System Administration

Transcription

1 System Administratin ZENwrks Mbile Management 2.7.x August 2013

2 Legal Ntices Nvell, Inc., makes n representatins r warranties with respect t the cntents r use f this dcumentatin, and specifically disclaims any express r implied warranties f merchantability r fitness fr any particular purpse. Further, Nvell, Inc., reserves the right t revise this publicatin and t make changes t its cntent, at any time, withut bligatin t ntify any persn r entity f such revisins r changes. Further, Nvell, Inc., makes n representatins r warranties with respect t any sftware, and specifically disclaims any express r implied warranties f merchantability r fitness fr any particular purpse. Further, Nvell, Inc., reserves the right t make changes t any and all parts f Nvell sftware, at any time, withut any bligatin t ntify any persn r entity f such changes. Any prducts r technical infrmatin prvided under this Agreement may be subject t U.S. exprt cntrls and the trade laws f ther cuntries. Yu agree t cmply with all exprt cntrl regulatins and t btain any required licenses r classificatin t exprt, re-exprt r imprt deliverables. Yu agree nt t exprt r re-exprt t entities n the current U.S. exprt exclusin lists r t any embarged r terrrist cuntries as specified in the U.S. exprt laws. Yu agree t nt use deliverables fr prhibited nuclear, missile, r chemical bilgical weapnry end uses. See the Nvell Internatinal Trade Services Web page ( fr mre infrmatin n exprting Nvell sftware. Nvell assumes n respnsibility fr yur failure t btain any necessary exprt apprvals. Cpyright Nvell, Inc. All rights reserved. N part f this publicatin may be reprduced, phtcpied, stred n a retrieval system, r transmitted withut the express written cnsent f the publisher. Nvell, Inc Suth Nvell Place Prv, UT U.S.A. Online Dcumentatin: T access the latest nline dcumentatin fr this and ther Nvell prducts, see the Nvell Dcumentatin Web page ( Nvell Trademarks Fr Nvell trademarks, see the Nvell Trademark and Service Mark list ( tmlist.html). Third-Party Materials All third-party trademarks are the prperty f their respective wners.

3 Table f Cntents Accessing the Dashbard 4 Organizatin Administratin 6 Updating Organizatin Infrmatin... 6 Signing Certificate Uplad... 7 APNs Certificate Uplad... 7 ios Cnfiguratr Grups... 9 Organizatin Administratr Rles Predefined Organizatin Administratr Rles Custmized Organizatin Administratr Rles Organizatin Administrative Rles: User Privacy Prtectin Cnfiguring OpenID Prviders fr Organizatin Administratrs Organizatin Administratr Lgins Creating Organizatin Administratr Lgins Managing Organizatin Administratr Lgins Imprting Organizatin Administratr LDAP Grups Server Lgging 26 Synchrnizatin Lgs Database Task Scheduler Lg Data Usage Lg Device Lgs Errr Chain Lg (ios device specific) Licensing Lg Mail Message Lg System Administratin 36 Managing Multiple Organizatins Managing the License Database Task Scheduler Plug-Ins System Administratr Rles Predefined System Administratr Rles Custmized System Administratr Rles Cnfiguring an OpenID Prvider fr System Administratrs System Administratr Lgins Creating System Administratr Lgins Managing System Administratr Lgins Imprting System Administratr LDAP Grups System Grup ing System Settings Custm Dashbard and Lgin Lgs Signing Certificate Uplad Update Management Administratr Audit Trail Appendix A: Rle Permissins 62 Appendix B: System Maintenance 65 ZENwrks Mbile Management 2.7.x System Administratin Guide Accessing the Dashbard 3

