Computrace Agent Quick Reference and Best Practices Guide

Transcription

1 Computrace Agent Quick Reference and Best Practices Guide May 14, 2008

2 Absolute Software Computrace Agent Quick Reference and Best Practices Guide This document, as well as the software described in it, is confidential and contains proprietary information protected by non-disclosure agreements. No part of this document may be reproduced in any form or disclosed to any party not bound by a non-disclosure agreement without the express written consent of Absolute Software Corporation. Absolute Software Corporation reserves the right to revise this document and to periodically make changes in the content hereof without obligation of such revisions or changes unless required to do so by prior agreement. Information contained herein is believed to be correct, but is provided solely for guidance in product application and not as a warranty of any kind. Absolute Software Corporation assumes no responsibility for use of this information, nor for any infringements of patents or other rights of third parties resulting from the use of this information. Absolute Software Corporation, Suite 1600, Four Bentall Centre, 1055 Dunsmuir Street PO Box Vancouver, British Columbia, Canada V7X 1K Absolute Software Corporation. All rights reserved. Computrace and Absolute are registered trademarks of Absolute Software Corporation. All other trademarks are property of their respective owners. Computrace US Patents #5,715,174, #5,764,892, #5,802,280, #5,896,497, #6,244,758, #6,269,392, #6,300,863, and #6,507,914. Canadian Patents #2,205,370 and #2,284,806. U.K Patents #EP793823, and #GB German Patent # Australian Patent # Page 2 of 11

3 Table of Contents 1. Overview of the Computrace Windows Agent Installation Installing the Computrace Agent Manually Installing the Computrace Agent Using Third Party Deployment Software Computrace Installer Switches Preparing the Master Image Creating a Master Image using a Batch File CTMWeb Agent Management Tool Verifying the Computrace Image Activation Activation on BIOS-Enabled Machines Activation on Non-BIOS Machines Computrace and Full Disk Encryption Installation Order with FDE Software Workstation Maintenance Monitoring Your Assets in Customer Center Connecting to Customer Center Confirming Activation with the Customer Center Activation Report Monitoring Your Computrace Agent Population Retiring the Computrace Agent Computrace Agent Management - Best Practices Checklist Theft Reporting and Recovery Guarantee Submission Checklist More Information Page 3 of 11

4 1. Overview of the Computrace Windows Agent The Computrace Windows agent is client software that allows you to utilize Absolute Software s theft recovery, data protection and secure asset tracking services. Once installed, the Computrace agent contacts the monitoring center on a scheduled basis to report its location and pre-determined data. An Electronic Serial Number (ESN) associates each agent with the computer on which it is installed. The ESN is assigned automatically upon agent installation and is tied to the Serial Number of the computer. There are 2 main components to the Computrace Windows Agent: 1. Application Agent Installed in the Operating System as a service. Makes regularly scheduled calls to the Absolute Monitoring Server. Installed by running Computrace.msi. 2. Persistent Agent Restores the Application Agent if it has been removed. Installed either in the BIOS (where supported by OEM) or in the Partition Gap of the hard drive. The Persistent Agent is activated during the Application Agent s call to the Absolute Monitoring Server. To find out if a PC supports Computrace in the BIOS, go to 2. Installation The Computrace Agent can be installed manually on individual machines, or deployed automatically across a network using imaging and third party deployment tools Installing the Computrace Agent Manually The Computrace agent can be installed manually using the Computrace.msi installer. To install Computrace: 1. Double-click on Computrace.msi. 2. Follow the on-screen instructions in the installation wizard. Accept all default settings, and click Finish when complete. Generally, manual installation of the agent is appropriate for smaller deployments of the Agent (20 or less). See Chapters 2 and 3 of the Computrace Agent Installation Guide for details Installing the Computrace Agent Using Third Party Deployment Software The Computrace.msi agent installer can be deployed the same way as any other Microsoft Installer application using SMS, Active Directory, Altiris or other third party deployment tools. The only requirement is that users must have administrator rights for the installation. Most deployment software programs allow for emulated administrator rights during the installation. This method allows for remote installation, with no end-user intervention. See Chapter 5 of the Computrace Agent Installation Guide for details. Page 4 of 11

