel Server. The entries must be WINS names in the format domain\group name. For example, e3qa\atier1. 7. Depending on the topology of the site, select the server type: Central server (default)- Root Primary server. Secondary server- server where the Athena Web Services are installed. 8. The Site Code field is populated with the three character alphanumeric code of the Management Point server. Enter the following: SCCM Database- name of the SCCM database. SCCM Database Server- name of the server where the SCCM database resides.

Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Upgrading Symantec Mobile Management for Configuration Manager 13 9. Select any options as required for the site: Management Point Address- IP address of server. Typically this entry is the address of the Central server or the Primary server. Note: The http:// prefix is not automatically pre-pended to the IP address, so it must be entered with the IP address when a server is running DHCP. For example, a valid entry is http://192.168.1.101. If http:// is not entered, the correct Management Point address will not be written to the Athena web.config file and DCOM will be used to communicate, which is problematic. Management Point Port- port of the server that is specified in the Management Point Address field. EndPoint Server Name- name of the Management Point server. DNS Suffix specifies the DNS suffix that managed devices use to connect to the server. This setting is not required for WINS. Note: Run the ipconfig /all command in a command window to view the DNS suffix of the server. Log to EventLog specifies when the Athena Device Tracker (Tracker) service logs run time errors to the server Event Log under the Athena application group. Used by Athena Tracker and Web Services. Log to DeviceLog Table- specifies when Tracker service writes run time errors and run time status messages to the Athena database DEVICELOG table. Used by Athena Tracker and Web Services. Derive Device Name From Host Name determines whether the custom parsing logic within the Athena Tracker service is used to derive the Device Name property from the DNS Host Name attribute passed to the device from a DHCP server. Derive Device Name From Phone Number (Phone devices only) determines whether the custom parsing logic within the Athena Tracker service is used to derive the Device Name property from the device(s) Phone Number attribute. 10. On the Device Agent Server Configuration screen, the Agent (ios and Android) entries configure the Symantec Mobile MGMT agent. The following settings must match your site environment's current settings:

14 Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Upgrading Symantec Mobile Management for Configuration Manager Using SSL protocol- select to enable SSL. Server Name- name of the server where devices communicate. This entry can be an IP address, machine name, or FQDN. The default is the server where the upgrade is being performed. Port Override- port to use for SSL connections. The ios MDM (SSL) entries configure a separate port for the native Apple ios agent using the following entries: Server Name- name of the server where devices communicate. This entry can be an IP address, machine name, or FQDN. The default is the server where the upgrade is being performed. SSL Port Override- port to use for SSL connections. Certificate- select the web server SSL certificate from the drop-down list. 11. Enter the server name where Push Services reside. Enter the project ID in GCM Project ID. The project ID was created in the GCM setup procedure and also entered in the Google Cloud Messaging step in the Push Services upgrade. Note: If C2DM was used for the installation, you may be prompted for C2DM email or Android Sender ID. 12. Enter the server name where the Mobile Library proxy resides. 13. The Symantec Mobile Management Database Name entry is populated with the recommended name Athena. This entry must match the Symantec Mobile Management Database Server that will be entered on the next screen of the wizard. If a different database was used for the installation, enter its name. Note: The existing database will be used for the upgrade. If you want to create a new database, contact customer support for assistance. 14. Use existing database is selected by default for Central or Primary server upgrades to preserve existing device information when performing the upgrade. Note: This option is not available when upgrading Secondary servers.

Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Upgrading Symantec Mobile Management for Configuration Manager 15 Update packages from central database server- selected by default when upgrading a Primary server. Note: This option is not available when upgrading Central or Secondary servers. 15. Enter the Central Database Server name when upgrading a Primary server. This entry should be a fully qualified domain name. Note: This option is not available when upgrading Central or Secondary servers. 16. Select the database server where the Athena Database is located. When using a Secondary server, the database server must be the database of the Primary (parent) server of this Secondary server. If the current user is a Configuration Manager administrator, accept the default of Windows authentication credentials of current user. If using SQL server logins, select Server authentication using the Login ID and password below to create the SQL server login. 17. On the Product License screen, select You have purchased a license and want to install it to replace the trial license which is installed by default if you have purchased a license for the software. Leave this option unchecked if you are using a trial license. Perform one of the following steps: If the SLF (obtained when the product license was purchased) resides on the server, select Browse to your SLF and click Browse to locate the file. OR If the server has access to the internet, click Provide information for the Licensing Server and enter all information. This selection allows you to activate the product license from the Symantec licensing server using the License Serial Number and required information. 18. Click Install to start the upgrade of the Services. 19. Click Finish to complete the upgrade and exit the wizard. The upgrade is now complete.