4 Accessing the Dashbard Requirements ZENwrks Mbile Management dashbard requirements: Micrsft Internet Explrer, Firefx, r Safari Adbe Flash Player Minimum screen reslutin: 1024 x 768 Desktp cmputer running Windws OS In yur Web brwser, enter the server address f the ZENwrks Mbile Management server, fllwed by /dashbard Example: Standard Lgin Lg in t the ZENwrks Mbile Management dashbard using yur administrative lgin credentials in ne f the fllwing frmats: Lcally authenticated lgins enter: address and passwrd LDAP authenticated lgins enter: dmain\ldap username and LDAP passwrd A system administratr can create additinal lgins t the dashbard with system administratr, rganizatin administratr, r supprt administratr privileges. See the System Administratr Lgins and Organizatin Administratr Lgins sectins in this guide fr details. ZENwrks Mbile Management 2.7.x System Administratin Guide Accessing the Dashbard 4

5 OpenID Lgin Use yur OpenID credentials t lg in. 1. At the ZENwrks Mbile Management lgin screen, select the icn identifying the OpenID prvider yu use: ZENwrks, Ggle, Yah!, r Facebk. 2. Enter the Zne r Organizatin, an easy t remember name ZENwrks Mbile Management uses t redirect yu t the OpenID prvider prtal. 3. At the prvider site, enter yur OpenID credentials. Nte: If this is the first time yu have lgged in t ZENwrks Mbile Management with an OpenID r yur OpenID infrmatin has changed, yu will be prmpted fr a PIN cde befre entering the ZENwrks Mbile Management dashbard. Zne Name and new PIN cdes are ed t yu frm the ZENwrks Mbile Management server. ZENwrks Mbile Management 2.7.x System Administratin Guide Accessing the Dashbard 5

6 Organizatin Administratin This sectin f the guide dcuments tpics related t managing a single rganizatin. See Managing Multiple Organizatins fr infrmatin regarding management f a ZENwrks Mbile Management server with multiple rganizatins. Updating Organizatin Infrmatin Yu can update the rganizatin infrmatin if administrative cntacts r rganizatin defaults change. Select System > Organizatin and update the fllwing infrmatin: Organizatin name and cntact infrmatin Welcme letter enablement s a welcme letter t users when they are added EULA enablement - when this ptin is enabled, users must accept an End User License Agreement t cmplete ZENwrks Mbile Management app enrllment SMTP server name Signing Certificate Uplad buttn (see descriptin) APNs Certificate Uplad buttn (see descriptin) APNs Expiratin Date ios Cnfiguratr Grups buttn (see descriptin) Hands-Off enrllment defaults: Plicy Enfrcement Type Plicy Schedule Plicy Suite(s) Device Cnnectin Schedule (Administrative) LDAP Server Liability ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 6

7 Signing Certificate Uplad The signing certificate is a security measure that authenticates the server and allws ios devices t recgnize it as a trusted surce. The signing certificate Uplad buttn allws yu t add a signing certificate fr the rganizatin. This must be a CA signed certificate; because self-signed certificates are currently nt supprted. A Signing Certificate designated here fr the rganizatin verrides the system-wide Signing Certificate defined in System Settings. 1. Select System > System Administratin > Organizatins. 2. Select an rganizatin frm the list and click the Uplad buttn next t the signing certificate field. 3. Click the Brwse buttn, then navigate t and select the file cntaining the certificate. 4. Enter the Passwrd assciated with the file and click Uplad. 5. Click Save Changes n the gray ptin bar. APNs Certificate Uplad Apple Push Ntificatin Service (APNs) is a highly secure and efficient service fr prpagating infrmatin t the ios devices in yur envirnment. An APNs certificate applied t the ZENwrks Mbile Management server prvides Apple ios MDM functinality fr ios devices in yur envirnment. Functinality includes: Devices supprt Selective Wipe, Lck Device, and Clear Passcde Full Wipe and Lck Device cmmands are applied immediately Yu can recrd and access installed applicatins n devices Yu can recrd and access installed cnfiguratin prfiles n devices Yu have access t additinal device statistics Cnfiguratin prfile updates require n user interactin The APNs Certificate Uplad buttn allws yu t apply the APNs certificate that yu generated n the Apple Develpment prtal. Yu need: The APNs certificate file (the.pfx frmat) The passwrd yu set when exprting the certificate The APNs certificate settings can be edited if necessary. Hwever, a change t the APNs certificate settings requires ios device users t relad the APN prfile n the device. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 7

