Installation Guide. BlackBerry Enterprise Service 12. Version 12.0

Transcription

1 Installation Guide BlackBerry Enterprise Service 12 Version 12.0

2 Published: SWD

3 Contents About this guide... 5 What is BES12?... 6 Key features of BES Comparing BES12 with previous EMM solutions from BlackBerry...7 Preinstallation tasks... 8 Configure permissions for the service account... 8 Configuring connections for the BES12 database... 8 Specifying database permissions to create the BES12 database... 9 Using the BES12 Readiness Tool...9 Preparing a BES5 database for an upgrade to BES Configuring database high availability using Microsoft SQL Server AlwaysOn AlwaysOn high availability Preinstallation tasks...13 Install BES12 and configure support for database high availability How BES12 selects listening ports during installation Prerequisites: Installing the BES12 software...15 Installing the BES12 software Install BES Installing BES12 in a DMZ Installing a standalone BlackBerry Router Install a standalone BlackBerry Router Logging in to BES12 for the first time...20 Log in to BES12 for the first time Modify the default variables for the management console and BES12 Self-Service Additional information Best practice: Running BES Configuring database permissions using Microsoft SQL Server roles...22 Configure minimum database permissions for the service account or Microsoft SQL Server account... 23

4 BES12 listening ports...23 Troubleshooting BES5 roles The setup application detected incompatible roles in the BES5 database The setup application could not complete the role compatibility check on the BES5 database Removing the BES12 software Remove the BES12 software Remove a BES12 instance from the database Glossary Product documentation...29 Provide feedback...32 Legal notice...33

5 About this guide About this guide 1 BES12 helps you manage BlackBerry 10, BlackBerry OS (version 5.0 to 7.1), ios, Android, and Windows Phone devices for your organization. This guide provides instructions on how to install BES12. This guide is intended for senior IT professionals who are responsible for installing the product. After you complete the tasks in this guide, you must activate licenses and configure BES12. You can find instructions for activating licenses in the BlackBerry Enterprise Service 12 Licensing Guide. You can find instructions on configuring BES12 in the BlackBerry Enterprise Service 12 Configuration Guide. 5

6 What is BES12? What is BES12? 2 BES12 is an EMM solution from BlackBerry. EMM solutions help you do the following: Manage mobile devices for your organization to protect business information Keep mobile workers connected with the information that they need Provide administrators with efficient business tools With BES12, you can manage the following device types: BlackBerry 10 BlackBerry OS (version 5.0 to 7.1) ios Android Windows Phone You can manage these devices from a single, simplified UI with industry-leading security. Key features of BES12 Feature Management of many types of devices Single, unified UI Trusted and secure experience Balance of work and personal needs Description You can manage BlackBerry 10, BlackBerry OS (version 5.0 to 7.1), ios, Android, and Windows Phone devices. You can view all devices in one place and access all management tasks in a single, web-based UI. You can share administrative duties with multiple administrators who can access the management console at the same time. Device controls give you precise management of how devices connect to your network, what capabilities are enabled, and what apps are available. Whether the devices are owned by your organization or your users, you can protect your organization's information. BlackBerry Balance and Secure Work Space technologies are designed to make sure that personal information and work information are kept separate and secure on devices. If the device is lost or the employee leaves the organization, you can delete only work-related information or all information from the device. 6

7 What is BES12? Comparing BES12 with previous EMM solutions from BlackBerry EMM solution Supported device types Description BES12 BlackBerry 10 BlackBerry OS (version 5.0 to 7.1) ios Android Windows Phone You can manage the server, user accounts, and all device types with a single UI, the management console. The software architecture has been simplified for easier management, increased scalability, and additional multiplatform features. For high availability, you can install additional active servers that share the management load automatically. BlackBerry Enterprise Service 10 BlackBerry Enterprise Server 5 BlackBerry 10 BlackBerry OS (version 5.0 to 7.1) BlackBerry PlayBook ios Android BlackBerry OS (version 5.0 to 7.1) You can manage the server, devices, and user accounts with dedicated, advanced UIs for different device types. You can also use BlackBerry Management Studio as a single, unified UI for basic administration of all devices. To manage BlackBerry OS (version 5.0 to 7.1) devices, you can install BlackBerry Enterprise Service 10 on the same computer as BlackBerry Enterprise Server 5.0 SP4 and use BlackBerry Management Studio for basic administration. For high availability, you can install standby instances of the server. You can manage the server, devices, and user accounts with the BlackBerry Administration Service. For high availability, you can install standby instances of most server components. 7

