Installation and Configuration Guide

Transcription

1 Installation and Configuration Guide BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Version 10.2

2 Published: SWD

3 Contents Overview: BlackBerry Enterprise Service Overview: The BlackBerry Resource Kit for BlackBerry Enterprise Service Download the BlackBerry Resource Kit for BlackBerry Enterprise Service System requirements...9 Compatibility with other releases...9 System requirements: BlackBerry Enterprise Service 10 User Administration Tool... 9 System requirements: BlackBerry Directory Sync Tool System requirements: BlackBerry IT Policy Import and Export Tool System requirements: BlackBerry Enterprise Service 10 Log Monitoring Tool System requirements: BlackBerry Push Initiator Tool Installing tools from the BlackBerry Resource Kit...19 Install tools from the BlackBerry Resource Kit...19 Files for the BlackBerry Resource Kit tools...20 Support for UTF-8 encoding...20 Configuring command-line tools to use UAC-compliant file paths...21 Postinstallation tasks BlackBerry Enterprise Service 10 User Administration Tool...22 Supported authentication models Verify that the BlackBerry Enterprise Service 10 User Administration Tool was installed correctly BlackBerry Directory Sync Tool Permit SSL authentication with an LDAP directory Configure the BlackBerry Directory Sync Tool to search for directory groups Configure the BlackBerry Directory Sync Tool to search for groups in a BlackBerry Enterprise Service 10 domain...25 Configure provisioning options Configure reporting preferences...26 Change the performance and configuration settings for the BlackBerry Directory Sync Tool Configure the BlackBerry Directory Sync Tool to skip certificate validation BlackBerry Push Initiator Tool Configure the BlackBerry Push Initiator Tool for a BlackBerry Device Service connection Configure the BlackBerry Push Initiator Tool for a BlackBerry MDS Connection Service connection...31

4 Troubleshooting...32 BlackBerry Enterprise Service 10 User Administration Tool...32 Check the status of the BlackBerry Enterprise Service 10 User Administration Tool BlackBerry Directory Sync Tool No Directory groups to display. Please check the configuration...33 No BlackBerry groups to display. Please check the configuration...34 Exception retrieving BlackBerry groups...34 Invalid URI: The hostname could not be parsed...35 Remove the BlackBerry Resource Kit tools...36 Glossary Provide feedback...38 Legal notice...39

5 Overview: BlackBerry Enterprise Service 10 Overview: BlackBerry Enterprise Service 10 1 BlackBerry Enterprise Service 10 is an enterprise solution that allows administrators to manage an organization s mobile devices. Whether employees are using devices that their organization provides, or their own personal devices, BlackBerry Enterprise Service 10 drives business forward by giving users a reliable and secure mobile connection to enterprise resources. BlackBerry Enterprise Service 10 consists of the following products: Product BlackBerry Device Service Universal Device Service BlackBerry Management Studio Description The BlackBerry Enterprise Service 10 component that allows administrators to manage users BlackBerry 10 smartphones and BlackBerry PlayBook tablets. Various server components manage the transfer of data to and from devices. Administrators manage user accounts and devices using a web-based console called the BlackBerry Administration Service. The BlackBerry Enterprise Service 10 component that allows administrators to manage users ios devices and Android devices. Various server components manage the transfer of data to and from devices. Administrators manage user accounts and devices using a web-based console called the Administration Console. A unified management console that connects with the BlackBerry Device Service, Universal Device Service, and supported versions of the BlackBerry Enterprise Server. BlackBerry Management Studio offers administrators a single access point for performing basic administrative tasks for any type of device, for example, creating and managing groups, managing device controls, and activating devices. Administrators can perform more advanced administrative tasks using the BlackBerry Administration Service or the Administration Console. BlackBerry Enterprise Service 10 allows you to perform the following management tasks: Provision and activate devices to synchronize and other enterprise services Create groups to configure and manage multiple user accounts at once Manage multiple devices for each user Assign IT policies to control device permissions and functionality Assign software configurations to install, upgrade, and manage applications Assign profiles to control how devices connect to the organization s network Manage the work data on devices while maintaining the integrity and privacy of personal data 5

6 Overview: BlackBerry Enterprise Service 10 Monitor devices and review device statistics Manage a wide range of device features For more information about BlackBerry Enterprise Service 10, visit to read the product documentation. 6

