Advanced Administration

Transcription

1 BlackBerry Enterprise Service 10 BlackBerry Device Service Version: 10.2 Advanced Administration Guide

2 Published: SWD

3 Contents 1 Introduction...11 About this guide...12 What is BlackBerry Enterprise Service 10?...13 Key features of BlackBerry Enterprise Service About the BlackBerry Device Service...15 Log in to the BlackBerry Device Service console...15 About BES10 Self-Service Setting up administrator accounts...19 Defining different types of administrators Preconfigured roles View the permission of a role Create a role...21 Copy a role Change a role Delete a role...22 Permissions for preconfigured roles...22 Creating and managing administrator accounts Create an administrator account...30 Change an administrator account Delete an administrator account...31 Remove an administrator account from the BlackBerry Device Service Add an administrator account to the BlackBerry Device Service...32 Add an administrator account to a group Delete administrator accounts from a group Add a role to an administrator account Delete roles from an administrator account Setting up device controls...35 Controlling how devices can connect to your organization's network Managing Wi-Fi profiles Managing VPN profiles Managing profiles Managing SCEP profiles Managing proxy profiles...50 Accessing network drives from devices Allow devices to have single sign-on access to your organization's network...53

4 Managing device security features and behaviors Preconfigured IT policy...55 Create an IT policy...55 Copy an IT policy Import IT policies Export IT policies...56 Change an IT policy Delete an IT policy...57 View the IT policies assigned to user accounts and administrator accounts...57 Resolving IT policy conflicts Managing work and personal spaces Configuring the default device activation type for all new users...61 Enforcing your organization's device compliance requirements Update the template for the device compliance notification Select an enforcement action for devices that are not in compliance Managing app availability on devices...67 Preparing an app for delivery Sending and removing apps from devices Reconciling multiple software configurations that are assigned to a user account Managing groups, users, and device controls Creating and managing groups...80 About preconfigured groups Create a group Change a group...81 Delete a group...81 Add child groups to a group Delete child groups from a parent group Add roles to a group Delete roles from a group Applying device controls to a group Add software configurations to a group Delete software configurations from a group Add an IT policy to a group Delete an IT policy from a group...85 Add Wi-Fi profiles to a group...85 Delete Wi-Fi profiles from a group Add VPN profiles to a group Delete VPN profiles from a group Creating and changing user accounts...88 Creating organization notices... 88

5 Create a user account Create a local user account Synchronize new or updated user information with a company directory...92 Change a user account...92 Create user accounts from a.csv file...92 Create local user accounts from a.csv file...94 Change the user accounts in a.csv file...95 Create a list of all user accounts and their associated devices...96 Create a list of selected user accounts and their associated devices Move a user account from one BlackBerry Device Service instance to another Delete a user account...97 Managing groups and roles for user accounts Add user accounts to groups Delete user accounts from groups Add roles to user accounts Delete roles from user accounts Applying device controls to user accounts Add software configurations to user accounts Delete software configurations from user accounts Add an IT policy to a user account Delete an IT policy from a user account Add Wi-Fi profiles to user accounts Delete Wi-Fi profiles from user accounts Add VPN profiles to user accounts Delete VPN profiles from user accounts Add an profile to a user account Delete an profile from a user account Activating and managing devices Activating devices Preparing to assign devices Activate a device using the BlackBerry Administration Service Setting an activation password using BES10 Self-Service Activating a device over the wireless network Prevent wireless activation over the BlackBerry infrastructure Managing devices Sending CA certificates to devices Sending work space wallpaper to devices Assign a user a different device Specify a new device password and lock the device Specify a new work space password and lock the work space...120

6 Resend IT policies to a device Managing how device controls are sent to devices Deactivating a device Reactivate a device Create a list of all user accounts and their associated devices Create a list of selected user accounts and their associated devices Troubleshooting devices The computer blocks incoming connections from a device The computer uses an incorrect certificate template for the SCEP The service plan on your SIM card doesn t support your organization s activation requirements Maintaining and monitoring Maintaining and monitoring the health of the BlackBerry Device Service Change how the BlackBerry Controller restarts a BlackBerry Device Service component Managing log files for server components Change the location for log files Change the folder for log files Change the name of a log file Add a prefix to the file name of a log file Change the maximum size of a log file Change the logging level of a log file Specify how the BlackBerry Device Service manages a log file that reaches its maximum size Specify when the BlackBerry Device Service creates a log file Set the maximum age for a log file Change the encoding of the log file Restore default settings for log files Changing how the BlackBerry MDS Connection Service creates a log file Sending device log files to the BlackBerry Technical Solution Center Profile settings profile settings Type setting Server Name setting Server Port setting Use SSL setting SyncML server SyncML server port Use SSL to connect to SyncML Push Enabled setting Days to Synchronize setting Interval Between Synchronizations setting Require Manual Synchronization When Roaming setting

