Administrative Guide 14.1

Transcription

1 Administrative Guide Bomgar Corporation. All rights reserved worldwide. BOMGAR and the BOMGAR logo are trademarks of Bomgar Corporation; other trademarks shown are the property of their respective owners. TC:7/2/2014

2 Table of Contents Bomgar Administrative Interface 4 Login to the Administrative Interface 5 Status 6 Information: View Bomgar Software Details 6 Representatives: View Logged In Reps and Send Messages 7 What's New: See Software Release Details 8 My Account: Change Password and Username, Download the Representative Console and Other Software 9 Configuration 11 Options: Manage the General Queue, Record Sessions, Monitor License Usage, Set Up Text Messaging 11 Issues: Manage Support Issues 13 Support Teams: Group Representatives into Teams 14 Skills: Route Issues to Representatives 16 Access Sponsors: Create Groups of Privileged Users 18 Jumpoint: Set Up Unattended Access to a Network 19 Jump Clients: Manage Settings and Install Jump Clients for Unattended Access 26 Bomgar Buttons: Deploy Bomgar Buttons for Quick Session Start 29 Canned Messages: Create Messages for Chat 32 Canned Scripts: Create Scripts for Command Shell Sessions 33 Special Actions: Create Custom Special Actions 34 Users and Security 35 User Accounts: Add User Permissions for a Representative or Admin 35 Embassy: Create an Embassy for Vendor Access 36 Rep Invite: Create Profiles to Invite External Representatives to Sessions 39 Security Providers: Enable LDAP, Active Directory, RADIUS, and Kerberos Logins 40 Session Policies: Set Session Permission and Prompting Rules 41 Group Policies: Apply User Permissions to Groups of Users 43 CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 2

3 Settings and Field Details: User Permissions 46 Kerberos Keytab: Manage the Kerberos Keytab 57 Reports: Report on Session and Presentation Activity 58 Public Portals 60 Public Sites: Customize the Support Portal 60 HTML Templates: Customize the Web Interface 62 Customer Notices: Create Messages for the Customer Notification System 63 File Store: Upload Resource Files 66 Apple ios: Add Apple Configuration Profiles 67 Exit Surveys: Enable the Customer Exit Survey and Representative Exit Survey 69 Customer Client: Modify the Invitation , Display Options, Connection Options 70 Presentation: Modify the Invitation s and Display Options 74 Localization 76 Languages: Manage Available Languages 76 Search: View Customized Text in Enabled Languages 77 Management 78 Software Management: Download a Backup, Upgrade Software 78 Security: Manage Security Settings 79 Site Configuration: Set HTTP Ports, Enable Prerequisite Login Agreement 82 Configuration: Configure the Software to Send s 83 Outbound Events: Set Events to Trigger Messages 84 Cluster: Configure Atlas Technology for Load Balancing 86 Failover: Set Up a Backup Appliance for Failover 88 Support: Contact Bomgar Support 90 Ports and Firewalls 91 Disclaimers, Licensing Restrictions and Tech Support 92 CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 3

4 Bomgar Administrative Interface As a tour of /login, this guide is designed to help you administer Bomgar users and your Bomgar software. The Bomgar Appliance serves as the central point of administration and management for your Bomgar software and enables you to log in from anywhere that has internet access in order to download the representative console to virtually support your end-users. Use this guide only after an administrator has performed the initial setup and configuration of the Bomgar Appliance as detailed in the Bomgar Appliance Hardware Installation Guide. Once Bomgar is properly installed, you can begin supporting customers immediately. Should you need any assistance, please contact Bomgar support at CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 4

5 Login to the Administrative Interface The user administrative interface enables administrators to create representative accounts and configure software settings. Log into the user administrative interface by going to your appliance s public URL followed by /login. Although your appliance s URL can be any registered DNS, it will most likely be a subdomain of your company s primary domain (e.g. support.example.com/login). Default Username: admin Default Password: password Because Bomgar is licensed by concurrent users, you can set up as many accounts as you need, each with unique usernames and passwords. If Kerberos has been properly configured for single sign-on, you can click the link to use integrated browser authentication, allowing you to enter directly into the web interface without requiring you to enter your credentials. Note: For security purposes, the administrative username and password used for the /appliance interface are distinct from those used for the /login interface and must be managed separately. Administrators may restrict access to the login screen by enabling a prerequisite login agreement that must be confirmed before the login screen is displayed. If you wish to enable the prerequisite login agreement, see "Site Configuration: Set HTTP Ports, Enable Prerequisite Login Agreement" on page 82 CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 5