7 Overview: The BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Overview: The BlackBerry Resource Kit for BlackBerry Enterprise Service 10 2 The BlackBerry Resource Kit is a collection of tools that you can use to manage, monitor, and troubleshoot user accounts and devices that are associated with BlackBerry Enterprise Service 10. You can download the BlackBerry Resource Kit from The BlackBerry Resource Kit for BlackBerry Enterprise Service 10 includes the following tools: Tool Supported by Description BlackBerry Enterprise Service 10 User Administration Tool BlackBerry Directory Sync Tool BlackBerry Device Service only BlackBerry Device Service Universal Device Service A command-line tool that you can use to manage the BlackBerry Device Service, user accounts, and BlackBerry devices. For example, you can add, find, and remove user accounts, or you can configure various settings for devices, including assigning software configurations or IT policies. You can also use the tool to collect information about servers, devices, and users that you can use to monitor your organization's environment and troubleshoot issues. An application that you can use to synchronize the membership of directory groups with groups on a BlackBerry Device Service or Universal Device Service. BlackBerry IT Policy Import and Export Tool BlackBerry Enterprise Service 10 Log Monitoring Tool BlackBerry Device Service only BlackBerry Device Service only A command-line tool that you can use to export IT policy information from a BlackBerry Configuration Database to a backup file. You can use the backup file to import the information to a different BlackBerry Configuration Database so that you can make the IT policies available to a different domain. A command-line tool that you can use to monitor the information that is written to the log files for BlackBerry Device Service components. You can specify actions that you want the tool to perform when it finds specific values, such as events or text strings. For example, you can configure the tool 7

8 Overview: The BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Tool Supported by Description to run a custom batch file when it finds a specific event ID in the BlackBerry Dispatcher log file. BlackBerry Push Initiator Tool BlackBerry Device Service only An application that you can use to push data to apps installed on BlackBerry devices. For example, you can push mapping information about folders in an organization's network that BlackBerry device users can then access using the BlackBerry Work Drives app without the users needing to configure access to the folders. You can customize the data for group members or individuals. You can create a batch file to specify the mapping information used by the BlackBerry Push Initiator Tool. You can use a scheduling tool to run the batch file. This document assumes that you are using the tools in the BlackBerry Resource Kit to manage BlackBerry Enterprise Service 10. If you want to use the tools with previous releases that are supported, visit enterprise-services/ to see the documentation for the appropriate version of the BlackBerry Resource Kit. Download the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 You can download the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 from downloads. Related information System requirements, on page 9 Install tools from the BlackBerry Resource Kit, on page 19 8

9 System requirements System requirements 3 Compatibility with other releases This document assumes that you are using the tools in the BlackBerry Resource Kit to manage BlackBerry Enterprise Service 10 version If you want to use the tools with previous releases that are supported, visit category/enterprise-services/ to see the documentation for the appropriate version of the BlackBerry Resource Kit. Previous versions of the tools have been released for use with the BlackBerry Enterprise Server, BlackBerry Device Service, and Universal Device Service. You cannot use the setup application for the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 version to upgrade previous versions of the tools. Related information System requirements: BlackBerry Enterprise Service 10 User Administration Tool, on page 9 System requirements: BlackBerry Directory Sync Tool, on page 11 System requirements: BlackBerry IT Policy Import and Export Tool, on page 13 System requirements: BlackBerry Enterprise Service 10 Log Monitoring Tool, on page 15 System requirements: BlackBerry Enterprise Service 10 User Administration Tool Item Operating system Supported environments Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. The following environments have been fully tested with and are recommended for use with the tool: BlackBerry Enterprise Service 10 version 10.1 or later (BlackBerry Device Service only) BlackBerry Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 or later for IBM Domino BlackBerry Enterprise Server 5.0 SP4 or later for Novell GroupWise 9

10 System requirements Item Requirement The following environments have been partially tested and are supported for use with the tool: BlackBerry Enterprise Server Express 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 or later for IBM Domino Unsupported environments The following environments are not supported for use with the tool: Universal Device Service component of BlackBerry Enterprise Service 10 version 10.1 Universal Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP2 or earlier for IBM Domino BlackBerry Enterprise Server 5.0 SP1 or earlier for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP2 or earlier for IBM Domino BlackBerry Administration Service Memory Browser Running the tool from a remote computer User Account Control restrictions The tool must be able to connect to the BlackBerry Administration Service. At least 2 GB of memory. Windows Internet Explorer 6.0 or later with language preferences configured to display encoded webpages. Running the tool from a remote computer using the UNC path is not supported. If you did not run the setup application for the tool on the computer, the computer might not have the security requirements to run the tool. When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Enterprise Service 10 User Administration Tool Client). 10

