EML 03 Best Practices for Policy Management in Client Management Suite Hands-On Lab

Transcription

1 EML 03 Best Practices for Policy Management in Client Management Suite Hands-On Lab Description If you are new to the Symantec Management Technologies or are just looking to reinforce your existing knowledge this lab is a great place to start. This lab provides a hands on look at some of the best practices and methodologies for organizing your environment to provide the most efficient and functional mechanisms for managing it. This lab assumes a prerequisite knowledge of the Symantec Management Platform and Client Management Suite 7.1 At the end of this lab, you should be able to Create various Filters Create Organizational Views Understand the functional use cases for using Filters and Organizational Views Understand how Filters, Targets and Organizational Views relate to Policies Understand how Filters. Targets and Organizational Views relate to Jobs/Tasks Notes A brief presentation will introduce this lab session and discuss key concepts. The lab will be directed and provide you with step-by-step walkthroughs of key features. Feel free to follow the lab using the instructions on the following pages. You can optionally perform this lab at your own pace. Be sure to ask your instructor any questions you may have. Thank you for coming to our lab session.

2 Exercise 1 Creating Filters In order to successfully manage our environment we need to organize it. One of the first steps in that process is creating filters by which our resources can be grouped and/or separated. In this exercise we will create two filters. Creating a Filter Based on Existing Filters 1. If they are not already powered on, power on the virtual machines in the following order: a. DC b. NS71 2. Switch to the NS71 virtual machine 3. On the NS71 virtual machine open the Symantec Management Platform console by clicking Start-> All Programs-> Symantec-> Symantec Management Console On the navigation bar choose Manage-> Filters 5. Right click on the folder labeled Filters on the left pane and choose New-> Folder 6. Name the folder Vision Right click the Vision 2012 folder and choose New-> Filter Note: The right side of the screen will change to allow the creation of the new filter. 8. On the upper right side of the screen click on the blue title New Filter 9. Change the name of the filter to Vision 2012 CMS Clients 10. Press the Save Changes button. 11. When the screen refreshes press the Edit button on the upper right side of the screen. 12. Find the Filter Definition section and click the upside down triangle on the right side of the menu bar to expand it. 13. Locate the Inclusions section under Explicit Inclusions and Exclusions and choose the link for Filters included in this filter: The window displays a list of all of the available filters 14. In the search bar type Windows 2000/XP/2003/Vista/2008/7/8 Computers 15. Highlight the Windows 2000/XP/2003/Vista/2008/7/8 Computers line item 2 of 8

3 16. Press the > button to move the filter to the Selected Filters list 17. Press Ok 18. Press the Save Changes Button 19. When the screen refreshes press the Update Membership button on the menu bar How many resources does the filter membership list? Note: The total is located at the bottom of the resource list Since this lab focuses on managing client side machines and our base filter includes essentially all Microsoft based operating systems, we now need to exclude any server class operating system from our filter. 20. Press the Edit button located in the top right of the filter window again 21. This time locate the Exclusions section under Explicit Inclusions and Exclusions and choose the link for Filters excluded in this filter: The window displays a list of all of the available filters 22. In the search bar type Windows Servers 23. Highlight the Windows Servers line item 24. Press the > button to move the filter to the selected list 25. Press Ok 26. Press Save changes 27. When the screen refreshes press the Update Membership button on the menu bar How many resources does the filter membership list show now? Note: It is important to remember that the filters will automatically be updated on a scheduled ongoing basis. Pressing the Update Membership button forces this process to happen in real time for the selected filter. It is considered best practice to manually update the filters as you are creating them to insure the desired results. Creating a Filter based on a SQL Query In the previous section we created a filter that was based on previously existing filters. Although we have provided a large amount of premade filters in Client Management Suite, you may come across a situation where a filter does not exist. This step will walk you through creating a filter based on raw SQL queries. These filter types can consist of very simple or highly complex queries depending on your specific needs. 3 of 8