6 Status Information: View Bomgar Software Details The main page of the Bomgar /login interface gives an overview of your Bomgar Appliance statistics. An administrator can select the appropriate time zone from a dropdown, setting the correct date and time of the appliance for the selected region. You also can restart the Bomgar software remotely. Additionally, view the number and type of Bomgar clients connected. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 6

7 Representatives: View Logged In Reps and Send Messages View a list of representatives logged into the representative console, along with their login time and whether they are running support or presentation sessions. You also can terminate a representative's connection to the representative console. Send a message to all logged-in representatives via a pop-up window in the representative console. You also may view representatives who have extended availability mode enabled. Enabling extended availability mode does consume a license. You may disable a representative's extended availability in order to free up a license. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 7

8 What's New: See Software Release Details Easily review Bomgar features and capabilities newly available with each release. Learning about new features as they become available can help you make the most of your Bomgar deployment. The first time you log into the administrative interface after a Bomgar software upgrade, the What's New page will receive focus, alerting you that new features are available on your site. You must be an administrator to view this tab. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 8

9 My Account: Change Password and Username, Download the Representative Console and Other Software From the My Account page, you can download the Bomgar representative console. The file type will default to the appropriate installer for your operating system. For system administrators who need to push out the representative console to a large number of systems, the Microsoft Installer can be used with your systems management tool of choice. In your command prompt, when composing the command to install the representative console using an MSI, change to the directory where the MSI was downloaded and enter the command included on the My Account page. You can include optional parameters for your MSI installation. INSTALLDIR= accepts any valid directory path where you want the representative console to install. RUNATSTARTUP= accepts 0 (default) or 1. If you enter 1, the representative console will run each time the computer starts up. ALLUSERS= accepts or 1 (default). If you enter 1, the representative console will install for all users on the computer; otherwise, it will install only for the current user. If you install for only the current user, you can choose to have the representative console automatically update each time the site is upgraded by entering SHOULDAUTOUPDATE=1; a value of 0 (default) will not auto-update, and the representative console will need to be manually reinstalled when the site is upgraded. If you install the representative console for all users, it will not auto-update. You can download a session recording viewer to view recorded sessions from your desktop rather than only on the web. In unusual scenarios where video driver performance is slowing down screen refresh rates, downloading the display driver on the target system can greatly improve screen sharing speed. The display driver must be installed on the computer whose screen is to be viewed, either the remote computer for a support session or the representative's computer for a presentation. The display driver works only on Windows XP and higher and Server 2003 and higher. From the Bomgar Virtual Smart Card section, download the virtual smart card installer for the representative system or the customer system. A virtual smart card allows you to authenticate to a remote system using a smart card on your local system. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 9

10 To attempt virtual smart card authentication, the representative must have the Bomgar representative virtual smart card driver installed. The computer being accessed must be running in elevated mode. Also, either it must have the Bomgar customer virtual smart card driver installed, or it must be accessed by the Jump To functionality of the representative console. For more details and requirements, see the Smart Cards for Remote Authentication document. In special cases, you may need a session to start with the customer client already in elevated mode, or you may need to elevate the customer client without providing credentials. To securely elevate the customer client without the prompt, download the Bomgar Automatic Elevation Service and install it beforehand on the remote Windows systems to which you need credential-less elevation access. You must install the elevation service using an account that has administrative privileges to the local machine. When the elevation service runs, it adds to the registry a hash unique to your Bomgar site. Then, when the remote user starts a support session from that site, the elevation service matches the registry hash against the hash in the customer client. If they match, the customer client attempts automatic elevation following the rules set in /login > Public Portals > Customer Client :: Miscellaneous Options. If the rules set for the customer client do not allow it to elevate automatically, a matching hash will still make the elevation service the means for elevation when the representative clicks the Elevate button in the representative console. When the elevation service is used, neither the representative nor the customer is prompted for credentials. After a Bomgar software update, your site hash changes. Download and run the elevation service registry file to update the registry hash on systems which already have the elevation service installed. You must run the elevation service registry file using an account that has administrative privileges to the local machine. Enable or disable Extended Availability Mode by clicking the Enable/Disable button. Extended Availability Mode allows you to receive invitations from other representatives requesting to share a session when you are not logged into the representative console. You can change your settings for Extended Availability Mode, including preferred language for the s. You can change your password and display name, and nonadministrators may change the security question and answer. Bomgar recommends changing your password regularly. You can choose to have a public display name, for use with customers, and a private display name, used for all internal communications between representatives, on chat transcript reports, team activity reports, and so forth. By default the two fields are in sync, so anything you type in the Private Display Name field is copied automatically to the Public field. To change your public display name type in the name you want your customers to see. To put the fields back in sync, simply make them identical again. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 10