5 Computrace Installer Switches The following switches are available with the Computrace.msi installer: Switch /qn /qb /qr /qf /qn+ /qb+ /qb- Description Displays no user interface. Displays a basic user interface. Displays a reduced user interface with a modal dialog box displayed at the end of the installation. Displays the full user interface with a modal dialog box displayed at the end. Displays no user interface, except for a modal dialog box displayed at the end. Displays a basic user interface with a modal dialog box displayed at the end. Displays a basic user interface with no modal dialog boxes. Table 1: Computrace Installer Switches 2.3. Preparing the Master Image The agent installer can be incorporated into an image used to configure workstations. If your organization uses disk images for deployment or for maintenance Absolute strongly recommends that you incorporate the agent installer into your image(s). See Chapter 4 of the Computrace Agent Installation Guide for details. The Computrace application agent should be installed but not activated. To avoid activation, the computer to be used for the image must not have access to the Internet during or after agent installation. This means that you should also disable any wireless devices. Furthermore, if the computer you are using to create the image supports Computrace in the BIOS, it must not have had the Computrace Agent previously activated on it. If the source computer does have BIOS protection enabled, contact Absolute Technical Support to have the BIOS temporarily disabled prior to image creation. Prior to creating an image, disconnect the computer from the Internet and install the Computrace Agent using Computrace.msi. Note that the source computer must NOT have an activated Computrace agent (hence the instruction to disconnect from the web), nor can the computer have Computrace protection activated in the BIOS, from a previous activation. To create the master image: 1. Ensure the computer you are using to produce the master image does not have access to the Internet. 2. Install the Application Agent by running Computrace.msi and following the instructions in the installation wizard. 3. Verify the agent installation using the Computrace Agent management tool CTMWeb. Run CTMWeb.exe. Password will be 'password'. The ESN (Electronic Serial Number) should end in four zeros ('0000'). Page 5 of 11

6 4. For security reasons, delete CTMWeb.exe if it was installed on the hard drive of the imaging computer. The image can now be created, using your imaging software of choice. Absolute recommends that the Computrace agent be the last software application installed before the image is created Creating a Master Image using a Batch File You can also use a batch file to automate creation of the master image. Note that Wireless access does not have to be disabled for this method: 1. Copy Computrace.msi to the root of C: 2. Create a ct.bat file with the following off msiexec.exe /i C:\Computrace.msi /qn del c:\computrace.msi del "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ct.bat" 3. Save the ct.bat file in the following location: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ 4. Create your master image before rebooting the machine. 3. CTMWeb Agent Management Tool The CTMWeb application is an agent management tool used to verify the state of the agent in an image prior to deploying the image for installation across a network. To install CTMWeb: 1. Extract the two files (ctmweb.exe and ctmweb.xsl) included in the zip file you received from your Absolute technical contact. 2. Copy these files to the same directory location Verifying the Computrace Image 1. Double-click on ctmweb.exe. 2. When prompted, enter password for the password. If CTMWeb does not accept the password, the agent is not yet installed. Run Computrace.msi to install the agent before continuing. 3. The Agent Status page appears. The ESN (Electronic Serial Number) should end in four zeroes. If the ESN ends in '0001', or any value other than '0000', it means that the agent has already called into our monitoring center and registered itself. If that is the case, please contact Absolute Technical Support for assistance in reinstalling the agent before creating the master image. 4. When you are finished verifying the installation, delete the ctmweb.exe and ctmweb.xsl files from the master image. You do not need to deploy them to all the computers you Page 6 of 11

