Automatic Deployment and Authentication Guide

Transcription

1 This document gives administrators an overview of automatically deploying insync. Table of Contents Contents Introduction... 3

2 insyncconfig.ini File Composition... 3 Druva Automatic Deployment Package... 4 The Process... 5 Server.conf : INI creation Modes... 5 Group/Profile Mapping... 6 Binaries Location... 6 Edit MASSDS.bat... 7 Edit SI.bat... 7 GPO Setup... 8 Help Disclaimer Page 2

3 Introduction Druva insync has the ability to allow an organization to automate the Account Creation, Deployment, and authentication of insync Agents. The process relies on the creation of an ini file on the target machine which contains the information needed to create and assign the account to the correct insync Server, Storage and Profile, and also the target users credentials. The auto installation of client feature helps to install the insync client package on the client computer and loads the authentication key without user s intervention. After the successful installation of insync client, the user is created on the insync server without manual Administrator input An organization can create their own scripting methods to create and save this information, or use the Automatic Deployment package provided by Druva to assist in is process. The Druva Automatic Deployment package can integrate with AD, or a CSV file to create the required ini files insyncconfig.ini File Composition The INI file contains the following information for the MSI installer to read after installation This allows the account to be configured on the insync server, and the users account to be authenticated. ADDRESS = 'IP Address of insync Server:6061' STORAGE = 'Name of Target Storage' PROFILE = 'Name of Target Profile' ADUSERNAME = 'AD UserName of user' USERNAME = 'Name of User for insync Account' MAIL = ' address of user' WINUSERNAME = 'Windows UserName of user' WINUSERDOMAIN = 'Windows UserDomain of user' The ini file should be created in the following location on the target device C:\Windows\temp Page 3

4 Druva Automatic Deployment Package This article describes how to use the Microsoft Active Directory Group Policy to automatically distribute and deploy the insync Client installable (MSI) across domain computers or users and to authenticate them automatically as well. Note: The method used for MS Active Directory Group policy can be used with other third party tools such as SCCM, LANDesk etc. Currently, auto installation feature supports only Windows and Macintosh client versions. Note: The mass deployment of insync clients support new client installation only and does not support upgrade to the existing insync clients. Before you begin the auto installation of Windows client, make sure you have installed the latest insync server and configured the user profile and storage. Following is the block diagram of insync client auto-installation process for Microsoft Windows operating system. Download INI creator ZIP and Unzip to a file share accessible to all users Edit server.conf to reflect the deployment method & enter details Edit MASSDS.bat script to reflect new file share path Edit SI.bat for MSI in file share, Mass deployment token and INI file path Generate Mass Deployment Token from insync Server console Setup MASSDS.bat under GPO to execute as User Log on Script Setup SI.bat under GPO to execute as Windows Startup Script Page 4

5 The Process To automate the entire process we need to execute two steps using GPO Create an %username%.ini file Deploy MSI using Mass deployment token You can download the package from here Auto-Depv1.2.zip: This package has some libs and binaries which help creating the insync INI file. There are some editable files for customizing the package to your environment 1. Server.conf : Allows us to set Server address, default storage and profile, and select INI creation mode (AD or CSV). 2. MASSDS.bat: This is a batch script which is responsible for invoking the insync INI creator exe. Hence it is executed using User log on scripts via GPO. 3. SI.bat: This is again a batch script which is executed a machine startup script and it executes using parameters like TOKEN and INIFILE. Server.conf : INI creation Modes The insync INI creator package allows using two different modes to create INI file. These modes can be classified as below: Use LDAP: In this mode if the server.conf has variable CSV = No the exe will query the LDAP server to find the logged in user ID. The server.conf here will look as below [DETAILS] SERVER_IP = :6061, :80 STORAGE = insyncstore PROFILE = DEFAULT CSV = No BASEDN = DC=Scorpius,DC=Druva,DC=COM LDAP_IP = ldap:// :3268 LDAP_USERNAME = administrator@scorpius.druva.com LDAP_PASSWORD = p@ssw0rd USERDOMAIN = scorpius.druva.com Page 5

6 GROUPMAPPING = Yes [PROFILEMAPPINGS] Administrators = IT PROFILE1 = SALES Use CSV: In this mode if the server.conf has variable CSV = Yes the exe will try and parse through the users.csv file provided by the administrator. The users.csv format looks something like below: UserName, ID,Storage,Profile test1,test1@gmail.com,insyncstore,it, test2,test2@gmail.com, insyncstore,it, test3,test3@gmail.com, insyncstore,it, test4,test4@gmail.com, insyncstore,it, test5,test5@gmail.com, insyncstore,it, test6,test6@gmail.com, insyncstore,it, test7,test7@gmail.com, insyncstore,it, test8,test8@gmail.com, insyncstore,it, Group/Profile Mapping The server.conf also has another section known as [PROFILEMAPPINGS]. This allows IT administrators to map their exiting AD group with insync server user profile. For example: We can use an AD group as administrators and map it insync user profile as IT. The parameters look as below [PROFILEMAPPINGS] Administrators = IT Note: Please note that INI creator will use the logged user accounts member group to execute the mappings if the user does not belong to mapped groups then the default profile will be used. Binaries Location The zip files of automatic deployment needs to be hosted on common accessible shares so that these are available to all the users to be executed. The path for share needs to be updated in MASSDS.bat as listed in next section. Page 6