11 Configuration Options: Manage the General Queue, Record Sessions, Monitor License Usage, Set Up Text Messaging The option Enable the General Queue is selected by default and creates a queue in the representative console that includes all logged-in representatives. If deselected, representatives will see only their personal and team queues, and they will be unable to communicate with any representatives outside their teams. Disabling the general queue is helpful for companies with a large support center where representatives do not need to interact outside their teams. Note: Disabling the general queue does not prevent representatives from transferring sessions to other teams. This permission is configured per user from the User Accounts page. See "User Accounts: Add User Permissions for a Representative or Admin" on page 35. If you check Require Closed Sessions on Logout or Quit, then representatives will be unable to log out of the representative console until their personal queues are empty. There are five rules for when a representative s connection to a session is lost or terminated. (1) If the session is shared, it transfers to the representative who has been sharing the session the longest. If not shared, it transfers to (2) the last queue it was in, (3) the queue in which it entered, or (4) the general queue. This second set of rules can be turned on or off for normal sessions (attended), Jump sessions (unattended), or both. (5) Finally, if no representative is found, the session ends. Note: If the session is in a persistent queue, the above logic will not apply. For information about persistent queues, see "Support: Contact Bomgar Support" on page 90. If General Queue Routing Algorithm is set to Least Busy, Equilibrium will be enabled so that a session in the general queue will be assigned to the least busy representative who is allowed to participate in the general queue. If it is set to Skills Match, Least Busy, then if a session has needed skills marked and is transferred to the general queue, that session will be assigned to the representative with the best skills match. The representative has as long as is set in General Queue Alert Timeout to either accept or reject the session. If the representative rejects the session or fails to respond before the timeout, the session will be reassigned to the next best matched representative who is allowed to participate in the general queue. When a session is assigned, the representative receives an alert. If Show Session Information is checked, all session assignment alerts, both for the general queue and for any other queues using Equilibrium, will display the support request information. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 11

12 Choose if you want screen sharing sessions, Show My Screen sessions, and/or command prompts to be recorded as videos (FLV). Set the resolution at which to view playback. Note that all recordings are saved in raw format; the resolution size affects playback only. You can automatically pull the remote computer s system information to be available in the session report details. When supporting mobile platforms, choose Standard to pull a small set of data or Extended to pull all available information. You can also choose to record presentations. You can set a license threshold alert to let you know when the number of licenses in use reaches a preset amount or percentage, or all reserved slots are taken. The is sent to the License Alert Contact(s) entered in the License Alert Contact field. If Enable Login Denied Alerts is checked, an alert is sent whenever a representative is unable to log in due to insufficient licenses or insufficient reserved slots. One or both options can be selected simultaneously. This feature requires valid SMTP configuration for your appliance, set up on the Configuration page under the Management tab. You may enter a custom link that will appear as a button in the representative console during a support session. One example use of this link is to associate sessions with external programs such as customer relationship management systems (CRM). The variable %EXTERNAL_KEY% inserts the session's external key into the URL. If, for instance, the external key matches the unique identifier of a case in your CRM system, clicking the session's custom link button could pull up the associated case in this system. You may enter a secure SMS Gateway URL from your ISP or third-party gateway provider to give reps the option to send support access keys via SMS text messages. Send support messages via SMS to a mobile device from within the representative console. SMS messages sent in this manner to other mobile devices will still receive a session link. The SMS communication is not logged in the appliance. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 12

13 Issues: Manage Support Issues Create support issues to streamline your customers' experience when requesting support on the public portal. Issues created may be configured to appear on the dropdown menu of the issue submission form and comprise a list of the support problems most likely to be experienced by your customers. Note: Since support issues need to be routed to Support Teams (see "Support Teams: Group Representatives into Teams" on page 14), you need to create teams before you create support issues. If you wish to associate skills with that issue, you need to create them first as well (see "Skills: Route Issues to Representatives" on page 16). Click Add New Support Issue to create a new issue. Give it a title and a code name. Then use the Route To dropdown menu to have that issue routed to a specific team. Set the issue's priority to High, Medium, or Low, depending on how you want the issue to be handled by the system. The default is Medium. Next, check the box if you want to allow representatives to request help for this support issue while in a session. If checked, the issue is listed in the Request Help flyout window of the representative console when the Session Sharing option is selected. Issues can be associated with the skills needed to best resolve them. Skills can be More Preferred, Less Preferred, or Ignored, depending on the level of knowledge required to resolve a given issue. This will determine how support requests are routed and handled by the system. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 13

