Managed Workplace Setup Guide. On Premise. See All. Manage All. Service All.

Transcription

1 Managed Workplace 2012 Setup Guide On Premise See All. Manage All. Service All.

2

3 TABLE OF CONTENTS Welcome... vii About this Document... viii Where To Get More Help... viii Contact Us...ix Documentation...ix Technical Support...ix Level Platforms Partner Portal...x Chapter 1: Introducing Managed Workplace... 1 Architecture Overview...2 Service Center...3 Onsite Manager...4 Device Manager...6 Application...6 Key Concepts...7 Devices...7 Management Protocols...7 Website...7 Site...7 Monitors...8 Alerts...8 Policy Modules...8 Groups...9 Chapter 2: Planning Your Installation Planning Your Installation For Growth...12 Minimum System Requirements...12 Service Center...12 Onsite Manager...16 Device Manager...21 Technician s Computer...22 Performance Tuning Service Center...23 Data Volume...24 What SQL Needs...24 How to Avoid IO Bottlenecks...25 How SQL Log Files Behave...25 How Much Bandwidth You Will Use...26 Chapter 3: Installing or Upgrading Managed Workplace Installing Managed Workplace...28 About Installation...28 Access to Software...28 Installing Service Center...28 iii

4 Installing Onsite Manager...32 Cloning Onsite Manager...34 Installing Device Manager...37 Upgrading Managed Workplace...39 About Upgrades...39 Upgrading Service Center...39 Upgrading Onsite Manager...42 Upgrading Device Manager...44 Chapter 4: Post-Installation Tasks Configuring Service Center...48 Configuring the Alert Settings...48 Preparing Group Structure...49 Configuring a Modem...52 Configuring Data Retention...53 Scanning for Devices...53 Configuring Scan Intervals...53 Running an Initial Scan...54 Limiting the IP Addresses to Scan...55 Excluding Devices from a Scan...56 Scanning Intel vpro Devices...57 Running the First MBSA Scan...57 Preparing a Site...58 Configuring SNMP Devices...58 Configuring Syslog Devices...58 Configuring WMI Devices...58 Configuring Intel AMT Devices...61 Configuring Patch Management...62 Chapter 5: Moving Managed Workplace About Moving Managed Workplace...64 Moving a Service Center...64 Moving an Onsite Manager...66 Moving a Device Manager...67 Chapter 6: Backing Up and Restoring Databases Backing Up Databases...70 Configuring the SQL Recovery Model...70 Back Up Strategy for Databases...73 Back Up Strategy for Files...78 Creating Back Ups of the Managed Workplace Databases...79 Creating Back Ups of the Reporting Services Databases...80 Restoring Databases...81 Restoring Back Ups of the Managed Workplace Databases...81 Restoring Back Ups of the Reporting Services Databases...82 Appendix A: Installation Checklists Appendix B: Troubleshooting iv Setup Guide

5 Troubleshooting...90 Setup Guide v

6 vi Setup Guide

7 WELCOME Managed Workplace takes established technology concepts and standards and provides a sophisticated monitoring and management platform. The hybrid architecture provides the flexibility you need to scale your solution to service any size of customer, using either agentless or agent-based monitoring as appropriate. vii

8 About this Document This document provides detailed information about setting up Managed Workplace. Where To Get More Help User Guide Contains detailed information about Managed Workplace. It s designed to be used as a reference in your everyday work. Online Help Contains all the information from the User Guide optimized for use online. Integration Guide: Service Desks Contains the procedures required to integrate Professional Services Automation (PSA) tools or service desks with Managed Workplace. Integration Guide: Backup and Disaster Recovery Contains the procedures required to integrate Symantec Backup Exec and Axcient with Managed Workplace. Integration Guide: Antivirus Contains the procedures required to integrate Symantec Endpoint Protection with Managed Workplace. System Requirements Provides an overview of what hardware and software is required to run Managed Workplace. Release Notes Provides last-minute information about the product and documentation. What s New To see a demo of what s new in Managed Workplace 2011 or to read about the key new features, click here. Domain Configuration Document Contains an overview of domain configuration. To see the document, click here. Script Reference Help Describes all the scripts in the script library. To see this information, click here and search for article 2451 Managed Workplace Script Reference. (You must log into the Partner Portal to access the Script Reference Help.) Knowledgebase Contains hundreds of articles to help you use Managed Workplace, including self-guided troubleshooting tools, advanced topics, and answers to frequently asked questions. To explore the Knowledgebase, click here. (You must log into the Partner Portal to access the Knowledgebase.) On the Level - Video Series.An online video resource for instruction about Managed Workplace. Click here to view the videos currently available. (You must log into the Partner Portal to access the videos.) viii Setup Guide

9 Contact Us Documentation Technical Support Training Level Platforms offers a series of live and on-demand technical training courses for all registered Partners. For more information, click here. (You must log into the Partner Portal to access the Training.) We are committed to making your experience with our product the best it can be. If you find any errors or omissions in our documentation, or have suggestions for improving it, write to us: documentation@levelplatforms.com Our Technical Support team is committed to delivering best-in-class support to our Partners. Hours Sunday 10:00 p.m. EST to Friday 10:00 p.m. EST (GMT -5 hours) If you require assistance immediately (outside of the normal support hours), Level Platforms offers a pay-per-incident telephone and support service. Call International Toll-Free USA & Canada UK Australia New Zealand Ireland Press 5 for Support Setup Guide ix

10 To contact a representative by for Service Center outages only support@levelplatforms.com Level Platforms Partner Portal Click this link to access the Level Platforms Partner Portal, click and then log in with your Username and Password. Technical Information To find technical information such as product downloads, performance guidelines, libraries of policy modules, resource library, scripts and predefined reports, log into the Level Platforms Partner Portal and in the main menu, click Technical. Partner Services To find training information, including live and on demand training, a list of courses, course descriptions and a course calendar log into the Level Platforms Partner Portal and in the main menu, click Partner Services. To access Knowledgebase articles and frequently asked questions (FAQ), click Knowledge Base Articles/FAQs located under the Partner Services menu. To view or participate in discussions about Managed Workplace, select Forum under the Partner Services menu. x Setup Guide

11 C HAPTER INTRODUCING MANAGED WORKPLACE This section provides new users with an overview of the Managed Workplace architecture and introduces the concepts you should understand before beginning. 1

12 Architecture Overview Managed Workplace is made up of two components: Service Center Onsite Manager or Device Manager Service Center is installed on one or more servers in your network or in a data center. Service Center is the web-based management application where users perform their work and also the database where all the client information resides. Onsite Manager and Device Managers collect client data and send it to Service Center over the Internet. Use Onsite Manager to collect data and manage many devices. Use Device Manager to collect data and manage a single device. The Onsite Manager performs agentless monitoring, collecting information from all types of IP-based devices, including computers running any operating systems as well as routers, printers and other infrastructure devices. The Device Manager is an agent, monitoring information only from the device upon which it is installed. Both Onsite Managers and Device Managers regularly initiate outbound communications to Service Center to receive new instructions and upload the data that has been collected. END USER LOCAL INFRASTRUCTURE SERVICE PROVIDER SERVICES MANAGEMENT Home Business Device Manager SOHO CLOUD SERVICES Remote Backup Websites SaaS Clouds Device Managers SMB Venture Inc. Device Managers ABC Midsized Corp. Onsite Manager Onsite Manager Service Center ON PREMISE HOSTED SERVICES ECOSYSTEM PSA/Help Desks Service Collabora on Remote NOCs Vendor Client Services Device Managers Onsite Manager 2 Introducing Managed Workplace Setup Guide

13 Service Center Service Center itself is made up of a database server and an application server. These can either be installed on a single computer or on multiple computers to provide the high performance required for larger deployments. Important: Beginning with a single server deployment and growing to the point where another is required consumes time to migrate the production system, which means downtime for your clients. As such, you may decide to use two servers from the start. Deciding on whether to use a single or dual server installation requires you to predict how busy the system will be. Service Center also integrates with other applications to perform some management activities. For information about the Service Center minimum requirements, see Service Center on page 12. Database Server The database server uses Microsoft SQL Server to house the Managed Workplace databases: SCData_Default The primary database, containing information that has been collected about your clients environments, including Managed Workplace users and user-defined configurations, scripts, reports and other binary files. SCMaster Contains global configuration settings that define how your Service Center operates. MWSessions Used to separate dynamic user sessions from one another so that users do not see each other s data. The reporting functionality of Managed Workplace relies on SQL Reporting Services and so the following databases are also present: ReportServer is a native database for SQL reporting services. ReportServerTempDB is a native database for SQL reporting services used as scratch space for reporting operations. Application Server The application server runs a Microsoft.NET Framework web application using Internet Information Services (IIS) as the web server. These websites are created either as New Websites or Virtual Directories: SC The web interface used to view information, work with alerts and tickets, generate reports and launch remote control sessions. Setup Guide Introducing Managed Workplace 3

14 Onsite Manager SCMessaging The web service for collecting information sent to Service Center by the Onsite Managers and Device Managers. It also contains a service for interacting with other applications, such as Professional Service Automation (PSA) systems. SCMDM The web service for communications with Apple supporting mobile device management for ios devices. This website is required to use SSL with a certificate signed by a Trusted Root Certificate Authority. The application server uses these Windows Services: Service Center Monitor The listener for the SCMessaging web service, receiving information from Onsite Managers and Device Managers. MW Remote Desktop Handles remote control sessions initiated by Service Center users for devices managed by Onsite Managers not yet upgraded to Managed Workplace Other Applications Service Center can optionally integrate with other applications to extend workflow capabilities: PSA applications Provides integration with third-party professional services automation (PSA) systems for comprehensive ticket tracking and issue management. Most partners use a PSA system to assist them with project and resource management. Service Center integrates with the most popular, powerful applications available today, and can also be integrated with custom solutions. See Also Professional Services Automation (PSA) Integration Guide Onsite Manager has a database server and an application. It is capable of handling up to 1000 devices, in healthy environments with basic monitoring requirements. As such the database server and the application can reside on the same physical server. Dedicating a server to Onsite Manager is recommended for larger networks and when more thorough or frequent monitoring is required. For an average SMB client, you can typically install Onsite Manager onto a shared server. Best Practice: When deploying a single Onsite Manager to monitor more than 500 devices, start with policy modules for the operating system, and layer in other monitoring, automated tasks, and patch management activity one configuration at a time, keeping track of any changes to the performance of the server at each stage (CPU and disk activity). 4 Introducing Managed Workplace Setup Guide

15 Important: When installing onto a shared server, you must ensure that the resources specified as the minimum system requirements are available during the client s production hours. (For information about the Onsite Manager minimum requirements, see Onsite Manager on page 16.) Otherwise you are introducing contention for the server s resources, which can cause both Onsite Manager and its other roles to be performed less than optimally. Best Practice: When there is another option available, you should avoid installing Onsite Manager on Domain Controllers or other mission-critical servers. Web or file servers are favorable when available. Database Server The database server uses Microsoft SQL 2008 R2 Server Express, included in the installation package, to house the Managed Workplace database: MWData Stores the monitoring rules that have been defined in Service Center, which direct the activities of the Onsite Manager application. It also contains the information about IP addresses and their associated devices. Setup Guide Introducing Managed Workplace 5