4 When creating custom filters it is a best practice to try and limit your query to a common data point. In other words, instead of creating a single query/filter that starts with All Operating Systems and then removes Linux Operating Systems; create one query/filter for All Operating Systems and a second query for Linux specific operating systems. You would then create an inclusion/exclusion filter that referenced those two query filters respectively. 1. On the NS71 virtual machine open the Symantec Management Platform console by clicking Start-> All Programs-> Symantec-> Symantec Management Console On the navigation bar choose Manage-> Filters 3. Right click the vision 2012 folder and choose New-> Filter Note: The right side of the screen will change to allow the creation of the new filter. 4. On the upper right side of the screen click on the blue title New Filter to enable editing. 5. Change the name of the filter to Vision 2012 Microsoft Project 2010 Clients 6. Press the Save Changes button. 7. When the screen refreshes press the Edit button on the upper right side of the screen. 8. On the Filter Definition dropdown box choose Query Mode: Raw SQL Note: You will see a message asking you to confirm your selection. 9. Press Ok to the notice NOTE: The screen will refresh, and you may have to expand the Filter Definition area 10. In the text editor window that is now available, type the following query lines: SELECT _ResourceGuid,Name, DisplayName FROM Inv_AddRemoveProgram,vComputer WHERE DisplayName like '%Microsoft Office Project Professional 2010%' AND Inv_AddRemoveProgram._ResourceGuid = vcomputer.guid 11. Press Save Changes 12. Press the Update Membership Button Note: You should now have two resources listed in the membership window. These resources were a result of the query entered and they represent any managed computers with Microsoft Office Project Professional 2012 Installed on it. 4 of 8

5 Exercise 2 Creating Organizational Views and Groups Creating Organizational Views In addition to creating filters there is a method for organizing the environment called Organization Views. Organizational Views allow us to use multiple metadata points associated with a resource as a basis for inclusion, where as filters rely on other filters or SQL queries. Organizational Views allow us to create containers called Organizational Groups to house resources. For example you may have one Organizational View called Resources by Location that uses location metadata to define its hierarchy and another Organizational View called Resources by Cost Center that uses cost center metadata to define its hierarchy. It is important to note that a resource can be (and will be) a member of multiple Organizational Views but can only be referenced once in each view. In other words you can be a located in Las Vegas, NV and belong to Cost Center 1234 but you cannot be located in Las Vegas, NV and also be located in Mountain View, CA. 1. On the Symantec Management Console navigation bar choose Manage-> Organizational Views and Groups Note that a number of Organizational Views are displayed on this virtual machine are a representation of the items included with the ITMS 7.1 product. ITMS 7.1 includes Client, Server and Asset Management Suites. 2. Right click on the Organizational Views folder at the top of the screen and choose New-> Organizational View 3. When the screen refreshes select the blue text labeled New Organizational View on the right side of the screen to edit it. 4. Rename the Organization View Vision Right click on the newly created Vision 2012 Organizational View on the Vision of the screen and choose New-> Organizational Group 6. Rename the Group to Vision 2012 All Other Computers 7. Press the blue + (Add) button and choose Computers 8. Press the >> (double arrows) button to move all of the available resources to the selected window. 9. Press Ok 10. Refresh the browser by pressing F5 or using the Internet Explorer refresh button Look at the Resources: total at the top of the right side of the screen. How many resources are members of this Organizational Group? 11. Right click on the Vision 2012 Organizational View and choose New->Organizational Group 12. Name the Group Vision 2012 Lab 5 of 8