14 Support Teams: Group Representatives into Teams Grouping support representatives into teams aids efficiency by assigning leadership within groups of representatives as well as by helping to direct customers to the representative best suited to solve a given problem. Assign the team a name and set comments to help identify the purpose of this team. If Persistent Queue is checked, support sessions will remain in this team s queue even if no representatives are available. A session transferred to this team s queue will remain in the queue indefinitely until a team member or API operation handles the session. This option provides additional flexibility for custom session routing management. When adding a team, you can reserve a minimum number of licenses for that team via the Reserved Slots field. This option guarantees that at least the specified number of licenses will be available for members of this support team. Effective license usage management helps to avoid license lockout situations wherein a license is needed but none is available, thereby ensuring that the most critical issues can be addressed by reserving licenses for the most crucial support teams. Note any group policies which assign members to this team. Click the link to go to the Group Policies page to verify or assign policy members. From the list of available representatives, select one or more users and click the arrow to move them into the team. You can set each member s role as a Team Member, Team Lead, or Team Manager. These roles play a significant part in the Dashboard feature of the representative console. Team members who share membership through one or more group policies are listed for you, along with a link to the Group Policies configuration page. Under the Equilibrium Settings section, if Routing Algorithm is set to Least Busy, a session in this team queue will be assigned to the least busy representative who is a member of this team. If it is set to Skills Match, Least Busy, then if a session has needed skills marked and is in this queue, that session will be assigned to the representative in this team with the best skills match. The representative has as long as is set in Alert Timeout to either accept or reject the session. If the representative rejects the session or fails to respond before the timeout, the session will be reassigned to the next least busy representative who is a member of this team. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 14

15 If enabled in the Dashboard Settings section of the main page, a Team Lead or Manager can monitor team members from the dashboard. Choose a selection to Disable the ability to monitor, restrict monitoring to Only Representative Console, or allow a Team Lead or Manager to monitor a team member's Entire Screen. Monitoring affects Team Leads and Managers for all teams on the site. To display a monitoring icon in the team member's representative console, select the checkbox Enable Monitor Indicator. A Team Lead can also take over or transfer a team member s sessions if the Enable Session Transfer checkbox is selected. Similarly, a Team Manager can monitor and administer both team members and Team Leads. Within a team, a representative can administer only others with roles lower than his or her own. Note, however, that roles apply strictly on a team-by-team basis, so a representative may be able to administer another representative in one team but not be able to administer that same representative in another team. Once you have saved your changes, you can modify a team by clicking Edit or remove a team entirely by clicking Delete. Deleting a team does not delete those representative accounts, only the team with which they are associated. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 15

16 Skills: Route Issues to Representatives Skills are the areas of expertise covered by your representatives. As an administrator, you need to create a list of these skills, which are ranked in broad categories according to their importance. These root skills can be assigned a number of sub-skills. For instance, the root skill for "Antivirus"can contain a list of common antivirus programs, each a particular sub-skill necessary to properly address a customer support issue dealing with antivirus-related problems. Representatives associated with a given skill are listed on the right. If no representative is associated with a skill, click on the Users page link to configure skills for each user. Creating Skills Note: In order to be able to create and edit skills, this permission has to be set per user. Go to Users and Security > User Accounts, scroll down to the Permissions section, and make sure Allowed to Edit Skills permission is checked. Administrators are automatically granted this permission. To begin, you need to create a list of skills. To start, add a few general categories, or root skills. On the Configuration > Skills page, click New Root Skill, then enter a display name and a code name. The code name is for internal use only. Next add skills under the new root skill. The new root skills and their sub-categories display in the Skills tree. You can use the orange arrows to expand or collapse each section. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 16

17 Root skills are ranked sequentially from more critical to less critical. When Equilibrium is enabled, the system will try first to match all the root skills, but if that is not possible, it will begin to peel away lower ranking skills first, one at a time, until a match is found. If you need to change a root skill's rank, click on Change Ranking and you will now be able to drag and drop skills into their new positions. Once created, skills can be assigned to representatives from the User Accounts page. See "User Accounts: Add User Permissions for a Representative or Admin" on page 35 Bulk Import When dealing with a larger number of representatives and/or skill sets, it may be easier to assign skills to representatives using bulk import. Use Import User Skills to upload a CSV file with the usernames and associated skills. The CSV file should use the following format: "username1", "skill_code_name" "username1", "skill_code_name2" "username2", "skill_code_name" Please note that the skills listed for a given representative on the import file will override any skills already associated with that user. If you need to remove all associated skills with a particular user, leave the skill code name empty ( username3, ). CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 17