16 During periods where Internet connectivity is interrupted, monitoring data is queued in the database to be sent to Service Center once the connection has been restored. Best Practice: Install Microsoft SQL 2008 Management Studio Express when you install Onsite Manager so that you have a tool to back up your database, and are ready to receive technical support should it be required. Application Device Manager Application The Onsite Manager application makes use of three Windows services: MWExpertSystem Handles all the querying of managed devices for data, and also listens for data being sent to it, such as SNMP traps or syslog messages. To function correctly, it must run with Administrator privileges to ensure it can gather all the information you are requesting from the devices. MWExpertSystemHelper Uses Microsoft Background Intelligent Transfer Service (BITS) to download large task files from Service Center. OMNetworkService Controls all the remote sessions users launch. Other Applications Onsite Manager optionally integrates with another application: Windows Server Update Services (WSUS) Provides the capability to manage Microsoft product updates for devices the Onsite Manager is monitoring. An added benefit of this method is you can choose to cache patches locally on the Onsite Manager server, conserving bandwidth when updating Microsoft products. Device Manager is the functional equivalent of the Onsite Manager but monitors and manages a single device only. There is a lightweight database that is bundled with the application for data storage. For information about the Device Manager minimum requirements, see Device Manager on page 21. The Device Manager makes use of a single Windows service: MWExpertSystem Runs under the security context of the Local System account unlike that for the Onsite Managers. Also, because only a single device is being managed, the transfers normally handled by the 6 Introducing Managed Workplace Setup Guide

17 Key Concepts Devices MWExpertSystemHelper and remoting normally handled by the OMNetworkService are included in this service. Managed Workplace is designed to let you manage many devices easily, and employs common IT standard organizational practices to do so. Having a good understanding of these from the outset allows you to get up and running quickly. Devices in Managed Workplace are workstations, servers, printers and infrastructure devices. This includes anything that has an IP address and responds to an ICMP ECHO request. Onsite Manager identifies devices by their IP addresses, MAC addresses, DNS names and names provided via any management protocols available. Management Protocols Website Site Managed Workplace collects information about computer networks using a wide variety of technologies, but chief among these are the management protocols Windows Management Instrumentation (WMI) and Simple Network Management Protocol (SNMP). These are used to expose status information about devices to authenticated parties. WMI is available only on Windows operating systems and SNMP is commonly available on routers, firewalls and printers, but is also available on almost all operating systems including Windows. Managed Workplace can also monitor websites in addition to IP-based devices. Onsite Manager performs the monitoring, so the websites can be on the Internet or local to the client s network. A Managed Workplace site is a logical container for devices and websites. Most typically this will be a single physical location for one of your clients, but may also be multiple locations using Device Managers. Setup Guide Introducing Managed Workplace 7

18 Monitors Monitors are rules for sampling information from a device, applications running on a device or website. The rules define what data should be collected, when to collect it and how frequently it is sampled. The following types of monitors are available: Device Availability Device Warranty Bandwidth Windows Events Performance Counters Windows Services Network Services SNMP SNMP Traps Syslog Messages Website availability, performance and content search AMT Events Patch Status MBSA Reports SCE Custom log Content Alerts Policy Modules Alerts are an event that is triggered when data being monitored crosses a userdefined threshold. Alerts are displayed on the Central Dashboard in Service Center, but can also be configured to generate an or contact a pager and create a trouble ticket. Alerts for some monitor types can be configured to selfheal, which means they automatically clear when the condition causing the alert is no longer true. Policy modules are sets of monitor and alert configurations for a specific device or application. Managed Workplace comes with over 400 policy 8 Introducing Managed Workplace Setup Guide

19 modules for popular technologies, which lets partners get up and running quickly. Level Platforms designs these policy modules to meet the needs of most partners under the widest range of circumstances, but it is still important for you and your team to be familiar with the rules in all policy modules you have applied. This helps ensure that all monitoring you want to happen is in place. Policy modules for some products, notably Microsoft operating systems, come in baseline and full versions. The baseline versions are appropriate for new users who are looking to monitor only the most critical information available. Using the full version of these policy modules will generate significantly more alerts, which new users may find challenging to manage. Policy modules can be applied to devices or groups of devices. Note: Using the full versions of policy modules may result in more database space being used. Best Practice: Meet with your team on a weekly basis to review active policy modules. You may find that alerts are being generated for events that are outside your Service Level Agreement with your clients, which can be disabled to reduce noise. Alternatively, you may need to add monitors and alerts for situations not covered by default in the policy module. Groups Groups are containers that allow you to manage many similar devices. You can apply policy modules, run automated tasks and generate reports at the group level. There are two kinds of groups you can create: Service groups contain devices from one or more client sites and can be used to manage similar devices across multiple sites. Site groups contain only devices from a single site and can be used to manage devices on one site only. Setup Guide Introducing Managed Workplace 9

20 10 Introducing Managed Workplace Setup Guide

21 C HAPTER PLANNING YOUR INSTALLATION This section provides you with the minimum system requirements for Managed Workplace components. More importantly, guidance is provided to help you predict the hardware and deployment choices you will need as your managed services practice grows. 11

22 Planning Your Installation For Growth As you grow your managed services practice, hardware requirements will also grow beyond the stated minimum system requirements. This section provides you with information about how to predict your future requirements and optimize your initial deployment accordingly. Performance characteristics are a function of load so Level Platforms provides sizing recommendations for any deployment at no charge. We will never withhold support but may declare an issue unresolvable if we determine it to be a result of underpowered hardware. Minimum System Requirements Service Center Service Center is resource-intensive. This means production systems should be dedicated to Managed Workplace. Sharing a server with other applications results in contention for resources, particularly disk throughput, which can significantly impact the performance of all applications on the server. Hardware Memory and disk space requirements listed in this section must be dedicated to Service Center, so additional resources are required for the server operating system and any other roles performed. All Service Center configurations require the following: 2 GB free space in the system partition as listed in the table Minimum hardware requirements as listed in the table Occupancy 1-5 sites (1-150 devices) 5-25 sites ( devices) Hardware Minimums 2.8 GHz dual core CPU with 2 GB ram 20 GB disk space in the data partition 3.0 GHz quad core CPU with 3 GB ram 2 physical disks 60 GB disk space in the data partition 12 Planning Your Installation Setup Guide

23 Occupancy Hardware Minimums sites ( devices) sites ( devices) Two servers recommended Application server: 2.8 GHz dual core CPU with 3 GB ram Database server: 2.8 GHz quad core CPU with 4 GB ram, 3 physical disks and 120 GB disk space in the data partition Two servers required Application server: 2.8 GHz dual core CPU with 4 GB ram Database server: 2.8 GHz quad core CPU with 8 GB ram, 3 physical disks and 240 GB disk space in the data partition 3,000-10,000 devices Two servers required Application server: 2.8 GHz quad core CPU with 8 GB ram Database server: 2.8 GHz quad core CPU, 16 GB ram, 5 volumes: Disk 1 - OS, SQL, Page File Disk GB Raid 10, DB.mdf files Disk GB Raid 1, DB.ldf files Disk GB, Raid 1, Temp DB. Data file spread on 2 physical files (one.mdf and one.ndf of 40 GB each Disk GB RAID 1, SQL Backups Setup Guide Planning Your Installation 13

24 Occupancy Hardware Minimums 10,000-25,000 devices Two servers required Application server: 2.8 GHz quad core CPU with 8 GB ram Database server: 2.8 GHz quad core CPU, 32 GB ram, 5 volumes: Disk 1 - OS, SQL, Page File Disk GB Raid 10, DB.mdf files Disk GB Raid 1, DB.ldf files Disk GB, Raid 1, Temp DB. Data file spread on 2 physical files (one.mdf and one.ndf of 60 GB each For more information, see Performance Tuning Service Center on page 23. Software All the software listed in this section has passed performance testing with Managed Workplace While it may be possible to install on other flavors of Windows or other required applications, it is not recommended because support may be limited for any products not explicitly listed. Installation The following installer is supported: Windows Installer 4.5 Operating System Managed Workplace will install natively for either 32- or 64-bit versions of the server operating system. When installing on a 64-bit operating system, all required software components must be installed in 64-bit mode. The following operating systems are supported: Microsoft Window Server 2011 (Small Business Server) Microsoft Windows Server 2008 SP2 or Windows Server 2008 R2 (Web, Standard, Small Business Server, Enterprise and Datacenter) Microsoft Windows Server 2003 SP2 or Windows Server 2003 R2 (Web, Standard, Small Business Server, Enterprise and Datacenter) 14 Planning Your Installation Setup Guide

25 Note: Small Business Server is not recommended for Service Center installations outside of very small production or staging environments. Note: Windows 2008 is required to support Mobile Device Management for ios devices. Application Framework The following application frameworks are supported (both must be installed): Microsoft.NET Framework 3.5 Service Pack 1 Microsoft.NET Framework 4.0 Web Server The following web servers are supported: Microsoft Internet Information Services 6, 7, and 7.5.NET Framework 2.0 with.net Framework 4.0 Notes: When using SSL with IIS 7.x, the web server must be configured to Ignore client certificates. This is the default setting. A third-party SSL certificate is required in order to offer mobile device management for ios products. Database Server The following database servers are supported: Microsoft SQL Server 2008 SP1 or R2 with Reporting Services (Standard and Enterprise) with Microsoft SQL Server 2008 Management Objects Microsoft SQL Server 2008 Native Client Microsoft SQL Server 2005 SP2 with Reporting Services (Standard and Enterprise) with Microsoft SQL Server 2008 Management Objects Microsoft SQL Server 2008 Native Client Note: Microsoft SQL Server 2008 Management Objects are installed on the application server. Important: Virtualization of SQL Server with Managed Workplace is not supported because of disk I/O concerns. Managed Workplace is considerably more resource intensive than an average database, and virtualization adds a Setup Guide Planning Your Installation 15

26 prohibitively significant amount of complexity to deployment and troubleshooting. Data Centers typically encourage real hardware except where databases serve light applications such as blogs. Important: For performance and management reasons, the Service Center database should be housed in its own database instance. All future versions of Managed Workplace will require a dedicated instance. Mail Server Managed Workplace will work with any SMTP server. Authentication and port options are configurable. Web Browser Microsoft Internet Explorer 7 and 8 Network Requirements The following lists the networking requirements for Service Center: 80 TCP inbound Access to the SCMessaging and SC websites over HTTP. 80 TCP outbound Access to the Level Platforms license server and WSUS meta data server. 443 TCP inbound Access to the SCMessaging and SC websites over HTTPS TCP inbound Access to the Mobile Device Management tunnel service TCP outbound Access to the database server TCP outbound Access to Apple web service (gateway.push.apple.com) for mobile device management feature TCP outbound Access to Apple web service (feedback.push.apple.com) for mobile device management feature. Onsite Manager Onsite Manager is not typically resource-intensive, but can be under some circumstances. Dedicated Onsite Manager servers are recommended for larger sites to avoid resource contention impacting the performance of Onsite Manager or other roles the server performs. Hardware Memory and disk space requirements listed in this section must be dedicated to Onsite Manager, so additional resources are required for the server operating system and any other roles performed. 16 Planning Your Installation Setup Guide

27 All Onsite Manager configurations require the following: 3 GB free space in the system partition 4 GB free space in the database partition 30 GB free space for storing Microsoft updates if storing patches locally Minimum hardware requirements as listed in the table Size of Site SOHO (5 devices or 1 server Small (15 devices, including 1 server) Medium (75 devices, including 15 servers) Large (256 devices, including 30 servers) Enterprise 1 (500 devices, including 50 servers) Enterprise 2 (1000 devices including 100 servers) Hardware Minimums 2.0 Ghz CPU with 1.5 GB ram 2.0 GHz CPU with 2 GB ram 2.8 GHz CPU with 2 GB ram 3.0 GHz CPU with 4 GB ram Please contact Level Platforms technical support for assistance in optimizing configuration. Multiple Onsite Managers or combinations of Onsite Managers and Device Managers may be used. Software All the software listed in this section has passed performance testing with Managed Workplace While it may be possible to install on other flavors of Windows or other required applications, it is not recommended because support may be limited for any products not explicitly listed. Setup Guide Planning Your Installation 17