7 Edit MASSDS.bat Once we have the file share and server.conf configured we can now edit MASSDS.bat to reflect latest paths. The file could look as on IF EXIST C:\inSyncAD goto CHECKINI mkdir C:\inSyncAD cd C:\inSyncAD copy "\\ \iMD\*.*" "C:\inSyncAD" > filecopy.log goto CHECKINI :CHECKINI cd C:\inSyncAD if EXIST "c:\insyncad\%username%.ini" goto END Mass_Dep.exe :END Edit SI.bat Similarly we can now edit SI.bat to reflect new paths and MSI name along with new token value from insync server web console Management Users Import Mass Deployment on copy "\\ \iMD\*.msi" "C:\inSyncAD" cd C:\ msiexec /qn /i C:\inSyncAD\inSync5.0.msi TOKEN="4-9eff6f87a64bb5a7614ce3f173c24e81" INIFILE="C:\inSyncAD\%USERNAME%.INI" /Lime C:\inSyncAD\MSIlog.txt if exist "c:\program files (x86)" goto WIN7 goto XP :WIN7 cd "C:\Program Files (x86)\druva\insync" Page 7

8 insyncgui.exe goto END :XP cd "C:\Program Files\Druva\inSync" insyncgui.exe goto END :END GPO Setup Once we have the file shares configured along with server.conf file. We can now start executing the steps below to start the automatic deployment In GPO create a policy on user logon script to execute MASSDS.bat In GPO create a policy on Windows startup script to execute SI.bat See the following screen shot. Page 8

9 Note: For details on how to setup GPO policies please follow Microsoft KB article here Note: The logs are created at C:\inSyncAD and Users temp directory. Sample log from insync AD folder. Filename: AD.log :36:15,489 INFO Using LDAP Method :36:15,505 INFO The logged in user :36:15,505 INFO Connected to the LDAP Server :36:15,505 INFO ldap searching :36:15,505 INFO [('CN=Sirohi Bhaskar,CN=Users,DC=Scorpius,DC=druva,DC=com', {'primarygroupid': ['513'], 'cn': ['Sirohi Bhaskar'], 'objectclass': ['top', 'person', 'organizationalperson', 'user'], 'userprincipalname': 'lastlogontimestamp': [' '], 'instancetype': ['4'], 'distinguishedname': ['CN=Sirohi Bhaskar,CN=Users,DC=Scorpius,DC=druva,DC=com'], 'dscorepropagationdata': [' Z', ' Z'], 'objectsid': ['\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\xd3f\x01\x1as\r\xe1 \xc1\xefr_\x03n\x04\x00\x00'], 'whencreated': [' Z'], 'usncreated': ['21918'], 'mail': Page 9

10 'samaccountname': ['sbhaskar'], 'objectcategory': ['CN=Person,CN=Schema,CN=Configuration,DC=Scorpius,DC=druva,DC=com'], 'objectguid': ['\xed\x99\x06\x03\x8f\x1e0l\x9f\xf5]\x13%\xd3\xfa\xd0'], 'whenchanged': [' Z'], 'displayname': ['Sirohi Bhaskar'], 'name': ['Sirohi Bhaskar'], 'memberof': ['CN=Galaxy,OU=LEO,DC=Scorpius,DC=druva,DC=com', 'CN=PF,OU=Pre- Sales,DC=Scorpius,DC=druva,DC=com', 'CN=Administrators,CN=Builtin,DC=Scorpius,DC=druva,DC=com'], 'useraccountcontrol': ['66048'], 'samaccounttype': [' '], 'usnchanged': ['24971'], 'sn': ['Bhaskar'], 'givenname': ['Sirohi']})] :36:15,519 INFO Groupnames are ['Galaxy', 'PF', 'Administrators'] :36:15,519 INFO Could not find group mapping for groupname=galaxy :36:15,519 INFO Could not find group mapping for groupname=pf :36:15,519 INFO Found group mapping for groupname=administrators :36:15,519 INFO Connection established with insync server :36:15,519 INFO Creating sbhaskar.ini file :36:15,519 INFO sbhaskar.ini file created at:c:\insyncad\sbhaskar.ini MSI Installation log: === Logging started: 7/13/ :39:34 === Action start 15:39:34: INSTALL. Action start 15:39:34: SystemFolder Microsoft_VC90_CRT_x86.SP.D8D85FD0_537C_3A3A_9BE C_7A1B426637EC. Action ended 15:39:48: INSTALL. Return value 1. MSI (s) (10:50) [15:39:48:649]: Product: Druva insync Installation completed successfully. === Logging stopped: 7/13/ :39:48 === Help For more information, visit or send an to Page 10

11 Disclaimer Druva Inc. shall not be liable for errors contained in this document and any damages in connection with this document. Contact Support US: International: India: Page 11