18 Access Sponsors: Create Groups of Privileged Users Create access sponsor groups to enable a representative with restricted permissions to request a more highly privileged representative to perform certain actions on his or her behalf, such as elevating a customer client to administrative rights or entering credentials for a remote system. First, name the group and add a brief description. Then, add lower-privileged representatives as requesters to this group, and higher-privileged representatives as sponsors. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 18

19 Jumpoint: Set Up Unattended Access to a Network Bomgar's Jump Technology enables a representative to support both attended and unattended computers on a remote network without having to pre-install software on every machine. Simply install a single Jumpoint agent at any network location to gain unattended access to every PC within that network. At the bottom of the Jumpoint page is the option to Enable network browsing. If checked, permitted representatives can view and select systems from the network directory tree. If unchecked, representatives can access a system through a Jumpoint only by entering the system's hostname or IP address. Either way, the representative must provide valid credentials to the remote system before gaining access. At the top of the page, click Add New Jumpoint. Give this Jumpoint a name that will help users identify it when they need to start a session with a computer on the same network as this Jumpoint. If you want representatives to be able to connect to SSH-enabled and Telnet-enabled network devices through this Jumpoint, check Enable Shell Jump Access. Authorize at least one representative to use this Jumpoint. After the Jumpoint has been created, you can also grant access to groups of representatives from Users & Security > Group Policies. Once you click the Add Jumpoint button, your new Jumpoint should appear in the list of configured Jumpoints, along with a link to download the 32-bit or 64-bit Jumpoint installer. Click on a link to install the Jumpoint agent on a single system in the remote network you wish to access. This system will serve as the initiation point for Jump sessions with other computers on the remote network. As such, it is important that the host system NOT be a system already in use as a server, such as a file server, server, or print server. For security purposes, a Jumpoint must close any active network connections to the computer it needs to access before it can attempt a Jump to that machine. Therefore, if the host system is being used as a server, the Jumpoint may be unable to complete a Jump because some other software is actively using a critical network connection which the Jumpoint is unable to close, causing the Jump to fail. Instead, Bomgar recommends deploying the Jumpoint agent to a virtual system as the ideal setup scenario. If a virtual system is unavailable, you can deploy the Jumpoint agent to its own dedicated server or even a normal client PC, provided that the host system has high availability. On the host system, run the Jumpoint installation wizard to configure further settings and start the service. To change the configuration after installation, locate the Bomgar folder in the Windows All Programs menu, open the site subfolder, and run Bomgar Jumpoint Configuration. Once the Jumpoint is active, any representative with privileges to access that Jumpoint can start a Bomgar session with any accessible device on that network, provided that the representative has valid credentials on the system he or she is attempting to access. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 19

20 Proxy Settings For a Jumpoint to be deployed on a remote network that is behind a proxy, appropriate proxy information may be necessary for the Jumpoint to connect back to the Bomgar Appliance. From dropdown on the Proxy tab, select Basic or NTLM to configure proxy settings. Enter the Proxy Host, Proxy Port, Username and Password. The Jumpoint will supply this proxy information whenever Jumping to another system on the remote network, providing the credentials necessary to download and run the customer client on the target system. You also can set up this Jumpoint to function as a proxy itself by selecting Jump Zone Proxy Server from the dropdown on the Proxy tab. With Jump Zone Proxy Server selected, this Jumpoint can be used to proxy connections for clients on the network that do not have a native internet connection, such as POS systems. Using a Jumpoint as a proxy will route traffic only to the appliance. A Jumpoint can also be used to proxy Jump Client connections. Note: In order for a Jumpoint to function as a Jump Zone Proxy Server, its host system cannot reside behind a proxy. The Jumpoint must be able to access the Internet without having to supply proxy information for its own connection. Enter the hostname to use at the listening interface, and set which port to use. IMPORTANT! Host and port fields should be set carefully since any Jump Client deployed using this Jumpoint as a proxy server will use the settings available to it at the time of deployment and will not be updated should the host or port change. If the host or port must be changed, the Jump Client would need to be redeployed. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 20