28 Installation The following installer is supported: Windows Installer 4.5 Operating System Managed Workplace will install natively for either 32- or 64-bit versions of the server operating system. When installing on a 64-bit operating system, all required software components must be installed in 64-bit mode. The following operating systems are supported: Microsoft Windows Server 2011 (Small Business Server) Microsoft Windows Server 2008 SP2 or Windows Server 2008 R2 (Web, Standard, Foundation, Small Business Server, Enterprise and Datacenter) Microsoft Windows Server 2003 SP2 or Windows Server 2003 R2 (Web, Standard, Small Business Server, Enterprise and Datacenter) Microsoft Windows Home Server Microsoft Windows 7 Professional or Ultimate Note: Windows 7-based Onsite Managers are restricted to managing a maximum of 15 devices. Note: Windows 7 is limited to a single user session. Installing Onsite Manager requires that it be dedicated to Managed Workplace to prevent remote desktop protocol (RDP) sessions from logging out a user. Only one RDP session can take place at any time. Note: Windows 7 is not supported by Microsoft Windows Server Update Services. Patch management will be restricted to computers managed by Device Managers at a site. Database Server Onsite Manager installs a dedicated instance of Microsoft SQL Server 2008 R2 Express. The dedicated instance name is required. Note: Previous versions of Onsite Manager supported other SQL versions. When upgrading a legacy version installed on another SQL version, the original database server is retained. Note: Previous versions of Onsite Manager supported the use of remote database servers. Managed Workplace 2011 requires the database be local to the application server. 18 Planning Your Installation Setup Guide

29 Best Practice: Installing Microsoft SQL 2008 Management Studio Express, available in the Managed Workplace 2011 disk image, provides an interface to take back ups and interact with the database. This install also requires Microsoft PowerShell 1.0, also available. Application Framework The following application framework is supported: Microsoft.NET Framework 4.0 Patch Management Server The following patch management server is supported: Microsoft Windows Server Update Services 3.0 SP2 (Microsoft.NET Framework 3.5 SP1 is also required) Note: This optional component is only required if the site will be using patch management for devices managed by an Onsite Manager, and is running a server class operating system. Web Server The following web servers are supported: Microsoft Internet Information Services 6, 7 and 7.5 Note: This optional component is only required if the site will be using patch management for devices managed by an Onsite Manager. External Network Requirements The following table lists the networking requirements for Onsite Manager. Default Port 80 TCP outbound Purpose Communicating with Service Center over HTTP and using BITS 443 TCP outbound Communicating with Service Center over HTTPS and using BITS Setup Guide Planning Your Installation 19

30 Notes: Sites with an Onsite Manager contact a web service at regularly to determine the Internet facing external IP address. Internal Mandatory Network Requirements These ports must be open between Onsite Manager and the managed devices for discovery and monitoring. If SNMP or syslog monitoring is not taking place, the associated ports do not need to be open. Inbound and outbound qualify the direction between Onsite Manager and the managed devices, not the Internet. Default Port 53 UDP inbound and outbound Purpose Domain Name System (DNS) resolution 135 and 445 TCP inbound and outbound WMI monitoring 161 TCP and UPDP inbound and outbound SNMP monitoring 162 UDP inbound Receiving SNMP traps 514 UDP inbound Receiving syslog messages 3389 TCP outbound OM Utilities, AMT console, and Web Console remote sessions operating via RDP 6996 TCP inbound Receiving communications from Device Managers 20 Planning Your Installation Setup Guide

31 Default Port TCP outbound Purpose Connection to Intel vpro AMT consoles TCP outbound Connection to Intel vpro AMT consoles using ikvm Internal Optional Network Requirements These ports must be open between Onsite Manager and the managed devices for the corresponding features to function correctly. If a specific remote control solution is not being used for the site, its port does not have to be opened. If patch management is not taking place, the WSUS port does not have to be opened. Inbound and outbound qualify the direction between Onsite Manager and the managed devices, not the Internet. Port 22 TCP outbound 23 TCP outbound 80 and 8350 TCP outbound 3389 TCP outbound 5900 TCP outbound TCP outbound Purpose Secure Shell (SSH) remote control Telnet remote control Connection to web consoles Remote Desktop Protocol (RDP) remote control Virtual Network Computing (VNC) remote control Intel Active Management Technology management traffic for Intel vpro Device Manager Hardware Device Manager requires the following: Setup Guide Planning Your Installation 21

32 P4 CPU or better 100 MB free in the system partition Note: When there is no Internet connection, Device Manager keeps collecting information. This information queues to send to Service Center when a connection is restored. It is possible to queue up to a maximum of 2GB but this would require extensive monitoring over a period of several weeks or longer with no Internet connection. Typical database size is no greater than 20 megabytes. Software Managed Workplace will install natively for either 32- or 64-bit versions of the server operating system. All versions of the following operating systems are supported, unless otherwise noted: Microsoft Windows Server 2011 (Small Business Server) Microsoft Windows Server 2008 or Windows Server 2008 R2 (Web, Standard, Small Business Server, Enterprise and Datacenter) Microsoft Windows Server 2003 or Windows Server 2003 R2 (Web, Standard, Small Business Server, Enterprise and Datacenter) Microsoft Windows Home Server Microsoft Windows 7 Professional or Ultimate Microsoft Windows Vista Business or Ultimate Microsoft Windows XP Professional Application Framework The following application framework is supported: Microsoft.NET Framework 4.0 Technician s Computer A technician s computer requires the following: browser (recommend Internet Explorer) 22 Planning Your Installation Setup Guide

33 Browser and Operating System Support for Remote Control and Remote Tools This table identifies what feature works in which browser: Browser Remote Control Remote Tools Internet Explorer Yes Yes (plugin) Google Chrome Yes (plugin) Yes (plugin) Mozilla Firefox Yes (plugin) Yes (plugin) Apple Safari No Yes (plugin) Note: Remote control will fail if you are prompted for a plugin and choose not to install it. If you also select the Don't Show this Message Again check box, you will not be offered the choice to install the required plugin on subsequent attempts, and the connection will fail without further messages. To be prompted for plugin installation again, you must remove the cookies for the Service Center site and then install the plugin when prompted. This table identifies what feature works in which operating system: Operating System Remote Control Remote Tools Windows Yes Yes Non-Windows Yes (requires the server software for the selected protocol) No Note: The remote tools are not supported on Windows 2000 computers because.net 3.5 is required on the target device. Windows 2000 does not support.net 3.5. Performance Tuning Service Center To optimize your Service Center performance, you must understand how to manage your infrastructure so that the enormous amount of data processing that occurs does not create bottlenecks. Setup Guide Planning Your Installation 23

34 Data Volume What SQL Needs The rate of continuous data processing in Managed Workplace is dependent on the amount of sites and devices you manage, the frequency and scope of your monitoring, and the health of the managed devices. For example, a single healthy device can generate 2500 events or traps per month. Add to this 20 performance counters sampled every 15 minutes and consider this typical across 20 sites with 25 devices each, and you re processing 30 million records per month. You manage how much data is collected by using alert dashboards and reporting to find unhealthy managed devices quickly. Prioritizing their remediation means restoring the amount of records collected for these devices to normal levels quickly. Consider also how much customer data you need to retain. The default retention in On-Premise Managed Workplace is 400 days. If your Service Level Agreements do not require you to keep this much information, you may decide to limit this further. Review the policy modules you use with your team regularly. This will familiarize your technicians with the data available to them, and provide opportunities for them to suggest monitoring that can be disabled as unnecessary for your needs or added to improve your service. On single server deployments, one-quarter of CPU resources are consumed by Service Center s web service (Service Center Monitor) and three-quarters by SQL server. This is under normal operating conditions and assumes the server performs no other roles. Using a modern, multi-core processor ensures that adequate processing power is available to handle all operations. Choosing a 64-bit processor will also provide benefits by permitting more memory to be installed on the server and reserved for Service Center Monitor. Service Center Monitor cannot use more than 2 GB ram on 32-bit Windows or 4 GB ram on 64-bit. However, Microsoft SQL Server will typically consume as much memory as is it can. This lets more database indexes to be cached in memory, improving overall performance. For example, on a server with 6 GB of memory, 1.5 GB will be used by Windows and running applications, up to 2 GB will be used by Service Center Monitor, and the remaining memory will be employed for caching of indexes used by dashboards and reporting. So a single server deployment essentially must use a 64-bit operating system to avoid having greatly reduced memory available to SQL along with increased IO contention from the resulting paging. 24 Planning Your Installation Setup Guide

35 Another way to make sure that SQL gets the resources it needs is to use a database server separate from the Service Center application server. Between the two servers, SQL will do more work, so it should be installed on the more powerful system. As a best practice, install twice as much memory on the database server than is available on the application server. How to Avoid IO Bottlenecks Most database applications have many more read transactions than writes. For Managed Workplace, this situation is reversed. As data from many sites are delivered to Service Center continuously, 90% of the SQL activity is handling the writes. Windows memory management (system paging) generates disk IO activity, which competes with database IO, and can decrease Service Center performance when sufficient hardware resources are not available. When you start out using Managed Workplace, you will probably have only a few sites reporting in, making this competition much less significant. But as the overall occupancy increases so will the memory usage, meaning disk contention must be managed. As such it is recommended that you manage your hardware resources with future growth in mind. Since disk IO is the greatest potential bottleneck, their effective use is where you can realize the most gains. A single disk being used for SQL data, logs, and system paging will experience significant IO contention. The only way to go faster than a single disk is to add more disks and controllers, and to distribute the activity across them all. How SQL Log Files Behave Database logs are important to SQL Server for higher IO performance and reliability. Transactions are written to the SCData_Default.LDF log file first and then committed to the SCData_Default.MDF database file. Service Center Monitor continues processing other things while SQL is busy committing the transactions. If there are failures for any reason, SQL Server will use the information in the log to ensure that data integrity is not affected. To ensure continued efficiency, SQL Server does not release the disk space consumed by the log file when the space in the file is cleared by committing transactions. This means that the log file will plateau eventually, only increasing in size as new monitoring is applied, or current monitoring expanded by the addition of new sites and devices. You may also see a jump in disk footprint when there are unhealthy devices under management, which typically produce more data than healthy ones. Setup Guide Planning Your Installation 25

36 The actual disk space consumed is reclaimed by database shrink operations, either on their own or as part of back up or maintenance routines. When sufficient space exists on the data drive, you should avoid manually shrinking the database as more CPU will be used to grow the log file back to the normal size. However, in low-disk space emergencies or following reduction in monitoring you may want to run manual shrinks to reclaim the disk space. Service Center supports two SQL Server recovery models, and the behavior of the logging for each is distinct: Simple recovery Full recovery Using the simple recovery model, the log file contains only transactions not yet written to the database. This is the easier model to manage, sufficient for most Partners needs, but means that data will be lost between the point of failure and the most recent back up. Full recovery should only be configured if back ups will be done at least daily. In this model anything written to the database is kept in the log file until it is backed up, otherwise it will continuously grow until there is no available disk space. The benefit is that there is no potential for any data loss, because the log file contents can be recommitted against a restored database. How Much Bandwidth You Will Use Most telecom carriers offer broadband and narrowband service. Both are compatible with Managed Workplace, but broadband will usually be a better choice. This is because it is the newer technology and is optimized for data communications as opposed to voice. Broadband rates are also generally cheaper than narrowband for the same speed. When choosing a broadband provider, you will also want to investigate whether the service is asymmetric or symmetric. Symmetric connections use the same data rate in both directions. If your Internet access bandwidth is shared between Service Center and other applications, reserve some bandwidth for those applications when determining your sizing needs. A useful guide is to reserve 125 Kbps per 100 devices, with 125 Kbps being the minimum. 26 Planning Your Installation Setup Guide

37 C HAPTER INSTALLING OR UPGRADING MANAGED WORKPLACE This section provides the procedures you must follow to install or upgrade Managed Workplace. 27