7 are imaging. However, you will want to keep a copy of this utility in a separate location for testing and debugging purposes. You can also use the CTMWeb tool to force test calls in a testing scenario or as part of the installation process. However, DO NOT FORCE A CALL on the machine that you are using to create your master image. If you do, a unique serial number will be assigned to that machine and replicated to other machines during your imaging process. 4. Activation Depending on the make and model of the workstation, the following steps are required to fully activate the Computrace agent after installation. When a computer has been fully activated, our persistence module has been downloaded to the workstation which will allow our agent to selfheal if the agent files are removed in a theft scenario or as a result of IT procedures Activation on BIOS-Enabled Machines For workstations that ship with the Computrace interface in the BIOS, follow this activation procedure: 1. Install Computrace using one of the installation methods listed above 2. Connect the computer to the Internet and force a test call using the CTMWeb tool, or wait for the machine to make its scheduled call. 3. On the 1 st (activation) Call into the monitoring center, the persistence module activation will occur 4. Reboot the machine to complete the BIOS activation. 5. On certain makes and models, a 2 nd test call needs to be forced using CTMWeb to complete the activation. The calls will either happen naturally or you can force them using our CTMWeb tool for testing purposes. The natural calls are set to happen once daily Activation on Non-BIOS Machines For laptops that do not support Computrace in the BIOS, our persistence module is downloaded into the partition gap of the hard drive on the first call into the monitoring center. To maximize persistence, we recommend setting the hard drive as the first device in the computer s boot sequence and then password protecting the BIOS. Perform the following steps to change the BIOS setting: 1. Reboot the computer and enter the CMOS setup 2. Change the boot order to have the hard drive appear first in the boot order list 3. Password protect the BIOS 4. Exit and save the BIOS settings Note that the boot order needs to be changed only on non-bios laptops. Page 7 of 11

8 5. Computrace and Full Disk Encryption If installing Full-Disk Encryption (FDE) software, the following best practices are recommended: 1. Contact Absolute Technical Support or speak with your technical Sales Representative to determine the level of compatibility between Computrace and your FDE software. There are some known compatibility issues with the Computrace Persistent Agent and some FDE software. 2. Disconnect the computer from the network during the initial disk encryption process Installation Order with FDE Software The interaction between the Computrace Agent and FDE software sometimes requires that the two applications be installed in a specific order: 1. For BIOS-enabled computers, the installation order generally does not matter, with the exception of Dell. For all Dell BIOS-enabled computers, you must install Computrace before installing any full-disk encryption products, in order for Computrace activation to be successful. Once installed, Computrace will generally not be able to self-heal from the BIOS into an encrypted drive if the agent files are removed. However, if the computer is stolen and the hard drive is erased, Computrace will self-heal from the BIOS. 2. For computers which do not have Computrace embedded in the BIOS, it is important to install the FDE software first, and Computrace second. Computrace will check for the presence of the FDE software during installation, and will not install the persistence module if a potential conflict is discovered. 6. Workstation Maintenance As workstations are repaired or upgraded, or software is added or removed, there are opportunities for the agent to become disabled or unable to communicate with Absolute s monitoring server. Absolute recommends the following tips to keep the agent fully functional on all computers: 1. Incorporate the agent installer into any images used for repair or maintenance. 2. Update the serial number in a computer s BIOS (DMI information) when the computer is serviced. For example, when a manufacturer services a laptop, a common repair procedure is to replace the system board. You should work with your vendor to ensure the new system board contains the physical serial number shown on the computer. 7. Monitoring Your Assets in Customer Center You can use the Absolute Customer Center Web site to view all of your computers which have the Computrace Agent installed Connecting to Customer Center To connect to Customer Center: 1. Go to 2. Click the Corporate Login button. 3. On the Customer Login page, enter your User ID and password: Page 8 of 11