21 Set whether to allow all IP addresses or to limit the IPs that can connect through this proxy. If allowing or denying access, enter one IP address or CIDR subnet range per line. Note: It is a best practice to make an exception in the Windows firewall for the port which the proxy server will listen on for the process which will be accepting connections. Intel vpro Settings Using Intel Active Management Technology, privileged representatives can support fully provisioned Intel vpro Windows systems below the OS level, regardless of the status or power state of these remote systems. Configure this Jumpoint to enable vpro connection by going to the Intel vpro tab and checking Enable Intel vpro. Under Authentication, designate how the Jumpoint should attempt to authenticate to vpro-provisioned computers. Regardless of the authentication method, the provided credentials must match the authentication settings in the AMT firmware on the vpro systems. To require representatives to provide credentials each time they connect to a vpro computer, select Basic Digest Password and then Prompt Representative for credentials. Prompting for credentials is useful if the vpro systems on this network do not share a common username and password. However, since the vpro AMT firmware is entirely separate from any user accounts on the computer, administrators frequently provision all vpro systems to have the same credentials. Additionally, note that there is little security risk in storing credentials in the Jumpoint. To use vpro support, a representative must have not only the vpro user account privilege but also access to the vpro-enabled Jumpoint. Therefore, prompting for credentials may be an unnecessary measure. If the same credentials are used for all vpro systems on the network, you can select Basic Digest Password and then Use the following credentials for all connections. With this configuration, representatives are never prompted for vpro credentials; the Jumpoint automatically supplies the stored username and password for all vpro connections. If you select Kerberos, the Jumpoint supplies the credentials for the account that the Jumpoint service is running as. These credentials can be modified to be a specific account that has permissions to access the AMT system. This configuration assumes that the account hosting the Jumpoint uses the same credentials as all provisioned vpro systems to which you wish to connect. With this configuration, representatives are never prompted for vpro credentials. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 21

22 On the Encryption tab, set how the Jumpoint encrypts vpro network traffic. If the remote vpro systems are provisioned not to use TLS encryption, simply select No Encryption. Otherwise, you must define the path to the Base 64- encoded CER file which contains the certificates used during the provisioning of the remote vpro systems. Under Disk Redirection, specify the folder location of any ISO or IMG disk images you would like to make available for mounting in a vpro session. Representatives can use these files for IDE-R, booting the remote vpro system to a disk image rather than the hard drive. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 22

23 Shell Jump Settings The Shell Jump tab determines how this Jumpoint can be used to connect to SSH-enabled and Telnet-enabled network devices. Note: Shell Jump must also be enabled on the Configuration > Jumpoint page of the administrative interface. For a representative to use Shell Jump, he or she must be granted access to a Jumpoint with Shell Jump enabled and must have the user account permission Allowed to Use Shell Jump enabled. On the Policy tab, if Open Access is selected, permitted representatives can Shell Jump to any remote device by entering its hostname or IP address or by selecting it from a list of provisioned devices. If Limited Access is selected, representatives can Shell Jump to provisioned devices or can enter a device's hostname or IP address provided that it falls within the parameters set by the host list on the Limited tab. If Provisioned Only is selected, representatives can Shell Jump only to provisioned devices. If limited access is enabled on the Policy tab, the Limited list accepts IP addresses and CIDR subnet masks to which Shell Jump access will be limited. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 23

24 Configure access to provisioned Shell Jump targets by going to the Provisioned tab and clicking Add. Enter a Name that will help representatives to identify this device when starting a Shell Jump session with it. Enter the device's hostname or IP address.choose the Protocol to use, either SSH or Telnet. Port automatically switches to the default port for the selected protocol but can be modified to fit your network settings. Select the Terminal Type, either xterm or VT100. If you are using SSH, you can choose to use Public Key Authentication. If you choose to do so, select a Private Key to use. Private keys are configured from the Private Keys tab. Representatives Shell Jumping to this provisioned device may connect only with the Username you provide. You can also select to Send null packets to keep idle sessions from ending. Enter the number of seconds to wait between each packet send. If you are going to be using SSH, you can upload a key file to use by going to the Private Keys tab and clicking Add. Give this key a Name and browse to the key file you wish to use. Keys must be in PuTTY format (PPK). PuTTYgen can be used to generate a PPK file if needed. If a Password is required, you can store the key file password for all representatives to use, or you can require representatives to enter the key file password each time they connect to a provisioned device using this key. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 24