7 Synchronization setting Calendar Synchronization setting Contact Synchronization setting Memo Synchronization setting Task Synchronization setting To Do list synchronization SCEP Profile setting S/MIME Messages setting Digitally Signed S/MIME Messages setting Encrypted S/MIME Messages setting Allowed Content Ciphers setting SCEP profile settings SCEP Service URL setting Certificate Thumbprint setting Key Algorithm setting RSA Strength setting ECC Strength setting Specify Encryption Algorithm setting Specify Hash Function setting Certification Authority Identifier setting Certification Authority Challenge Password setting Automatic Renewal setting Wi-Fi profile settings SSID setting Hidden SSID setting Link Security setting EAP Security setting EAP-FAST Provisioning Method setting EAP Inner Link Security setting WEP Key setting Preshared Key Type setting Preshared Key setting User Name setting User Password setting Band Type setting Enable DHCP setting IP Address setting Subnet Mask setting Primary DNS setting Secondary DNS setting...165

8 Default Gateway setting Enable IPv6 setting Domain Suffix setting Access Point Handover setting User Can Edit setting Trusted Certificate Source setting Client Certificate Source setting Data Security Level setting Use HTTP Proxy setting Proxy Server setting Proxy Port setting Proxy User Name setting Proxy Password setting Associated SCEP Profile setting VPN Profile setting Associated Proxy Profile setting VPN profile settings Server Address setting Gateway Type setting Authentication Type setting Authentication ID Type setting Authentication ID setting Group User Name setting Preshared Key setting Group Password setting Hard Token setting User Name setting Password setting EAP Identity setting MSCHAPv2 EAP Identity setting MSCHAPv2 User Name setting MSCHAPv2 Password setting Gateway Authentication Type setting Gateway Preshared Key setting Gateway Authentication ID Type setting Gateway Authentication ID setting Automatically Determine IP setting Private IP setting Private IP Mask setting Subnet setting...184

9 Subnet Mask setting Dynamically Determine DNS setting Primary DNS setting Secondary DNS setting Domain Suffix setting Perfect Forward Secrecy setting Manual Algorithm Selection setting IKE DH Group setting IKE Cipher setting IKE Hash setting IKE PRF setting IPSEC DH Group setting IPSEC Cipher setting IPSEC Hash setting IKE Lifetime setting IPSEC Lifetime setting NAT Keep Alive setting DPD Frequency setting Split Tunneling setting Disable Banner setting User Can Edit setting Trusted Certificate Source setting Display VPN Information on Device setting Custom IKE DH Provider setting Client Certificate Source setting Data Security Level setting Use HTTP Proxy setting Proxy Server setting Proxy Port setting Proxy User Name setting Associated SCEP Profile setting Associated Proxy Profile setting Proxy profile settings Exclusion List setting Host setting PAC URL setting Password setting Port setting Type setting User setting

10 User Can Edit setting Product documentation Provide feedback Glossary Legal Notice

11 Introduction 1

12 Introduction About this guide The BlackBerry Device Service allows you to manage BlackBerry devices in your organization's environment. This guide provides instructions on how to manage user accounts and devices after the BlackBerry Device Service is installed and configured. This guide is intended for IT professionals who are responsible for activating devices and managing user accounts. Before you can use the tasks in this guide, you need to complete the tasks to configure the BlackBerry Device Service. You can find instructions on configuring the BlackBerry Device Service in the BlackBerry Enterprise Service 10 Configuration Guide. 12

13 Introduction What is BlackBerry Enterprise Service 10? BlackBerry Enterprise Service 10 helps you manage mobile devices for your organization. You can manage BlackBerry devices and BlackBerry PlayBook tablets, as well as ios and Android devices, all from a unified interface. BlackBerry Enterprise Service 10 is designed to help protect business information, keep mobile workers connected with the information they need, and provide administrators with efficient tools that help keep business moving forward. BlackBerry Enterprise Service 10 includes the following components: Component BlackBerry Device Service Universal Device Service Provides advanced administration for BlackBerry 10 devices and BlackBerry PlayBook tablets Provides advanced administration for ios and Android devices BlackBerry Management Studio Provides a unified interface to administer common tasks for BlackBerry 10 devices, BlackBerry PlayBook tablets, BlackBerry 7.1 and earlier devices, ios devices, and Android devices BES10 Self-Service Provides a console to users so that they can perform some self-service tasks. For example, users can create activation passwords, remotely change the password on their device, or delete data from the device. Key features of BlackBerry Enterprise Service 10 The table below describes some of the key features for BlackBerry Enterprise Service 10. Feature Management of most types of devices Single, unified interface Trusted and secure experience BlackBerry Enterprise Service 10 supports all types of BlackBerry devices and tablets, as well as ios devices and Android devices. BlackBerry Management Studio is a single, web-based interface where you can view all devices in one place and access the most common management tasks across multiple domains. These tasks include creating and managing groups, managing device controls, and activating mobile devices. Device controls give you precise management of how devices connect to your network, what capabilities are enabled, and what apps are available. Whether the devices are owned by your organization or your users, you can protect your organization's information. 13