8 T Uplad the APNs Certificate: 1. Select System > Organizatin. 2. Click the Uplad buttn next t the APNs Certificate field. 3. Click the Brwse buttn, then navigate t and select the.pfx file cntaining the APNs certificate. 4. In the Certificate Passwrd field, enter the passwrd yu set when exprting the certificate. 5. Enter the Apple ID used t generate the certificate, if yu want t display it fr reference n the Organizatin Settings page. This infrmatin can be useful at renewal time. 6. Check the Use Default URLs bx t ppulate the Server URL and Check in URL fields with This is the required frmat f the URLs. Verify that the <ServerAddress> is the external address f the ZENwrks Mbile Management server. If yu have nt accessed the Web site externally, d nt use the default check bx. Enter the URLs manually, in the frmat nted abve. 7. Click the Submit buttn. After yu have upladed an APNs certificate, it appears under the APNs Certificate field n the dashbard. Nte: The APNs certificate must be renewed annually. The expiratin date is displayed n the Organizatin Settings page. Yu can als use the Test Nw buttn t check the certificate s validity. The test will return the certificate s activatin and expiratin dates. 8. Click Save Changes when yu are finished. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 8

9 ios Cnfiguratr Grups Apple Cnfiguratr is a tl that assists administratrs in the deplyment and management f ios devices in business r educatin settings. It is well suited t envirnments where devices are ften reassigned r where they are shared by multiple users. When integrated with ZENwrks Mbile Management, the applicatin is useful as a deplyment tl since it prvisins multiple devices quickly, enrlling them with the ZENwrks Mbile Management server and staging each device with the apprpriate MDM prfiles. Create an ios Cnfiguratr Grup prfile and exprt it fr use with the Apple Cnfiguratr. The ZENwrks Mbile Management prfile, nce imprted int the Cnfiguratr, can be used t quickly cnfigure a fleet f mbile devices. Select System > Organizatin Any device assciated with the Cnfiguratr Grup will appear n the ZENwrks Mbile Management user grid with the Cnfiguratr Grup name. Refer t the Apple Cnfiguratr Integratin guide fr details. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 9

10 Organizatin Administratr Rles See als System Administratr Rles Predefined Organizatin Administratr Rles There are three predefined Organizatin Administratr rles. The permissins fr these rles cannt be altered. Yu can view the set permissins fr these rles via the Rle Permissins ptin in the System view: Organizatin Administratin Rles. The three predefined rganizatin administratr rles are: Full Organizatin Admin - Gives full administrative permissins in nly ne rganizatin n the ZENwrks Mbile Management server. The ZENwrks Mbile Management System view n the dashbard is limited t the Organizatin, Organizatin Administratrs, Organizatin Administrative Rles, View Lgs, and Abut ZENwrks menu ptins. Supprt Organizatin Admin Gives limited administrative access r read nly access in nly ne rganizatin n the ZENwrks Mbile Management server. Organizatinal Supprt Administratrs can individual users, but nt grups f users. Restricted Organizatin Admin Restricted frm viewing private data such as Lcatin, MMS/SMS Lg, Phne Lg, and File Archive. Gives Read nly permissins fr all ther views in nly ne rganizatin n the ZENwrks Mbile Management server. Organizatin administratr credentials give access t ne specific rganizatin n the ZENwrks Mbile Management server. Credentials can be authenticated via an LDAP server and can be assigned Full Admin, Supprt Admin (read-nly), r Restricted Admin (limited read-nly) permissins. Wh Shuld Have an Organizatin Administratr Lgin Organizatin Administratr Lgins are ideal fr thse respnsible fr cnfiguring and maintaining a single rganizatin n a system with grups f users that have been divided int separate rganizatins. ORGANIZATION ADMINISTRATOR ROLES Dashbard View Supprt Organizatin Admin Restricted Organizatin Admin Activity Mnitr Users Read-nly access; cannt disable r snze alerts Can add r remve users and perfrm all the functins in the right-hand Details panel, except Shw Recvery Passwrd Can an individual user, but cannt use Grup ing Can perfrm mst functins in the left-hand panel f User Prfile Can view the grids in the Audit Data and Search Text Message Lg ptins (User Prfile), but cannt view the bdy r attachments f a text message Can chse the Visible Clumns Read-nly access; cannt disable r snze alerts Restricted frm adding r remving users and frm all functins in the right Details panel Restricted frm sending an t an individual user r a grup Restricted frm the Lcatin Data, Audit Data, Search Phne Lg, Search Text Message Lg, and File Archive ptins in the left panel f User Prfile Read-nly access t ptins in the left panel f User Prfile Can chse the Visible Clumns fr the Users list ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 10