11 System requirements System requirements: BlackBerry Directory Sync Tool Item Operating system User directory Supported environments Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. Any user directory that BlackBerry Enterprise Service 10 supports. The following environments have been fully tested and are recommended for use with the tool: BlackBerry Enterprise Service 10 version 10.1 or later (BlackBerry Device Service and Universal Device Service) BlackBerry Device Service 6.2 Universal Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP3 MR5 or later for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 MR5 or later for IBM Domino BlackBerry Enterprise Server Express 5.0 SP3 MR2 or later for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 MR2 or later for IBM Domino Unsupported environments The following environments are not supported for use with the tool: BlackBerry Device Service 6.1 and earlier BlackBerry Enterprise Server 5.0 SP3 MR4 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 MR4 or earlier for IBM Domino BlackBerry Enterprise Server Express 5.0 SP3 MR1 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 MR1 or earlier for IBM Domino Running the tool in a Microsoft Exchange Resource Forest Topology is not supported. Remote computer Install the tool on a computer that does not host an instance of the BlackBerry Device Service or Universal Device Service. 11

12 System requirements Item Microsoft.NET Framework Access to the user directory and server instances Administrator permissions Requirement Microsoft.NET Framework 3.5 (full package) must be installed on the computer that hosts the BlackBerry Directory Sync Tool. The computer that hosts the tool must be able to access the user directory and the computers that host instances of the BlackBerry Device Service and Universal Device Service. The Windows account that you use to run the tool must have read permissions for the directory. The administrator account that you configure the tool to use must exist on every server instance that you want the tool to connect to. For example, if you configure the tool to access a BlackBerry Device Service and a Universal Device Service, the administrator account must exist on both server instances. The administrator account must have one of the following roles, or a role with equivalent permissions: Security Administrator Enterprise Administrator Senior Helpdesk Administrator For more information about administrator roles and permissions, visit help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 documentation. User accounts must exist on the server instance The tool can synchronize groups only if the directory users have matching user accounts on the BlackBerry Device Service or the Universal Device Service. Before you run the tool, verify that the user accounts that you want to synchronize exist in both the directory and on the appropriate server instance. If matching user accounts do not exist on the server, you can add the user accounts manually using the administration console, or you can enable the provisioning feature so that the tool can add user accounts during the synchronization process. For more information about adding user accounts to a server, visit help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 documentation. Group size limit By default, the tool cannot synchronize changes to BlackBerry Enterprise Service 10 groups that have more than 2000 members. There is no size limit for directory groups. If you want to synchronize changes to groups that have more than 2000 members, change the maximum group size limit in the configuration file (DirectorySync.exe.config). 12

13 System requirements Item Requirement For more information about changing the configuration file, see Change the performance and configuration settings for the BlackBerry Directory Synchronization Tool. Multiple instances are not supported Property names Do not install more than one instance of the tool on the same computer. You cannot run multiple instances of the tool at the same time. The tool reads the following property names from the directory: "name" for group names, "mail" for addresses, and "displayname" for display names. If your organization uses different property names, add the property names to the configuration file (DirectorySync.exe.config). For instructions, see Change the performance and configuration settings for the BlackBerry Directory Synchronization Tool. User Account Control restrictions When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Directory Sync Tool). Related information Change the performance and configuration settings for the BlackBerry Directory Sync Tool, on page 26 System requirements: BlackBerry IT Policy Import and Export Tool Item Operating system Database management system for the BlackBerry Configuration Database Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. Any version of Microsoft SQL Server that BlackBerry Enterprise Service 10 supports. Visit to see the BlackBerry Enterprise Service 10 Compatibility Matrix. 13

14 System requirements Item Supported environments Requirement The following environments have been fully tested and are recommended for use with the tool: BlackBerry Enterprise Service 10 version 10.1 or later (BlackBerry Device Service only) BlackBerry Device Service 6.0 or later The following environments have been partially tested and are supported for use with the tool: BlackBerry Enterprise Server 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 or later for IBM Domino BlackBerry Enterprise Server 5.0 SP4 or later for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 or later for IBM Domino Unsupported environments The following environments are not supported for use with the tool: Universal Device Service component of BlackBerry Enterprise Service 10 version 10.1 Universal Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP2 or earlier for IBM Domino BlackBerry Enterprise Server 5.0 SP1 or earlier for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP2 or earlier for IBM Domino Same type of domain Same platform Version compatibility The source and destination BlackBerry Configuration Database must be associated with the same type of product. For example, you cannot export IT policy information from the BlackBerry Configuration Database for the BlackBerry Enterprise Server and import the IT policy information to the BlackBerry Configuration Database for the BlackBerry Device Service. Each product supports a different set of IT policy rules. The tool does not support exporting and importing IT policy information between different platforms of the BlackBerry Enterprise Server. For example, you cannot export IT policy information from the BlackBerry Enterprise Server for Microsoft Exchange and import the IT policy information to the BlackBerry Enterprise Server for IBM Domino. The tool does not support importing IT policy information to a version of a product that is earlier than the version that you exported the IT policy information from. For example, you 14