14 Introduction Feature Balance of work and personal needs BlackBerry Balance and Secure Work Space technology are designed to ensure that personal and work information are kept separate and secure on devices. If the device is lost or the employee leaves the organization, you can delete only work-related information or all information from the device. Additional security features are available depending on the device type. 14

15 Introduction About the BlackBerry Device Service The BlackBerry Device Service permits you to manage BlackBerry 10 OS devices and BlackBerry PlayBook tablets that run BlackBerry Tablet OS 2.0 or later. As an administrator, the BlackBerry Device Service allows you to: Provision devices in an enterprise environment by providing Microsoft ActiveSync configuration information that the device uses to synchronize , calendar and tasks Support a work and life balance by separating work and personal data using BlackBerry Balance technology Audit devices and users by being able to view user and tablet information Protect your organization's data by managing work data on devices using BlackBerry Balance, set contact information on the home screen when users connect to the network, and use IT policies to manage access to your organization's data Manage mandatory and optional applications by creating a catalog of optional applications on the device, and manage the installation and update of mandatory applications Increase productivity because of familiar user interfaces which include BlackBerry Administration Service and BES10 Self-Service To provide a single interface for helpdesk administrators to manage all the devices in your organization's environment, you can connect BlackBerry Management Studio to the BlackBerry Device Service. Log in to the BlackBerry Device Service console Also known as the BlackBerry Administration Service, you can use the BlackBerry Device Service console to manage the BlackBerry Device Service and the user accounts and devices that are associated with it. To open the console, you can use a browser on a computer that can access the computer that hosts the BlackBerry Administration Service. You can use a Microsoft Active Directory, LDAP, or BlackBerry Administration Service username and password to log in. When you install BlackBerry Enterprise Service 10, you specify the username and password that you use to log in for the first time. 1. In the browser, type where <server_name> is the name of the computer that hosts the BlackBerry Administration Service. The default port for the BlackBerry Administration Service is port In the User name field, type your username. 3. In the Password field, type your password. 4. Perform one of the following actions: In the Log in using drop-down list, click BlackBerry Administration Service. 15

16 Introduction In the Log in using drop-down list, click Active Directory and type the Microsoft Active Directory domain in the Domain field. In the Log in using drop-down list, click LDAP. 5. Click Log in. 6. Install the RIMWebComponents.cab add-on if you are prompted to do so. 16

17 Introduction About BES10 Self-Service BES10 Self-Service is a web-based application that you can make available to users so that they can perform certain tasks such as creating activation passwords, remotely locking their devices, or deleting data from their devices. Users do not need to install any software on their computers to use BES10 Self-Service. You must provide the BES10 Self-Service web address and login information to users. You can send this information in an message, or edit the activation template to include the information. Provide the following information: Web address. The web address for BES10 Self-Service is where <server_name> is the FQDN of the computer that hosts the console, and 7445 is the default port. You can change the port in the BES10 Configuration Tool. Username and password. Company directory users can log in with their organization usernames and passwords. For local users that have BlackBerry 10 devices, you must create their usernames and passwords in the BlackBerry Device Service. Local users that have ios or Android devices cannot use BES10 Self-Service. Domain name (for Microsoft Active Directory users) 17