11 fr the Users list Organizatin Read-nly access Read-nly access Reprting Full access (view and exprt) Full access (view and exprt) System Read-nly access Restricted frm the System Administratin ptin in the left panel Read-nly access Restricted frm the System Administratin ptin in the left panel Custmized Organizatin Administratr Rles Administratrs can create custmized rganizatin administratr rles t tailr the permissins assciated with ZENwrks Mbile Management dashbard lgin credentials. When a custm rle has been created, it appears as a chice in the drp-dwn list f the Add Administratr Wizard s Rle field. See Organizatin Administratr Lgins. Administratrs wh are lgged in when changes are made t rle permissins must lg ut and lg in again fr permissin changes t take effect. Select System > Organizatin Administrative Rles > Rle Permissins > Add Rle 1. Chse a methd fr creating an Organizatin Administrative Rle: Use the sliders t determine the rle s initial settings. The new rle cpies the settings f the predefined Organizatin Full Admin, Supprt Admin, r Restricted Admin. Cpy the settings f an existing rle 2. Specify the rle permissins t cpy. 3. Enter a Rle Name and Descriptin. 4. Click Finish t save the new rle. 5. Find and select the rle in the Organizatin Administrative Rles grid. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 11

12 6. Set the general permissins fr the rle: Prevent rle frm managing administratr accunts, rles and user privacy prtectins Lcks the rle ut f mdifying administratr accunts, administratr rles, and user privacy prtectin. Mst rles shuld be lcked, except thse fr administratrs requiring full privileges. If set t YES, this permissin verrules the System Sectin Permissins, regardless f hw they are set. Defaults t YES when creating a rle with the sliders. If yu are cpying an existing rle, the setting f the cpied rle is the default. Prevent rle frm viewing prtected data as defined in User Privacy Prtectin Blcks administratrs assigned this rle frm viewing the prtected data f nly the users r plicy suites designated in User Privacy Prtectin. (Autmatically places the rle in the Restricted clumn f the Restrict Organizatin Administrative Rles list. See User Privacy Prtectin.) Defaults t YES when creating a rle with the sliders. If yu are cpying an existing rle, the setting f the cpied rle is the default. 7. Set the permissins assciated with dashbard access. See Appendix A: Rle Permissins fr a cmprehensive list. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 12

13 Organizatin Administrative Rles: User Privacy Prtectin Private data includes a user s SMS/MMS cntent, lcatin data, phne lgs, and file list. User Privacy Prtectin prvides a way t prtect the private data f individual users r users assigned t a particular plicy suite withut restricting rganizatin administrative rles frm viewing the private data f all users. Example: Yu assign a rle t an administratr with permissins fr viewing private data. Hwever, rganizatin administratrs in this rle must be restricted frm viewing the private data f yur executive staff. Yu can add the executive staff users t the User Privacy Prtectin list and designate the administrative rle as ne that is restricted frm viewing the private data f users n this list. Administratrs wh are lgged in when changes are made t the User Privacy Prtectin list r the Restrict Organizatin Administrative Rles list must lg ut and lg in again fr permissin changes t take effect. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 13