6 13. Click the blue + button and choose Computers 14. In the search bar type: Win7 15. Highlight the Win7 Resource and press the > button to move it to the selected resource list 16. Press Ok 17. On the left side of the screen select the previously created Vision 2012 All Other Computers Organizational Group Look at the Resources: total at the top of the right side of the screen. How many resources are members of this Organizational Group? Exercise 3 Applying Filters to Actions Creating Filters and/or Organizational Groups allows us to specifically target resources with policies or tasks that need to apply to them. Now that they have been created, we can utilize them for the many actions that are performed in Client Management Suite. Targeting Actions Using Filters In this case the IT Department has been tasked with setting a more frequent Hardware and Software Inventory gathering policy for specific computers. This exercise will show you how you can use the created filters within a policy. A similar process is used with Jobs/Tasks as they both use the Add Target window to apply them. 1. On the Symantec Management Console navigation bar choose Manage-> Policies 2. Expand the Discovery and Inventory folder 3. Right click on the Inventory folder and choose New-> Inventory Policy 4. When the screen refreshes select the blue text labeled New Inventory Policy on the right side of the screen to edit it. 5. Rename the Inventory Policy using Vision 2012 Lab Inventory Policy 6. Change the Ensure my inventory is current.. setting to Daily 7. Select any listed items found in the Applies to/compliance area and press the red X to delete them. This ensures that you are starting this policy with no computers assigned. 8. Select the Applied To Drop Down under Applies to/compliance area 9. Select Computers -- The Add Target window should come up at this point 6 of 8

7 10. Press the Add Rule Button 11. Under the Start with all computers THEN section a. Choose exclude computers not in for the logic selection b. Choose Filter as the type c. Type in Vision 2012 Microsoft Project 2012 Clients as the Filter d. Press the Add Rule Button e. Choose Include Computers in for the logic selection f. Choose Group as the type g. Choose the drop down box and select Vision 2012 Vision 2012 Lab h. Press the Add Rule Button i. Choose Include Computers in for the logic selection j. Choose Computer List as the type k. Choose the drop down box and select SYM l. When you have completed these tasks, it should look like this: m. Press the Update Results Button. Notice the computers in the list. These are now your targeted computers. n. Press the Save As Button and name it Vision 2012 (Target) o. Press OK to save the Target Note: By saving this newly created Target you will be able to use it in any Policy or Task within the Symantec Management Console. 12. Press OK to accept the changes 13. Press Save Changes You have now created an Inventory Policy that will trigger daily for all computers that meet the configured criteria. This method can be applied to many of the policies found throughout the Client Management Suite 7.1 solutions. 7 of 8

8 Targeting Actions Using Custom Targets In this case the IT Department has been tasked with rebooting specific computers on a regular basis. This exercise will show you how you can use the previously created Target within a Job/Task. A similar process is used with Policies as they both use the Add Target window to apply them. 1. On the Symantec Management Console navigation bar choose Manage-> Jobs and Tasks 2. Expand the Jobs and Tasks folder 3. Right click on the Jobs and Tasks folder at the top left side of the screen and choose New-> Folder 4. When asked, name the folder Vision 2012 Jobs 5. Right click on the Vision 2012 Jobs folder on the left pane and choose New-> Client Job 6. When the screen refreshes select the blue text labeled New Client Job on the right side of the screen and name it Reboot Vision Lab Computers Weekly 7. Select the yellow * symbol labeled New and select Task from the drop down menu. The Create New Task screen should be displayed 8. Scroll down to the end of the list of tasks and choose Power Control 9. Make sure Restart is selected 10. Press OK 11. Press the Save Changes Button near the middle of the Right pane. 12. Select the New Schedule Button under the Task Status area near the bottom of the Right pane. The New Schedule window should come up at this point 13. Under the Schedule section Select Schedule and Set it for 12/11/2012, at 19:00, repeating every 1 Weeks. 14. Press the Add Button and select Target from the drop down list 15. Press the Open Button 16. In the search bar, type Vision 2012 (Target) 17. Press OK (notice that it populates all of your Filtering rules for you.) 18. Press the Schedule Button You have now created an Client Job that will reboot specific computers weekly. This method can be applied to many of the policies, jobs and tasks found throughout the Client Management Suite 7.1 solutions. 8 of 8