38 Installing Managed Workplace About Installation Access to Software Level Platforms provides installation assistance for Service Centers and your first Onsite Manager. The appointment is booked by your Partner Development Manager (PDM). Please review all documentation prior to performing an installation so that you are familiar with the procedures involved. Managed Workplace installation packages are available on the Level Platforms Partner Portal. Your PDM provides you with a login and password so that you can download the installers. The packages available for download include the following: Managed Workplace disk image An ISO file that contains all the files for installing or upgrading Service Center and Onsite Manager, as well as all required redistributables (MBSA, WSUS,.NET). You can burn this using many free and commercial packages, including the Windows Disc Image Burner. You can also mount the image in virtualization applications or extract the contents using 7zip or Winrar. Service Center installer A smaller download than the Managed Workplace disk image, but does not contain any redistributables. If a component is missing from the computer you are installing to, you can use a download link to fetch it. Onsite Manager installer Does not contain any redistributables, but will check for any missing components and will provide a link to download the product on Microsoft's website. Onsite Manager appliance installer Used with Microsoft s System Preparation utility to create an image to clone Onsite Managers. It is otherwise identical to the Onsite Manager installer. Installing Service Center Before proceeding, ensure that the server meets Service Center system requirements for the expected monitoring load. the user account performing the installation must have Domain or Local Administration privileges, as applicable. 28 Installing or Upgrading Managed Workplace Setup Guide

39 all Microsoft installation source files are available. all Managed Workplace installation source files are available locally. you have your VAR code so you can complete the registration. Your PDM provides this, and it is the same as your account number. Should you encounter any kind of failure during the installation process, restart the installer and allow it to continue. If you experience a subsequent failure, contact Level Platforms Technical Support for assistance and have the following setup log files available: LpiSetups.log ConfigureOnsiteManager.log All log files are located in %SystemDrive%\Program Files\Level Platforms\ LpiSetupLogs. For registration failures, provide all log files from the Service Center installation directory. 1 Double-click SetupSC.exe to launch the Service Center installer. Or, if you are installing from the disk image autorun, click Install Service Center. 2 Click Verify Required Components to confirm software requirements. Install any missing components by clicking the links presented, if any. 3 Under the Options section, select the Install Service Center check box. Setup Guide Installing or Upgrading Managed Workplace 29

40 4 If you would like to have the installer create common Service Groups and apply policy modules to them, select Configure Basic Monitoring Service. 5 Click Install Service Center. 6 Click Next. 7 Choose to Accept the license agreement and click Next. If any required Windows services are not running, you will be prompted to start them at this point. Also, if you are presented with the option, click Configure to update IIS and ASP.NET to work with Managed Workplace. 8 Indicate where you want to create the Service Center databases by selecting Local machine or Remote machine. Click Next. If you select Remote machine, the SQL Server Login dialog box opens. Choose the target SQL Server from the list. Enter the SQL login and password and click OK. The account must have the server role System Administrator and Database Creator privileges. Click Next. If you select Local machine, choose an SQL instance to which the database will be created. Click Next. 9 Click Browse to review the installation path and, if required, select a different location. Click Next. 10 Choose whether a proxy will be used. If using a proxy server, do the following: a b c Enter the Address, Port, Username and Password. Define the authentication type by selecting either Basic, Digest or Negotiate. Click Next. 11 Indicate how you want the Service Center websites to be created by choosing either Virtual Directory or New Website. Click Next. Note: If the computer is a Domain Controller, the only option you will have is to create virtual directories. If using a virtual directory, select the parent website and enter Virtual Directory Name. Click Next. If using a new website, enter the URL for Service Center. A corresponding DNS entry is required to view the site. Click Next. The Public Service Center Communication Settings dialog box opens. 30 Installing or Upgrading Managed Workplace Setup Guide

41 12 Enter the following information: a Public facing Service Center URL, which is the URL for Service Center, that must also be accessible from the Internet in order for Device Managers to obtain configuration information. b Public SCMessaging URL, which is the URL used by the Onsite Managers to report and send data to Service Center. 13 Write the URL down because you will need it later when you install the Onsite Manager. Click Next. 14 Click Install. 15 Once the wizard completes, click Continue to begin the Report Configuration Wizard. 16 Indicate where Microsoft SQL Reporting Services is installed by selecting either Local Machine or Remote Machine. If you selected Local Machine, click OK. Select the check box for the Reporting Services Instance and click OK. If you selected Remote Machine, select the machine where the SQL Reporting Services is installed. Enter a User Name and Password for a Local or Domain Administrator. If you are using a Domain Administrator, include the Domain in the User Name (such as, Domain\User). Click OK. Select the check box for the Reporting Services Instance and click OK. The Select a Report Server dialog box opens. 17 Select the check box for an SQL instance and click OK. 18 Click OK when advised that Report Server configuration succeeded. 19 The Register Service Center dialog box opens. Enter identifying information in the Company Information and Contact Information sections. 20 Type your VAR Code and then click Register. 21 Click OK when notified database creation may take several minutes. 22 Click OK to complete the installation when advised that Service Center was successfully registered. 23 Click Exit to close the installer. 24 Start Service Center and login with the default account Admin (no password required). Best Practice: Create a password for the Admin account. In the Status Pane along the top left-hand corner of Service Center, click Edit Profile. When the Setup Guide Installing or Upgrading Managed Workplace 31

42 User Configuration dialog box for the account opens, click Reset Password and enter and confirm a strong password, saving when you have done so. Installing Onsite Manager Before proceeding, ensure that the installation server meets Onsite Manager system requirements for the expected monitoring load. the user account performing the installation must have Domain Administration privileges. If you are not installing in a Domain, the account must have Local Administrator privileges. all Microsoft installation source files are available. all Managed Workplace installation source files are available locally. Should you encounter any kind of failure during the installation process, restart the installer and allow it to continue. If you experience a subsequent failure, contact Level Platforms Technical Support for assistance and have the following setup log files available: LpiSetups.log ConfigureOnsiteManager.log All log files are located in %SystemDrive%\Program Files\Level Platforms\ LpiSetupLogs\. Performing the Onsite Manager Installation 1 Double-click SetupOM.exe to launch the Onsite Manager Installation Wizard. 2 In the Options section, select the Install Onsite Manager check box. If you are managing updates for the site, also select the Configure Patch Management check box. 3 Click Verify Components to confirm the server meets the software requirements. Install any missing components. Windows Installer 4.5 requires a reboot after installation. You will be given the opportunity to cancel the installation to avoid rebooting at inappropriate times. SQL Server 2008 R2 Express will prompt you for the sa account password, and then install a dedicated instance for Onsite Manager, LPIMWOMEXPRESS. 32 Installing or Upgrading Managed Workplace Setup Guide

43 Windows Server Updates Services (WSUS) 3.0 SP2, you must select Full Server installation, when prompted. Choosing to install WSUS will also install the Internet Information Services (IIS) dependency, if it is not present on the server. SQL Server Management Studio 2008 R2 Express is an optional install, but is recommended for interacting with the Onsite Manager database for technical support and maintenance. It requires PowerShell which may require a reboot. 4 Click Install Onsite Manager. 5 If discovered, you can choose to integrate with the local WSUS. Click Next to proceed or click Skip to bypass the integration. 6 At the Welcome page, click Next. 7 Choose to Accept the license agreement and click Next. 8 Review the installation path. If required, click Browse to select a different location. Click Next. 9 Click Install. 10 Click OK when advised Patch Management configuration has been successful, if applicable. 11 When the installation is compete, click Continue to move onto the configuration phase. Configuring and Registering Onsite Manager The Configure Onsite Manager utility opens at the end of the installation process, or can be launched manually at a later time from the Level Platforms Start Menu program group. 1 In the Windows Service Account section, type your User Name and Password and then confirm your password. For important information about the required group membership for this account, see Configuring WMI Devices on page Click Next. 3 Onsite Manager will automatically use any proxy which does not require authentication. If a proxy server is present and requires authentication, do the following: a Enter the Address, Port, Username and Password. b Define the authentication type by selecting either Basic, Digest or Negotiate. Setup Guide Installing or Upgrading Managed Workplace 33

44 4 In the Communication Settings section, type your Service Center URL. The utility will often be able to guess your Web Service URL based on what you entered for your Service Center URL. 5 Check that the Web Service URL is correct and update it if necessary. Note: Clear the Use Global Service Center Communication Settings check box if you need to have this Onsite Manager connect to Service Center using a different address than what is normally used. For example, you might have a static VPN between your data center where Service Center resides and the customer s network. In such a circumstance, you can choose to use private addressing so no communications occur over the Internet. Alternatively, you can accomplish the same thing by using DNS records. 6 Click Next and OK when advised that the settings have been validated. 7 Type in the Company Information for the customer whose network Onsite Manager is monitoring. 8 Type in the Contact Information for the primary contact you deal with for this customer. 9 Click Register and then OK when advised that the registration information was successfully submitted to Service Center. Note: If you receive an Unable to register with the Service Center message, click OK and then click Details. Review the error message as part of your troubleshooting or send it to support@levelplatforms.com for assistance. 10 Click Exit to close the Onsite Manager installer. Cloning Onsite Manager Cloning systems with Onsite Managers using the Onsite Manager Appliance package speeds up the rollout process without altering any functionality. The Onsite Manager is prepared in advance and then cloned onto a server for rapid deployment. You use the Sysprep tool supplied by Microsoft to clone the devices. The procedures are different depending on the operating system where the Onsite Manager is installed. If you need any additional information regarding the Sysprep tool, refer to the Microsoft documentation here. When your cloned Onsite Manager starts up for the first time after the Sysprep process, the Onsite Manager configuration utility runs automatically. It is at this point you enter information about the client. For instructions, see Configuring and Registering Onsite Manager on page Installing or Upgrading Managed Workplace Setup Guide

45 Important: Changing a computer name following a cloned deployment will cause SQL and.net permissions to fail. To distinguish between cloned Onsite Managers, assign aliases to the device in Service Center. Installing Onsite Manager for Cloning Before proceeding, ensure that the installation server meets Onsite Manager system requirements for the expected monitoring load. the person performing the installation is logged in as the local administrator. all Microsoft installation source files are available. Should you encounter any kind of failure during the installation process, restart the installer and allow it to continue. If you experience a subsequent failure, contact Level Platforms Technical Support for assistance and have the following setup log files available: LpiSetups.log ConfigureOnsiteManager.log All log files are located in %SystemDrive%\Program Files\Level Platforms\ LpiSetupLogs\. 1 Double-click SetupOMAppliance.exe to launch the Onsite Manager Appliance Installation Wizard. 2 In the Options section, select the Install Onsite Manager check box. If you are managing updates for the site, also select the Configure Patch Management check box. 3 Click Verify Required Components to confirm the server meets the software requirements. Install any missing components. 4 Click Install Onsite Manager. 5 If discovered, you can choose to integrate with the local WSUS. Click Next to proceed or click Skip to bypass the integration. 6 At the Welcome page, click Next. 7 Choose to Accept the license agreement and click Next. 8 Review the installation path. If required, click Browse to select a different location. Click Next. 9 Click Install and when the installation is compete, click Finish. Setup Guide Installing or Upgrading Managed Workplace 35

46 Cloning Onsite Manager on Windows On your local drive, navigate to Windows\System32\Sysprep folder. 2 Double-click sysprep.exe to launch the Setup Manager wizard. The System Preparation Tool 3.14 dialog box opens. 3 In the System Cleanup Action list, click Enter System Out-of-Box Experience (OOBE). 4 Select the Generalize check box and then click Shutdown. Cloning Onsite Manager on Windows On your local drive, create a folder and name it Sysprep (for example, C:\ Sysprep). 2 In the root directory of the Microsoft installation media, navigate to Support > Tools and find the DEPLOY.CAB file. Extract the contents of the DEPLOY.CAB file into the Sysprep folder you created in step 1. 3 In the Sysprep folder, double-click setupmgr.exe to launch the Setup Manager wizard. 4 Click Next. 5 Select Create new and click Next. 6 Select Sysprep setup and click Next. 7 Select the product you are using and click Next. 8 Select Yes, fully automate the installation and click Next. 9 Configure sysprep with information about the destination computer so you will not have to add the information again before using the Onsite Manager Configuration Utility. Note: You can set the password during an automated install if the Administrator password field is empty. If you want to set an Administrator password on the cloned device, remove it on the source computer before shutting it down prior to cloning. Note: Do not specify anything on the Run Once page because when you installed the Onsite Manager it automatically configured this information. 10 Click Finish. Save the answer file to the default location (C:\Sysprep\ sysprep.inf) and click OK. Close the Setup Manager. 11 Launch sysprep.exe from C:\Sysprep. Click OK. 12 Accept all the option defaults on the System Preparation Tool 2.0 dialog box. 36 Installing or Upgrading Managed Workplace Setup Guide

