Kofax Front Office Server Administrator's Guide

Transcription

1 Kofax Front Office Server Administrator's Guide August 12, 2011

2 Kofax, Inc., Laguna Canyon Road, Irvine, California 92618, U.S.A. All rights reserved. Use is subject to license terms. Third-party software is copyrighted and licensed from Kofax s suppliers. For information on third-party software included in this product, see KFSTHIRDPARTYLICENSEREADME.txt. This product is protected by U.S. Patent No. 6,370,277. THIS SOFTWARE CONTAINS CONFIDENTIAL INFORMATION AND TRADE SECRETS OF KOFAX, INC. USE, DISCLOSURE OR REPRODUCTION IS PROHIBITED WITHOUT THE PRIOR EXPRESS WRITTEN PERMISSION OF KOFAX, INC. Kofax, the Kofax logo, VirtualReScan, the VRS VirtualReScan logo, and VRS are trademarks or registered trademarks of Kofax, Inc. in the U.S. and other countries. All other trademarks are the trademarks or registered trademarks of their respective owners. U.S. Government Rights Commercial software. Government users are subject to the Kofax, Inc. standard license agreement and applicable provisions of the FAR and its supplements. You agree that you do not intend to and will not, directly or indirectly, export or transmit the Software or related documentation and technical data to any country to which such export or transmission is restricted by any applicable U.S. regulation or statute, without the prior written consent, if required, of the Bureau of Export Administration of the U.S. Department of Commerce, or such other governmental entity as may have jurisdiction over such export or transmission. You represent and warrant that you are not located in, under the control of, or a national or resident of any such country. DOCUMENTATION IS PROVIDED AS IS AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID.

3 Contents Legal Notice Overview...5 Integration with Kofax Capture...5 About the Configuration Folder Location in this Guide... 6 Related Documentation... 7 Training... 8 Getting Help for Kofax Products...8 Starting the Kofax Front Office Server Applications... 8 Starting the Administration Console... 8 Starting the Administration Console from a Browser...9 Starting the Thin Client...10 Identify URLs for Kofax Front Office Server Applications Security Settings for Server Operating Systems...12 Stop and Restart Kofax Front Office Server About Security with Secure Sockets Layer (SSL)...12 About Security with the Encrypting File System (EFS)...13 Configuring IPsec...13 Configuring IPsec for Windows Server Configuring IPsec for Windows Server Configuring IPsec on the HP MFP...15 Configuring IPsec on Ricoh MFPs About Single Sign On...16 Enabling Single Sign On Examples of Possible Configurations...18 Back Up and Restore Backing Up Departmental Configurations...22 Restoring Departmental Configurations...22 Backing Up Enterprise Configurations...23 Restoring Enterprise Configurations...23 Change System Configuration Changing SQL Server Database Authentication Changing the Kofax Front Office Server Location...24 Change Host Names Using the Kofax Front Office Server Utilities...25 Set Options for the Thin Client Defining the Page Size for the Thin Client List of Documents...27 Setting Session Timeout Optimizing Thumbnail Generation Set Up to Scan Directly from the Thin Client Customize a Connector, Data Validation, and Field Lookup Customizing Data Validation and Field Lookup

4 Contents Set Up Kofax Capture Setting Up User Accounts...33 Setting Up Batch Classes, Document Classes, and Form Types Information Updates to Kofax Capture Values...34 Adding Fax Number and Address Lookup Fields...36 Advanced Notification Configuration for Kofax Capture...38 Implementing the Properties...38 Configure Retries...39 Configuring Retries for Failed Scan Jobs Configuring Database Retries...40 Configuring Retries to Storage Destinations Troubleshooting and Maintenance...40 Troubleshooting Failed Batches Important Information About Validation Failure Identifying and Correcting Release Errors...41 Information About Bar Code Support Changing the Default VRS Settings Reviewing the Log Files...44 Managing Free Drive Space Manage Document Tracking Activity...45 Index

5 This guide is intended to be used by the administrator who will configure and maintain the Kofax Front Office Server installation. Overview Kofax Front Office Server, an add in for Kofax Capture, enables documents from a variety of sources, including multifunction peripherals (MFPs), to be delivered directly to Kofax Capture, or to the Thin Client application for additional processing before submission to Kofax Capture. Integration with Kofax Capture Kofax Front Office Server integrates with Kofax Capture and takes advantage of the following features. User Authentication Kofax Front Office Server uses the Kofax Capture user profile and group membership authentication on MFP devices and in both the Thin Client and the Administration Console applications. You can configure Kofax Front Office Server so that once users have logged on to the computer where they launch the browser, users will not have to log on to either the Thin Client or the Administration Console (this is also called single sign on). Note Access to the Administration Console is restricted to Kofax Capture users who have rights to the Kofax Capture Administration module. All Kofax Capture users can be assigned permission to access the Thin Client without special Kofax Capture rights. Licensing Kofax Front Office Server integrates with the Kofax Capture centralized license management scheme. System Licenses Kofax Front Office Server System license to run Kofax Front Office Server standard installations using the Microsoft SQL Server Express or Standard database. Kofax Front Office Server Enterprise System license to run Kofax Front Office Server Enterprise installations using a SQL Server Enterprise or Oracle database. Station Licenses Kofax Front Office Server Device Limits the number of devices that can be added to the Administration Console. When no more device licenses are available, no more devices can be added. You can either remove devices, or purchase additional licenses. 5

6 Kofax Front Office Server Thin Client Limits the number of concurrent open sessions of the Thin Client. When no more station licenses are available, users cannot log on. You can either have current users log off, or purchase additional licenses. Note In versions of Kofax Capture prior to version 9 Service Pack 1, this license was named Kofax Front Office Server Web Client. Volume Licensing and MFPs Volume licensing for the following Kofax Capture licenses is not affected (the page count is not decremented) for any documents that are scanned at an MFP and come through Kofax Front Office Server directly to Kofax Capture or through the Thin Client: Scan/Import page count Kofax PDF Image+Text page count Documents imported directly into the Thin Client and then submitted to Kofax Capture do decrement page count. If documents scanned at an MFP are merged, page count is not decremented. However, if any imported pages are added to a scanned MFP document, page count is decremented only for the for the additional pages that were added. Volume licensing is still affected by activity from any custom Web services client. Shared Folder in Kofax Capture Server Files Location The Kofax Front Office Server installation detects the location of the Kofax Capture server files, and creates a \KFS<version> subfolder where users inboxes, scanjob images, and configuration files (among other items) are stored. If the location of the Kofax Capture server files is ever changed after Kofax Front Office Server installation, you must follow the instructions in Changing the Kofax Capture Server Files Location. Validation Kofax Capture batch class information is used to validate batches released from MFPs or the Thin Client. About the Configuration Folder Location in this Guide There are several shared configuration files you can edit to change product behavior. During Kofax Front Office Server installation, the location of the Kofax Capture server installation is identified, and a subfolder structure \KFS<version>\Config is created to hold the configuration files for Kofax Front Office Server. By default, the full path is: Windows Server 2003 For standalone installations: C:\Documents and Settings\All Users\Application Data\Kofax\Capture \KFS <version>\config For Enterprise installations: C:\Documents and Settings\All Users\Application Data\Kofax\CaptureSV \KFS <version>\config Windows Server 2008 For standalone installations: 6

7 C:\ProgramData\Kofax\Capture\KFS<version>\Config For Enterprise installations: C:\ProgramData\Kofax\CaptureSV\KFS<version>\Config Where <version> is the Kofax Front Office Server version number. In the rest of this guide, references will use just the folder names \KFS<version> and \KFS<version>\Config without the additional path details. Related Documentation In addition to this guide, Kofax Front Office Server includes the following documentation. Except for the Help and release notes, you can select to view any of the documentation by opening guides.html in the root of the product files (before installation), clicking View Documentation from the main installation menu, or opening \Documentation \KFSguides.html (after installation). Figure 1. Guides Page Kofax Front Office Server Installation Guide The Kofax Front Office Server Installation Guide provides installation instructions and other information that helps you successfully set up Kofax Front Office Server. Multifunction Peripheral (MFP) s These guides show how to make Kofax Front Office Server features available on MFP front panels. Help for Kofax Front Office Server Applications Help is available for Kofax Front Office Server Thin Client (also referred to as the Thin Client) and Kofax Front Officer Server Administration Console (also referred to as the Administration Console) that describes how to use the application. To view the Help in the Thin Client or the Administration Console, click the Help button. The Help appears in a separate browser window. You can also view the Help when you are at the server: On the Start menu, navigate to Kofax Front Office Server, point to Documentation, and click the Help you want to view. Release Notes Late-breaking product information is available from the release notes. The release notes contain information that may not be included in other Kofax Front Office Server 7

8 documentation. The release notes are available for viewing or downloading from the Kofax Web site. Kofax Capture Documentation Kofax Front Office Server is designed to work with Kofax Capture. Refer to the Kofax Capture documentation for instructions on using the features of that product. Training Kofax offers both classroom and computer-based training that will help you make the most of your Kofax Front Office Server solution. Visit the Kofax Web site at for complete details about the available training options and schedules. Getting Help for Kofax Products Kofax regularly updates the Kofax Support site with the latest information about Kofax products. To access some resources, you must have a valid Support Agreement with an authorized Kofax Reseller/Partner or with Kofax directly. Go to for Access to product knowledge bases Click CAPTURE: SUPPORT KNOWLEDGE. Access to the Kofax Customer Portal (for eligible customers) Click CAPTURE: SUPPORT INTERACTIONS and log in. To optimize your use of the portal, go to the Kofax Customer Portal login page and click the link to open the Guide to the Kofax Support Portal. The guide describes how to access the portal, what to do before contacting the support team, how to open a new case or view an open case, and what information to collect before opening a case. Product information and release news Click Product and select a product name and version. Downloadable product documentation Click Documentation and select a product name and version. Access to support tools Click Tools and select the tool to use. Information about the support commitment for Kofax products Click Options and select Kofax Support Commitment. Use these tools to find answers to questions that you have, to learn about new functionality, and to research possible solutions to current issues. Starting the Kofax Front Office Server Applications Before starting either of the applications, complete the installation and make sure that Kofax Front Office Server has started. Starting the Administration Console You can start the Administration Console from the Kofax Capture Administration Module, or from a browser by entering the URL. Before starting the Administration Console, do the following: Make sure that the Web browser is certified by Kofax Front Office Server. Enable the browser to use cookies and JavaScript. 8

9 Make sure that Kofax Front Office Server has been properly installed and is running. Once you start the Administration Console, you can click the Help button for information about the particular node and tab you are on, and from there you can access the entire Help system or select other nodes. The Introduction to the Administration Console topic is a good place to start, because it outlines the general steps to configure MFPs and describes the tasks you can perform. 1 Start the Kofax Capture Administration Module, and select one of the Administration Console nodes from the menu list. The Administration Console appears. Figure 2. The Administration Console 2 Expand the nodes on the left panel to create shortcuts, add MFP devices, and perform other management tasks. Starting the Administration Console from a Browser 1 Be sure your computer can connect to the server where Kofax Front Office Server is installed. 2 Start the Administration Console by doing either of the following: Open a certified Web browser and type the URL for Kofax Front Officer Server Administration Console. For the URL, refer to Identify URLs for Kofax Front Office Server Applications on page 11. If you are at the server, on the Start menu, navigate to Kofax Front Office Server and click Administration Console. The Administration Console Log On screen appears. If automatic log on (also called single-sign on) does not occur, the Administration Console Log On screen appears. 9

10 Figure 3. Administration Console Log On Screen Tip Bookmark the Administration Console Log On screen to make it convenient to start each time. 3 Type your Kofax Capture user ID and password. Passwords are case-sensitive. After you have logged on successfully, the Administration Console appears. 4 Expand the nodes in the menu on the left panel to create shortcuts, add MFP devices, and perform other management tasks. Starting the Thin Client Before you can log on to the Thin Client, you need the following: The URL of the Thin Client. For the URL, refer to Identifying the URLs for Kofax Front Office Server Applications. A user name and password if you are prompted for log on credentials. A Web browser supported by the Thin Client. Cookies and JavaScript enabled on the browser. Tip Bookmark the Thin Client Log On page to make it convenient to start each time. 1 In the browser s Address field, type the URL for the Thin Client. If automatic log on (also called single sign on) does not occur, the Thin Client Log On screen appears. 2 Type your Kofax Capture user ID and password. Passwords are case-sensitive. 3 Click Log On. 10

11 Figure 4. The Thin Client Log On Screen The Thin Client window appears. Identify URLs for Kofax Front Office Server Applications Provide all users of Kofax Front Office Server applications with the URL they need to connect from a Web browser. For Kofax Front Officer Server Administration Console, type the URL as follows: If security is not enabled with an SSL certificate: If security is enabled with an SSL certificate: For Kofax Front Office Server Thin Client, type the URL as follows: If security is not enabled with an SSL certificate: If security is enabled with an SSL certificate and you are not using Thin Client Scanning: If security is enabled with an SSL certificate and you are using Thin Client Scanning: Where: <server> is the IP address or host name of: The computer with a departmental installation of Kofax Front Office Server An NLB cluster or IIS server in an Enterprise installation servername is the host or DNS name of: The computer with a departmental installation of Kofax Front Office Server The proxy server in an Enterprise installation 8443 is the port used by Kofax Front Office Server for transmitting secure data. Note the following: 11

12 In the URL, KFSAdmin and KFSThinClient may be typed in all uppercase or all lowercase, as in these examples: You can omit the Thin Client portion of the URL to start, as in this example: Security Settings for Server Operating Systems If you are using Internet Explorer 8 on Windows Server 2003 or 2008, you need to add Kofax Front Office Server applications and Help to the Trusted Sites zone to use them with Windows Enhanced Security. Add the following URLs to the Trusted Sites zone: about:internet about:blank Stop and Restart Kofax Front Office Server You may need to stop and restart Kofax Front Office Server when changing some of the files in the \KFS<version>\Config folder or for routine maintenance. The process depends on which type of installation and configuration you use, and the instructions are in the Kofax Front Office Server Installation Guide. About Security with Secure Sockets Layer (SSL) The use of an SSL certificate encrypts, and thereby protects, the transmission of sensitive data, such as passwords. Kofax Front Office Server ships with SSL encryption enabled using a selfsigned, built-in SSL certificate by default for HTTPS connections over port To connect to the Kofax Front Office Server using a secure connection with SSL, enter one of the following URLs into the browser (where <server> is the hostname or IP Address of the Kofax Front Office Server): Thin Client: Administration Console: Tip If you use the DSA algorithm when creating a self-signed certificate for use with SSL, users will not be able to connect to the HP or Canon MFP. To use SSL with those MFPs, you must create the certificate using the RSA algorithm. We recommend you always use the RSA algorithm when generating self-signed certificates. When configuring security with SSL, note the following: Kofax Front Office Server ships with a default self-signed SSL certificate, with the file avalin.keystore which specifies avalin as the host name for the installation. The avalin.keystore file is located in the \Kofax\Front Office Server\Avalin \jboss\server\avalin\conf folder where Kofax Front Office Server is installed. You can replace the file avalin.keystore, using the same file name to ensure a smooth implementation and to avoid having to edit other server and/or network properties. 12

13 If replacing the file avalin.keystore using the same file name, note the following: Keystore password=avalin Host name=the full name for the server where Kofax Front Office Server is installed. For example: or Server01. About=avalin Kofax Front Office Server by default uses port 8443 for the secured transmittal of encrypted data. The URL for accessing the Administration Console or the Thin Client requires https instead of http. For more information, see Identifying the URLs for Kofax Front Office Server Applications. About Security with the Encrypting File System (EFS) A number of Kofax Front Office Server capabilities rely on access to a number of local and network resources. If you encrypt files using EFS, there is the potential to prevent Kofax Front Office Server from accessing critical resources. This inability may cause unexpected errors. The KofaxServer service user account must have privileges to decrypt all data used bykofax Front Office Server and the Kofax Capture share, including the Kofax Capture database location. In addition the Kofax Capture Service service user account must have privileges to decrypt to all Kofax Capture data including the Kofax Capture database location. We recommend either of the following configurations: Configure EFS at the domain level, and include the KofaxServer and Kofax Capture Server services user accounts as members of the group allowed to decrypt encrypted files. Encrypt all files with EFS using the KofaxServer service name and run the Kofax Capture Service service with the same user account. Configuring IPsec This section provides step-by-step instructions for configuring Internet Security Protocol (IPsec) secure communications between and the HP, Ricoh, Canon, Lexmark, and Konica Minolta MFPs. Note There are many ways to configure IPsec, but these instructions enable the only configuration supported by Kofax. Configuring IPsec for Windows Server From Administrative Tools, select Local Security Policy. The Local Security Settings windows opens. 2 Right-click IP Security Policies on Local Computer and select Create IP Security Policy. The IP Security Policy Wizard opens. 3 Click Next, enter a name for the new policy, and then click Next. 4 Unselect Activate the default response rule click Next, select Edit properties, and then click Finish. The properties window for the new policy opens, where you will add a new rule. 5 Select Use Add Wizard and click Add. the Security Rule Wizard opens. 13

14 6 Click Next, and on the next two screens select This rule does not specify a tunnel and All network connections. 7 Click Next, select All ICMP Traffic, and click Add. The IP Filter List window opens. 8 Enter a name for your new IP Filter List, select Use Add Wizard, and click Add. The IP Filter Wizard opens. 9 Click Next, and unselect Mirrored. Match packets with the exact opposite source and destination addresses. 10 On the next two screens, select Any IP Address for both Source and Destination addresses. 11 Click Next, and select Any as the protocol type. 12 Click Next, unselect Edit properties, and then click Finish. You are returned to the IP Filter List window. 13 Click OK. You are returned to the Security Rule Wizard. 14 Select the new filter, and then click Next. The Filter Action screen opens, where you will add a new filter action. 15 Select Use Add Wizard, and click Add. The Security Filter Action Wizard opens. 16 Click Next, enter a name for the new filter action, and then click Next. 17 On the next three screens, select Negotiate Security, Do not communicate with computers that do not support IPSec, and Integrity and encryption. 18 Click Next, unselect Edit properties, and then click Finish. You are returned to the Filter Action window. 19 Select the new filter action, and click Next. 20 Select Use this string to protect the key exchange(preshared key), enter a secret key string, and click Next. 21 Click Next, unselect Edit properties, and then click Finish. You are returned to the properties window. 22 Click OK. You are returned to the Local Security Settings window. 23 In the right panel of IP Security Policies on Local Computer, right-click your new policy and select Assign. Once you assign this IPsec rule, you'll only be able to access this IPsec configured computer from clients that are similarly configured for IPsec. You can turn off IPsec at any time by right-clicking the rule and selecting Un-assign. Configuring IPsec for Windows Server From Administrative Tools, select Local Security Policy. 2 Right-click IP Security Policies on Local Computer and select Create IP Security Policy. The IP Security Policy Wizard opens. 3 Click Next, enter a name for the new policy, and then click Next. 4 Unselect Activate the default response rule (earlier versions of Windows only) and click Next, select Edit properties, and then click Finish. The properties window for your new policy opens. 5 Click Add. The Security Rule Wizard opens. 6 On the next two screens, select This rule does not specify a tunnel and All network connections, and then click Next. 14

15 You are prompted to select and IP filter list, which you will create. 7 Click Add, enter a name for your new IP Filter List, and then click Add. The IP Filter Wizard opens. 8 Click Next, unselect Mirrored. Match packets with the exact opposite source and destination addresses, and then click Next. 9 On the next three screens, select Any IP Address for both Source and Destination address, and Any for the protocol type, and then click Next. 10 Unselect Edit properties and click Finish. You are returned to the IP Filter List window. 11 Click OK, select your new filter list, and then click Next. You need to add a new filter action. 12 Click Add, and when the Filter Action Wizard opens, click Next. Enter a name for the new filter action, and click Next. 13 On the next three wizard screens, select Negotiate Security, Do not allow unsecured communication, and Integrity and encryption. 14 Unselect Edit properties and click Finish. You are returned to the Security Rule Wizard screen. 15 Select your filter action and click Edit. The Properties window opens. 16 Select Negotiate security and Accept unsecured communication, but always respond using IPsec. 17 Click Ok, then click Next. You need to enter an Authentication Method. 18 Select Use this string to protect the key exchange (preshared key), enter a secret key string, and click Next then Finish. You are returned to the Properties window. 19 Click OK. You are returned to the Local Security Policy window. 20 In the right panel of IP Security Policies on Local Computer, right-click your new policy and select Assign. Once you assign this IPsec rule, you'll only be able to access this IPsec configured computer from clients that are similarly configured for IPsec. You can turn off IPsec at any time by right-clicking the rule and selecting Un-assign. Configuring IPsec on the HP MFP 1 Open the MFP jetadmin application: <hostname or IP address of the MFP>/HP/jetadmin. 2 On the Networking tab, select IPsec/Firewall. 3 Click Add Rules, then click New. Enter the following information and then click OK: Enter a name in the Address Template Name field. Enter the IP address of the Kofax Front Office Server in the Remote Address, IP Address field. You are returned to the IPsec/Firewall page, with your new address template listed. 4 Select your policy from the list, and click Next. 5 From the Service Templates list, select All Services and then click Next. 6 From the Specify Action options, select Require traffic to be protected with an IPsec/ Firewall policy and then click Next. 15

16 7 Click New, enter a name for the template, select Internet Key Exchange Version 1 (IKEv1), and then click Next. 8 Select Pre Shared Key, enter a secret key string, and then click Next. 9 Select the new template and click Next, then click Finish. You are prompted to enable the new policy And failsafe. Make your selections and then click OK. Note You can choose to enable IPsec/Firewall on this page, or later from the IPsec/ Firewall page, where you can enable or disable a policy at any time. Configuring IPsec on Ricoh MFPs Install a certificate on the Ricoh if it does not have a device certificate already, so that https can be used to interface with it after IPsec is turned on On the left panel, select Configuration. Under Security, select IPsec. Under the Encryption Key Auto Exchange Settings, click Edit. Select a new/clear Settings tab, and enter the following information: In Address Type, select IPv4. in Local Address, enter the IP information for the MFP. In Remote Address, enter the IP address of the Kofax Front Office Server In the Security Details area, after PSK Text, click Change, then enter and confirm a secret key string and click OK. Accept all the default information in the Security Details area. 5 Click OK You are returned to the IPsec page. 6 Under IPsec, after IPsec, select Active. About Single Sign On Kofax Front Office Server supports single sign on for Kofax Capture linked users. If users log on to a computer using a user account that is linked in Kofax Capture and have the appropriate access rights, users can start the Administration Console or the Thin Client without being prompted to log on. When authentication fails, or if the user is not authorized to log on, a log on screen appears to allow users to manually enter credentials. This section assumes you are familiar with Group Policy configuration and using and registering a Service Principal Name (SPN). To use the single sign-on feature, the following conditions have to be met: 16 If using IIS, the IIS authentication method must be set to Enable anonymous access. Clients must use Internet Explorer 7 or 8. Internet Explorer must have the Enable Integrated Windows Authentication option turned on. If users are using the Fully Qualified Domain Name (FQDN), Internet Explorer must have the Kofax Front Office Server computer added to the Local intranet zone or the Trusted zone. To avoid setting this up for each user individually, your domain administrator can create a Group Policy and add it to the desired organizational units.

17 Important When adding to the Trusted zone, the IE Security Settings option User Authentication, Logon must be set to Automatic logon with current user name and password. The user you specify with SPN must be in the Administrators group on the computer registered with DNS. Enabling Single Sign On 1 In the Administration Console, select the Settings node and select the check box next to Enable Single Sign On. 2 Click Save. The change takes effect automatically in less than a minute. Registering a DNS Entry In the section Examples of Possible Configurations on page 18, there are some additional configuration tasks listed in the tables to register DNS and SPN. Although it is expected that system administrators will know how to perform those tasks, we include the following instructions. Use this procedure to register a DNS entry pointing to a machine hosting the physical server. Note Complete this procedure before you register the SPN because you need to use the URL that you will create as part of the SPN command line entry when you register SPN. Note also that you must create a DNS entry for all configurations, including a standalone (Departmental), that will not use the host name in the URL. 1 On your domain controller, open Administrative Tools and select DNS. 2 Expand Forward Lookup Zones, select your domain, then right-click and select New Host (A). 3 In the Name field, type a name that will be the first part of the URL (for example, wwwkfs). This will be the URL address. Be sure the name you enter is not already used on the domain. 4 In the IP address field, enter your standalone IP or the IP of your proxy IIS, IBM HTTP for WebSphere, or NLM cluster host. 5 Click Add Host. Registering SPN Use this procedure to register SPN (Service Principal Name) under the user account running the KofaxServer service. The intent is to enable Kerberos authentication: you are using a domain account to run the KofaxServer service, and that domain user must be registered. (The Local System account is automatically registered by the server.) 1 On the domain controller machine (where directory service runs), open a Command Prompt and run: Setspn -A <http/dns name> <domain>\<user> For example, in an domain named domain01 for the account Kfs-service-user, you would run: Setspn -A http/www-kfs domain01\kfs-service-user This registers SPN for Kfs-service-user. 17

18 2 Change the log on account for all your KofaxServer services to the account you just registered. Examples of Possible Configurations This section provides examples and lists any additional configuration needed for different installations, log on accounts to run KofaxServer service, and URLs used to log on to the Thin Client (used in the examples) and the Administration Console. Single Server Installation (Department or Enterprise) The figure illustrates a single server installation on a domain (Kofax.com). Both the server (named kfs-svr) and client (names Mike-xp-wks) are on the same domain. A domain account Kfs-serviceuser has been created to be used instead of the built-in Local System account. Clients access the server using either host name or a DNS name. Figure 5. Single Server Table 1. Client Connects to Server Using Host Name URL Entered by Mike on Mikexp- wks KFSThinClient KFS/ KFSThinClient 1 Log on Account for KofaxServer Service Additional Configuration Required by a Domain Administrator Local System1 None Local System1 Add the FQDN (kfssvr.kofax.com) to the Intranet zone or Trusted zone in Internet Explorer. This can be done individually on each client browser, or it can be done on the domain controller with Group Policies so that the setting will be applied to all clients in the domain. Note that the DNS and SPN steps in the following configurations are not necessary since they are done automatically for server host names. If you need to use a domain user account, then you must use a DNS name. See the next table for information. 18

19 Table 2. Client Connects to Server Using a DNS Name URL Entered by Mike on Mikexp- wks Log on Account for KofaxServer Service Additional Configuration Required by a Domain Administrator KFSThinClient Kfs-service-user None On the domain controller, register DNS entry pointing www-kfs.kofax.com to host machine kfs-svr. On the domain controller, register SPN HTTP/ wwwkfs-svr.kofax.com under user account Kfs-service-user. Then, configure the computer to use Kfs-service-user as the KofaxService log on account. KFS/ KFSThinClient Kfs-service-user Same two steps above plus: Add the FQDN (kfssvr.kofax.com) to the Intranet zone or Trusted zone in Internet Explorer. This can be done individually on each client browser, or it can be done on the domain controller with Group Policies so that the setting will be applied to all clients in the domain. Enterprise Cluster with Proxy Server The figure illustrates an Enterprise installation using a proxy. The cluster is configured to include kfs-svr-node1, kfs-svr-node2 and the proxy server kfs-svr-proxy. All servers and clients are on the same domain. Clients access the cluster through the proxy server s designated DNS name. 19

20 Figure 6. Cluster with Proxy Server Table 3. Client Connects to Proxy Server Using DNS Name URL Entered by Jack on Jack-xp-wks Log on Account for KofaxServer Service Additional Configuration Required by a Domain Administrator KFSThinClient Kfs-service-user On the domain controller, register DNS entry pointing www-kfs.kofax.com to host machine kfs-svr-proxy. On the domain controller, register SPN HTTP/wwwkfs.kofax.com under user account Kfs-service-user. Then, configure every Kofax Front Office Serverin the cluster to use Kfs-service-user as the KofaxService log on account KFSThinClient Kfs-service-user Same two steps above plus: Add the FQDN (kfs-svrproxy.kofax.com) to the Intranet zone or Trusted zone in Internet Explorer. This can be done individually on each client browser, or it can be done on the domain controller with Group Policies so that the setting will be applied to all clients in the domain. Enterprise Cluster with NLB This figure illustrates an enterprise installation using NLB. The NLB cluster is configured to include kfs-svr-worker1 and kfs-svr-worker2. The cluster name is www-kfs.kofax.com. All 20

21 servers and clients are on the same domain. Clients access the cluster through the cluster s DNS name. Figure 7. Cluster with Microsoft NLB Table 4. Client Connects to Server (NLB Cluster) Using DNS Name URL Entered by Jill on Jillxp-wks Log on Account for KofaxServer Service Additional Configuration Required by a Domain Administrator KFSThinClient Kfs-service-user On the domain controller, register DNS entry wwwkfs.kofax.com as NLB cluster name pointing to the static IP address assigned to the NLB cluster. On the domain controller, register SPN HTTP/wwwkfs.kofax.com under user Kfs-service-user. Then, configure every Kofax Front Office Server in the cluster to use Kfs-service-user as the KofaxService log on account. KFSThinClient Kfs-service-user Same two steps above plus: Add the FQDN (wwwkfs.kofax.com) to the Intranet zone or Trusted zone in Internet Explorer. This can be done individually on each client browser, or it can be done on the domain controller with Group Policies so that the setting will be applied to all clients in the domain. 21

22 Back Up and Restore The steps to back up and restore your data depend on whether you have a Departmental or Enterprise configuration. Backing Up Departmental Configurations You may want to back up important data before upgrading, and regularly to be able to restore a failed system to a certain state. Make sure that you have your original Kofax Front Office Server installation media (or installation media of the same version) before proceeding. 1 In the Services console, stop the SQL Server (KFS) service. 2 Create backup copies of the following folders: <Kofax Capture Server folder>\kfs<version> \Avalin, \Resources, and \SQLServer at the root of the Kofax Front Office Server installation 3 Verify that the backup was successful, and store in a safe location. Restoring Departmental Configurations 1 Remove the non-functional Kofax Front Office Server installation from the computer. This can be done by uninstalling the software or restoring the computer a state before Kofax Front Office Server was installed. Be sure that all Kofax Front Office Server software is removed from the computer. 2 Install the same version of Kofax Front Office Server as you previously backed up, because the installer versions must match. If possible, install to the same path as the original installation. 3 In the Services console, stop the following services: KofaxServer SQL Server (KFS) If you have a 32-bit computer with the Kofax Server Monitor running in the system tray, 4 right-click the icon and select Exit. 5 Delete the following folders: <Kofax Capture Server folder>\kfs<version> \Avalin, \Resources, and \SQLServer at the root of the Kofax Front Office Server installation 6 Replace the deleted folders with the backup data folders. 7 Set the Security permissions of the following folders to grant Full Control to the Windows user that was specified for the Kofax Front Office Serverservice during installation: <Kofax Capture Server folder>\kfs<version> \Avalin and \Resources at the root of the Kofax Front Office Serverinstallation folder 8 Set the Security permissions of the \SQLServer at the root of the Kofax Front Office Server installation to grant Full Control to the NETWORK SERVICE user. 9 In the Services console, start the following services: KofaxServer SQL Server (KFS) 22

23 10 On 32-bit computers, you can display the Kofax Server Monitor in the system tray by selecting Start, navigating to Kofax Front Office Server, and clicking Kofax Server Monitor. Backing Up Enterprise Configurations You may want to back up important data before upgrading, and regularly to be able to restore a failed system to a certain state. Make sure that you have your original Kofax Front Office Server installation media (or installation media of the same version) before proceeding. 1 Create backup copies of the following folders: <Kofax Capture Server folder>\kfs<version> \Avalin and \Resources at the root of the Kofax Front Office Server installation 2 Verify that the backup was successful, and store in a safe location. 3 Backup your SQL Server or Oracle database state. Restoring Enterprise Configurations 1 Remove the non-functional Kofax Front Office Server installation from all computers in the cluster. This can be done by uninstalling the software or restoring the computers a state before Kofax Front Office Server was installed. Be sure that all Kofax Front Office Server software is removed from the computer. 2 Install the same version of Kofax Front Office Server as you previously backed up, because the installer versions must match. If possible, install to the same path as the original installation. 3 In the Services console, stop the KofaxServer service. 4 If you have a 32-bit computer with the Kofax Server Monitor running in the system tray, right-click the icon and select Exit. 5 Delete the following folders: <Kofax Capture Server folder>\kfs<version> \Avalin and \Resources at the root of the Kofax Front Office Server installation 6 Replace the deleted folders with the backup data folders. 7 Set the Security permissions of the following folders to grant Full Control to the Windows user that was specified for the Kofax Front Office Server service during installation: <Kofax Capture Server folder>\kfs<version> \Avalin and \Resources at the root of the Kofax Front Office Server installation 8 Restore your backed-up SQL Server or Oracle database state. 9 In the Services console, start the KofaxServer service. 10 On 32-bit computers, you can display the Kofax Server Monitor in the system tray by selecting Start, navigating to Kofax Front Office Server, and clicking Kofax Server Monitor. Change System Configuration You can change several system configuration options. Changing SQL Server Database Authentication If your SQL Server database authentication username or password is changed after installation, you need to change the database authentication credentials in both Kofax Capture and Kofax Front Office Server. 23

24 1 In the database management console, make the changes to the database credentials. 2 For Kofax Capture, do the following: a On thekofax Capture server, on the Windows Taskbar, select Start, Run, and type DBUtil in the text field. Click OK. The Database Utility will start. b If you are prompted for credentials for a Kofax Capture user, enter credentials of a user with administration utilities rights and click OK. c Connection to the database cannot be made, so the Kofax Capture - Password screen appears, where you enter the new database access credentials. d Click OK. A message that the credentials have been changed briefly appears. 3 For Kofax Front Office Server, do the following: a Stop Kofax Front Office Server on the local host and, if you have a cluster installation, all other hosts in the cluster. b On the local Kofax Front Office Server host or any host machine in a cluster, run <installation path>\kofax\front Office Server\OtherResources \Utilities\kfsutil.bat. c If you are prompted for credentials for a Kofax Capture user, enter credentials of a user with administration utilities rights and click OK. d Connection to the database cannot be made, so the Kofax Front Office Server Utilities - Database Authentication screen appears, where you enter the new database access credentials. e Click OK. A message that the credentials have been changed briefly appears. f Restart Kofax Front Office Server on the local host and, if you have a cluster installation, all other hosts in the cluster Changing the Kofax Front Office Server Location The default location of the Kofax Capture server files (the shared folder that contains various database, XML, and other files used by Kofax Capture) is C:\Documents and Settings \All Users\Application Data\Kofax\CaptureSV. During Kofax Front Office Server installation, a \KFS<version> folder is created which holds all the shared files for Kofax Front Office Server. If the location of the Kofax Captureserver files changes (for example, if the Kofax Capture server is duplicated on a second computer, or the location of the shared server files changes), the Kofax Capture ACDeployutil utility can be used to automatically configure Kofax Capture for the new locations. However, there are some manual steps you must perform to enable Kofax Front Office Server to recognize the changes. 1 Stop all Kofax Capture components and stop every Kofax Front Office Server. 2 Make a registry change to update the Classpath (-Djava.class.path) to reflect the new location of the Kofax Capture server files: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \KofaxServer\Parameters\ JVM Option Number 3 For example: -Djava.class.path=\\<new server hostname if it changed> \<additional path folders if changed>\capturesv\kfs<version> \Config;C:\Program Files\Kofax\Front Office Server\Avalin\jboss \bin\run.jar;c:\program Files\Kofax\Front Office Server\Avalin \jboss\server\avalin\lib;c:\program Files\Kofax\Front Office Server\Avalin\WindowsService\KFSService.jar 3 In the \KFS<version>\Config folder, locate the shared_resources.properties file and open it in a text editor. Modify the following properties, and then save and close the file: scanjobsdir 24

25 inboxdir 4 If you will be adding additional servers to a Kofax Front Office Server cluster: In the \KFS<version> folder, locate the MasterConfig.properties file and open it in a text editor. Modify the value(s) of any changed host names in the loadbalanceservers property (the first server listed is the first server installed in the cluster), and then save and close the file. 5 Start all Kofax Capture components and every Kofax Front Office Server. Change Host Names The host name of a computer should not be changed after Kofax Front Office Server has been installed. Changing the host name may cause problems connecting to MFPs. You can restore connections by changing the host name back to the one you used when you licensed Kofax Front Office Server. The host name of an MFP also should not be changed after it has been added to Kofax Front Office Server. Because the Administration Console does not recognize that the MFP s host name has changed, it instead recognizes it as a different device. If you add the device with the new host name, the Administration Console will have two records and use two input licenses for the same device. Using the Kofax Front Office Server Utilities Kofax Front Office ServerUtilities is a standalone application that allows you to do the following tasks, which are described in the remainder of this section: Switch between supported databases Manage document tracking data 1 Stop Kofax Front Office Server on the local host and, if you have a cluster installation, all other hosts in the cluster. 2 On the local host or any host machine in a cluster, locate <installation path>\kofax \Front Office Server\OtherResources\Utilities\kfsutil.bat. Then, do either of the following: For Windows Server 2008, right click on kfsutil.bat and select Run as administrator. For Windows Server 2003, run kfsutil.bat. 3 Log on if prompted. The Kofax Front Office Server Utilities screen appears. 25

26 Figure 8. Kofax Front Office Server Utilities Screen 4 The utility comes with its own Help system. Click the Help button and follow the instructions for the task you want to perform. Switching Between Supported Databases The Database utility migrates data between the database types supported by Kofax Front Office Server. To run the utility, you must be a user with rights to use the Kofax Capture administrative utilities. The Database tab allows you to select which database configuration to use with Kofax Front Office Server. Configurations on a single server use the Microsoft SQL Server 2005 Express Edition database by default. If desired, you can switch to a SQL Server or an Oracle database to actively administer the database, or for scalability and availability. You can use the Database utility to change the type of authentication for a SQL Server database without migrating the data, such as switching from SQL Server to Windows authentication. Use the Database utility to update the credential, and then use SQL Server Management Studio to change the authentication type. You can switch databases as often as you like. The rest of this section describes the additional database options. Important The database to use for Kofax Front Office ServerKofax Capture needs to be created by the database administrator before you can switch to it. The utility will not create the database for you. Managing Document Tracking Data The Document Tracking menu options allow you to export data to CSV (comma separated values) files or delete data. The options work on all the current document tracking data: There are no options for constraints. See the Help for instructions. See Manage Document Tracking Activity on page 45 for information about what data is generated for document tracking. 26

27 Set Options for the Thin Client You can set several options related to the Thin Client. Defining the Page Size for the Thin Client List of Documents When you are viewing a list of documents in the Inbox, only a certain number of these documents display at one time, on a page of the list. If the number of documents in the Inbox exceed a defined maximum for a page, you can view additional pages of the list. The Thin Client installs with a default page size for the list of documents. If you have a preference, you can change the maximum number of documents to display on a single page of the list. You can set the page to display from 1 to 150 listed documents. 1 In the \KFS<version>\Config folder, locate the KFSportal.properties file and open it in a text editor. 2 Edit the following property to specify the desired maximum number documents for a page of the list of documents: paging.page.size 3 Save the file. The change will take affect for all new sessions of the Thin Client. Setting Session Timeout You can set the number of minutes of inactivity before the Thin Client session will timeout and the user will have to log on again. 1 In the \KFS<version>\Config folder, locate the KFSportal.properties file and open it in a text editor. 2 Edit the following property to specify the desired session timeout: client.session.timeout 3 Save the file. The change will take affect for all new sessions of the Thin Client. Optimizing Thumbnail Generation If thumbnail generation in the Thin Client slows down other processes in Kofax Front Office Server, you can lower the number of threads or the priority. See the comments in the file for additional instructions. 1 In the \KFS<version>\Config folder, locate the KFSportal.properties file and open it in a text editor. 2 Edit one or both of the following properties: thumbnail.generator.threads thumbnail.generator.priority 3 Save the file. Any changes will take affect for all new sessions of the Thin Client. Set Up to Scan Directly from the Thin Client Users can scan directly from the Thin Client from a TWAIN- or WIA-compatible scanner that is connected directly to their computer. When they scan the document, it appears in the Thin Client Inbox. 27