8 Preinstallation tasks Preinstallation tasks 3 Configure permissions for the service account A service account is a Windows account that runs the services for BES12. The service account must be a member of the local Administrators group on the computer that you install BES12 on, and must have the Log on as a service permission. The service account must also have permission to access the Microsoft SQL Server. If your organization's environment includes another EMM solution from BlackBerry, you can use the same service account to install BES12. Otherwise, create a service account in your company directory or a local Windows account on the computer that you want to install BES12 on. Note: If you use Microsoft SQL Server authentication to connect to the BES12 database, the BES12 services run under the Local System account. 1. On the taskbar, click Start > Administrative Tools > Computer Management. 2. In the left pane, expand Local Users and Groups. 3. Navigate to the Groups folder. 4. In the right pane, double-click Administrators. 5. Click Add. 6. In the Enter the object names to select field, type the name of the service account (for example, BESAdmin). 7. Click OK. 8. Click Apply. 9. Click OK. 10. On the taskbar, click Start > Administrative Tools > Local Security Policy. 11. In the left pane, expand Local policies. 12. Click User rights agreement. 13. Configure Log on as a service permission for the service account. Configuring connections for the BES12 database The BES12 setup application creates the BES12 database. BES12 can connect to the BES12 database using Windows authentication or Microsoft SQL Server authentication. 8

9 Preinstallation tasks You can connect to the BES12 database using one of the following: Service account that you use to complete the installation process Windows administrator account that has create_db role permissions Microsoft SQL Server account that you specify during the installation process Specifying database permissions to create the BES12 database Depending on the database option and the type of authentication that you select, you might need to assign database creator permissions to one of the following: Service account that you use to complete the installation process Microsoft SQL Server account that you specify during the installation process Database option Install Microsoft SQL Server Express during the BES12 installation Use an existing Microsoft SQL Server in your organization's environment Database permission If you choose Windows authentication, the setup application automatically assigns the required database permissions to the service account You must add the service account or Microsoft SQL Server account to the dbcreator server role Using the BES12 Readiness Tool You can use the BES12 Readiness Tool to check system requirements before you run the BES12 setup application. The BES12 Readiness Tool checks the following requirements: Proxy server setting validation Minimum operating system requirements Minimum hard disk space Secure connection SRP connection Required ports Account permissions Database validation The BES12 Readiness Tool does not check for the following requirements: Microsoft.NET Framework 4.5 9

10 Preinstallation tasks The BES12 Readiness Tool is included with the BlackBerry Enterprise Service 12 software. You can also download the tool from the Enterprise section of Preparing a BES5 database for an upgrade to BES12 You must prepare the BES5 database before you upgrade it to BES12. BES5 software version Before you upgrade from BES5 to BES12, make sure that the BES5 database is at version MR10 or later. Database compatibility The BES5 database must be compatible with the version of Microsoft SQL Server used for BES12. The compatibility level of the BES5 database must be 100 or higher. You can check and set the compatibility level using Microsoft SQL Server Management Studio: To check the compatibility level, type and execute the following query in Microsoft SQL Server Management Studio: SELECT compatibility_level FROM sys.databases WHERE name = '<besdbname>'; If the compatibility level is less than 100, type and execute the following query in Microsoft SQL Server Management Studio: ALTER DATABASE [<besdbname>] SET COMPATIBILITY_LEVEL = 100 Note: Replace <besdbname> with the name of the BES5 database. Database backup Before you upgrade your BES5 environment to BES12, back up the BES5 databases. CAUTION: After an upgrade from BES5 to BES12, you cannot roll back to the BES5 database. BES5 roles After an upgrade, the roles from BES5 are available in BES12 and you can manage them using the BES12 management console. However, BES12 handles roles differently than BES5: BES12 allows only one role for each user. BES12 requires that an entire role to be assigned to one, some, or all groups. During an upgrade from BES5 to BES12, if a user has more than one role assigned, BES12 combines the roles. BES12 resolves the roles so that the permissions remain as close as possible to the original permissions in BES5. If there are conflicting permissions that BES12 cannot resolve, the setup application stops and you must resolve the conflict in BES5 manually. You should review role permissions in BES5 and resolve potential conflicts before you upgrade to BES12. For more information, see Troubleshooting BES5 roles. 10