16 Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Fixed Issues Fixed Issues The following issues are fixed issues for this release: Back button on the APNS Push Service installer stops working. Location Services is not disabled on the ios device when disabled in Configuration Manager. ios policies do not appear in Device Explorer. Changing the Allow diagnostic data to be sent to Apple setting in the Configuration Editor, doesn t change the option on the device. itunes or Android App Store shows labels for Networks: Adapters, Wifi Access Points, and TCP/IP Statistics but nothing else. Touchdown script error when opening Set Signature and Select Phone Book fields window on Configuration Editor. Feed items do not display on Android devices. In the Mobile Library, the About screen has reference to Odyssey Software and the copyright needs to be updated. No Domain is being displayed on the All Windows Mobile Devices screen. Touchdown HTML Signature Editor error: "HTMLPanel Error". Cannot download Mobile Library items on Android devices. ios Provisioning Profiles cannot be deleted. Auto lock of 10 minutes results in 5 minutes on ios device. Auto lock of 15 minutes results in 5 minutes on ios device. ios Policies assigned to a collection are never being provisioned to an ios Device. Passcode history is 1 more than selected in Configuration Editor. Select 2, and 3 unique passwords are required before reuse. After clean install on Configuration Manager and enrollment of devices, the Symantec right-clicks are not present. Device Explorer display shows 0 for Colors, Horizontal and Vertical Resolution. iphones Serial Number and IMEI not displayed in Identification (Device Explorer). Device Explorer is incorrect for several items. SSL port binding for AthenaMDM website does not get configured during Services installation.

Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Fixed Issues 17 The following error is displayed in the device log: Server message Device creation failure 403. Some ios Restrictions are not updating in the inventory. If you incorrectly enter the APNS cert password, the installer continues but the APNS feature doesn t work. When profileservice runs, it reinstalls the profile with the incorrect username (blank) which breaks email. Database not updating after upgrading from v5.2 to v7.2 MR1. Reinstalling the Push Services over existing Push Services uninstalls the web services and does not reinstall. Services installation upgrading from v7.2 to 7.2 MR1 does not fill in the SQL connection string. Missing host_cert_ua_patterns value on Android devices after enrolling on upgrade. Symantec Mobile Management tree duplicated after Console upgrade. Configuration Editor error opening page inside the console. Installers will not upgrade an existing installation to v7.2 MR1. If a user de-selects the option for APNS, the user is still presented with the dialog for APNS. UpgradeCo App crashes during upgrade of services.

18 Symantec Mobile Management for Configuration Manager 7.2 MR1 Release Notes Known Issues Known Issues General Issues The ios and Android Mobile MGMT Agents must be upgraded to the latest versions. Previous versions of the Agents do not have the security fixes implemented for the Mobile Library content. Visit itunes for the latest ios agent or Google Play for the latest Android agent. ios Issues There is a potential timing issue during ios enrollment. Symantec development is unsure of the exact cause, but it seems that if you speed through enrollment with the right combination of slowness during processing, two resource GUIDs can be created for a single device. The manifestation of this issue was that the MDM enrollment profile wasn t able to be installed. A workaround is to delete the resource for the device in the Console and re-enroll. allowuntrustedtlsprompt setting- an Apple bug prevents the setting from being reported as inventory. The setting does take effect on the device. allowicloudkeyvaluesync- this does not exist. The feature was dropped by Apple during the ios 5.0 beta period. allowlocationservices and ForceAssistantProfanityFilter settings do not take effect on the device due to an Apple issue. In addition, the following items will not be reported properly: allowlocationservices is always reported as True. ForceAssistantProfanityFilter is always reported as False. WiFi proxy username/password does not get set on the device when set in a profile. All other settings associated with WiFi proxy work. Apple has acknowledged this issue. Changing the Allow diagnostic data to be sent to Apple setting in the Configuration Editor, doesn t change the option on the device. Web clip image not fully removed from ios device. This is an ios issue. Restart device and the image disappears.