47 13 In the Shutdown mode list, click Shutdown. 14 Click Reseal. Do not restart the computer again until you have successfully taken an image of it. 15 Load the images to identical hardware and power on. Installing Device Manager Device Managers are either installed by a Service Center user downloading the setup file directly, ing a download link out to someone who will perform the install, or through Managed Workplace scripting for devices already monitored by an Onsite Manager. Before proceeding, ensure that the installation computer meets Device Manager system requirements. the user account performing the installation has Domain Administration privileges. If you are not installing in a Domain, the account must have Local Administrator privileges. all Microsoft installation source files are available. Should you encounter any kind of failure during the installation process, restart the installer and allow it to continue. If you experience a subsequent failure, contact Level Platforms Technical Support for assistance and have the following setup log files available: LpiSetups.log ConfigureOnsiteManager.log For registration failures, provide the log.txt file from the Service Center installation directory. All log files are located in %SystemDrive%\Program Files\Level Platforms\ LpiSetupLogs\. Note: You cannot install Device Manager onto a computer that already has Onsite Manager installed. Downloading Device Manager 1 In Service Center, click Configuration and then Site Management. 2 Click the Site Name to which you want to download the Device Manager. 3 Click the Device Manager tab. Setup Guide Installing or Upgrading Managed Workplace 37

48 4 Click Download Device Manager. 5 Click Run to download and start the installer or save to choose a location to save the installer. ing Device Manager 1 In Service Center, click Configuration and then Site Management. 2 Click the Site Name to which you want to download the Device Manager. 3 Click the Device Manager tab. 4 Click Device Manager. An with the subject Device Manager Download Link containing a clickable URL for the download is created in your program. 5 Add one or more recipients and send the . Performing the Device Manager Installation 1 Double-click DMSetup.exe to start the installer. 2 Click Yes when asked to confirm that you want to install Managed Workplace Device Manager. 3 Click OK when advised that Managed Workplace Device Manager has been installed successfully. 38 Installing or Upgrading Managed Workplace Setup Guide

49 Upgrading Managed Workplace About Upgrades Upgrades to production systems must always be preceded and followed by full database back ups to ensure you have an up-to-date restore point should you encounter a failure. Important: You must upgrade Service Center before upgrading Onsite Managers or Device Managers. Until all Onsite Managers and Device Managers have been upgraded to the new version of Service Center, no configuration changes should be made. This prevents application failure and loss of data. Upgrading Service Center You can upgrade to Managed Workplace 2012 Feature Pack 2 Service Center from Managed Workplace 2012 Service Center. Notes: The SQL Agent Windows service must be set to Automatic startup and be running prior to upgrading. The Service Center application server must be able to access the MWResources file share on the SQL Reporting Services application server to import reports. Important: Upgrading Service Center requires exclusive control over the database instance. If other databases for production systems are present in the same instance, an outage window must be scheduled in which the upgrade may be completed. For this reason, and to ensure optimal performance of all databases, Level Platforms recommends dedicating an instance to Service Center. Data Conversion When Service Center is being upgraded, it is unavailable while the application and database structure are updated to the new format. The upgrade prioritizes getting Service Center back online and fully functional quickly over converting historical data into the improved database structure. Following the upgrade, historical data is not viewable in Service Center, but will begin to appear within 30 minutes after the upgrade completes. The Patch Management menu item will not appear until the historical patch data has been converted to the new structure. The final portion of the Service Center upgrade is to update the MS SQL Report Server with updated LPI reports. If the database conversions begin prior to this (triggered by an Onsite Manager sending data to Service Center), then the Setup Guide Installing or Upgrading Managed Workplace 39

50 Report Server configuration may time out. If the Report Server configuration does time out, then wait until the database conversion is complete. Once complete, run the Report Server Configuration again, which can be found under Start > Programs > Level Platforms > Managed Workplace > SC Tools > Configure Reporting Services. You must run this tool to access the new reports that are included with the Service Center installation. Once the upgrade has completed, you may resume working with Service Center as the historical data is converted to the new format in the background. During the conversion process, incoming information from the Onsite Managers is available as normal, but historical data will only appear in the Service Center console once converted. If you experience a subsequent failure, contact Technical Support for assistance and have the following setup log files available. LpiSetups.log LPI_SC_MSIx.x.x.log (filename will indicate current version and build number) All log files are located in %SystemDrive%\Program Files\Level Platforms\ LpiSetupLogs\. Performing the Upgrade 1 Double-click the file SetupSC.exe to launch the Service Center installer, or if you are installing from the disk image autorun, click Install Service Center. Click Install Now. The installer detects an older version of Managed Workplace and asks if you want to upgrade. 2 Click Yes. The installer welcome screen opens. 3 Click Next. 4 Choose to Accept the license agreement and click Next. Note: At this point, if the installer is unable to stop any SQL services that continue to access the database, the installer will halt and prompt you to stop them manually. To do so, open a management console, right-click the service named in the installer message and choose Stop. Contact Level Platforms Technical Support if you require assistance. The installer presents a reminder to ensure a current back up of the Managed Workplace databases exists before continuing. 5 Confirm back ups exist before clicking Next to continue. 40 Installing or Upgrading Managed Workplace Setup Guide

51 Note: At this point, if the installer is unable to restart any SQL services the installer will halt and prompt you to start them manually. To do so, open a management console, right-click the service named in the installer message and choose Start. Contact Level Platforms Technical Support if you require assistance The Public Service Center Communication Settings dialog box opens. 6 Enter the following information: Public facing Service Center URL, which is the URL for the Service Center user interface. Public SCMessaging URL, which is the URL used by the Onsite Managers and Device Managers to report and send data to Service Center. 7 Click Next. 8 On the Ready to Install the Program dialog box, click Upgrade. 9 When the installation completes, click Continue on the Service Center Installation Completed dialog box to begin the Report Configuration Wizard. It can be run at a later time from the Level Platforms Program Group or the Service Center Installation directory: \Level Platforms\Service Center\ Setups\ReportSetup\LPI.Setup.Report.exe 10 Indicate where Microsoft SQL Reporting Services is installed by selecting either Local Machine or Remote Machine. a b If you selected Local Machine, click OK. Select the check box for the Reporting Services Instance and click OK. If you selected Remote Machine, select the machine where the SQL Reporting Services is installed. Enter a User Name and Password for a Local or Domain Administrator. If you are using a Domain Administrator, include the Domain in the User Name (such as, Domain\User). Click OK. Select the check box for the Reporting Services Instance and click OK. 11 Click OK when notified that the Report Server configuration succeeded. 12 Click Exit to close the installer. Setup Guide Installing or Upgrading Managed Workplace 41

52 Upgrading Onsite Manager Always upgrade your Service Center before upgrading Onsite Managers. Versions of Onsite Managers older than 2011 are upgraded remotely using Managed Workplace Automation or locally on the host computer. If you experience a subsequent failure, contact Technical Support for assistance and have the following setup log files available. LpiSetups.log LPI_SC_MSIx.x.x.log (filename will indicate current version and build number) LpiSilentUpgradeOM.log (for automated upgrades) All log files are located in %SystemDrive%\Program Files\Level Platforms\ LpiSetupLogs\. Note: Onsite Managers no longer support remote databases. If you are using a remote database, you must first back it up and restore it to the Onsite Manager application server. Performing the Remote Upgrade For 2010 and 2009 SP2 Onsite Managers Managed Workplace 2011 uses local patch management, a Microsoft best practice. When upgrading Onsite Managers remotely, new installations of WSUS are not detected. If you need a site to be patch management ready where it was not previously, you must run the upgrade locally. 1 From the legacy version download knowledgebase article in the Partner Portal, Download the Managed Workplace 2011 silent install script to your desktop. UpgradeLegacyOMs.mws is the filename. 2 In Service Center, click Automated Tasks and then Script Management. 3 Click Import. 4 Browse to and select UpgradeLegacyOMs.mws. Click OK. 5 Review the information on the Script Details page and click Save. 6 Click Add Task in the Automated Tasks main menu. 7 Enter Upgrade Legacy Onsite Managers as the task name. 8 Select the script category Software Distribution. 9 Select the script UpgradeLegacyOMs. 10 Under the Targets section, click Add Devices. 42 Installing or Upgrading Managed Workplace Setup Guide

53 11 Choose to filter by Managed Workplace component Onsite Manager installed. Click Filter. 12 Use the column header check box to select all computers with Onsite Manager installed. Click Add. 13 Under the Schedule section, click Run Once and use the controls to schedule a start time. 14 Under the Timeouts section, configure both the Execution and Device Unreachable timeouts to 1 hour. 15 Configure the Delivery Failure alert settings to notify you in your preferred manner in the event the script cannot be delivered to Onsite Managers. Because the script is being run against legacy Onsite Managers, you cannot configure Execution Results alerts. 16 Click Save. 17 Your Onsite Managers are now upgraded to MW2011. To upgrade to MW2012, follow the procedure in the next section. Performing the Remote Upgrade for 2012 Onsite Managers Once all Onsite Managers have been upgraded to 2012, you can upgrade them with major or minor releases directly from Service Center. 1 In Service Center, click Configuration and then Site Management. 2 Use the check box column header to select all sites in the list. 3 Click More Actions, and then select Upgrade Onsite Managers. Performing the Local Upgrade 1 Double-click SetupOM.exe or select to install Onsite Manager from the disk image autorun. 2 Click Install Now. If you have selected the Patch Management option, an information dialog box opens if Microsoft WSUS is already installed. 3 Click Next to use the existing WSUS and continue. The installer detects an older version and asks if you want to upgrade. 4 Click Yes. 5 Click Next in the Welcome dialog box. 6 Choose to Accept the license agreement and click Next. A message appears suggesting you back up the database. Setup Guide Installing or Upgrading Managed Workplace 43

54 7 Click Next. 8 Once the database has been upgraded, click OK. 9 On the Ready to Install the Program dialog box, click Upgrade. 10 Click Continue on the Installation Wizard Completed dialog box. The Patch Management Configuration Confirmation opens. 11 Click OK. 12 Click Exit. Verifying the Upgrade 1 In Service Center, click Status and then click Central Dashboard. 2 Click the name of the site that you want to verify. 3 Verify the OM Installation Information. 4 Confirm that the Version Number and Installation Date are correct. Note: Once all Onsite Managers have been upgraded to Managed Workplace 2012, you can stop forwarding port 9222 to the Service Center application server, since remote control sessions are now over HTTP or HTTPS. Important: Until the Onsite Manager for a site has been upgraded to the 2012 version, the Support Assistant tab will not appear in its Site Management page. Upgrading Device Manager Always upgrade your Service Center before upgrading Device Managers. Device Managers are upgraded remotely using the Site Management page in Service Center. If you experience a failure, contact Technical Support for assistance and have the following setup log files available. LpiSetups.log LPI_SC_MSIx.x.x.log (filename will indicate current version and build number) LpiSilentUpgradeOM.log (for automated upgrades) All log files are located in %SystemDrive%\Program Files\Level Platforms\ LpiSetupLogs\. 44 Installing or Upgrading Managed Workplace Setup Guide