15 System requirements Item Requirement cannot export IT policy information from BlackBerry Enterprise Service 10 version 10.1 and import the information to BlackBerry Device Service 6.2. Importing custom IT policy rules User Account Control restrictions The BlackBerry IT Policy Import and Export Tool 10.1 and later does not import custom IT policy rules to the destination BlackBerry Configuration Database (this functionality is relevant only to BlackBerry Enterprise Server 5.0 SP4 and earlier). If the destination domain supports custom IT policy rules, and you want to import custom IT policy rules, download and use a version of the tool that matches the version of the destination domain. When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry IT Policy Import and Export Tool). System requirements: BlackBerry Enterprise Service 10 Log Monitoring Tool Item Operating system Supported environments Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. The following environments have been fully tested and are recommended for use with the tool: BlackBerry Enterprise Service 10 version 10.1 or later (BlackBerry Device Service only) BlackBerry Device Service 6.0 or later The following environments have been partially tested and are supported for use with the tool: 15

16 System requirements Item Requirement BlackBerry Enterprise Server 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 or later for IBM Domino BlackBerry Enterprise Server 5.0 SP4 or later for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 or later for IBM Domino Unsupported environments The following environments are not supported for use with the tool: Universal Device Service component of BlackBerry Enterprise Service 10 version 10.1 Universal Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP2 or earlier for IBM Domino BlackBerry Enterprise Server 5.0 SP1 or earlier for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP2 or earlier for IBM Domino Computer that hosts the BlackBerry Device Service Log files User Account Control restrictions You must run the BlackBerry Enterprise Service 10 Log Monitoring Tool on the computer that hosts the BlackBerry Device Service. The BlackBerry Enterprise Service 10 Log Monitoring Tool can monitor only one log file at a time. When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Enterprise Service 10 Log Monitoring Tool). 16

17 System requirements System requirements: BlackBerry Push Initiator Tool Item Operating system Supported environments Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. The following environment has been fully tested and is recommended for use with the tool: BlackBerry Enterprise Service 10 version or later (BlackBerry Device Service only) Unsupported environments The following environments are not supported for use with the tool: BlackBerry Device Service 6.1 and earlier BlackBerry Enterprise Server 5.0 SP3 MR5 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 MR4 or earlier for IBM Domino BlackBerry Enterprise Server Express 5.0 SP3 MR1 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 MR1 or earlier for IBM Domino Running the tool in a Microsoft Exchange Resource Forest Topology is not supported. Remote computer Microsoft.NET Framework Access to the server instances Administrator permissions Install the tool on a computer that does not host an instance of the BlackBerry Device Service or Universal Device Service. Microsoft.NET Framework 3.5 (full package) must be installed on the computer that hosts the BlackBerry Push Initiator Tool. The computer that hosts the tool must be able to access the computers that host instances of the BlackBerry Device Service. The administrator account that you configure the tool to use must exist on the server instance that you want the tool to connect to. For example, if you configure the tool to access a BlackBerry Device Service, the administrator account must exist on the server instances. The administrator account must have one of the following roles, or a role with equivalent permissions: 17

18 System requirements Item Requirement Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator User Only Administrator For more information about administrative roles and permissions, visit help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 documentation. Multiple instances are not supported User Account Control restrictions Do not install more than one instance of the tool on the same computer. You cannot run multiple instances of the tool at the same time. When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Push Initiator Tool). BlackBerry MDS Connection Service BlackBerry Enterprise Service 10 version 10.2 or later 18