25 You can add SSH Host Keys prior to a representative's Jumping to that host. If no host key is cached, the representative will receive a message alerting him or her that the server's host key is not cached and that there is no guarantee that the server is the computer he or she thinks it is. Caching a server's host key prior to connection can help prevent confusion. Enter the hostname or IP address. Enter the Port the device uses. The server will then return its host key, which you should verify. Clicking Update will poll the device for its host key and will let you know if it has changed. TTL Settings A date and time can be set to specify when the Jumpoint should become active and when it should automatically uninstall. Setting these delimiters determines the duration of time for which representatives can access the remote network through this Jumpoint. Note: Jumpoint is only available for Windows systems. Jump Clients are needed for remote access to Mac or Linux computers. To Jump to a Windows computer without a Jump Client, that computer must have Remote Registry Service enabled (disabled by default in Vista) and must be on a domain. If you need to access remote computers via Jumpoint when no user is available, make sure your account permissions are set either to disable prompting or to default to Allow. You cannot Jump to a mobile device, though Jump Technology is available from mobile representative consoles. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 25

26 Jump Clients: Manage Settings and Install Jump Clients for Unattended Access The Mass Deployment Wizard enables administrators and privileged representatives to deploy Jump Clients to one or more remote computers for later unattended access. From the dropdown, select whether to pin the Jump Client to your personal queue, to a team queue, or to the general queue. Pinning to your personal queue means that only you can access this remote computer through its Jump Client. Pinning to a team queue allows all members of that team to access this computer through its Jump Client, while pinning to the general queue allows access to all representatives. Select the Public Portal through which this Jump Client should connect. If a session policy is assigned to this public portal, that policy may affect the permissions allowed in sessions started through this Jump Client. Choose a session policy to assign to this Jump Client. A policy assigned to this Jump Client will have the highest priority when setting session permissions. For information about creation and priority of session policies, see "Session Policies: Set Session Permission and Prompting Rules" on page 41. Adding a Group Name helps to organize your Jump Clients into categories within the representative console. Set the Connection Type to Active or Passive for the Jump Clients being deployed. If you have one or more Jumpoints set up as proxies, you can select a Jumpoint to proxy these Jump Client connections. That way, if these Jump Clients are installed on computers without native internet connections, they can use the Jumpoint to connect back to your Bomgar Appliance. The Jump Clients must be installed on the same network as the Jumpoint selected to proxy the connections. Add Comments, which can be helpful in searching for and identifying remote computers. Note that all Jump Clients deployed via this installer will have the same comments set initially. The installer will remain usable only as long as specified by the This Installer is Valid For dropdown. If someone should attempt to run the Jump Client installer after this time, installation will fail, and a new Jump Client installer will have to be created. This time can be set for anywhere from 10 minutes to 1 year. This time does NOT affect how long the Jump Client remains active. If Attempt an Elevated Install if the Client Supports It is selected, the installer will attempt to run with administrative rights, installing the Jump Client as a system service. If the elevated installation attempt is unsuccessful, or if this option is deselected, the installer will run with user rights, installing the Jump Client as an application. This option applies only to Windows and Mac operating systems. Note: For Windows and Mac computers, a Jump Client pinned in user mode is available only when that user is logged in. In contrast, a Jump Client pinned in service mode, with elevated rights, will allow that system to always be available, regardless of which user is logged in. If Prompt for Elevation Credentials if Needed is selected, the installer will prompt the user to enter administrative credentials if the system requires that these credentials be independently provided; otherwise, it will install the Jump Client with user rights. This applies only if an elevated install is being attempted. By selecting Start Customer Client Minimized When Session Is Started, the customer client will not take focus and will remain minimized in the taskbar or dock when a session is started through one of these Jump Clients. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 26