11 Preinstallation tasks Configuring database high availability using Microsoft SQL Server AlwaysOn Before you install BES12, decide if you want to configure high availability for the BES12 database. Database high availability allows you to retain database service and data integrity if issues occur with the BES12 database. You can use one of the following Microsoft SQL Server features for database high availability: AlwaysOn Failover Cluster Instances (FCI) for Microsoft SQL Server 2012 or 2014 (Standard Edition) AlwaysOn Availability Groups for Microsoft SQL Server 2012 or 2014 (Enterprise Edition) Database mirroring for Microsoft SQL Server 2008 or 2012 If you want to use an AlwaysOn feature, you must complete configuration steps before you install BES12. This section gives you instructions for configuring database high availability using AlwaysOn. You can configure database mirroring any time after you install BES12. For instructions, visit docs.blackberry.com/bes12 to read the BlackBerry Enterprise Service 12 Configuration Guide. Note: Microsoft recommends using AlwaysOn because database mirroring will be deprecated in a future version of Microsoft SQL Server. AlwaysOn high availability BES12 supports AlwaysOn using a Failover Cluster Instance (FCI) or availability group. Both methods require a Windows Server Failover Clustering (WSFC) cluster where independent servers interact to provide a high availability solution for databases. For more information about WSFC, visit the MSDN Library to see Windows Server Failover Clustering (WSFC) with SQL Server. Instance-level high availability using an AlwaysOn Failover Cluster Instance 11

12 Preinstallation tasks An FCI is an instance of Microsoft SQL Server that is installed across multiple computers (or nodes ) in a WSFC cluster. The nodes are members of a resource group, and all nodes have shared access to the BES12 database. One of the nodes has ownership of the resource group and gives the BES12 components access to the BES12 database. If the node that owns the resource group becomes unavailable (for example, a hardware or OS failure), a different node takes ownership of the resource group. As a result, BES12 database service continues with minimal interruption. For more information, visit the MSDN Library to see AlwaysOn Failover Cluster Instances (SQL Server). Database-level high availability using an AlwaysOn availability group 12

13 Preinstallation tasks To use an availability group, you configure a WSFC cluster with multiple nodes. Each node is a separate computer that has an instance of Microsoft SQL Server. One of the nodes hosts the primary BES12 database and gives the BES12 components readwrite access. This node is the primary replica. The WSFC cluster can have one to eight other nodes, each hosting a secondary database (a read-only copy of the BES12 database). These nodes are secondary replicas. The primary database synchronizes data with the secondary databases. Data is synchronized with each secondary database independently. If one secondary database is unavailable, it does not affect the other secondary databases. You can configure the data synchronization to be asynchronous (delayed synchronization with minimal transaction latency) or synchronous (faster synchronization with increased transaction latency). Automatic failover requires the primary replica and secondary replicas to use synchronous-commit mode. If you configure an availability group for automatic failover and the primary database becomes unavailable, one of the secondary replicas becomes the primary replica. That replica s secondary database becomes the primary database. As a result, BES12 database service continues with minimal interruption. For more information, visit the MSDN Library to see Overview of AlwaysOn Availability Groups (SQL Server) and AlwaysOn Availability Groups (SQL Server). Preinstallation tasks Before you install BES12, perform the following actions: Create a WSFC cluster. It is recommended to use static port 1433 for the database server. For requirements and instructions, visit the Technet Library to see Create a Failover Cluster. If you want to use an AlwaysOn FCI: Verify that your environment meets Microsoft requirements. Visit the MSDN Library to see Before Installing Failover Clustering. Configure the FCI. Visit the MSDN Library to see Create a New SQL Server failover Cluster (Setup). If you want to use an AlwaysOn availability group: Verify that your environment meets Microsoft requirements. Visit the MSDN Library to see Prerequisites, Restrictions, and Recommendations for AlwaysOn Availability Groups (SQL Server). Enable the availability groups feature and complete the initial setup tasks, including creating an availability group listener. You will set up the primary replica and secondary replicas after you install BES12 and create the BES12 database. Visit the MSDN Library to see Getting Started with AlwaysOn Availability Groups. Install BES12 and configure support for database high availability 1. Verify that your environment meets the requirements for installing BES12. See Prerequisites: Installing the BES12 software. 13