19 Installing tools from the BlackBerry Resource Kit Installing tools from the BlackBerry Resource Kit 4 Install tools from the BlackBerry Resource Kit Before you begin: Check the system requirements for the tools that you want to install. 1. On the computer where you plan to install the tools, create a folder for the installation files. 2. In a browser, visit and navigate to the Downloads area for the BlackBerry Resource Kit for BlackBerry Enterprise Service Download the installation package for the BlackBerry Resource Kit for BlackBerry Enterprise Service Extract the contents of the installation package to the folder that you created. 5. Double-click the brk<version>.msi file. 6. Click Next. 7. In the drop-down list, click your location. Read and accept the end-user license agreement. Click Next. 8. In the drop-down list for each tool, perform one of the following actions: To install the tool, click Will be installed on local hard drive. To prevent the setup application from installing the tool, click Entire feature will be unavailable. 9. Click Next. 10. If you chose to install the BlackBerry Enterprise Service 10 User Administration Tool, you are prompted for the DNS name of the BlackBerry Administration Service. Type the DNS name and port of the BlackBerry Administration Service that you use to manage the BlackBerry Device Service, using the following format: <DNS_name>:<port>. For example, server1.test.company.com: If necessary, click Verify DNS Name. After the DNS name is verified, click Next. 12. Verify the file path where the tools will be installed. If you want to change the file path, click Change and select a new location. 13. Click Next. 14. If you do not want the tools to use UAC-compliant file paths for configuration files, input files, output files, and log files, clear the Use Windows UAC compliant paths check box. 15. Click Next. 19

20 Installing tools from the BlackBerry Resource Kit 16. Click Install. 17. When the installation process completes, click Finish. After you finish: Complete the postinstallation tasks for the tools that you installed. For more information, see Post-installation tasks. If you want to change the information that you specified for the BlackBerry Enterprise Service 10 User Administration Tool, you can edit the BESUserAdminClient.exe.config file located at the file path that you specified in step 12. If your computer's operating system uses UAC and does not permit you to modify the configuration file at this location, open the virtualized copy of the BESUserAdminClient.exe.config file in the application data folder for the current user (for example, <drive>\users\<user_name>\appdata\local\virtualstore\program Files (x86)\research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10). Related information System requirements, on page 9 Postinstallation tasks, on page 22 Files for the BlackBerry Resource Kit tools The default location of the files for the BlackBerry Resource Kit tools is <drive>:\program Files\Research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\. After you install the tools, you can access them from the Start menu. Tool Executable file Configuration file BlackBerry Enterprise Service 10 User Administration Tool BESUserAdminClient.exe BESUserAdminClient.exe.config BlackBerry Directory Sync Tool DirectorySync.exe DirectorySync.exe.config BlackBerry IT Policy Import and Export Tool ITPolicyImportExport.exe BlackBerry Enterprise Service 10 Log Monitoring Tool LogMonitor.exe BlackBerry Push Initiator Tool PushInitiator.exe PushInitiator.exe.config Support for UTF-8 encoding The tools in the BlackBerry Resource Kit support UTF-8 encoding for input files. The command-line tools support UTF-8 encoded characters that you type using keystroke commands or that you copy and paste from the character map. 20

21 Installing tools from the BlackBerry Resource Kit Configuring command-line tools to use UACcompliant file paths If you install any tools that use a command-line interface, when you run the setup application, you specify whether you want the tools to use UAC-compliant file paths for configuration files, input files, output files, and log files. The setup application creates a subfolder for the files in the application data folder for the current user. For example: Configuration files: <drive>:\users\<user_name>\appdata\local\virtualstore\program Files (x86)\research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Log files, reports, input files and output files: <drive>:\users\<user_name>\appdata\roaming\research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10 or <drive>:\documents and Settings\<user_name> \Application Data\Research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10 When you use any of the command-line tools, you can use the -uac or -no_uac subparameters to override the setting that you configured when you installed the tool. For example, if you configured the BlackBerry Enterprise Service 10 User Administration Tool to use a UAC-compliant file path, you can use the -no_uac subparameter to write output files and log files to a file path that is relative to the current working directory (for example, <drive>:\program Files\Research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Enterprise Service 10 User Administration Tool). 21

22 Postinstallation tasks Postinstallation tasks 5 BlackBerry Enterprise Service 10 User Administration Tool Supported authentication models The BlackBerry Device Service supports the following authentication models for BlackBerry Administration Service administrator accounts: BlackBerry Administration Service authentication Microsoft Active Directory authentication LDAP authentication Single sign-on authentication (uses Microsoft Active Directory authentication) To use the tool, you must create an administrator account (or use an existing account) that uses any of the authentication types. When you specify commands to run a task, you must use authentication parameters to specify the login information for the administrator account that you want to use to perform the task. By default, if you do not specify login information, the tool tries to log in to the BlackBerry Administration Service using your current Windows authentication credentials. This behavior assumes that you configured the BlackBerry Administration Service for single sign-on authentication. For more information about creating an administrator account or how to configure single sign-on authentication, visit help.blackberry.com/en/bes10/10.2/ to read the BlackBerry Enterprise Service 10 documentation. Certain tasks can be performed only if the administrator account that you specify has a role with the required permissions. For example, the command to add a user account to the BlackBerry Device Service can complete successfully only if the administrator account that you specify has a role with the "Create a user" permission. For more information about the roles that can perform different administrative tasks, visit blackberry-resource-kit-for-bes10/10.2/ to see the "Parameters for the BlackBerry Enterprise Service 10 User Administration Tool" section of the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Administration Guide. 22

23 Postinstallation tasks Verify that the BlackBerry Enterprise Service 10 User Administration Tool was installed correctly Before you begin: Verify that you have the required permissions to manage users in the BlackBerry Administration Service. 1. On the computer that hosts the BlackBerry Enterprise Service 10 User Administration Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Enterprise Service 10 User Administration Tool. 2. Using the BlackBerry Enterprise Service 10 User Administration Tool, add a user account to the BlackBerry Device Service. For instructions on how to perform this task, visit to read the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Administration Guide. 3. In the BlackBerry Administration Service, verify that the user account was added correctly and that you can manage and make changes to the user account, including adding the user account to a group, assigning an IT policy or a software configuration to the user account, and assigning a device to the user account. For instructions on how to perform these tasks, visit to read the BlackBerry Enterprise Service 10 documentation. BlackBerry Directory Sync Tool Permit SSL authentication with an LDAP directory This task is only required if your organization uses an LDAP directory that requires SSL authentication. You must import the SSL certificate of the LDAP server into the Trusted Root Certification Authorities certificate store of the computer that hosts the BlackBerry Directory Sync Tool. This allows the tool to authenticate with the LDAP server when it tries to search for directory groups. Before you begin: Obtain the SSL certificate (.der) for the LDAP server. 1. On the computer that hosts the BlackBerry Directory Sync Tool, open the Microsoft Management Console. If a Windows message appears and requests permission to make changes to the computer, click Yes. 2. Click Console Root. 3. Click File > Add/Remove Snap-in. 4. In the Available snap-ins list, click Certificates. Click Add. 5. In the Certificates snap-in dialog, select the Computer account option. Click Next. 6. In the Select Computer dialog, select the Local computer option. Click Finish. 23

24 Postinstallation tasks 7. Click OK. 8. Expand Certificates (Local Computer) > Trusted Root Certification Authorities. 9. Right-click Certificates. Click All Tasks > Import. 10. In the Certificate Import Wizard, click Next. 11. Click Browse. Navigate to and select the SSL certificate for the LDAP server. Click Open. 12. Click Next. 13. Verify that Place all certificates in the following store is selected. Click Next. 14. Click Finish. Click OK. After you finish: Configure the BlackBerry Directory Sync Tool to search for directory groups. Configure the BlackBerry Directory Sync Tool to search for directory groups You can configure the tool to search for directory groups in Microsoft Active Directory or in a supported LDAP directory. 1. On the computer that hosts the BlackBerry Directory Sync Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Directory Sync Tool Client. 2. In the Directory Group Search section, click Configure. 3. In the Server Discovery drop-down list, perform one of the following actions: If you want the tool to search for directory groups in the domain that you are currently logged in to, click Automatic. The account that you are currently using must have read permissions for your organization's directory. If you want the tool to search for directory groups in a specific domain or server, click Manual. 4. If necessary, in the Domain or Server field, type the name of the domain or server that hosts the directory. 5. If necessary, in the Port field, type the port number that you want the tool to use to connect to the directory. The default port number is 389 (used if you leave the Port field blank). If your organization uses an LDAP directory that requires SSL authentication, specify the port to use for the SSL connection. The default port for an SSL connection is If you want the tool to limit the search to a specific DN, in the Search Path DN field, type the path of the DN (for example, OU=Groups,DC=sample,DC=net). 7. If you want to search an LDAP directory, select the Provide credentials check box. Specify the username and password of the account that you want to use to authenticate with the LDAP directory. 8. In the Maximum Results field, type the maximum number of directory groups that you want the tool to find and display. 9. In the Group search drop-down list, perform one of the following actions: 24