18

19 2 Setting up administrator accounts

20 Setting up administrator accounts Defining different types of administrators You can use roles to specify the information that an administrator can view and the tasks that an administrator can perform in the BlackBerry Device Service. Each role consists of a set of permissions that are assigned to an administrator account. The permissions do not apply to the BES10 Configuration Tool tool. You can use a preconfigured role or create a role to meet your organization's requirements. You can assign a role to an administrator account to manage permissions for a single administrator account or you can assign a role to a group to manage permissions for all of the administrator accounts in the group. If you assign a role to a user account, the user account becomes an administrator account. You can assign multiple roles to an administrator account (both directly and by assigning the roles to the group that the administrator account belongs to). If you assign multiple roles to an administrator account, the administrator has all of the permissions that are turned on for each of the assigned roles. Preconfigured roles The BlackBerry Device Service includes preconfigured roles. You can use a preconfigured role, change the preconfigured role and then use it, or copy the preconfigured role and use it as a template for a new role. Preconfigured role name Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator Server Only Administrator User Only Administrator This role has permission to perform all tasks in the BlackBerry Device Service. This role has permission to perform all tasks in the BlackBerry Device Service except changing role assignments. This role can only view role assignments. This role has permission to perform advanced administrative tasks in the BlackBerry Device Service. This role has permission to perform basic administrative tasks in the BlackBerry Device Service. This role has permissions to perform system management tasks in the BlackBerry Device Service. This role has permission to perform user management tasks in the BlackBerry Device Service. View the permission of a role 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Role. 20

21 Setting up administrator accounts 2. Click Manage roles. 3. Click the role. 4. View the permission for the role on the appropriate tabs. Create a role You can make changes to roles or create custom roles and specify permissions for those custom roles. By default, administrators assigned to the Security Administrator role are the only administrators with permissions to create or make changes to roles. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Role. 2. Click Create a role. 3. In the Name field, type a name for the role. 4. In the field, type a description for the role. 5. Click Save. After you finish: Change a role to configure the properties of the role. Copy a role You can create a role by copying the permissions from an existing role. Copying a role allows you to use a role as a template for a new role. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Role. 2. Click Manage roles. 3. In the list of roles, click the name of the role that you want to copy. 4. Click Copy role. 5. In the Name field, type a name for the role. 6. In the field, type a description for the role. 7. Click Copy role. After you finish: Change a role to configure the properties of the role. 21

22 Setting up administrator accounts Change a role You change a role to configure the properties of the role. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Role. 2. Click Manage roles. 3. In the list of roles, click the name of the role. 4. Click Edit role. 5. Make the changes on the appropriate tabs. 6. Click Save all. Delete a role If you delete a role that you assigned to an administrator account or a group, the administrator account or group no longer has the permissions that are associated with the role. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Role. 2. Click Manage roles. 3. In the list of roles, click the name of the role that you want to delete. 4. Click Delete role. 5. Click Yes - Delete the role. Permissions for preconfigured roles The following table lists the permissions for each preconfigured role. Permission name Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator Server Only Administrator User Only Administrator User and device group Create a group Delete a group View a group 22

23 Setting up administrator accounts Permission name Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator Server Only Administrator User Only Administrator Edit a group Create a user Delete a user View a user Edit a user View a device Edit a device View device activation settings Edit device activation settings Create an IT policy Delete an IT policy View an IT policy Edit an IT policy Import an IT policy Export an IT policy Resend data to devices Create a software configuration View a software configuration Edit a software configuration 23

24 Setting up administrator accounts Permission name Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator Server Only Administrator User Only Administrator Delete a software configuration Create an application View an application Edit an application Delete an application Create an administrator user Add or remove user configuration Import or export users Import user updates Assign the current device to a user Delete all device data and remove device Delete only the organization data and remove device View associated BlackBerry Device Service Override associated BlackBerry Device Service 24

25 Setting up administrator accounts Permission name Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator Server Only Administrator User Only Administrator View a company directory connection Edit a company directory connection View user authentication Create an profile Edit user authentication Delete an profile View an profile Edit an profile Create a SCEP profile Delete a SCEP profile View a SCEP profile Edit a SCEP profile Create a proxy profile Delete a proxy profile Create a company directory connection View a proxy profile Delete a company directory connection Edit a proxy profile 25

26 Setting up administrator accounts Permission name Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator Server Only Administrator User Only Administrator View enterprise authentication Import an enterprise authentication file Remove enterprise authentication file View device backup encryption keys Edit device backup encryption keys View compliance rules Edit compliance rules View certificate retrieval settings Edit certificate retrieval settings BlackBerry Device Service permissions Specify an activation password Generate an activation Enterprise Management Web Service permissions Import new users Topology group View a server Edit a server View a component 26

27 Setting up administrator accounts Permission name Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator Server Only Administrator User Only Administrator Edit a component View an instance Edit an instance Change the status of an instance Edit an instance relationship View a job Edit a job View default distribution settings for a job Edit default distribution settings for a job Manage deployment job tasks Change the status of a job task Delete an instance Edit license keys View license keys View reconciliation event status View SMTP configuration Edit SMTP configuration 27