55 The Site Management controls let you upgrade all Device Managers reporting to Service Center with one command or choose particular sites for which they will be upgraded. Note: Upgrade no more than 20 Device Managers at a time using the one click method to avoid overtaxing the Service Center's resources. 1 In Service Center, click Configuration and then click Site Management. 2 Select the check box for each site whose Device Managers you want to upgrade, or use the check box column header to select all sites in the list. 3 Click More Actions, and then select Upgrade all Device Managers within Sites. Setup Guide Installing or Upgrading Managed Workplace 45

56 46 Installing or Upgrading Managed Workplace Setup Guide

57 C HAPTER POST-INSTALLATION TASKS This section details the configuration tasks you complete after installing Managed Workplace. 47

58 Configuring Service Center Some information required for operation is not collected during Service Center setup, so you must make some choices and complete the configuration once the application is up and running. Configuring the Alert Settings Service Center is able to use any address and mail server you provide to issue alerts and system notifications. The address you provide will also be used as the reply-to address for report delivery schedules, so it is a good idea to have someone watch the address for responses from customers. You can also use the Alerts Setting to have the system check for any possible monitoring failures (such as which monitor is not collecting data). If enabled, Administrators will receive reports regarding failures on the selected interval (hourly, daily or weekly). Regularly reviewing these reports with your team will help you streamline your monitoring strategy. Configuring Your Settings 1 In Service Center, click Configuration and then click System Settings. 2 Click the Alert Settings tab. 3 In the Message Settings section, type an address in the text box. Depending on the configuration of the SMTP server, this may need to be a valid address. 4 In the SMTP Settings section, do the following: a Type the IP address or FQDN for the SMTP Server in the Server Name text box. b Enter the Server Port. The default SMTP port is 25. c Check Requires TLS if your mail server requires transport layer security. d Choose either Anonymous or Basic Authentication. Basic Authentication requires you to also enter a username and password. 5 Click Save. Testing Your Settings 1 In the Send Test section, enter the address to which the test is sent. 2 Enter a subject line for the Post-Installation Tasks Setup Guide

59 3 Click Send. A popup appears with either a success message or details regarding any errors. 4 Click Close. Configuring the Monitoring Failure Settings Managed Workplace can track the status of monitor failures and send reports to administrators. Monitor failures are when data being requested cannot be collected from a managed device. This can occur when there are environmental problems or configuration issues. Examples of environmental problems are firewalls blocking access to WMI ports or corrupt WMI repositories. Configuration issues are when users have applied policy modules or device level monitors to devices that cannot respond. Examples of this would be applying the Apple OS X or Cisco Firewall policy modules to Windows devices. 1 In the Monitoring Settings section, select the Enable Log Monitoring check box. 2 Select how frequently the system will run an audit (hourly, daily or weekly). 3 Click Save. Preparing Group Structure If you elected to check Configure Basic Monitoring Service, the groups listed in the following table will automatically be present in Service Center. Group Folder Group Policy Modules Backups Symantec Backup Exec 2010 Symantec Backup Exec 2010 Axcient Axcient Backup Service Servers Exchange 2010 Microsoft Exchange 2010 Exchange 2007 Microsoft Exchange 2010 Setup Guide Post-Installation Tasks 49

60 Group Folder Group Policy Modules Firewalls Cisco Pix 515 Cisco PIX 515E SonicWall SonciWALL Firewall Printers Dell Dell Printers Security HP LaserJet HP LaserJet Printers Symantec Endpoint Protection SBE 12 Symantec Endpoint Protection SBE 12 Trend Micro AV Trend Micro AV Servers Windows 2008 R2 Microsoft Windows Server 2008 R2 Baseline Software Asset Change Microsoft Baseline Security Analyzer SNMP Default Windows 2003 Microsoft Windows 2003 Server Baseline Software Asset Change Microsoft Baseline Security Analyzer SNMP Default 50 Post-Installation Tasks Setup Guide

61 Group Folder Group Policy Modules Windows Infrastructure SBS 2003 Standard Microsoft SBS 2003 Standard Software Asset Change Microsoft Baseline Security Analyzer SNMP Default MS DNS Server 2000/ 2003 MS Active Directory 2008 MS Windows DHCP Server 2008 Microsoft Windows DNS Server 2000/2003 Microsoft Active Directory 2008 Microsoft Windows DHCP Server 2008 Workstations Windows 7 Microsoft Windows 7 Baseline Software Asset Change Microsoft Baseline Security Analyzer Windows XP Pro Microsoft Windows Professional Baseline Software Asset Change Microsoft Baseline Security Analyzer Otherwise, you must configure groups and assign policy modules to them in order to begin monitoring automatically as soon as devices are added to the groups. Setup Guide Post-Installation Tasks 51

62 Configuring a Modem For more information, see the chapter Grouping in the User Guide. If a modem is installed on the application server and you want alert notifications to be sent to alphanumeric pagers, follow the procedure below to provide Service Center with the information it needs to use the modem. 1 In Service Center, click Configuration and then click System Settings. 2 Click the Modem tab. 3 In the Modem Configuration section, select the appropriate values for each field. COM Port The communications port to which the internal or external modem is connected. Baud Rate The communication speed the Pager Service supports. Parity Depending on the pager protocol used by the Pager Service, None, Odd, Even, and Mark will be set. (Contact the pager service for details if this information is not known.) Data Bits Depending on the pager protocol used by the Pager Service, this will be set to 7 or 8 Data Bits. (Contact the pager service for details if this information is not known.) Stop Bits The number of bits indicating the end of a byte. Typically this setting should be 1. 4 Click Save. Testing the Modem You can send a test message for confirmation that the modem is functional with Service Center. 1 Enter the paging service modem number. If you are using a phone system that requires a prefix to call out, include it. If a pause is required, use a comma for each second. PIN Pagers require an ID number. 2 Enter the ID number if required. (Contact the pager Service for details if this information is not known.) 3 Enter the callback number. The callback number is a numeric string sent to a pager indicating a problem has been detected. 4 Enter the value to wait (seconds). 52 Post-Installation Tasks Setup Guide

63 Some pager services have a default message that is played each time your pager number is dialed. To pause the Alert until the message has completed, specify the number seconds required. 5 Click Send. Configuring Data Retention Your data retention settings define how much history you retain in Service Center. Keeping a long history is beneficial to establish trends, but the more history retained, the larger the database footprint on disk. On a weekly basis, Service Center reviews timestamps of data and purges any data older than the value you define. The default setting is to retain 400 days of data. 1 In Service Center, click Configuration and then click System Settings. 2 Click the Data Retention tab. 3 Enter the number of days of data to keep. 4 Click Save. Scanning for Devices You can define which device IP addresses you want the Onsite Manager to manage. Configuring the network scans and running the initial scan is done in the Site Management dialog box of Service Center. The initial network scan must run manually after you have configured it, but will run automatically thereafter. Configuring Scan Intervals There are two intervals used to determine how frequently Onsite Manager and Device Managers update information: Device Discovery The Device Discovery interval is how long an Onsite Manager will wait following a network scan before initiating another. By default, 5 minutes will elapse between the end of a scan and the beginning of the next one. Important: Device availability alerts rely on the amount of time that has gone by since the last time Onsite Manager received a response during a network scan. If you extend this interval, you are also increasing how long it takes to determine a device is down for the purposes of alerting. Asset Discovery The Asset Discovery interval is the time frame within which all known devices must have asset data collected. Data collection for all Setup Guide Post-Installation Tasks 53

64 devices is distributed through the entire period. By default, each device will have its assets collected once every four hours. Running an Initial Scan When first configuring the Onsite Manager scan options, the initial scan must be run manually and it may take some time before the results appear, depending on the number of devices being scanned. When the scan completes, check to make sure that each discovered device has at least one management protocol (WMI or SNMP) enabled. This allows Onsite Manager to accurately identify a device. In the absence of a management protocol, Onsite Manager queries the reverse lookup zone in DNS for an A-name record associated with the IP address. If multiple A-name records are discovered, the device may be rediscovered as new. To avoid any issues with discovery, you must do one of the following: Enable WMI or SNMP on each managed device. Assign static IP addresses to devices that do not have a management protocol enabled. Assign unambiguous DNS names to the device so that it is uniquely reverse resolvable. Any or all the above actions will help Onsite Manager intelligently classify unique devices. Configuring Discovery of SNMP Devices Using a Community String An SNMP community string is a text string that is in effect a credential. It is used to authenticate communication with the SNMP device. Note: Managed Workplace currently supports SNMP version 1 and version 2. By default, Managed Workplace uses "public" as the community string to locate SNMP devices in the network. However, many companies use a unique community string that acts like a strong password against brute-force attack. If one of the devices is SNMP-enabled, but is not showing up in the scan, it may be because a different community string was set up for security reasons. You can either change the community string on the device modify the community string used in Managed Workplace add the community string to Managed Workplace 54 Post-Installation Tasks Setup Guide

65 1 In Service Center, click Configuration and then click Site Management. 2 Click the site for which you want to edit the scan settings. 3 Click the Network Discovery tab. 4 In the Network Scan (Local Network) section, click Modify. 5 In the SNMP V1/V2 Community Strings section, click Add. 6 Type the community string in the Community String Name text box. Note: Community strings are case-sensitive. For example, Public and public would be separate communities of SNMP devices. 7 Optionally, type a description in the Description text box. 8 Click Save. Tip: If you no longer need an existing SNMP community string, you can delete it. To run a network scan manually 1 In Service Center, click Configuration and then click Site Management. 2 In the Site Name column, click the site for which you want to perform a network scan. 3 Click the Network Discovery tab. 4 In the Network Scan (Local Network) section, click Scan Now. The scanning process begins and once complete, the results appear in the Scan Settings and SNMP V1/V2 Community Strings sections. Limiting the IP Addresses to Scan You can configure the network scan to skip individual or ranges of IP addresses. Wherever possible, you should scan the smallest number of IP addresses which will ensure you still discover all required devices. Best Practice: Using static IP addresses for devices, and controlling DHCP scopes and subnets are valuable tools to ensure you do not pick up devices you are not obligated to monitor for your clients. For example, you may have clients which allow their employees or customers to use wifi at their location. Configuring a separate subnet or private network range for the router is an easy way to ensure you are not discovering transient consumer grade devices such as ipads or Android phones. 1 In Service Center, click Configuration and then click Site Management. 2 Click the site for which you want to edit the scan settings. Setup Guide Post-Installation Tasks 55

66 3 Click the Network Discovery tab. 4 In the Network Scan (Local Network) section, click Modify. 5 In the Scan Settings section, click Add. 6 Do one of the following: To ignore a single IP address, select the Single option button and type the device IP address in the IP Address text box. To ignore a range of IP addresses, select the Range option button and type the Start IP Address and End IP Address in the text boxes. Type a description, if desired. 7 Select the Skip check box. 8 Click Save. Excluding Devices from a Scan There are a number of scenarios you may encounter in which you must specify devices that you do not want included in the monitoring service. These may be third-party servers at your client s location covered under their SLA agreement, as may be found with some Backup and Disaster Recovery (BUDR) services, or simply devices for which you are not being paid to monitor. For example, if a site has a consultant on the premises, his or her computer doesn t need to be monitored. 1 In Service Center, click Configuration and then click Site Management. 2 Click the site that contains the device for which you want to turn monitoring off. 3 In the Site Management page, click the Device Exclusion tab. 4 Click View Exclusion Rules. 5 Click Create. 6 Do any of the following: In the DNS Name box, type the domain name for the device. In the SNMP Name box, type the SNMP name for the device. In the MAC Address box, type the MAC address. The Media Access Control address (MAC address) is a unique identifier assigned to most network adapters or network interface cards (NICs) by the manufacturer for identification. 7 Click Save, and then click Save again. 56 Post-Installation Tasks Setup Guide

67 Scanning Intel vpro Devices To prepare Intel vpro devices for discovery, you must provide the Global Intel AMT credentials in Service Center. Global site credentials will be used where valid unless you specify an exception with explicit device credentials. Once the Intel AMT Administrator account credentials are successfully configured, Managed Workplace can remotely power up and power down the device, monitor events, generate alerts, and collect asset information. 1 In Service Center, click Configuration and then click Site Management. 2 Click the name of the site for which you want to run the scan. 3 Click the Network Discovery tab. 4 Under Network Scan, click Modify. Running the First MBSA Scan Microsoft Baseline Security Analyzer is run by Onsite Manager or Device Manager to audit the security of managed devices. The results are viewable in Service Center and optionally contribute to site health scores in Managed Workplace reports. You can also apply the MBSA policy module to all Windows devices to be alerted on the status of devices. Note: MBSA is installed with Onsite Manager but not with Device Manager. If MBSA is present on a system with a Device Manager, it will be used. Best Practice: By default, the MBSA scan is scheduled to run on Wednesdays at 12:30 p.m. To ensure you have security data available as soon as possible, you should manually run the first scan. 1 In Service Center, click Configuration and then click Site Management. 2 Click the name of the site for which you want to run the scan. 3 Click the Site Configuration tab. 4 Under External System Integration, click Scan Now beside MBSA Security Scanning. Each Windows device under management will have an MBSA section added to their Device Management page following the scan. This data is transported to Service Center using an offset to prevent abnormally high network usage, so the data is not instantly populated, but will be available for all devices within an hour or two. Setup Guide Post-Installation Tasks 57

68 Preparing a Site Configuring SNMP Devices SNMP devices are polled using case-sensitive community strings that must be provided by the monitoring agent, in this case Onsite Manager, to access data about the device's performance. The default community string set for most devices is public, and this is automatically populated in the Onsite Manager network scan, so you may find that no additional configuration of the SNMP devices is required. If you have SNMP devices not showing as SNMP-enabled in Onsite Manager, confirm that the networking requirements are satisfied. If there are no networking issues, refer to the vendor documentation on how to configure the SNMP community string. Each device that generates SNMP Traps must be given the host name or IP address of the Onsite Manager server to use as the receiver. Consult the vendor documentation on how to configure the receiver for each supported device at the customer site. Configuring Syslog Devices Some network infrastructure and most Unix/Linux devices will generate syslog messages sent out to syslog receivers, in this case the OnsiteManager, regarding the device status. The Onsite Manager will accept syslog messages from all devices. Each syslog-generating device must be given the host name or IP address of the Onsite Manager server to use as the syslog receiver. Consult the vendor documentation on how to configure the syslog receiver for each supported device at the customer site. Configuring WMI Devices Unless configured to use another account, the Onsite Manager Windows services will use the default logon account named MWService, created during installation, to scan the network. Depending on the type of network, this will require different actions to be taken. Domain Networks On Domain networks, the account is created as a Domain Administrator, so that it can access all Windows devices attached to the Domain. If installing in a Domain, then the Windows service account is created within Active Directory 58 Post-Installation Tasks Setup Guide

69 for Windows-based monitoring and management. Domain Policy settings, which help enable monitoring within a Domain environment, can be found in the Site Management section of Service Center. To access the Domain Controller Policies document 1 In Service Center, click Configuration and then click Site Management. 2 Click the name of the site with which you want to work. 3 Click the Site Resources tab. 4 Click Download Domain Configuration Document to download a PDF file that helps you prepare a site if the Onsite Manager is deployed within a Domain. Workgroup Networks On Workgroup networks, the account is created locally on the Onsite Manager server, and also needs to exist as a Local Administrator on each Windows device in the Workgroup. This user must have exactly the same logon and password as that on the Onsite Manager server, and the password must be set to never expire. If installing in a Workgroup, then the Windows service account is created locally on the Onsite Manager, but you must run the Workgroup Preparation Utility on all the devices you want managed. The Workgroup Preparation Utility can be run from the Site Management section of Service Center, which creates the user (and makes other changes required for monitoring) with a single click, minimizing setup time for Workgroup devices. Mixed Domain-Workgroup Networks Managed Workplace requires a service account (administrative user) to authenticate against and monitor the devices in your network. Depending on your network configuration, configure Managed Workplace as follows: If installing in a hybrid (mixed) environment, and you install on a computer that has access to the Domain, then the Windows service account is created within Active Directory for Domain-based windows devices. You only have to run the Workgroup Preparation Utility on all Workgroupbased devices. If installing in a hybrid (mixed) environment, and you install on a computer that does not have access to the Domain, then you must run the Workgroup Preparation Utility on all managed devices (because the Windows service account cannot be created if Active Directory cannot be accessed). Setup Guide Post-Installation Tasks 59

70 Caution: This configuration limits monitoring of Domain Controllers to availability and SNMP because Windows does not allow the required local User account to be created. Note: For ease of use, it is recommended that you install the Onsite Manager on a Domain server. Creating a Workgroup Preparation Utility 1 In Service Center, click Configuration and then click Site Management. 2 Click the site for which you want to run the utility. 3 Click the Site Resources tab 4 In the Workgroup Resources section, click Download Workgroup Preparation Utility. 5 Click Save and select the location to which you want to save the Workgroup Preparation Utility. Running a Workgroup Preparation Utility 1 Extract the following file on each Workgroup device that needs to be configured. LPIWorkgroupPrep_<om site name>_yyyy-mm-ddthh:mm:ss.zip For example: LPIWorkgroupPrep_myOmsitename_ T13:01:01.zip 2 From the extracted location, double click the omsiteprep.exe file. When complete, a dialog box opens stating if the site preparation was successful. 3 Click OK. The utility generates a log file in the current working directory named OASiteprep.log, which contains a detailed report of all changes and errors. The site preparation process: 1 Checks if Managed Workplace site preparation has been run before. 2 Checks the type of platform (Window OS) since some site preparation tasks are dependent upon the OS version. 3 Creates a Managed Workplace service account. Updates the password if the account already exits. 4 Starts and configures dependent system services, if required. 5 Configures and enables DCOM and WMI, if required. 60 Post-Installation Tasks Setup Guide

71 6 Configures UAC options on Vista and later versions of Windows Operating Systems. 7 Configures all firewall profiles regardless of whether the firewall is enabled. This includes allowing ICMP echo; remote administration, file and print sharing, and remote desktop services; and ports required for WMI and Managed Workplace applications. 8 Logs all changes to file and update registry with record of execution. Configuring Intel AMT Devices To prepare Intel AMT devices for discovery, you must do the following: Configure the device in Small Business Mode (SMB) mode. AMT devices configured to run in Enterprise mode are not compatible with Managed Workplace. Configure the user for the Intel AMT device. It is recommended that you use the same account on all Intel AMT devices in the environment so that when you scan the network you can provide a single credential for the Onsite Manager to use for discovery. Configure the Intel AMT device for SMB. For devices that are prior to version 4.0, ensure the host name is the same as the host name that is set in the operating system and configure the device for DHCP mode. AMT Firmware DHCP Mode Static Mode <4.0 Supported when both AMT and operating system are set to DHCP mode and use the same hostname >=4.0 Supported when both AMT and operating system are set to DHCP mode and use the same hostname Not supported Supported when both AMT and operating system are set to the same static IP address Setup Guide Post-Installation Tasks 61

72 Configuring Patch Management Managed Workplace handles patch management by integrating with Microsoft Windows Server Update Services (WSUS). The benefit of using WSUS with Managed Workplace is its centralization of control for multiple networks, and also the ability to monitor patch deployment, alert on particular installation statuses, and include patch information in internal and customer-facing reports. Before you can begin delivering patch management as a service, you must run the Initial Setup Wizard, which will guide you through the basic configuration. For more information, please refer to the Managed Workplace User Guide. 62 Post-Installation Tasks Setup Guide

73 C HAPTER MOVING MANAGED WORKPLACE This section describes how you can move a Managed Workplace installation between servers. This may be required in disaster recovery situations or when you need to upgrade hardware and deployment options to accommodate business growth. 63

74 About Moving Managed Workplace Moving Managed Workplace is a simple process that can be accomplished quickly if you understand what must occur before proceeding. This is the process: back up the database uninstall the application restore the database reinstall the application This way you can move either the application server, the database server or both. Throughout this section, the server or server from which the Managed Workplace is being moved are referred to as the originating server. The server or servers onto which Managed Workplace is being moved are referred to as the destination server. Moving a Service Center Changes may be required on the destination server, so be sure to have installation files available for the operating system. When moving to one or more servers, there are important networking changes that may be required to ensure that Managed Workplace functions normally once completed. Database connections Keep in mind that if you are using Windows authentication, you must ensure there are no restrictions on the user account that will impact the success of connections once the database has been moved to the destination server. If SQL authentication is being used, recreating the account on the destination server with the same permissions will suffice. Secure Sockets Layer (SSL) Use of SSL on the Service Center websites requires the host name or IP address defined in the certificate be maintained on the destination server. If the host name or IP address changes, you will have to generate and use a new certificate. Domain Name System (DNS) Requires that the destination server receives the same IP address as the originating server or that the DNS record is updated with the destination server s IP address. Network Address Translation (NAT) Requires that ports that had been forwarded to the originating server be forwarded to the destination server, if the IP address changes. 64 Moving Managed Workplace Setup Guide

75 PSA integration settings May need to be updated if the host name or IP address changes. SQL version The destination server must be updated to the same service pack as was applied to the originating server. Note: You must have sufficient space to create a back up of the Service Center databases before beginning. Important: If the destination server for the Service Center application will not be receiving the same DNS as the originating server, you must provide the new address to Onsite Managers and Device Managers before proceeding. To do this, update the Service Center Website Communications Settings. For more information, please refer to the Customizing the Service Center chapter in the Managed Workplace User Guide. Important: You must use identical settings for the destination report server as were in place for the originating report server. Any configuration differences on the destination server will cause reporting to not be available. Use the SQL Reporting Services Configuration utility to confirm settings on both servers are identical prior to proceeding. 1 Uninstall the Service Center application using Windows. Depending on your version of Windows, you will do this using either Programs and Features or Add or Remove Programs in the Control Panel. 2 If the databases (listed below) are going to be moved, create back ups and restore them to the destination database server. SCMaster.mdf SCData_Default.mdf ReportServer.mdf ReportServerTemp.mdf Note: The databases are backed up and restored using native SQL functionality. For more information, see Backing Up and Restoring Databases on page 69. Note: Moving the ReportServer databases requires additional steps to ensure that the destination server is using a valid encryption key for the contents. You cannot simply back up and restore the databases. For more information, see Creating Back Ups of the Reporting Services Databases on page Install Service Center. When prompted, select the destination database server and choose to keep the existing database. Complete the install and register Service Center. Setup Guide Moving Managed Workplace 65

76 4 Make any environmental changes (such as port-forwarding or DNS updates) so that Onsite Managers and Device Managers resume communications. Moving an Onsite Manager Changes may be required on the destination server, so be sure to have installation files available for the operating system. When moving to one or more servers, there are important networking changes that may be required to ensure that Managed Workplace functions normally once completed. Network Address Translation (NAT) Requires that ports that had been forwarded to the originating server be forwarded to the destination server, if the IP address changes. SQL version On the destination server, must be updated to the same service pack as was applied to the originating server. The collation must also be the same. Proxy servers May need to be configured to allow traffic from the Onsite Manager if the server host name or IP address changes. You may also need to run the Configure Proxy Server Settings utility from the Onsite Manager program group to restore normal communications. Firewalls and routers Must be updated to forward the correct ports to the destination server IP address, if it changes. No inbound access is required, but some internal security and infrastructure devices may require reconfiguration. SNMP Devices. Must be reconfigured to send traps to the destination server IP address or host name, if it changes. Syslog Devices. Must be reconfigured to send messages to the destination server IP address or host name, if it changes. Note: The procedures for moving an Onsite Manager assume SQL 2008 Management Studio Express exists on the originating and destination servers. If Onsite Manager was installed to an instance created by the installer, it is probably not installed. Click here to visit the download page for SQL 2008 Management Studio Express. 1 Uninstall the Onsite Manager application using Windows. Depending on your version of Windows, you will do this using either Programs and Features or Add or Remove Programs in the Control Panel. 2 Create a back up of the MWData database and restore it to the destination server. 66 Moving Managed Workplace Setup Guide