14 Select System > Organizatin Administrative Rles > User Privacy Prtectin > Add User Privacy Prtectin. Adding Users t the Privacy Prtectin List User Privacy Prtectin prvides a way t prtect the private data f individual users r users assigned t a particular plicy suite. Administrative rles can be blcked frm viewing the private data f users n this list, even if their rle permissins allw them t view private data assciated with the general user base. 1. Select the User r Plicy Suite ptin. An individual user r the grup f users assigned t a Plicy Suite. 2. If yu are adding an individual user t the privacy prtectin list, enter the user s Dmain and User Name. 3. If yu are adding users assigned t a plicy suite, select a plicy suite frm the drp-dwn list. 4. Select the bx beside the Privacy Prtectins yu wish t enable: 5. Click Finish t save. Prtect SMS Prtect MMS Prtect Lcatin Prtect Phne Lgs Prtect File List ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 14

15 Adding Administratr Rles t the Restricted/Nt Restricted List Designate each custmized administrative rle as ne that is Restricted r Nt Restricted frm viewing the private data belnging t users n the User Privacy Prtectin list. All predefined and custmized rles are listed in either the Nt Restricted r Restricted list. The predefined rles cannt be mved frm ne clumn t anther. The predefined Full Admin rle is always Nt Restricted. The predefined Supprt Admin and Restricted Admin rles are always Restricted. 1. Select an administrative rle n either side f the list. (Hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item). 2. Click Add t mve a rle frm Nt Restricted t Restricted. 3. Click Remve t mve a rle frm Restricted t Nt Restricted. 4. Click Save Changes n the ptin bar at the tp f the page. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 15

16 Cnfiguring OpenID Prviders fr Organizatin Administratrs OpenID is an pen standard that allws administratrs t lg in and authenticate using an utside surce. Cnfiguring the system includes defining the OpenID prvider settings and enabling r disabling the OpenID ptin fr each administratr. See als OpenID Cnfiguratin fr System Administratrs. Add an OpenID Prvider fr Organizatin Administratrs There can be multiple OpenID prviders fr Organizatin Administratrs, hwever, nly ne f each type can be cnfigured. 1. Select Organizatin > OpenID Prviders. 2. Select ne f the Predefined Prviders frm the drp-dwn list. Chse Facebk, Ggle, Yah!, r ZENwrks. 3. If yu chse ZENwrks as the prvider, enter the fllwing: Zne - enter a friendly name fr the Prvider URL. Administratrs use this at lgin t access the prvider. If there are ther rganizatins n the server r yu are defining a prvider fr bth rganizatin and system administratrs, this name must be unique. The Zne name is ed t the administratr alng with a PIN cde they will use the first time they lg in with OpenID credentials. OpenID Prvider URL - enter the URL f the ZENwrks Primary Server in the fllwing frm: ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 16

17 4. At the OpenID Return URL field, enter the URL f the server t which the user is returned after successful prvider validatin. The default is the current ZENwrks Mbile Management server URL. 5. Enable the OpenID ptin fr each administratr yu will allw t lg in with OpenID credentials. See als Add an OpenID Authenticated Organizatin Administratr Lgin. Update OpenID Prvider Settings Yu can enable, disable, r remve an existing OpenID prvider. Yu can als change its settings r reset the OpenID Pin fr all users lgging in thrugh this OpenID prvider. 1. Select Organizatin > OpenID Prviders and select a prvider frm the left panel. 2. Yu can update any f the fllwing fields: Enabled mark the checkbx t enable the prvider; t disable a prvider, verify that n administratrs are using the prvider, then remve the mark frm this checkbx. Predefined Prviders a drp-dwn list f the prvider types: Facebk, Ggle, Yah!, r ZENwrks Zne (ZENwrks prvider) the friendly name fr the Prvider URL. Administratrs use this at lgin t access the prvider. If there are ther rganizatins n the server r yu are defining a prvider fr bth rganizatin and system administratrs, this name must be unique. The Zne is ed t the administratr alng with a PIN cde they will use the first time they lg in with OpenID credentials. OpenID Prvider URL (ZENwrks prvider) the URL f the ZENwrks Primary Server in the fllwing frm: Errr! Hyperlink reference nt valid. OpenID Return URL - the URL f the server t which the user is returned after successful prvider validatin. The default is the current ZENwrks Mbile Management server URL. Descriptin and Ntes 3. The OpenID Pin reset buttn will reset all administratr pins and issue s t administratrs with the new 4 character pin. The first time administratrs lg in t ZENwrks Mbile Management with an OpenID they are prmpted fr a PIN cde befre entering the ZENwrks Mbile Management dashbard. If any f the prvider settings are updated r yu reset pins with this buttn, new PIN cdes are generated and ed t administratrs frm the ZENwrks Mbile Management server. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 17

18 Organizatin Administratr Lgins See als, System Administratr Lgins Creating Organizatin Administratr Lgins An rganizatin administratr lgin gives access t nly ne rganizatin. It can authenticate against the ZENwrks Mbile Management server, an LDAP server, r an OpenID prvider. Multiple administratr lgins with assigned rles can be created thrugh the dashbard. Fr infrmatin n rles see Organizatin Administratr Rles. Lgin Passwrds: Administratrs can change their lgin passwrds frm an ptin lcated in the dashbard header. Best Practices: Maintain at least ne lcal rganizatin administratr that authenticates directly against the ZENwrks Mbile Management server and that des nt use LDAP r OpenID authenticatin. This will prvide access t the dashbard that is nt subject t the availability f external authrities. T create an Organizatin Administratr Lgin, select System > Organizatin Administratrs > Add Administratr. Chse hw the administratr shuld be authenticated: Manual (lcally), LDAP, OpenID. The Add Organizatin Administratr Wizard steps yu thrugh creating lgin credentials fr rganizatin administratrs. Add a Manually (lcally) Authenticated Administratr Lgins Add an LDAP Authenticated Administratr Lgins Add an OpenID Authenticated Administratr Lgins Enter the administratr details, then chse the accunt settings. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 18

19 Add a Manually (lcally) Authenticated Organizatin Administratr Lgin Add an rganizatin administratr lgin that authenticates directly against the ZENwrks Mbile Management server with a unique passwrd. 1. Use the administratr s address fr the Administratr Lgin. 2. Enter a Display Name. 3. Enter the administratr s Address. 4. Create and cnfirm a Passwrd fr the administratr lgin. 5. Mark the checkbx t prmpt the administratr fr a Passwrd Change at his/her first lgin. 6. Click Next. 7. Enter the Accunt Settings. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 19

20 Add an LDAP Authenticated Organizatin Administratr Lgin Add an rganizatin administratr lgin that authenticates using the administratr s LDAP credentials. 1. Select an LDAP server and brwse the LDAP flders/grups t select the administratr, r manually enter the administratr s LDAP server user name in the LDAP Administratr Lgin field. 2. Click Next. 3. Enter a Display Name and the Address fr the administratr. 4. Enter the remainder f the Accunt Settings. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 20

21 Add an OpenID Authenticated Organizatin Administratr Lgin Add an rganizatin administratr lgin that authenticates using the administratr s OpenID credentials. 1. Enter the Display Name fr this lgin. 2. Enter the administratr s Address. 3. Click Next. 4. Enter the Accunt Settings. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 21

22 Organizatin Administratr Accunt Settings Rle Assign the permissins level t the lgin. Chse frm: Predefined Full Admin Full administrative permissins fr a single rganizatin; Restricted frm System Administratin Predefined Supprt Admin Read-nly permissins with limited editing capabilities fr a single rganizatin Predefined Restricted Admin Read-nly permissins with private data restrictins fr a single rganizatin; cannt view Lcatin Data, Audit Data, MMS/SMS r Phne Lgs, and File Archive Any custm Organizatin Administratr rle created fr the system Default View Select the default view at lgin System Timeut Select an inactivity timeut in minutes fr this lgin Add t Alert Recipient List Check this bx t make this administratr a recipient f Cmpliance Management r SMS alerts. Carrier Carrier f the administratr s mbile device (ptinal - needed fr receiving SMS ntificatins fr system alerts). Phne Number Phne number f the administratr s mbile device (ptinal - needed fr receiving SMS ntificatins fr system alerts). Active Status Select the bx t enable this administrative lgin ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 22

23 Managing Organizatin Administratr Lgins Yu must be lgged int the ZENwrks Mbile Management server with Full Admin rganizatin administratr credentials r Full Admin system administratr credentials in rder t edit r remve an Organizatin Administratr. Best Practices: Maintain at least ne Organizatin Administratr that des nt use OpenID. This ensures that yu have a way t access the dashbard in the event that an OpenID prvider is unavailable. Managing Individual Administratr Lgins 1. Select System > Organizatin Administratrs. Click the Organizatin Administratrs tab. 2. Select an administratr frm the list. Edit the settings and click Save Changes. Yu can als remve the administratr by clicking Remve Administratr. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 23

24 Imprting Organizatin Administratr LDAP Grups Imprting administratr LDAP grups int the ZENwrks Mbile Management server eliminates the need t create administratr lgins. Any member f the imprted LDAP grup can lg in t the ZENwrks Mbile Management dashbard as lng as their LDAP credentials are successfully authenticated. At the first successful lgin, an accunt n the ZENwrks server is created fr the administratr using the prvisining settings assciated with the grup. 1. Select System > Organizatin Administratrs. Click the Administratr Grups tab. 2. T imprt an LDAP administratr grup, select an LDAP server frm the drpdwn list. Click the Imprt LDAP Grup buttn t select an administratr grup t imprt. Administratrs shuld familiarize themselves with the LDAP server structure and verify that grups they chse fr use with the ZENwrks Mbile Management server cntain the fllwing necessary attributes: User Identificatin Attribute, Grup Membership Attribute, Grup Object Class, and User Object Class. Grups withut these attributes shuld nt be used. 3. Select a grup t imprt and click Finish. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 24

25 4. T chse prvisining settings fr members f this grup, select an Administratr Grup frm the grid and cnfigure these settings fr the grup. Enfrced Rle Default View System Timeut Is Alert Recipient (administratrs receive ZENwrks Mbile Management SMS/ alerts) Carrier (required if administratrs are an alert recipients) 5. If there are administratrs that belng t multiple grups, use the arrws t the right f the grup grid t priritize the grups. The grup with the highest pririty will determine an administratr s prvisining assignments when he r she is added at the first successful lgin. ZENwrks Mbile Management 2.7.x System Administratin Guide Organizatin Administratin 25

26 Server Lgging System level lgs assist administratrs with diagnsing prblems and in understanding the cmmunicatins between devices and the server. Bth server and device lgging ptins are available. Viewing Organizatin and System-Wide Lgs Select the System view and expand the View Lgs ptin in the left panel. Chse ne f the lgs. The fllwing lgs can be selected fr viewing system-wide infrmatin, infrmatin frm ne r mre rganizatins, r infrmatin fr ne r all devices. ActiveSync Lg Allws yu t view events lgged during cnnectins between the ZENwrks Mbile Management server and the ActiveSync server and between the devices ActiveSync client and the ZENwrks Mbile Management server. ios MDM Sync Lg Allws yu t view successful events lgged during cnnectins between the ZENwrks Mbile Management server and the Apple ios MDM server and between the ZENwrks Mbile Management server and the device s ios MDM functins. Unsuccessful events (errrs) are lgged in the Errr Chain Lg. (ios device specific) ZENwrks Sync Lg - Allws yu t view events lgged during cnnectins between the device s ZENwrks Mbile Management app and the ZENwrks Mbile Management server. