Configuration and Maintenance

Transcription

1 Cortado Corporate Server Version 6.0 Configuration and Maintenance Cortado AG Alt-Moabit 91 a/b Berlin Germany/ Alemania Cortado, Inc Grandview Avenue Suite 200 Denver, Colorado USA/EEUU Cortado Pty. Ltd. Level 20, The Zenith Centre, Tower A 821 Pacific Highway Chatswood, NSW 2067 Australia info@corp.cortado.com Web: Issued: October 29, 2012 (v164)

2 Notes Copyright This document is the intellectual property of Cortado AG. This document may be copied in whole or in part, provided this Copyright notice is included in every copy. Registered trade marks All hardware and software names mentioned in this document are the registered trademarks of their respective companies or should be regarded as such. Safety warning All Cortado products are pure software solutions. Please note the safety warnings in the technical documentation from your hardware vendor and from the manufacturer of each device and component. Before beginning installation, we recommend closing all windows and applications and deactivating any virus scanner. 2 Configuration Manual Cortado Corporate Server

3 Contents Introduction... 7 Overview... 7 Quick guide to Management Console... 8 Recommended procedure... 9 Preparatory work for MDM... 9 BlackBerry... 9 Android... 9 Apple ios Requesting and installing Apple Push certificates SCEP server installation User access Via Apple ios, Android and BlackBerry HTML5 Client User Management User Import Defining import source Selection of users and Import User Configuration Overview Configure network drives User settings Mobile printing Assigning predefined printers Assigning Network printer Assigning mobile printer (Wi-Fi, Bluetooth) Removing printers Target folders for print jobs Cortado Corporate Server Configuration Manual 3

4 Contents Managing devices Device information (Details) Device functions Device protection (Lock Screen + Wipe) Remove a device (Remove) Locate a device (Locate) Merging multiple-displayed devices (Merge) Applications (Apps) Policies Certificates Wi-Fi Profiles Reports Overview Examples Managing apps Storing apps as a link (Define App) Importing apps Allocating apps to the users Managing intranet apps Define a link Roll out links Managing certificates Overview Encryption between browser (end device) and server Encryption between the Cortado app (end device) and server Groups of certificates Types of Cortado certificates Cortado Corporate Server websites Cortado server addressing Configuration Manual Cortado Corporate Server

5 Contents HTTPS encryption between the Cortado app and server In detail Setting up root and server certificates for Cortado Corporate Server Establishing client certificates (optional) Managing Policies Define a policy Assigning policies to users or devices Wi-Fi Profiles Creating a Wi-Fi profile Assigning Wi-Fi profiles Sending Welcome Purpose Procedure Global Settings Server settings User Self Service Portal First Steps Wizard Apps Intranet Apps Setup Personal Printing What is Personal Printing? Opening the configuration console Settings ADAM Service Account Print Job Storage Cortado Corporate Server Configuration Manual 5

6 Contents Authentication Setting up printers Personal Printer for Windows machines Setting up Personal Printers for Mac and Linux machines (optional) Setting up target printers Font management Activating authentication methods Configuration for each user Configure each user separate Appendix License activation Mail directory on Apple and Android devices Creating a.csv file for importing users Link to Android s Cortado app in First Steps Wizard Creating files for importing apps To create the.zip file Intranet App: Define Cortado server as a proxy Use Microsoft Office instead of OpenOffice Cortado server ports Cortado app on ios devices will be inactive Update to Uninstalling the Cortado Corporate Server Additional sources Customer service and technical support Abbreviations Configuration Manual Cortado Corporate Server

7 Introduction Introduction The consumerization of IT and the growing number of various devices used in the enterprise means that cross-platform, high-performance mobile device management (MDM) is essential. The use of mobile devices in companies can only increase productivity and add optimal capacity to perform outside of traditional office settings when access to key corporate resources and comprehensive file management functions are guaranteed. The most important prerequisite for this is Cortado Corporate Server. The world's first solution to combine powerful MDM with a unique cloud-desktop approach. Whether ipad, iphone, Android, BlackBerry devices or PCs and Macs, all devices can be seamlessly, securely and efficiently integrated into the corporate IT environment as well as be professionally managed. Mobile application management (MAM) facilitates the management and administration of enterprise applications such as intranet and internet applications, as well as other apps. In addition apps can be recommended and cross-platform links to the respective app stores deployed to users. At the same time, employees benefit from mobile corporate access and thanks to full desktop capabilities, can work on the go with their mobile device just as productively as in a traditional office setting. The solution is complemented by a comprehensive security concept, which ensures maximum security and control on the mobile device, the server and during data transfer. Thanks to Cortado Corporate Server, Apple ios, Android and BlackBerry BES users can access through their smartphones or tablets information anytime and anywhere, documents can be viewed on site, copied, printed, faxed, ed or shared. A further option is the secure connection to the HTML5 client which can be established from any desktop while offering all the benefits of Cortado Corporate Server. The result is a complete solution for all mobility, bring your own device (BYOD) and consumerization challenges. Precondition The Installation and initial setup manual shows you how to install and initially configure Cortado Corporate Server. In this manual, you will learn how to configure Cortado Corporate Server and adjust it to the specific needs of your company. For further manuals see Page 115. You have already pre-configured Cortado Corporate Server with the Configuration Assistant (see Installation and initial setup manual, Page 115). However, before the user can use the full range of functions in Cortado Corporate Server, further steps are necessary. Open Management Console From a workstation, open the following website: An HTML5-enabled browser is needed to this. Log in to the web-based configuration console of the Cortado server with the same user account (CortadoService account) used for the installation (Illus. 1). Cortado Corporate Server Configuration Manual 7

8 Introduction Illus. 1 Illus. 1 Login of the web based Cortado server s Configuration Console In the Cortado Console you can, amongst other things: import users and assign them certificates and policies assign predefined printers and drives enable Cortado functions make the Cortado app available on mobile devices assign apps to mobile devices block access to mobile devices that are lost delete company data from mobile devices reset factory settings on devices locate devices. Illus. 2 Illus. 2 Control panel of Cortado Corporate Server s Console: Overview As an example of user management, we explain the Cortado Management Console, in which the user can manage, as well as other things, the devices, printers and certificates. 8 Configuration Manual Cortado Corporate Server

9 Introduction Management Console: Overview You reach the CONTROL PANEL (Illus. 2) by clicking on CONTROL PANEL (arrow in Illus. 3) and here you can select, for example, user management (USERS) (arrow in Illus. 2). This opens the summary page of the Cortado Management Console (Illus. 3). It is divided into two display columns and two editing columns. In the first column, the items from the selected module are displayed, for example users, devices or certificates. If you highlight at least one of these items, there appear in the corresponding editing column (= second column), actions that you can carry out, e.g. import, add or remove. The data sets of those items selected in the first column are displayed in the third column, and these can, in turn, be edited in the fourth column. Illus. 3 Illus. 3 Cortado Management Console: User management (example) You can also select other aspects from the tabs in column three, e.g. NETWORK DRIVES, PRINTERS, SETTINGS. Recommended procedure With Cortado Corporate Server configuration we recommend that you proceed as follows: If ios devices are used in your company, generate a certificate request, to enable the use of Mobile Device Management (MDM) (see the following section). If BlackBerry devices are used, read which steps are required in the BlackBerry Configuration manual. In GLOBAL SETTINGS enter the address of the SCEP server. Configuration of the welcome is under GLOBAL SETTINGS Import users (Page 26) Configure network drives (Page 32) Allocate user rights (Page 35) Configure printers (Page 39) Managing apps (Page 60) Assign Policies (Page 80) Send welcome (Page 81) Cortado Corporate Server Configuration Manual 9

10 Preparatory work for MDM Preparatory work for MDM BlackBerry See the BlackBerry configuration manual (Page 115). Android In order that you are able to manage the devices of your Android users (MDM), it is necessary for them to enter the Cortado server, rather than the exchange server, as their mail server in the set up of their company accounts (Exchange Active- Sync account). Inform your users of this. They must enter the Cortado server address instead of the Exchange server address (Illus. 4). Tell the users this information. Once the Cortado server s address is set up, the users receive the automatically created configuration (see Page 83). Illus. 4 Illus. 4 Setting up the Exchange ActiveSync account (example) Apple ios For mobile device management with ios devices you require, in addition to the already installed and configured Cortado components: an Apple issued Push certificate on the Cortado server (see below) an SCEP 1 server to automatically issue SSL certificates (see Illus. 5 and Page 17) 1 SCEP/NDES: Simple Certificate Enrollment Protocol and Network Device Enrollment Service 10 Configuration Manual Cortado Corporate Server

11 Preparatory work for MDM Illus. 5 Illus. 5 Mobile device management with Cortado and SCEP server Requesting and installing Apple Push certificates To use Apple ios mobile device management for Cortado, you must install an SSL certificate provided by Apple on your Cortado server. This certificate enables you to communicate securely with the Apple Push Notification Service. Before you can request an SSL certificate from Apple, you first have to run a Certificate Signing Request (CSR) on the Cortado server (see below). If your Cortado server wants to establish a connection to an ios device, it sends a notification to the device via the Apple Push Notification Service. This notification prompts a log on to the server. So no information is transmitted. The Apple Push Notification Service only wakes the device from hibernation, so that it can be logged on to the Cortado server. All configuration information, settings and requests go via an (encrypted) SSL connection directly from the Cortado server to the ios devices (Illus. 1). In order that your users' ios devices can communicate with the Cortado server, the devices must be registered there. Note! Please note that your network must also be prepared for Apple ios Mobile Device Management. Particularly Apple uses the following TCP ports: 80, 2195, 2196 and See table with Cortado ports on Page 113. More information about Apple can be found here: Cortado Corporate Server Configuration Manual 11

12 Preparatory work for MDM 1. For CSR, select: CERTIFICATES APPLE PUSH CERTIFICATE (Illus. 6 and 7) in the Cortado Management Console. Illus. 6 Illus. 7 Illus. 6 Control Panel: Select CERTIFICATES Illus. 7 Requesting a certificate from Cortado server 2. Click on GENERATE CERTIFICATE REQUEST (arrow in Illus. 7). 12 Configuration Manual Cortado Corporate Server

13 Preparatory work for MDM 3. Fill out the form (any text), and confirm with OK (Illus. 8). Illus. 8 Illus. 8 Fill out the request form 4. Click on DOWNLOAD CERTIFICATE REQUEST to save the certificate request (Illus. 9 and 10). Illus. 9 Illus. 9 Saving the certificate request Cortado Corporate Server Configuration Manual 13

14 Preparatory work for MDM Illus. 10 Illus. 10 Saved certificate request 5. Send this certificate request for signing by to: Your certificate request will then be signed by Cortado and sent back to you (Illus. 11). Illus. 11 Illus. 11 Signed certificate request received 14 Configuration Manual Cortado Corporate Server

15 Preparatory work for MDM 6. Then go to the Apple website ( and log in using your Apple ID. Click on CREATE A CERTIFICATE (Illus. 12), select your signed certificate request, and upload it (Illus. 13). Shortly after, you can download your SSL certificate in.pem format (Illus. 14 and 15). Illus. 12 Illus. 13 Illus. 12 Create a certificate by using the request Illus. 14 Illus. 13 Uploading a Cortado-signed certificate request Illus. 14 Downloading the certificate Cortado Corporate Server Configuration Manual 15

16 Preparatory work for MDM Illus. 15 Illus. 15 Push certificate downloaded from the Apple website 7. Using UPLOAD APPLE CERTIFICATE you can now upload your certificate onto the Cortado server (Illus. 16 and 17). Illus. 16 Illus. 17 Illus. 16 Loading the Apple Push certificate onto the Cortado server Illus. 17 Select certificate 8. Save a backup of the certificate in.pfx format with BACKUP APPLE PUSH CERTIF- ICATE (Illus. 18 and 19). With this version of the certificate, you can avoid future need for the procedure described above. Using IMPORT APPLE PUSH CERTIFICATE you can install it again anytime onto the Cortado server. 16 Configuration Manual Cortado Corporate Server

17 Preparatory work for MDM Illus. 18 Illus. 19 Illus. 18 Installed push certificate save backup copy Illus. 19 Apple Push certificate backup copy saved SCEP server installation The following steps can serve for a Proof of Concept. For productive environments we recommend the use of descriptions from Microsoft instead. 1. If possible, select a new server 2 to install as SCEP server (recommended: Windows Server 2008 R2 Enterprise). This server must be accessible for ios devices. 2. Set up a local user account 2 (here: NDESadmin), and include it in the following groups (see also Illus. 20): Certificate Service DCOM Access Cryptographic Operators IIS_IUSRS 2 If you are using two certificate servers (which is recommended in productive environments), use a domain account (domain user) instead of a local user account. Log on as a domain administrator once onto the SCEP server. Then open the Certificate Templates snap-in in the MMC as shown in Illus. 30 on Page 23. Cortado Corporate Server Configuration Manual 17

18 Preparatory work for MDM Illus. 20 Illus. 20 Create local user account and include in three groups 3. Open the Server Manager, and add the role ACTIVE DIRECTORY CERTIFICATE SER- VICES (Illus. 21). Illus. 21 Illus. 21 Add ACTIVE DIRECTORY CERTIFICATES SERVICES role 18 Configuration Manual Cortado Corporate Server

19 Preparatory work for MDM 4. Select CERTIFICATION AUTHORITY as role service (Illus. 22). Illus. 22 Illus. 22 Select role service CERTIFICATION AUTHORITY 5. Select the setup type STANDALONE (Illus. 23). Illus. 23 Illus. 23 Select setup type STANDALONE Cortado Corporate Server Configuration Manual 19

20 Preparatory work for MDM 6. Accept the suggested default values in all the remaining windows and start the installation by clicking on INSTALL (Illus. 24). Illus. 24 Illus. 24 Begin installation of the ACTIVE DIRECTORY CERTIFICATE SERVICES role 7. Then select NETWORK DEVICE ENROLLMENT SERVICE as an additional service of the same role (Illus. 25). Illus. 25 Illus. 25 Add NETWORK DEVICE ENROLLMENT SERVICE 20 Configuration Manual Cortado Corporate Server

21 Preparatory work for MDM 8. Assign the user account (here: NDESadmin) that you created above (Illus 20 and 26). Illus. 26 Illus. 26 Enter NDESadmin as user 9. As before, accept the suggested default values in all the remaining windows, and start the installation by clicking on INSTALL (Illus. 27). Illus. 27 Illus. 27 Start installation of the role service NDES 10. So as not to enforce a password entry for every enrolled certificate, set the following registry entry at 0 (zero): hkey_local_machine\software\microsoft\cryptography\mscep\enforcepassword\enforcepassword (Illus. 28) Confirm with OK. Cortado Corporate Server Configuration Manual 21

22 Preparatory work for MDM Illus. 28 Illus. 28 Set registry entry EnforcePassword at In the Microsoft Management Console (MMC), open the snap-in CERTIFICATION AUTHORITY. In the properties of the CA (certificate authority), select: POLICY MOD- ULE PROPERTIES FOLLOW THE SETTINGS IN THE CERTIFICATE TEMPLATE, IF APPLI- CABLE. OTHERWISE, AUTOMATICALLY ISSUE THE CERTIFICATE (Illus. 29). Confirm with OK. 12. Restart the certificate authority. Illus. 29 Illus. 29 Select... AUTOMATICALLY ISSUE THE CERTIFICATE 22 Configuration Manual Cortado Corporate Server

23 Preparatory work for MDM 13. In the MMC, switch to the snap-in CERTIFICATE TEMPLATES (Illus. 30), and add the account (Illus. 20) created above to the template IPSEC (OFFLINE REQUEST), and give it the permission ENROLL. Illus. 30 Illus. 30 Add user account NDESadmin to certificate template IPSEC (Offline request) 14. In the Cortado Management Console, select: CONTROL PANEL GLOBAL SETTINGS CONFIGURE CORTADO PUSH SERVER (Illus. 31) and enter the address of the newly installed SCEP server using the following syntax: Example: Confirm with OK. Illus. 31 Illus. 31 Register SCEP server in Management Console Cortado Corporate Server Configuration Manual 23

24 User access User access Via the Cortado app and the HTML5 client you can enable your users to access network drives and use various file options (printing, faxing, edit, export etc.). Learn how to assign all those options to the users after the following short survey of the user access. Via Apple ios, Android and BlackBerry The Cortado app is available for Apple-iOS-, Android-OS- and BlackBerry-OS devices (Illus. 32). After installation and configuration of the App in the User Self Service Portal (see Page 87) all enabled options are available for the users (see Page 35). Illus. 32 Illus. 32 Cortado app: start page on different mobile devices: (from left to right: Apple iphone, Android, BlackBerry) User guides for the Cortado apps on mobile devices can be found on our website under SUPPORT GUIDES & MANUALS CORTADO CORPORATE SERVER USER GUIDES. HTML5 Client With the HTML5 client, users are able to access shared corporate network drives, to edit files and folders, from any HTML5 supporting browser 3. The HTML5 client is accessible via following link: (exam- 3 For example: Safari v5.1.2 or later, Internet Explorer v9 or later, Firefox v8 or later, Google Chrome v16 or later. 24 Configuration Manual Cortado Corporate Server

25 User access ple: This link is part of the welcome (Page 83). Note! If your Cortado server uses a self-signed certificate (created from Cortado during installation) or an existing, but self-created certificate, The users will see a warning message in the browser when following this link for the first time. They can ignore this message by ciicking on CONTINUE TO THIS WEBSITE. Alternatively use a certificate from a Certification Authority. Users may utilize all options you assigned for them via the HTML5 client (Page 35). A user guide for the HTML5 client can be found on our website under SUPPORT GUIDES & MANUALS CORTADO CORPORATE SERVER USER GUIDES. Illus. 33 Illus. 33 Login to HTML5 client Cortado Corporate Server Configuration Manual 25

26 User Management User Management User Import To enable users for Cortado, open CONTROL PANEL USERS (Illus. 34 will open). Illus. 34 Illus. 34 Starting the import wizard To import the users, click on the plus sign (arrow in Illus. 34), the IMPORT WIZ- ARD will start (Illus. 35). Defining import source Here you will chose the source from which the users should be imported 4 : Illus. 35 Illus. 35 Selecting import source ACTIVE DIRECTORY We recommend this type of data import for environments in which Apple or Android devices are in use or in environments in which BlackBerry devices communicate via BIS (when no BES server is available). For more, see Import from Active Directory, Page 27). 4 To import users from different sources, just start Import Wizard several times 26 Configuration Manual Cortado Corporate Server

27 User Management COMMA SEPARATED VALUE (CSV) FILE The users to be imported can be read from a.csv file you have created. This type of data import can be used as an alternative to Active Directory import. Under Import from.csv file (Page 28) you will learn which additional settings to make for the data import. Information on creating a.csv file can be found in the appendix (Creating a.csv file for importing users, Page 105). BLACKBERRY CONFIGURATION DATABASE You can select this option in either a pure BES environment or one for your BlackBerry users. Here the BlackBerry users are selected from the BES database. Read more on this in the BlackBerry configuration manual, Page 115. Note! Importing user data uses one Cortado Corporate Server user license per user. Installing the Cortado Corporate Server automatically installs five demo licenses. The licenses are for user and devices, so every access to the Cortado server by either a device or the HTML5 client, uses up one license. Import from Active Directory If you have selected ACTIVE DIRECTORY as the import source (Illus. 35), another window opens, in which you can select a domain where the desired users will be found. Click to mark the desired domain (left arrow in Illus. 36). Then click on the small arrow on the right side (right arrow in Illus. 36). Illus. 36 Illus. 36 Selecting domain Cortado Corporate Server Configuration Manual 27

28 User Management Now the users selected to be imported are displayed (Illus. 37). Illus. 37 Illus. 37 Users that can be imported from the AD Proceed as described in Selection of users and Import on Page 29. Import from.csv file If you have selected COMMA SEPARATED VALUE (CSV) FILE as the import source, the window in Illus. 38 opens. Illus. 38 Illus. 38 Selecting.csv file For how to create a.csv file, refer to the appendix on Page Configuration Manual Cortado Corporate Server

29 User Management Via SELECT FILE (left arrow in Illus. 38) you specify the path and file name of the previously created.csv file (Illus. 39). Illus. 39 Illus. 39 Select.csv file Then click OPEN (arrow in Illus. 39). Afterwards click LOAD FILE (right arrow in Illus. 38). Now the users selected to be imported are displayed (Illus. 40). Illus. 40 Illus. 40 Users that can be imported from the.csv file Selection of users and Import In Illus. 37 and Illus. 40 the selected users from the AD, or else the.csv file are displayed. Decide whether all or only certain users are to be imported. To do so, place a checkmark by the corresponding users, or select all users (left arrow in Illus. 41). Cortado Corporate Server Configuration Manual 29

30 User Management Illus. 41 Illus. 41 Selecting users Then click IMPORT (right arrow in Illus. 41). Illus. 42 Illus. 42 Users successfully imported (green dot) If a user has been successfully imported, a green dot appears in the status column. (upper arrow in Illus. 42). In addition, the information bar at the bottom of the window (lower arrow in Illus. 42) displays the number of imported users. If the user could not be imported because, for example, no licenses are available, a red dot is displayed. If you roll over it with the mouse, the corresponding error message will be displayed. (Illus. 43). 30 Configuration Manual Cortado Corporate Server

31 User Management Illus. 43 Illus. 43 Users not imported (red dot) When you close the Import Wizard, the successfully imported users will be listed in user management (USERS) (Illus. 44). They are now enabled for use by Cortado Corporate. Illus. 44 Illus. 44 Imported users in user management (USERS) How to assign users with various drives is explained under Configure network drives (Page 32). In chapter User settings you will find information on special changes in the user management (Page 35). How to make additional printers available to the users is explained under Mobile printing (Page 39). How you can manage your users' devices, read under Managing devices (Page 50). Read how to manage your users' certificates under Managing certificates (Page 67). How you use Cortado Corporate together with Personal Printing Essentials, read under Personal Printing (Page 89). Cortado Corporate Server Configuration Manual 31

32 User Management User Configuration Overview Now under CONTROL PANEL USERS, you can further configure and manage settings of the successfully imported users. Illus. 45 Illus. 45 User management with various actions (example: user1) The following options are available if you have marked at least one user (Illus. 45): REMOVE: Here you can remove selected user from Cortado user management. In doing so, the user will not be deleted from AD. The license previously used by this user is then immediately free and can be made available for another user. GET SETTINGS: With this action, you can assign to a user, another user s settings. SEND With this action, users will be sent a welcome . It contains important informations for the users. There is more on this in the chapter Sending Welcome (Page 81). SET MAX DEVICE COUNT: By default, one device per user is designated. You can increase that number here. If a user logs in with another device, he will be denied access to the Cortado app. Configure network drives The users can directly access shared folders on the company network using their Cortado app. The user s access rights are completely carried over from the AD. Like mapping on the Windows computer, the administrator simply defines the letter for the existing shares. The shared network drives will be shown to the users on their mobile devices (or in HTML5 client) under HOME DRIVE (Illus. 50). Caution! With drive-access users can access your company data with their mobile devices. Please calculate a potential security risk. To give users access to network drives, mark one or more users in User Management (USERS) (arrow in Illus. 45). 32 Configuration Manual Cortado Corporate Server

33 User Management Then select under NETWORK DRIVES ADD in the context menu (arrow in Illus. 46). Illus. 46 Illus. 46 Managing network drives Assign drives Define a drive letter in DRIVE and enter the path to the desired share in PATH (Illus. 47). Illus. 47 Illus. 47 Add network drive (example) Repeat the procedure for all desired network drives. If the users have a Home Folder (Home Directory) in the AD, it can also be made available. For this purpose, enter the following variable under PATH: %HOMEDIR% (Illus. 48). Illus. 48 Illus. 48 Add Home Folder Cortado Corporate Server Configuration Manual 33

34 User Management These network drives are now displayed with network path and the corresponding drive letter under USERS NETWORK DRIVES (Illus. 49). Illus. 49 Illus. 49 Network drives of user1 (example) The users now have the configured drives available in the Cortado app on their mobile devices (Illus. 50). Illus. 50 Illus. 50 Network drives under HOME DRIVE on iphone (example) Editing shared drives ADD: Click if you want to add a shared drive (Illus. 51). EDIT: If you want to make changes to a shared drive, highlight it and click EDIT (Illus. 51). REMOVE: If you want to delete a shared drive, highlight it and click REMOVE (Illus. 51). Illus. 51 Illus. 51 Created network shares displayed User Storage Directories created in this way can now be found again in the root directory of the Cortado Corporate Server (here: C:\User Storage, see Illus. 52). 34 Configuration Manual Cortado Corporate Server

35 User Management Illus. 52 Illus. 52 User directories in the User Storage In the Cortado Corporate Server s USER STORAGE, one folder per user is created with the shared AD network drives. Note! If you later change the path to the user storage (for example, while running the Configuration Assistant again), the network drives defined here will be lost. Furthermore, a personal folder (MY DOCUMENTS) is provided for each user on his mobile device (see Illus. 50). The files which were stored there will also be stored in the respective user folders in USER STORAGE on the Cortado server (Illus. 52 and Illus. 80). User settings To configure the users' access rights of the users, highlight one or more users in the user management (CONTROL PANEL USERS, left arrow in Illus. 53). Then select SETTINGS EDIT in the context menu (right arrow in Illus. 53). Illus. 53 Illus. 53 Edit user settings Cortado Corporate Server Configuration Manual 35

36 User Management Now you can make changes to the default rights settings for the selected users. By default all the settings are checked, except for REPORT GPS DATA, FORCE OFFLINE PASSWORD and FORCE DOWNLOAD AS PDF (Illus. 54). Illus. 54 Illus. 54 Default user settings Account enabled. By removing this checkmark, you deny the users access to the company drives via the Cortado app. (see Illus. 55). Illus. 55 Illus. 55 Access denied to HOME DRIVE(S) (corporate drives) on the iphone Microsoft Exchange. By removing this checkmark, you deny the users the use of Microsoft Exchange, provided that in the configuration of the Exchange account on the mobile device, the name of the Cortado server, rather than the Exchange server is specified (see Page 10). This has the advantage that if the device is lost or stolen, the account of the user can be blocked on the mobile device. Report GPS data. With a checkmark placed here, the GPS data can be used to help locate a mobile device (see the selection Locate a device (Locate) on Page 53). 36 Configuration Manual Cortado Corporate Server

37 User Management Offline password. You can choose here from two options: Force offline password 5 : If this option is enabled, the user may not save the password for the Cortado app (see Illus. 56, left). Additionally, he must, even in offline mode, enter the password to gain access to the Local and the Secure drive 6 of the cortado app. Allow local password storage: If this option is enabled, the user may save the password for the Cortado app. (see Illus. 56, right). Illus. 56 Illus. 56 Left: Password entry necessary at each opening of the Cortado app; right: Option REMEMBER PASSWORD activated (iphone) Caution! Storing passwords holds a security risk. If a mobile device gets lost unauthorized persons can access company data. Display network drives. By removing this checkmark, you deny the users access to the company's shared network drives (see the section Network drives on Page 33). Furthermore, you can withdraw other rights from users to use and edit files located there: Send files by Allows the sending of files by (see Illus. 57, left). Delete files: Allows deleting of files (see Illus. 57, left). Upload files to Cortado server: Allows the uploading of files to the Cortado server. Please note, that if you eliminate this option for users, they can no longer save s or attachments on the company server. Furthermore, the users can neither print nor fax files stored only on the mobile device. The file will first need to be uploaded onto the server. Download files from Cortado server: Allows the downloading of files from the Cortado server. Force download as PDF: If this option is enabled, downloaded files will only be displayed in PDF format. Files such as.txt or.zip files, won't be downloaded. Preview: Allows a preview of a file to be created. (see Illus. 57, left, icon: eye). Export files: Allows exporting files in ZIP or in PDF format. (see Illus. 57, left). 5 When reconfiguring the Cortado app on an ios device (such as when passing the device on to another user), local files are only deleted when this option is enabled. 6 The protected drive is only available for Android devices OS 4 or later Cortado Corporate Server Configuration Manual 37

38 User Management Fax. By removing this checkmark, you prevent the users from sending files via fax. (see Illus. 57, left). (You'll find more information on faxing in the manual Installation and initial configuration, see Page 115). Printing. By removing this checkmark, you prevent the users from printing files (see Illus. 57, left, icon: printer). Wi-Fi printing: By removing this checkmark, you prevent the users from searching for printers via Wi-Fi. Illus. 57 Illus. 57 Left: various file options, right: Auto Download folder (Cortado-App on Android device) Auto Up-/Download 7. By removing this checkmark, you prevent the users from receiving automatic folder and file updates (see Illus. 57, right). Note! For Android users to be able to use the Auto Up/Download feature, password saving must be allowed. Intranet browsing. By removing this checkmark, you prevent the users from making use of SECURE BROWSERS (see Illus. 58, left). This browser is for intranet apps (see Page 65). Allow client side internet browsing 8. By removing this checkmark, you prevent the users from making use of the internet browser integrated into the Cortado app. (see Illus. 58, right). 7 The feature Auto Up-/Download is currently available for Android devices only 8 This feature is available for ios users only 38 Configuration Manual Cortado Corporate Server

39 Mobile printing Illus. 58 Illus. 58 SECURE BROWSER (left) and integrated default browser (right) in the Cortado app on an iphone Mobile printing Without any further setup on the server, smartphone users have access to direct printing, within the company and also when outside. With the mobile device, printers can be searched for locally, i.e. printers that can be found in the same network (Wi-Fi). These can then be printed to via Wi-Fi (see Illus. 59). Furthermore a connection to a Bluetooth printer can be established via the Cortado app 9. Illus. 59 Illus. 59 Via Wi-Fi or Bluetooth detected printer (example for Android device) Universal drivers are installed on the server with the Cortado installation, allowing problem free printing to most printers. A precondition is that during installation, the checkmark has not been removed from the checkbox DOWNLOAD DEFAULT PRINTER DRIVERS (see Installation and initial setup manual). If a special driver or a particular printing function is required, install the necessary original drivers as well on the Cortado server. Without these drivers, the universal 9 Bluetooth printing is for BlackBerry and Android devices only. Cortado Corporate Server Configuration Manual 39

40 Mobile printing driver will always be used, even when mobile users select the original driver from the list. If you install original drivers for certain printers, they will be used instead of the universal drivers. User guides for the Cortado app on mobile devices can be found on our website under SUPPORT GUIDES & MANUALS CORTADO CORPORATE SERVER USER GUIDES. Assigning predefined printers In addition to the option described above, you can relieve the users from printer searching. Specific users can be allocated printers, which will display immediately on the mobile (Illus. 60). The advantages: printer searching on the mobile is no longer required network and AD printers can be predefined it can store printer templates with specific settings and drivers that facilitate Bluetooth or Wi-Fi printing Illus. 60 Illus. 60 Preset printers (example for Android device) How to print? The Cortado server prints directly onto the network printers. The mobile device only initiates the print job; the rendering is done on the Cortado server or a print server. Using printers outside the company network (via Wi-Fi or Bluetooth), the print data that was rendered on the Cortado server is forwarded to the printer via the mobile device. This ensures that the print data is always rendered with the preferred driver and prints in original format. See also the scenarios on pages 42 to 46. You can search here for the following printers: (network) printers installed on Cortado server: Server-attached printer, Page 42 printers listed in the AD: Active Directory printer, Page 43 printers shared on a print server: Single print server, Page 44 Printer templates created on the Cortado server: Mobile printer, Page Configuration Manual Cortado Corporate Server

41 Mobile printing Pre-setting printers on the server 1. In CONTROL PANEL USERS, select the tab PRINTERS (Illus. 61, top arrow) and select the users for whom you want to set printers. 2. Select PRINTERS ADD on the right (Illus. 61, bottom arrow). Illus. 61 Illus. 61 Add printers for one or more users 3. The following dialog opens (Illus. 62). Illus. 62 Illus. 62 ADD PRINTER dialog Cortado Corporate Server Configuration Manual 41

42 Mobile printing Assigning Network printer If you click NETWORK PRINTER (Illus. 62), you can select following shared printers (Illus. 63): Illus. 63 Illus. 63 ADD PRINTER dialog Printers on the Cortado server: server-attached printer These printers appear when NETWORK PRINTER (Illus. 62) SERVER-ATTACHED PRINTER is selected. Furthermore, you can assign users with printers that were created on the Cortado server and which print via Windows provided printing ports, such as Standard TCP/IP port including the Personal Printer (see the section Personal Printing, Page 89). Here, Cortado server prints directly to the printer (Illus. 64). Illus. 64 Illus. 64 Server-attached printer: Printing with printers created on Cortado server, directly to the printer (blue arrow) All printers created locally on the Cortado server that are not connected to a CORTADO PRINT PORT are now displayed (Illus. 65). Select the relevant printer and click ADD to confirm. 42 Configuration Manual Cortado Corporate Server

43 Mobile printing Illus. 65 Illus. 65 Server-attached printer: Select printers on the Cortado server These printers appear on the mobile device as NETWORK PRINTERS (see Illus. 66). Illus. 66 Illus. 66 Server-attached printer on mobile device (example for Android device) Active Directory printer ACTIVE DIRECTORY PRINTER uses printers made available in AD which send their print jobs from a print server to the network printer (Illus. 67). Illus. 67 Illus. 67 Active Directory Printer and Shared Printer: Print jobs are rendered on the print server, where the drivers are installed and sent to the network printer (blue arrow) The AD printers appear when NETWORK PRINTER SHARED PRINTER ACTIVE DIREC- TORY PRINTER is selected (see Illus. 68). Cortado Corporate Server Configuration Manual 43

44 Mobile printing Illus. 68 Illus. 68 Select printers in AD shared The AD printers selected here will be assigned to the selected users as their preferred printers (see Illus. 69). Requirement: The option LIST IN DIRECTORY has already been enabled on the print server for each printer share. Illus. 69 Illus. 69 AD printers on the mobile device (example for Android device) Shared printer: Single print server With SINGLE PRINT SERVER you can provide the users with shared printers from your company network for example printers which are not listed in the AD. The print server prints also to the network printer (see Illus. 67). After selecting NETWORK PRINTER SHARED PRINTER SINGLE PRINT SERVER, you can enter the name of the print server directly (Illus. 70). Illus. 70 Illus. 70 Searching for shared printers: enter the print server name Select the preferred printer shares and confirm with NEXT, ADD and CLOSE (Illus. 71). The printer shares are thus assigned as network printer favorites to the users selected. 44 Configuration Manual Cortado Corporate Server

45 Mobile printing Illus. 71 Illus. 71 Selecting shared printers The shared printers selected here will be assigned to the selected users as their preferred network printers (see Illus. 72): Illus. 72 Illus. 72 Shared printer on mobile device (example for Android device) Note! All printer drivers of network printers that should be used by users on their end devices must be installed on the Cortado Corporate Server. It is enough to manually connect as an administrator from the Cortado server with the relevant network printer (\\servername\sharename). This installs the driver automatically or you will be prompted to select the appropriate driver. Assigning mobile printer (Wi-Fi, Bluetooth) 10 MOBILE PRINTER is particularly suitable for printers outside the company, and with which the user is already familiar 11. MOBILE PRINTER (WI-FI, BLUETOOTH) (Illus. 62 on Page 41) are printers that can be accessed by the mobile device via Bluetooth or WiFi, and for which preferences can be set on the server, using printer templates. You can then print from the Cortado server via the mobile device (Illus. 73, blue arrows). 10 This option is available for Android and BlackBerry devices.only 11 For unknown printers, we recommend instead, the printer search integrated into the app on the mobile device, where a suitable driver is selected manually. Cortado Corporate Server Configuration Manual 45

46 Mobile printing Illus. 73 Illus. 73 Mobile Printer: Printing from Cortado server via the mobile device with Wi-Fi or Bluetooth For printing via Bluetooth and Wi-Fi universal drivers were installed during the installation routine. If you use printers which need special drivers or on which you wish to make settings (color, duplex...), these still have to be set up on the Cortado server. First create the desired printer in the Cortado server s Printers folder and attach it to a CORTADO PRINT PORT (example in Illus. 74). Illus. 74 Illus. 74 Connecting a printer to Cortado Print Ports If you assign specific properties to the newly created printer objects (for example duplex printing) these will then be transferred. The user that selects thus printer object on his/her mobile device will then also be able to print in duplex format. Enable the function ENABLE PRINTER POOLING and confirm with APPLY (arrow in Illus. 75). So you can attach a printer to more than one CORTADO PRINT PORT and thus it s not necessary to create an own printer port for each printer. 46 Configuration Manual Cortado Corporate Server

47 Mobile printing Illus. 75 ILLUS. 75 ENABLE PRINTER POOLING The printer objects set up (in) this way will be displayed in MOBILE PRINTER (WI-FI, BLUETOOTH) (see Illus. 62 on Page 41) and can be assigned to the users. Illus. 76 Illus. 76 Select shared printers Cortado Corporate Server Configuration Manual 47

48 Mobile printing Users select on the Android or BlackBerry device this printers in PRESET PRINTERS (Illus. 77 left). Illus. 77 Illus. 77 Shared printers on the mobile device (example for Android) Removing printers For each user, the assigned printers will be displayed in the light gray field. To delete a printer (or rather, its assignment to a user), select the user first, and then the printer or printers (check box). Then click on REMOVE on the right (arrow in Illus. 78). Illus. 78 Illus. 78 Remove predefined printer for selected user Target folders for print jobs Some printers of ThinPrint Server Engine and Personal Printing store their jobs automatically to the Cortado server s User Storage. So, the users can view or print the respective files with their mobile devices (see also Illus. 79): Personal Printer (from Personal Printing, see Page 105) Print-to-Cloud (from Personal Printing or ThinPrint Server Engine, see the ThinPrint Server Engine manual, Page 115) Print-to-ePaper (from Personal Printing or ThinPrint Server Engine 48 Configuration Manual Cortado Corporate Server

49 Mobile printing Illus. 79 Illus. 79 Cortado server s printers folder (example) The jobs of the following printers are sent directly to the user s subfolders.print and.printvp (cp. Illus. 80): Printer Subfolder in the user s directory Displayed in the Cortado app Personal Printer.print Print-to-Cloud.print Print Jobs Print-to-ePaper.printVP epaper Further subfolders are:.mail (mail attachments and bodies, Page 105).proxy (Intranet apps, Page 65).tpm (configuration files for Cortado Explorer, see User Self Service Portal manual, Page 115) Illus. 80 Illus. 80 User Storage and the respective Cortado app menu Cortado Corporate Server Configuration Manual 49

50 Managing devices You can create printer objects of the type Print-to-Cloud and Print-to-ePaper either on a print server (see the manual ThinPrint Server Engine, Page 115) or directly on the Cortado server. On the Cortado server add an Output Gateway printer manually in the printers folder, name it Print-to-Cloud or Print-to-ePaper and connect it to a new Print-to-Cloud port, which is configured for Print-to-Cloud or Print-to-ePaper respectively (see Illus. 81). Illus. 81 Illus. 81 Print-to-Storage Port with Print-to-Cloud printer on the Cortado server Managing devices Device information (Details) In device management you can manage the devices of Cortado users (Illus. 82). Select CONTROL PANEL DEVICES. All the devices which have been imported via user management (see menu USERS, Page 26) will be displayed. For BlackBerry users, these appear immediately after the user was imported from BES. For Android and Apple devices, interaction on the mobile device is first required: For Android, the account has to be switched over to Cortado and for Apple the MDM profile must be downloaded. 12 Then the devices appear here automatically, in the device manager (on the left in Illus. 82). 12 see the user guide for User Self Service Portal on the Cortado website 50 Configuration Manual Cortado Corporate Server

51 Managing devices Illus. 82 Illus. 82 DEVICES DETAILS: Android device information, including user Device functions Device protection (Lock Screen + Wipe) If a device has been lost or stolen, you have the options to (Illus. 83): Illus. 83 Illus. 83 Device functions (ios): REMOVE, LOCK SCREEN, WIPE and LOCATE Cortado Corporate Server Configuration Manual 51

52 Managing devices LOCK SCREEN (ios only) Screen will be locked (see Illus. 84, left), and can only be unlocked again with a Passcode (see Illus. 84, right), provided that the device is protected with a password. WIPE FULL Delete all data from the device (= restored to factory settings) WIPE PARTIAL (Cortado app only, ios and Android only) Deny access to company drives (HOME DRIVE(S), see Illus. 85). Delete data in LOCAL DRIVE (ios) and SECURE DRIVE (Android). All other data stored locally on the device (or on SD cards) will be retained. Note! On Android devices, no data will be deleted from the LOCAL DRIVE. So make sure that sensitive data is always stored on SECURE DRIVE. Illus. 84 Illus. 85 Illus. 84 LOCK SCREEN: Screen is locked (left), to unlock a passcode must be entered (right) (option is available only for ios devices) Illus. 85 WIPE PARTIAL: Drives in the Cortado app (left); access to corporate drives (HOME DRIVES) is not possible after partial wipe (right). Example on Android device. 52 Configuration Manual Cortado Corporate Server

53 Managing devices Remove a device (Remove) With REMOVE (top arrow in Illus. 83) the device is deleted from the database. It makes sense to clean up the Cortado database if devices are located there, that no longer exist, or that have a new user. If a device is deleted with REMOVE but still has, or establishes, an active connection with the Cortado server, it will be added to the list again after a few minutes. If you want to delete data from the device, use WIPE instead (see above). Note! A device must removed here if an ios device has been deactivated (Illus. 86) because either it was to long inactive (Page 114) or the ios user has removed the MDM profile from her/his device. In this case, remove the device here and ask the user for rerunning the First Steps Wizard (Page 88). Illus. 86 Illus. 86 Deactivated Cortado app on the iphone Locate a device (Locate) If a mobile device has been lost or stolen, you can discover its current location via LOCATE (bottom arrow in Illus. 83). This is providing that the option REPORT GPS DATA has been enabled for the selected device in CONTROL PANEL USERS SETTINGS (Page 35). Illus. 87 Illus. 87 Device located at Cortado AG by the river Spree Cortado Corporate Server Configuration Manual 53

54 Managing devices Select a device on the left. The LOCATE button (Illus. 83) only appears if the device is turned on as well as GPS and with Android Google s Location Service is enabled on the device. Note with ios devices that the user must answer YES during configuration of the Cortado app when prompted to allow Cortado to use the location. The Cortado ball icon is displayed on the map, at the location where the mobile device is currently located (Illus. 87). Merging multiple-displayed devices (Merge) If a device shows two listings, for example if a user has run the configuration twice, you can checkmark both devices (Illus. 88 left arrow) and merge them with MERGE (right arrow), so the device is again displayed only once in the list. Caution! If your Cortado server requires a client certificate for the https communication to the end devices (Illus. 121) and for this purpose you distributed a global certificate to all devices (Page 74), after merging devices you must reimport the client certificate (Illus. 122) and the users must rerun the First Steps Wizard (Page 88). Illus. 88 Illus. 88 Merge twice-listed devices merged 54 Configuration Manual Cortado Corporate Server