14 Preinstallation tasks 2. Follow the instructions in Installing the BES12 software. When you run the setup application: On the Database information screen, when you specify the Microsoft SQL Server name, type one of the following: If you are using an AlwaysOn FCI, type the SQL Virtual Server Network Name for the WSFC cluster (for example, CompanySQLCluster). If you are using an AlwaysOn availability group, type the Availability Group Listener Virtual Network Name (for example, CompanyListener). On the Database information screen, it is recommended that you use the Static port option and use the default port Complete any postinstallation tasks described in this guide. After you finish: If you want to install another BES12 instance connecting to the same BES12 database, repeat these steps. If you are using an FCI, use the Failover Cluster Manager tool to manage the FCI and failover settings. If you are using an availability group, use Microsoft SQL Server Management Studio to set up the primary replica and secondary replicas and to configure failover settings. Visit the MSDN Library to see Getting Started with AlwaysOn Availability Groups and Use the Availability Group Wizard (SQL Server Management Studio). Choose the option to create a full backup for the secondary databases and specify a shared network location that all replicas can access. How BES12 selects listening ports during installation When you install BES12 for the first time, the setup application determines whether default listening ports are available for use. To review the list of default listening ports and the purpose of each port connection, see BES12 listening ports. If a default port is not available, the setup application assigns a port value from the range of to The setup application stores the port values in the BES12 database. When you install an additional BES12 instance in the domain, the setup application retrieves the listening port values from the database and uses those values for the current installation. If a defined listening port is not available, you receive an error message stating that you cannot complete the installation until the port is available for use. For more information about the port connections that you must open in your organization's firewall after you install BES12, visit docs.blackberry.com/bes12 to read the BlackBerry Enterprise Service 12 Configuration Guide. 14

15 Prerequisites: Installing the BES12 software Prerequisites: Installing the BES12 software 4 Verify that you opened the necessary ports on your organization's firewall. Verify that you installed all required third-party applications. If you perform the installation process on a computer that has more than one NIC, verify that the production NIC is first in the bind order in the Windows network settings. If your organization uses a proxy server for Internet access, verify that you have the computer name, port number, and credentials for the proxy server. When you run the setup application, use only standard characters to specify values. Unicode characters are not supported. If you want to install BES12 on the same computer as BES10, the setup application may identify that you must remove your static JRE version or install a newer, dynamic JRE version. Install the latest JRE 1.7 family version before you run the setup application. 15

16 Installing the BES12 software Installing the BES12 software 5 Install BES12 When you run the setup application, use only standard characters to specify values. Unicode characters are not supported. Before you begin: If you are upgrading from BES5 to BES12 during this installation, verify that the BES5 database is at BES5 version MR10 or later. If you install BES12 behind a firewall, it cannot connect to the BlackBerry Infrastructure until you configure the proxy server. BES12 prompts you the first time you log in to the BES12 management console. Installing BES12 or specifying the location of BES12 log files to a mapped network drive is not supported 1. Log in to the computer that you want to install BES12 on using the service account. 2. In the BES12 installation folder, double-click Setup.exe. If a Windows message appears and requests permission for Setup.exe to make changes to the computer, click Yes. 3. In the Java Setup screen, click Install. 4. Click Close. 5. In the BES12 setup application screen, click Next. 6. In the License agreement dialog box, perform the following actions: a. Select your country or region. b. Read the license agreement. To accept the license agreement, select I accept the terms of the license agreement. c. Click Next. 7. In the Installation requirements dialog box, you can check to see if your computer has met the requirements to install BES12. Click Next. The setup application may display a warning that indicates that Microsoft.NET Framework 4.5 is not installed. You can ignore this warning and proceed with the installation. The setup application will automatically install Microsoft.NET Framework 4.5 for you if it is not detected on your computer. 8. In the Setup type dialog box, perform one of the following actions: For a new installation of the BES12 software, select Create a new domain. Select Install and use Microsoft SQL Server 2012 Express Edition on this computer if you do not have Microsoft SQL Server installed. 16

17 Installing the BES12 software If you already have a supported version of Microsoft SQL Server installed, select Use an existing Microsoft SQL Server instance in your organization s environment. You can install the database server on the same computer or use an existing database server in your organization's environment (local or remote). To upgrade an existing BES5 database to BES12, or to use an existing BES12 database, select Use an existing domain. For more information about how to upgrade from BES10 to BES12, visit docs.blackberry.com/bes12 to read the BlackBerry Enterprise Service 12 Planning Guide. 9. Click Next. 10. In the Database information dialog box, fill out the fields depending on the setup type you selected: Setup type Steps Create a new domain and install Microsoft SQL Server 2012 Express 1. Type the Windows password. 2. Click Next. Create a new domain and use an existing Microsoft SQL Server instance 1. In the Microsoft SQL Server name field, type the name of the computer that hosts the database server. 2. In the Database name field, type a name for the database you are upgrading, or a name for the new database. 3. If you configured the database server to use static ports, select the Static option. If the static port number is not 1433, in the Port field, type the port number. 4. By default, the setup application uses Windows authentication to connect to the existing database. If you select Microsoft SQL Server authentication, specify a Windows account that has access to the Microsoft SQL Server. 5. Click Next. Use an existing domain 1. In the Microsoft SQL Server name field, type the name of the computer that hosts the database server. 2. In the Database name field, type a name for the database you are upgrading, or a name for the new database. 3. If you configured the database server to use static ports, select the Static option. If the static port number is not 1433, in the Port field, type the port number. 4. By default, the setup application uses Windows authentication to connect to the existing database. If you select Microsoft SQL Server authentication, specify a Windows account that has access to the Microsoft SQL Server. 17

18 Installing the BES12 software Setup type Steps 5. Click Next. If you are installing BES12 on a computer that already has an instance of BES5, the setup application automatically completes the fields in the Database information dialog box. 11. In the Folder locations dialog box, perform the following actions: a. Specify the location of the installation folder and log file folder. b. If you receive a message saying there is not enough space remaining, create extra space to install BES12 on your computer. c. If you receive a message asking you to create the installation and logs folder locations, click Yes. 12. Click Next. 13. In the Installation summary dialog box, click Install to install BES In the Installing dialog box, click Next when the installation is complete. 15. In the Console addresses dialog box, click Close. After you finish: If you performed an upgrade from BES5 to BES12, restart the BES5 BlackBerry Administration Service - Application Server service. If you performed an upgrade from BES5 to BES12, review the BES5 roles. You can install more than one BES12 instance in the domain to create a high availability configuration that minimizes service interruptions for BlackBerry 10, ios, Android, and Windows Phone device users. For more information about high availability, visit docs.blackberry.com/bes12 to read the BlackBerry Enterprise Service 12 Configuration Guide. Installing BES12 in a DMZ You can install BES12 in a DMZ, outside of your organization's firewall. To install BES12, see Install BES12. If you install BES12 in a DMZ, verify that you open the required ports on your organization's firewall. For more information about port requirements, visit docs.blackberry.com/bes12 to see the BlackBerry Enterprise Service 12 Configuration Guide. 18

19 Installing a standalone BlackBerry Router Installing a standalone BlackBerry Router 6 The BlackBerry Router is an optional component that you can install in a DMZ outside your organization's firewall. The BlackBerry Router connects to the Internet to send data between BES12 and devices that use the BlackBerry Infrastructure. The BlackBerry Router functions as a proxy server and can support SOCKS v5 (no authentication). Note: If your current environment contains a TCP proxy server, you do not need to install the BlackBerry Router for BES12. Install a standalone BlackBerry Router Before you begin: Make sure you have the name of the SRP host. The SRP host name is usually <country code>.srp.blackberry.com (for example, us.srp.blackberry.com). To verify the SRP host name for your country, visit the SRP Address Lookup page. Note: Installing the BlackBerry Router on a computer that hosts any components that manage BlackBerry OS devices is not supported. A standalone BlackBerry Router instance is hosted on a computer that does not host any other BES12 components. 1. Download and extract the BES12 Installation.zip file on your computer. 2. From the extracted BES12 installation files, open the router folder. 3. Extract the setupinstaller.zip file from the router folder. This.zip file contains an Installer folder that has the Setup.exe file to install the BlackBerry Router using the Command Prompt application. 4. Go to Start > All Programs > Accessories > Command Prompt. 5. Right-click the Command Prompt application and select Run as administrator. 6. Navigate to the location of the BlackBerry Router Setup.exe file using the Command Prompt application. 7. In the command prompt window, type Setup.exe -srphost <srphostname> (for example, Setup.exe -srphost ca.srp.blackberry.com). 19

20 Logging in to BES12 for the first time Logging in to BES12 for the first time 7 The first time that you log in to the management console after you install BES12, you must enter your organization name, SRP ID, and SRP authentication key. Log in to BES12 for the first time Before you begin: Verify that you have the organization name, SRP identifier, and SRP authentication key available. If the setup application is still open, you can access the management console directly from the Console addresses dialog box. Note: You may be prompted to provide the IP address and port number of the BlackBerry Router or a TCP proxy server. 1. In the browser, type where <server_name> is the FQDN of the computer that hosts the management console. The default port for the management console is port Do one of the following: If you upgraded the database from BES5 to BES12, verify that you have restarted the BlackBerry Administration Service services. Click OK. If you did not upgrade a BES5 database, click OK. 3. Click OK when you receive a reminder to restart the BlackBerry Administration Service services if you have upgraded the database from BES5 to BES12. If you have not upgraded the database from BES5 to BES12, you can ignore the reminder. 4. In the Username field, type admin. 5. In the Password field, type password. 6. Click Sign in. 7. In the Server location drop-down selection, select the country of the computer that has BES12 installed on it. 8. Click Next. 9. Type the name of your organization, the SRP identifier, and the SRP authentication key. 10. Click Submit. 11. You will be prompted to change your password. 12. Change the temporary password to a permanent password. 13. Click Submit. 20

21 Logging in to BES12 for the first time After you finish: When you log in to the management console, you can choose to complete or close the Welcome to BES12 dialog box. If you close the dialog box, it will not appear during subsequent login attempts. Modify the default variables for the management console and BES12 Self-Service You can modify the default values of the variables for the URLs of BES12 Self-Service and the management console. You use these variables in activation messages and compliance notifications. You can modify the values so that users can access BES12 Self-Service and the BES12 management console using the links in the messages and compliance notifications. If you don't want to change these default variables from the FQDN of the computer you installed BES12 on to the FQDN pool name, you do not need to complete this task. 1. Click Settings. 2. Click General Settings. 3. Click Default variables. 4. Modify the default <FQDN of the machine you installed BES12 on>:8008 for both the %AdminPortalURL% and %UserSelfServicePortalURL% variables to <FQDN pool name>: Click Test connection for both the %AdminPortalURL% and %UserSelfServicePortalURL% variables that you modified. 6. Click Save. 21