27 You can also set a Password for these Jump Clients. If a password is set, this password must be provided to modify or use any one of these Jump Clients. Once you click Deploy, you can download and install the Jump Client immediately if you are at the computer that you need to later access. You can also the installer to one or more remote users. Multiple recipients can install the Jump Client from the same link. The Platform option will default to the appropriate installer for your operating system. For system administrators who need to push out the Jump Client installer to a large number of systems, the Windows executable, Windows MSI, or Linux executable can be used with your systems management tool of choice. You can include an optional parameter for the installation. -install-dir <install directory> (for the Windows and Linux executables) and INSTALLDIR= (for the Windows MSI) accept any valid directory path where you want the Jump Client to install. When defining a custom install directory, ensure that the directory you are creating does not already exist and is in a location that can be written to. Note that, unlike the representative console, Jump Clients installed from an MSI do auto-update. An administrator can choose which statistics to view for all Jump Clients on a site-wide basis. These statistics are displayed in the representative console and include operating system, uptime, console user, CPU, disk usage, and a thumbnail of the remote screen. The Active Jump Client Statistics Update Interval determines how often these statistics are updated. Managing which statistics are viewed and how often can help to regulate the amount of bandwidth used. The more active Jump Clients you have deployed, the fewer the statistics and the longer the interval may need to be. Also set the maximum number of Jump Clients to upgrade at the same time. Note that if you have a large number of Jump Clients deployed, you may need to limit this number to regulate the amount of bandwidth consumed. You may further regulate the bandwidth used during upgrades by setting Maximum bandwidth of concurrent Jump Client upgrades. Note: Neither of these settings affects representative console upgrades or Bomgar Button deployments. Allow simultaneous representative access to a single Jump Client provides a way for multiple representatives to gain simultaneous access to the same Jump Client without having to be invited to join an active support session by another representative. The first representative to access the Jump Client maintains ownership of the session. Representatives in a shared Jump session will see each other and be able to chat. Restrict Local Uninstall/Disable of Jump Clients limits the remote user s ability to uninstall or disable Jump Clients from the rightclick context menu, reducing the need to reinstall Jump Clients that should not have been uninstalled. If this option is enabled, only users with appropriate privileges on the target machine may uninstall the Jump Client via the host system's "uninstall programs" mechanism. Set whether ad-hoc Jump Clients pinned during a session should by default be active or passive. The Passive Jump Client Port specifies which port a passive Jump Client will use to listen for a "wake up" command from the appliance. Ensure that firewall CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 27

28 settings allow inbound traffic on this port for your hosts with passive Jump Clients. Once awake, Jump Clients always connect to the appliance on port 80 or 443 outbound. CONTACT BOMGAR (US) +44 (0) (UK/EMEA) BOMGAR.COM 28

29 Bomgar Buttons: Deploy Bomgar Buttons for Quick Session Start Deploying a Bomgar Button on your customer's computer installs a customer client on their machine, providing a quick, seamless method of starting support sessions. The Bomgar Button does NOT maintain a connection to the Bomgar Appliance, but rather provides a customer-initiated method of requesting support. Depending on the configuration of the Bomgar Button and the support site, clicking the Bomgar Button will connect the customer to a previously defined representative or team, allow the customer to enter a session key, or allow the customer to submit an issue submission form. Bomgar Buttons can be installed on Windows, Mac, and Linux computers, as well as BlackBerry Smartphones. To mass deploy a Bomgar Button, first enter a user-friendly name for the Description. This will be helpful when managing deployed Bomgar Buttons. Next, select the Public Portal through which this Bomgar Button will start support sessions. If a session policy is assigned to this public portal, that policy may affect the permissions allowed in sessions started through this Bomgar Button. Set the Profile to either the default Bomgar Button profile or a custom profile as created below. Select the Language which this Bomgar Button should use. Next, specify whether starting a session from this Bomgar Button should place the customer in your personal queue or a team queue. Set the lifespan of the button. The customer can use this button to start sessions for only as long as specified here. If the customer clicks this button after it has expired, an invalid session key message will display, and the browser will refresh to your support portal. This time does NOT affect how long the installer remains active or how long a session can last. Finally, choose whether to install the Bomgar Button for a single user or for all users on the remote system. Deploying a Bomgar Button for all users is available only for Windows platforms. Also, if you make any changes to a Bomgar Button profile, a single-user Bomgar Button will automatically incorporate those changes the next time it connects, while an all-user Bomgar Button will have to be redeployed in order to receive those changes. For the best experience, redeploy all-user Bomgar Buttons each time you upgrade your Bomgar software. Note that all-user Bomgar Buttons may not be removed from within the representative console; they must be uninstalled from Programs and Features or Add or Remove Programs. Once you have set the parameters, click Create and then choose to download the Bomgar Button onto the local computer or to it to one or more recipients. The Platform option will default to the appropriate installer for your operating system. Select BlackBerry MDS from the Platform dropdown to deploy the Bomgar Button via the BlackBerry Enterprise Server. For system administrators who need to push out the Bomgar Button to a large number of systems, the MSI option can be used with your systems management tool of choice. In your command prompt, when composing the command to install the Bomgar Button using an MSI, change to the directory where the MSI was downloaded and enter the command included on the Bomgar Button page. Note that, unlike the representative console, Bomgar Buttons installed from an MSI do auto-update. Note: Because some browsers require that the installer be saved before it can be run, there may be some confusion about when the Bomgar Button is fully installed. The downloaded bomgar-scc-{uid}.exe file is not the button itself but rather the installer for the button. This executable file must be run to complete the installation. CONTACT BOMGAR info@bomgar.com (US) +44 (0) (UK/EMEA) BOMGAR.COM 29