77 Note: The database is backed up and restored using native SQL functionality. For more information, see Backing Up and Restoring Databases on page Install Onsite Manager on the destination server. When prompted, choose to keep the existing database. Complete the install and register Onsite Manager. 4 Make any environmental changes (such as proxy server configuration) so that Onsite Manager resumes communications. Moving a Device Manager Device Managers are device-specific rather than user-specific and cannot be moved. Setup Guide Moving Managed Workplace 67

78 68 Moving Managed Workplace Setup Guide

79 C HAPTER BACKING UP AND RESTORING DATABASES This section explains using Microsoft SQL Server 2008/2005 Management Studio to create back ups of your Managed Workplace databases and restore them. 69

80 Backing Up Databases Managed Workplace uses Microsoft SQL Server databases for its data repository. Backing up your databases daily lets you respond quickly to failures and maintain high-availability for your customers. Back ups should also be created before upgrading, applying hotfixes or Service Packs to your production servers. The Managed Workplace databases to be backed up are shown in the table below. Component Database Name Service Center SCMaster SCData_Default SQL Reporting Services ReportServer ReportServerTempDB Onsite Manager MWData Windows Server Update Services Note: Back up the user databases frequently to ensure the logs do not exceed a threshold of 80% full. Exceeding this threshold causes the total space reserved on disk for the log files to grow. Daily differential back ups or weekly full back ups are recommended to manage log file growth. Configuring the SQL Recovery Model Microsoft SQL Server uses transaction logs to guarantee the data integrity of the database and for data recovery. Transactions are written to the log file faster than they can be written to the database, and are then copied into the database by SQL Server in the background. Service Center supports two SQL Server recovery models: Simple Recovery Full Recovery Simple Recovery SUSDB Simple Recovery logs uncommitted transactions, which are those that have not yet been written to the database. Once a transaction has been written to the 70 Backing Up and Restoring Databases Setup Guide

81 database, or committed, the log entry is removed. This does not reduce the disk space consumed by the log file, however, since SQL Server will reclaim and use the space within the log file but will not release space back to Windows. Use the SQL Server management console to see the available space within a log file. When you add new sites, devices or monitors you can expect to see a relative amount of growth in the size of the log. Unhealthy devices that generate frequent Windows events, SNMP traps or syslogs can also cause the log file to consume more space. The space used by the log will always increase in size and will never shrink on its own. Running a back up will not shrink the log file, so when using Simple Recovery a shrink should be performed should the log file increase in size significantly month to month. Using a full back up to recover both the log and database files, data will be lost up to the point of the back up. Losing data from the point of failure to the point of last back up is not normally an issue, as most monitored data recurs over time; performance counter data is polled at fixed intervals and event data usually recurs until the root cause of the event has been addressed. However, any changes to the following will be lost during the restore: Alerts (opened, closed, self-healed) Trouble tickets (opened, closed, self healed) Monitoring rule configuration User management configuration RDP history Using Simple Recovery mode you will usually see much less disk space taken up by the log files. This model is recommended for deployments up to 10 sites or 500 devices. Full Recovery Full Recovery logs committed and uncommitted transactions. Once a transaction has been written to the database, or committed, the log entry is not removed. This causes the log file to grow in size until the next successful back up occurs. When the back up completes, the space occupied by committed transactions is reclaimed within the log file. Size will appear unchanged unless a shrink operation is performed. When you add new sites, devices or monitors you can expect to see a relative amount of growth in the size of the log rapidly, especially when unhealthy devices generate extra monitoring data. Setup Guide Backing Up and Restoring Databases 71

82 Running a back up will not shrink the database, nor will a manual shrink significantly reduce the overall size of the log. The only reduction in the size of the log file will come from successful back ups combined with a shrink operation. This means that to contain the log file growth, you must schedule more frequent back ups, at least on a daily basis. A full back up is used in conjunction with a replay of the log file, to recover the database without any loss of data, providing the log file was not lost. Level Platforms recommends against using third-party back up utilities, as testing has shown that some do not correctly trigger a SQL Server checkpoint upon successful completion. You can easily determine if this is an issue with your back up software by observing the size of the log file before and after a back up completes successfully. If the size of the log is not reduced by the back up followed by a shrink operation, you should use the built-in SQL back up engine rather than the third-party utility. Both recovery models depend on frequent database back ups to provide reliability, and Level Platforms recommends that back ups be created on a daily basis, at a minimum, to protect the integrity of the data and manage the growth of the log file disk footprint. 1 Open SQL Management Studio and connect to the database server. 2 Right-click the database and select Properties. 3 Select Options and choose either Full or Simple from the Recovery Model selection list. 72 Backing Up and Restoring Databases Setup Guide

83 4 Click OK. Back Up Strategy for Databases Performing a back up of SCData_Default as part of regular maintenance will also help to keep the size of the transaction log down to a manageable amount. Depending on your environmental needs, you may want to also include a shrink, but remember when you do so your are trading the disk footprint for SQL performance speeds, as SQL must create white space to which records are written, and shrinking eliminates this white space. Level Platforms recommends against using third-party back up utilities, as testing has shown that some do not correctly trigger a SQL Server checkpoint upon successful completion. You can easily determine if this is an issue with your back up software by observing the size of the log file before and after a back up completes successfully. If the size of the log is not reduced by the back up followed by a shrink operation, you should use the built-in SQL back up engine rather than the third-party utility. Setup Guide Backing Up and Restoring Databases 73

84 The maintenance plan below is an example only. Depending on your situation you may need to make more or less frequent back ups and add or remove other tasks. 1 Launch SQL Management Studio and connect to the Service Center database server. 2 Expand Management and right-click Maintenance Plans. Select Maintenance Plan Wizard. Click Next. 3 Enter a name for the plan and select the Separate schedules for each task option button. Click Next. 4 Select the tasks you want to schedule and click Next. Level Platforms recommends including the following: Back Up Database (Full) Back Up Database (Differential) Back Up Database (Transaction Log) Note: You only need the Back Up Database (Transaction Log) if you are using the Full recovery model. 74 Backing Up and Restoring Databases Setup Guide

85 5 Use the Move Up and Move Down buttons to adjust the order in which the maintenance tasks will execute. Click Next. Note: Schedule database shrink operations to occur before back ups. 6 Configure each task as described below. 7 Optionally, choose to write a report to a text file (suitable for monitoring with a Managed Workplace custom log monitor) or supply an address to which an will be sent. Click Finish. To configure a back up database (full) task 1 Select SCData_Default and click OK. 2 Choose a location (Disk or Tape) and to Overwrite existing back up files. 3 Click Change to open the Job Schedule Properties. Set a schedule that suits your needs. Click OK and then Next if it appears. Setup Guide Backing Up and Restoring Databases 75

86 Note: Level Platforms recommends a full back up at least once a week. To configure a back up database (differential) task 1 Select SCData_Default and click OK. 2 Choose a location (Disk or Tape) and to Overwrite existing back up files. 3 Click Change to open the Job Schedule Properties. Set a schedule that suits your needs. Click OK and then Next if it appears. 76 Backing Up and Restoring Databases Setup Guide

87 Note: Level Platforms recommends differential back ups every day when a full back up does not take place. To configure a back up database (transaction log) task 1 Select SCData_Default and click OK. 2 Choose a location (Disk or Tape) and to Overwrite existing back up files. 3 Click Change to open the Job Schedule Properties. Set a schedule that suits your needs. Click OK and then Next if it appears. Setup Guide Backing Up and Restoring Databases 77

88 Note: Level Platforms recommends backing up the transaction log once a week at a time when no other maintenance operations are scheduled. Back Up Strategy for Files Best Practice: Perform a full back up of the program directories of Service Center, Onsite Manager and their associated foundation technologies. This will allow you to examine the file system in the event of failure, including parsing text log files for relevant errors and scanning executables for malware infection. 78 Backing Up and Restoring Databases Setup Guide

89 Creating Back Ups of the Managed Workplace Databases Beyond scheduling regular back ups, you must also take manual back ups prior to upgrades or migrations. 1 Launch SQL Management Studio and connect to the Service Center database server. Expand Databases. 2 Right-click the database you want to back up and select Tasks > Back Up. 3 Note the location where the back up file will be created, and click OK. When a dialog box appears advising the back up completed successfully, click OK. 4 Copy the database back up file to a secure storage location. Setup Guide Backing Up and Restoring Databases 79

90 Creating Back Ups of the Reporting Services Databases The contents of the Reporting Services databases are encrypted. You must also deal with the encryption key as part of the back up process to make sure you have usable back ups. 1 Launch SQL Management Studio and connect to the Service Center database server. Expand Databases. 2 Right-click the database you want to back up and select Tasks > Back Up. 3 Note the location where the back up file will be created, and click OK. When a dialog box appears advising the back up completed successfully, click OK. 4 Open the Reporting Services Configuration tool from the SQL program group on your start menu, and select Encryption Keys from the left-hand pane. 5 Click back up. 6 Enter a strong Password then click Browse [...] and select a name and location to store the encryption key file. Click Save. Click OK. 7 Copy the database back up and encryption key files to a secure storage location. 80 Backing Up and Restoring Databases Setup Guide

91 Restoring Databases Restoring Back Ups of the Managed Workplace Databases 1 Launch SQL Management Studio and connect to the Service Center database server. 2 Right-click Databases and select Restore Database. 3 Under the Source for restore heading, select the From device option button and click Browse [...]. 4 Click Add. Select the back up file and click OK. Setup Guide Backing Up and Restoring Databases 81

92 5 The back up file now appears in the Restore Database dialog box. Enter the original database name in the To database text box, enable the Restore check box corresponding to the back up and click OK. 6 When a dialog box appears advising the restore completed successfully, click OK. Restoring Back Ups of the Reporting Services Databases 1 Enter the following command in the Windows Run prompt: iisreset stop 2 Open the Reporting Services Configuration tool from the SQL program group in the Start menu of the destination server. Select Server Status from the left-hand pane and click Stop. 82 Backing Up and Restoring Databases Setup Guide

93 3 Launch SQL Management Studio and connect to the destination database server. Detach the following databases by right-clicking on each and selecting Tasks > Detach: ReportServer ReportServerTempDB 4 For each, select Drop Connections and click OK. 5 Once the databases are detached, the files must be deleted or moved out of the directory of origin so that there will be no errors restoring files with the same name. 6 Under the Source for restore heading, select the From device option button and click Browse [...]. 7 Click Add. Select the back up file and click OK. The back up file now appears in the Restore Database dialog box. 8 Enter the original database name in the To database text box, enable the Restore check box corresponding to the back up and click OK. 9 When a dialog appears advising the restore completed successfully, click OK. 10 Open the Reporting Services Configuration Tool and confirm that the following settings on the destination server match those on the originating server: Virtual Directory Names Type of Service Account used Setup Guide Backing Up and Restoring Databases 83

94 11 Select Server Status in the left-hand pane. Click Start. 12 Enter the following command in the Windows Run prompt: iisreset start 13 To display the encryption key, open a command prompt and enter the following command: rskeymgmt -l -i MSSQLSERVER Note: The command above is for deployments using the default SQL instance. Replace with the name of your instance, if required. You will see two keys listed in the following format: ComputerName\InstanceName\EncryptionKeyID 14 Record the EncryptionKeyID for the originating server. 15 Still working in the command prompt, enter the following command using the ID you recorded in the previous step: rskeymgmt -r EncryptionKeyID 16 In the Reporting Services Configuration tool, select Encryption Keys from the left-hand pane. Click Restore. Enter the password used to back up the key on the originating server and click Browse [...]. Select the back up file and click OK. 17 From the Management console on the SQL Server, restart the SQL Server Reporting Services Windows service for your instance. 84 Backing Up and Restoring Databases Setup Guide