25 Postinstallation tasks If you want the tool to discover and list the directory groups automatically, click Automatic. If you want to search for directory groups manually using a search field, click Manual. 10. Click Save. Configure the BlackBerry Directory Sync Tool to search for groups in a BlackBerry Enterprise Service 10 domain Create an administrator account (or use an existing account) that you will use to access the BlackBerry Device Service and/or the Universal Device Service. The administrator account must exist in and have the required permissions on every server that you want the tool to connect to. 1. On the computer that hosts the BlackBerry Directory Sync Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Directory Sync Tool Client. 2. In the BlackBerry Group Search section, click Configure. 3. In the Administrator Credentials section, in the Authentication Type drop-down list, select the authentication type for the administrator account that you want to use. 4. In the Username field, type the user name of the administrator account. 5. In the Password field, type the password of the administrator account. 6. If you selected Microsoft Active Directory authentication, in the Domain field, type the name of the Microsoft Active Directory domain. 7. In the Add BlackBerry Domain section, in the Label field, type a label for a BlackBerry Enterprise Service 10 domain. 8. In the Hostname field, type the FQDN of the BlackBerry Administration Service pool. You can find the BlackBerry Administration Service pool name on the BlackBerry Administration Service Pool tab in the BES10 Configuration Tool. 9. In the Port field, type the port number for the administration console. The default value for the BlackBerry Device Service is The default value for the Universal Device Service is Click Add. 11. Repeat steps 7 to 10 for each server instance that you want the tool to connect to. 12. Click Save. Configure provisioning options The tool can only synchronize groups if the directory users have matching user accounts on the BlackBerry Device Service or Universal Device Service. If matching user accounts do not exist, you can use the appropriate administration console to manually add the user accounts, or you can enable the provisioning feature so that the tool can add user accounts during the synchronization process. 25

26 Postinstallation tasks 1. On the computer that hosts the BlackBerry Directory Sync Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Directory Sync Tool Client. 2. In the BlackBerry Group Search section, click Configure. 3. In the Provisioning Options section, select Enable user provisioning with virtual provisioning mappings. 4. If you want the tool to manage the removal of user accounts from the BlackBerry Device Service or Universal Device Service, select Enable user de-provisioning when removed from provisioning mappings. In the De-provisioning Warning dialog box, click Yes. In the De-provisioning action drop-down list, perform one of the following actions: If you want the tool to remove user accounts from the server if they do not exist in directory groups that are mapped to virtual provisioning groups, click Delete users. If you want the tool to identify in the report and the log file the user accounts that should be deleted, and you do not want the tool to delete the user accounts, click Log only. Use the information in the report or log file to remove the user accounts using the administration console. 5. Click Save. After you finish: Configure mappings between directory groups and virtual provisioning groups. Configure reporting preferences 1. On the computer that hosts the BlackBerry Directory Sync Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Directory Sync Tool Client. 2. Click Edit > Preferences. 3. If you want to hide "User not found" warning messages in the report when the tool tries to assign user accounts to BlackBerry Enterprise Service 10 groups, select the Suppress "User not found" warnings when assigning users to groups check box. 4. Click Save. Change the performance and configuration settings for the BlackBerry Directory Sync Tool The tool retrieves information from the directory by reading the following object class names and property names: Object class names Group object class name: group User object class name: user Property names 26

27 Postinstallation tasks Group name: name address: mail Display name: displayname User logon name: samaccountname Domain name: domaindns If your organization's directory uses different object class names or property names, you can edit the configuration file (DirectorySync.exe.config) to specify the names that you want the tool to use. You can also change how the tool completes the synchronization process. It is a best practice to use the default performance settings. Changing the settings might have a performance impact on your organization's BlackBerry Enterprise Service 10 domain. 1. On the computer that hosts the BlackBerry Directory Sync Tool, navigate to <drive>:\program Files\Research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Directory Sync Tool. 2. In a text editor, open the DirectorySync.exe.config file. If your computer's operating system uses UAC and does not permit you to modify the configuration file at this location, open the virtualized copy of the DirectorySync.exe.config file in the application data folder for the current user (for example, <drive>\users\<user_name>\appdata\local\virtualstore\program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10). 3. Perform any of the following actions: Action Change the group object class name Change the user object class name Change the property name for group names Change the property name for addresses Change the property name for user display names Change the property name for user logon names Steps In the <appsettings> section, type <add key="groupobjectclassnameproperty" value="<group_oc_property_name>"/>. In the <appsettings> section, type <add key="userobjectclassnameproperty" value="<user_oc_property_name>"/>. In the <appsettings> section, type <add key="groupnameproperty" value="<group_property_name>"/>. In the <appsettings> section, type <add key=" addressproperty" value="< _property_name>"/>. In the <appsettings> section, type <add key="displaynameproperty" value="<display_property_name>"/>. In the <appsettings> section, type <add key="logonnameproperty" value="<logon_property_name>"/>. 27