28 Setting up administrator accounts Permission name Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator Server Only Administrator User Only Administrator View BlackBerry Enterprise Service 10 license information Edit BlackBerry Enterprise Service 10 license information View an organization notice Edit an organization notice View wireless service plan Edit wireless service plan BlackBerry MDS Connection Service permissions View rules for the BlackBerry MDS Connection Service BlackBerry Administration Service setup group Create a role Delete a role View a role Edit a role Add or remove a role View BlackBerry Administration Service software management 28

29 Setting up administrator accounts Permission name Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator Server Only Administrator User Only Administrator Edit BlackBerry Administration Service software management Import or export groups within roles View BlackBerry Administration Service certificate management Edit BlackBerry Administration Service certificate management Organizations View an organization Edit an organization 29

30 Setting up administrator accounts Creating and managing administrator accounts You can use administrator accounts to control who can view information and perform tasks in the BlackBerry Administration Service. You can create an administrator account that only exists on the BlackBerry Device Service or you can assign a role to a user account that exists in your organization's user directory. Create an administrator account 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Administrator user. 2. Click Create an administrator user. 3. In the Display name field, type a name for the administrator account. 4. To configure the login information that the administrator account uses to log in to the BlackBerry Administration Service, complete one of the following tasks: Task Configure Microsoft Active Directory authentication. Steps 1. In the Authentication type drop-down list, select Active Directory. 2. In the User name field, type the username for the administrator account. 3. In the Domain field, type the domain for the administrator account. 4. In the Administrator password field, type your password. Configure LDAP authentication. 1. In the Authentication type drop-down list, select LDAP. 2. In the User name field, type the username for the administrator account. 3. In the Administrator password field, type your password. Configure BlackBerry Administration Service authentication 1. In the Authentication type drop-down list, select BlackBerry Administration Service. 2. In the User name field, type the username for the administrator account. 3. In the Password and Confirm password field, type the password for the administrator account. 4. In the Administrator password field, type your password. 30

31 Setting up administrator accounts 5. In the Role drop-down list, click the role that you want to assign to the administrator account. 6. Click Create an administrator user. After you finish: Change the administrator account to set the account properties. Change an administrator account 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Administrator user. 2. Click Manage users. 3. Search for an administrator account. 4. In the search results, click the display name of the administrator account. 5. Click Edit user. 6. Make the changes on the appropriate tabs. 7. Click Save all. Delete an administrator account 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Administrator user. 2. Click Manage users. 3. Search for an administrator account. 4. In the search results, click the display name of the administrator account. 5. In the Status list, click Delete user. 6. Click Yes - Delete the user. Remove an administrator account from the BlackBerry Device Service You can remove an administrator account from the BlackBerry Device Service without deleting the account and group memberships. This allows an administrator without an active BlackBerry device to perform administrative tasks in the BlackBerry Administration Service. A device cannot be activated for the administrator account until the account is added back to the BlackBerry Device Service. 31

32 Setting up administrator accounts Administrator accounts with no associated devices are the only user accounts that can be removed from the BlackBerry Device Service and added back in. All other user accounts must be deleted and then added as new user accounts. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Administrator user. 2. Click Manage users. 3. Search for an administrator account. 4. In the search results, click the display name of the administrator account. 5. Click Remove from BlackBerry Device Service. 6. Click Yes Remove from BlackBerry Device Service. Add an administrator account to the BlackBerry Device Service You can add an administrator account that was removed from the BlackBerry Device Service back to the BlackBerry Device Service. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Administrator user. 2. Click Manage users. 3. Search for the administrator account. 4. In the search results, click the display name of the administrator account. 5. Click Add to BlackBerry Device Service. 6. Click Save. Add an administrator account to a group When you add an administrator account to a group, the administrator account inherits the roles, configurations, IT policies, and profiles of the group. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Administrator user. 2. Click Manage users. 3. Search for an administrator account. 4. In the search results, click the display name of the administrator account. 5. Click Edit user. 32

33 Setting up administrator accounts 6. On the Groups tab, in the Available groups list, click the group that you want to add the administrator account to. 7. Click Add. 8. Click Save all. Delete administrator accounts from a group 1. In the BlackBerry Administration Service on the BlackBerry solution management menu, expand Administrator user. 2. Click Manage users. 3. Search for the administrator account that you want to delete. 4. In the search results, click the display name of the administrator account. 5. Click Edit user. 6. On the Groups tab, perform one of the following actions: To delete the administrator account from one group, select the group in the Current groups list and click Remove. To delete the administrator account from more than one group, select multiple groups in the Current groups list and click Remove. To delete the administrator account from all of the groups, click Remove all. 7. Click Save all. Add a role to an administrator account 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Administrator user. 2. Click Manage users. 3. Search for an administrator account. 4. In the search results, click the display name for the administrator account. 5. Click Edit user. 6. On the Roles tab, select the role and click Add. 7. Click Save all. 33

34 Setting up administrator accounts Delete roles from an administrator account 1. In the BlackBerry Administration Service on the BlackBerry solution management menu, expand Administrator user. 2. Click Manage users. 3. Search for the administrator account. 4. In the search results, click the display name of the administrator account. 5. Click Edit user. 6. On the Roles tab, perform one of the following actions: To delete one role from the administrator account, select the group in the Current roles list and click Remove. To delete more than one role from the administrator account, select multiple roles in the Current roles list and click Remove. To delete all of the roles from the administrator account, click Remove all. 7. Click Save all. 34

35 Setting up device controls 3

36 Setting up device controls Controlling how devices can connect to your organization's network You can specify how users' devices can connect to your organization's network, messaging and proxy servers, and the settings for enrolling certificates to devices. You can also use the BlackBerry Work Drives app to allow BlackBerry 10 devices to access files and folders on your organization's network. The following profiles allow you to control how devices can connect through these communication paths: Profile Can be applied to SCEP profiles Proxy profiles SCEP profiles can be added to Wi-Fi profiles, VPN profiles, and profiles to use certificatebased authentication for Wi-Fi connections, VPN connections, and messaging server connections. Specify how users use a proxy server to access web services on the Internet or in your organization's network. Wi-Fi profiles VPN profiles profiles Wi-Fi profiles VPN profiles BlackBerry Device Service domain Wi-Fi profiles Specify how users connect to your organization's Wi-Fi network. Users Groups VPN profiles Specify how users connect to your organization's VPN. Wi-Fi profiles Users Groups profiles Specify how devices connect to your organization's messaging server and synchronize messages and organizer data using Exchange ActiveSync or IBM Notes Traveler. Users Managing Wi-Fi profiles You can create a Wi-Fi profile to specify how users connect to your organization's Wi-Fi network within the firewall. 36

37 Setting up device controls Note: When you add a Wi-Fi profile to a user account, both personal and work apps on the device can use the profile settings to access your organization's network. To prevent personal apps from connecting to your organization's network, set the Work Network Usage for Personal Apps IT policy rule. For more information about the profile settings, see Wi-Fi profile settings. Create a Wi-Fi profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Create Wi-Fi profile. 3. Type a name and description for the Wi-Fi profile. 4. Click Save. After you finish: Change a Wi-Fi profile to set the Wi-Fi profile settings. Copy a Wi-Fi profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage Wi-Fi profiles. 3. Click the name of the Wi-Fi profile. 4. Click Copy profile. 5. Type a name and description for the Wi-Fi profile. 6. Click Save. After you finish: Change a Wi-Fi profile to configure the profile settings. Change a Wi-Fi profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage Wi-Fi profiles. 3. Click the name of the Wi-Fi profile. 4. Click Edit profile. 5. Make changes on the appropriate tabs. 6. Click Save all. Delete a Wi-Fi profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Policy. 2. Expand Wi-Fi configuration. 37

38 Setting up device controls 3. Click Manage Wi-Fi profiles. 4. Click the name of the Wi-Fi profile. 5. Click Delete profile. 6. Click Yes - Delete the profile. Add a VPN profile to a Wi-Fi profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage Wi-Fi profiles. 3. Click the name of the Wi-Fi profile. 4. Click Edit profile. 5. On the Wi-Fi profile settings tab, in the Wi-Fi associations section, in the VPN Profile drop-down list, select the VPN profile. 6. Click Save all. Delete a VPN profile from a Wi-Fi profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage Wi-Fi profiles. 3. Click the name of the Wi-Fi profile. 4. Click Edit profile. 5. On the Wi-Fi profile settings tab, in the Wi-Fi associations section, in the VPN Profile drop-down list, select the blank field. 6. Click Save all. Add a SCEP profile to a Wi-Fi profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage Wi-Fi profiles. 3. Click the name of the Wi-Fi profile. 4. Click Edit profile. 5. On the Wi-Fi profile settings tab, in the Wi-Fi associations section, in the Associated SCEP Profile drop-down list, click the SCEP profile. 6. Click Save all. 38

39 Setting up device controls Delete a SCEP profile from a Wi-Fi profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Policy. 2. Expand Wi-Fi configuration. 3. Click Manage Wi-Fi profiles. 4. Click the name of the Wi-Fi profile. 5. Click Edit profile. 6. On the Wi-Fi profile settings tab, in the Associated SCEP Profile field, delete the name of the SCEP profile. 7. Click Save all. Add a proxy profile to a Wi-Fi profile If you want devices that run BlackBerry 10 OS to use a proxy server when they use a work Wi-Fi connection, you must add a proxy profile to a Wi-Fi profile. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage Wi-Fi profiles. 3. Click the name of a Wi-Fi profile. 4. Click Edit profile. 5. On the Wi-Fi profile settings tab, in the Proxy associations section, in the Associated Proxy Profile drop-down list, select a proxy profile. 6. Click Save all. Delete a proxy profile from a Wi-Fi profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage Wi-Fi profiles. 3. Click the name of a Wi-Fi profile. 4. Click Edit profile. 5. On the Wi-Fi profile settings tab, in the Proxy associations section, in the Associated Proxy Profile drop-down list, select the blank value. 6. Click Save all. Managing VPN profiles You can create a VPN profile to specify how users connect to your organization's VPN. 39

40 Setting up device controls Note: When you add a VPN profile to a user account, based on IT policy rules and device settings, both personal and work apps on a device may be able to use the VPN profile to access your organization s network. For more information, see the BlackBerry Device Service Solution Security Technical Overview. Note: If you allow devices to connect to your organization s network using a VPN, you must make sure that your VPN network is set up to have access to BlackBerry Enterprise Service 10 to ensure that devices can communicate with BlackBerry Enterprise Service 10 while they are connected to your VPN Network. For more information about profile settings, see the VPN profile settings and the BlackBerry Enterprise Service 10 Configuration Guide. Create a VPN profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Create VPN profile. 3. Type a name and description for the VPN profile. 4. Click Save. After you finish: Change a VPN profile to set the VPN profile settings. Copy a VPN profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage VPN profiles. 3. Click the name of the VPN profile. 4. Click Copy profile. 5. Type a name and description for the VPN profile. 6. Click Save. After you finish: Change a VPN profile to configure the profile settings. Change a VPN profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage VPN profiles. 3. Click the name of the VPN profile. 4. Click Edit profile. 5. Make changes on the appropriate tabs. 6. Click Save all. 40

41 Setting up device controls Delete a VPN profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage VPN profiles. 3. Click the name of the VPN profile. 4. Click Delete profile. 5. Click Yes - Delete the profile. Add a SCEP profile to a VPN profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage VPN profiles. 3. Click the name of the VPN profile. 4. Click Edit profile. 5. On the VPN profile settings tab, in the VPN associations section, in the Associated SCEP Profile drop-down list, click the SCEP profile. 6. Click Save all. Delete a SCEP profile from a VPN profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Policy. 2. Expand Wi-Fi configuration. 3. Click Manage VPN profiles. 4. Click the name of the VPN profile. 5. Click Edit profile. 6. On the VPN profile settings tab, in the Associated SCEP Profile field, delete the name of the SCEP profile. 7. Click Save all. Add a proxy profile to a VPN profile If you want devices that run BlackBerry 10 OS to use a proxy server when they use a VPN connection, you must add a proxy profile to a VPN profile. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage VPN profiles. 3. Click the name of a VPN profile. 41

42 Setting up device controls 4. Click Edit profile. 5. On the VPN profile settings tab, in the Proxy associations section, in the Associated Proxy Profile drop-down list, select a proxy profile. 6. Click Save all. Delete a proxy profile from a VPN profile 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Profiles. 2. Click Manage VPN profiles. 3. Click the name of a VPN profile. 4. Click Edit profile. 5. On the VPN profile settings tab, in the Proxy associations section, in the Associated Proxy Profile drop-down list, select the blank value. 6. Click Save all. Managing profiles You can use profiles to specify how devices connect to your organization's messaging server and synchronize messages and organizer data using Microsoft ActiveSync or IBM Notes Traveler. You can add profiles to user accounts. Extending messaging security on BlackBerry 10 devices using S/MIME protection You can extend messaging security for the BlackBerry Device Service solution and permit users to send and receive S/ MIME-protected messages on BlackBerry 10 devices. Digitally signing or encrypting messages adds another level of security to messages that users send or receive from their devices. If they use a work account that supports S/ MIME-protected messages on devices, users can digitally sign or encrypt messages using S/MIME encryption. When a device is activated on the BlackBerry Device Service, you can require the device to sign, encrypt, or sign and encrypt messages using S/MIME encryption when users send messages using a work address. Digital signatures help recipients verify the authenticity and integrity of messages that users send. When a user digitally signs a message with their private key, recipients use the sender's public key to verify that the message is from the sender and that the message has not changed. Encryption keeps messages confidential. When a user encrypts a message, the device uses the recipient's public key to encrypt the message. The recipient's device uses the recipient's private key to decrypt the message. Devices support keys and certificates in the following file formats and file name extensions: PEM (.pem,.cer) DER (.der,.cer) 42