9 User ID: usually your address Password: this will be provided to you by Absolute We recommend that you change your password once you log in to the Customer Center. For complete information on installing the Computrace Agent and using the Monitoring Center, click the Documentation link on the Customer Center home page Confirming Activation with the Customer Center Activation Report The Activation Report When logged into Customer Center, go to the Activation Report on the Reports tab. This report shows the activation date/time of all machines and also shows whether the machine is fully activated or not. BIOS enabled machines will show BIOS Active and non-bios machines will show Software Active for the Persistence status if fully activated. If the status shows BIOS Pending, another Computrace agent call is required to update the status to BIOS Active. If necessary, this call can be forced via CTMWeb Monitoring Your Computrace Agent Population Periodically review the ESNs assigned to computers in your organization. Check for any that have not contacted the monitoring center for an unusually long period of time (i.e. 30 days). Lack of contact from a computer may indicate that the agent is missing, or that an event has occurred that is preventing the agent from contacting the monitoring center. To be eligible for the Recovery Guarantee payment after a computer has been stolen, the computer must make at least one post-theft call. If you ensure that your computer is calling in regularly, there will be a much greater likelihood that the computer will make a post-theft call, and that Absolute will be able to recover the computer if it is stolen. Check the call-in statistics on the Customer Center homepage and use the built-in Loss Control reports in Customer Center to monitor your computers. See the Customer Center User's Guide for details on available reports and alerts in Customer Center. 8. Retiring the Computrace Agent As a computer population ages, some computers will be retired or destroyed. Similarly, the ESNs associated with these computers should be retired. Retired (or disabled) ESNs no longer consume a license, and do not appear in Customer Center reports unless specifically selected. ESNs are assigned to a single computer, and are not reusable. However, the license associated with a retired ESN can be applied to a new ESN. To retire ESNs, contact Absolute Technical Support and notify us of the ESN(s) you wish to retire. Absolute will then mark the ESNs as disabled, which removes the ESN from most Customer Center reports, and instructs the computer to cease calling the Monitoring Center. You can periodically Absolute the list of ESNs you wish to retire. Please contact Absolute s Technical Support team to determine the required file format and an appropriate schedule. Note: Once an ESN has been retired (disabled), it can only be re-enabled by advising Absolute and reinstalling the agent. Page 9 of 11

10 9. Computrace Agent Management - Best Practices Checklist Stage Item Description Installation - Non-BIOS PCs Installation - BIOS PCs Installation - Script or Manual Install Boot Order HDD 1st, FDD\CDROM [Administrative BIOS password] Agent installer is not left on the computer after install Change the computer s boot order to Hard Drive (HDD) first. This is not necessary with BIOS based persistence. Additional security can be gained by setting a BIOS password, to prevent unauthorized access to the computer s BIOS. Due care must be used remove the copy of the agent installer locally from the computer after installing the Computrace agent Installation - Image Install Installation Activation Maintenance - O/S Reinstall Maintenance - Hard Drive Replacement Maintenance - System board Replacement Agent installer incorporated into image ESN uniquely activated Reinstall agent Reinstall agent Update the serial number in the computer s BIOS (DMI information) Incorporate the Agent installer into any images used for repair or maintenance. Confirm that the computer s agent has contacted the monitoring center and has acquired a unique ESN once the agent is installed. As the computer s physical serial number is directly associated to its electronic counterpart, it is critical to ensure its uniqueness. When removing and installing an operating system, even if it is the same operating system, reinstall the agent. This will occur automatically with BIOS based persistence Ensure the agent is reinstalled in cases where hard drives have been replaced. This will occur automatically with BIOS based persistence Work with your vendor to ensure the new system board contains the physical serial number shown on the computer. Monitoring/ Drift License Management Monitor when machines drift or have not called in for more than 30 days Retire the associated ESN when the computer is retired or destroyed Proactively identify any computers that have not contacted the Monitoring Center for unusually long period of time (Greater than 30 days). Retired (or disabled) ESNs no longer consume a license, and do not appear in Customer Center reports unless specifically selected. Page 10 of 11

11 10. Theft Reporting and Recovery Guarantee Submission Checklist Stage Required Item Description Computer Handling Reasonable secure handling of the computer The computer was not left insecurely unattended Theft Report Report to the Police and then Submit a Computrace theft report Within 7 days of theft detection AND No later than 14 days after actual theft Recovery Guarantee Submission Submit the completed recovery guarantee submission form No later than 30 days after receipt Communicate to Absolute If the Recovery Guarantee submission has not been received via Submit receipts for computer AND Computrace Complete or Computrace Professional license Receipts for both the original purchase price of the computer and the license must be provided at time of Recovery Guarantee submission 11. More Information If you are interested in best practices pertaining to theft recovery, secure asset tracking and data protection, please contact your Absolute account executive. Absolute s Professional Services team provides best practices training and materials and can tailor courses to suit your environment. For general technical support, please go to and follow the onscreen instructions to contact Absolute Technical Support for your region. Page 11 of 11