28 Postinstallation tasks Action Change the property name for the domain name Specify the maximum number of changes that you want the tool to synchronize to a group Specify the maximum size of a group that the tool can synchronize changes to Steps In the <appsettings> section, type <add key="domainnameproperty" value="<domain_property_name>"/>. In the <appsettings> section, type <add key="maxnumberofchanges" value="<max_changes>"/>, where <max_changes> is a value greater than 0. The default value is 0 (no limit). When you start the synchronization process, the tool counts the number of changes to be made to a group. If the number of changes exceeds the value that you specified, the tool does not make any changes to the group. In the <appsettings> section, change the value of <add key="maxnumberofusersinbasgroup" value="<max_users_group>"/>, where <max_users_group> is the maximum number of user accounts in a group. Specify how long you want the tool to wait before synchronizing each change The default value is The tool does not synchronize changes to groups with more user accounts than the value that you specify. In the <appsettings> section, change the value of <add key="changedelay" value="<change_delay>"/>, where <change_delay> is a value greater than 0, in seconds. The default value is 1 second. Specify the maximum level of nested groups that the tool can synchronize In the <appsettings> section, type <add key="maxnestinglevel" value="<max_nesting_level>"/>, where <max_nesting_level> is a value of 0 or greater. The default value is -1 (no limit). Specify the maximum number of errors that can occur before the tool stops performing actions In the <appsettings> section, type <add key="maxnumberoferrors" value="<max_errors>"/>, where <max_errors> is a value of 0 (no limit) or greater. The default value is 5. Specify the minimum number of assignments before the tool caches all of the users on a server instead of searching for the users individually Change the level of logging information written to the console In the <appsettings> section, type <add key="bbusercachethreshold" value="<threshold>"/>, where <threshold> is a value of 0 (no cache) or greater. The default value is 100. If you want the tool to perform a large number of synchronization tasks, caching might improve the tool's performance. In the <appsettings> section, type <add key="consoleloglevel" value="<log_level>"/>, where <log_level> is a value between 0 (no logging) and 5 (trace log level). 28

29 Postinstallation tasks Action Change the level of logging information written to the log files Steps In the <appsettings> section, type <add key="fileloglevel" value="<log_level>"/>, where <log_level> is a value between 0 (no logging) and 5 (trace log level). 4. Save and close the DirectorySync.exe.config file. Example appsettings section <appsettings> <add key="groupobjectclassnameproperty" value="groupocexample"/> <add key="userobjectclassnameproperty" value="userocexample"/> <add key="groupnameproperty" value="groupexample"/> <add key=" addressproperty" value=" example"/> <add key="displaynameproperty" value="displaynameexample"/> <add key="logonnameproperty" value="logonexample"/> <add key="domainnameproperty" value="domainexample"/> <add key="maxnumberofchanges" value="1000"/> <add key="maxnumberofusersinbasgroup" value="1000"/> <add key="changedelay" value="2"/> <add key="maxnestinglevel" value="5"/> <add key="maxnumberoferrors" value="10"/> <add key="bbusercachethreshold" value="150"/> <add key="consoleloglevel" value="5"/> <add key="fileloglevel" value="5"/> </appsettings> Configure the BlackBerry Directory Sync Tool to skip certificate validation When the BlackBerry Directory Sync Tool connects to the administration console, it verifies that the FQDN that you configured the tool to use matches the SSL certificate of the administration console. You can configure the tool to skip this verification process for specific servers. 1. On the computer that hosts the BlackBerry Directory Sync Tool, navigate to <drive>:\program Files\Research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Directory Sync Tool. 2. In a text editor, open the DirectorySync.exe.config file. If your computer's operating system uses UAC and does not permit you to modify the configuration file at this location, open the virtualized copy of the DirectorySync.exe.config file in the application data folder for the current user (for example, <drive>\users\<user_name>\appdata\local\virtualstore\program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10). 3. In the <appsettings> section, type the following: <add key="certvalidationexcludedhosts" value="<server>"/>, where <server> is the FQDN or IP address of the computer that hosts the administration console. If you want to specify multiple computers, separate each FQDN or IP address using a comma (, ) or semi-colon ( ; ). 29