43 Setting up device controls PFX (.pfx,.p12) Users can store their private keys on their devices or a smart card. For devices that are running BlackBerry 10 OS version or later, you can use the BlackBerry Device Service to configure LDAP-enabled server settings and send them to devices so that devices can automatically retrieve the recipient's public key and users don't need to import public keys from work messages manually. You can require that devices use either simple authentication or Kerberos to authenticate with LDAP-enabled servers. If you require that devices use Kerberos authentication, if a valid TGT is available on a user's device, the user isn't prompted for login information. Users don't have to install additional software on devices to support S/MIME protection. Users can configure S/MIME preferences on devices in the BlackBerry Hub settings, including choosing certificates and encoding methods. Users can manage certificates on their devices in the Security and Privacy section of the System Settings. BlackBerry 10 devices support attachments in S/MIME-protected messages. Users can view, send, and forward attachments in S/MIME-protected messages. Users can configure the S/MIME settings on the device to send either clear-signed messages that any application can open, or opaque-signed messages that only applications that support encryption can open. If devices do not have S/MIME support turned on, devices cannot send signed or encrypted messages. To send encrypted messages, a user must have the recipient's public key on their device. To read encrypted messages, a user must have their private key on their device or on a smart card. If users do not have their private keys on their devices, the devices cannot read S/MIME-encrypted messages, and the devices display the message, "Unable to decode the message because you do not have the corresponding private key." Retrieving S/MIME certificates For devices that are running a version of BlackBerry 10 OS that is or later, you can use the BlackBerry Device Service to configure LDAP-enabled server settings and send them to BlackBerry devices so that devices can search for and retrieve recipients' S/MIME certificates from LDAP-enabled servers over the wireless network. If a required S/MIME certificate isn't already in a device's certificate store, the device retrieves it and imports it into the certificate store automatically. A device searches each LDAP-enabled server and retrieves the S/MIME certificate. If there is more than one S/MIME certificate and the device is unable to determine the preferred one, the device displays all of the S/MIME certificates so that the user can choose which one to use. If you don't configure certificate retrieval settings, users must manually import S/MIME certificates from a work attachment or a computer. To allow BlackBerry devices to trust the network and servers when making secure connections, you will need to distribute root and intermediate CA certificates to the devices. For more information, see Sending CA certificates to devices. For more information about certificates, see the BlackBerry Device Service Solution Security Technical Overview. Retrieve public keys over the wireless network from LDAP-enabled servers For devices running BlackBerry 10 OS version or later, you can use the BlackBerry Device Service to configure LDAP-enabled server settings and send them to devices so that devices can search for and retrieve S/MIME certificates from LDAP-enabled servers. Before you begin: If you use a secure connection, you must add the certificates to the Enterprise trusted certificate store folder on the shared drive. 43

44 Setting up device controls 1. In the BlackBerry Administration Service, on the Devices menu, expand Device settings. 2. Click Certificate retrieval settings. 3. Click Edit settings. 4. On the LDAP tab, type a name and description for the LDAP certificate retrieval setting. 5. In the Service URL field, type the web address for the server using the following format LDAP://<FQDN>:<port> (for example, LDAP://server01.blackberry.com:123). 6. In the Default server base query field, type the query that you would like to use for the LDAP-enabled server. 7. Optionally, in the User search scope drop-down list, perform one of the following actions: To search the base object, click Base. This is the default setting. To search the base object and one level below it, click One level. To search the base object and all levels below it, click Subtree. To search for a particular object, click Children. 8. In the Secure connection turned on drop-down list, perform one of the following actions: Click Yes if you want to use a secure connection. Click No if you do not want to use a secure connection. 9. Perform one of the following actions: Option Use no authentication when connecting to the LDAP-enabled server. Use simple authentication when connecting to the LDAP-enabled server. Use Kerberos authentication when connecting to the LDAP-enabled server. Step In the Authentication type drop-down list, click None. 1. In the Authentication type drop-down list, click Simple. 2. In the LDAP user ID field, type the username for authentication 3. In the LDAP password and Confirm LDAP password fields, type the password for authentication. In the Authentication type drop-down list, click Kerberos. 10. In the Connection timeout field, type the time in seconds that the device waits for the LDAP-enabled server response. 11. Click Save all. After you finish: For devices running a version of BlackBerry 10 OS that is later than , do one of the following to verify the status of S/MIME certificates: Configure the OCSP server settings and send them to BlackBerry devices. 44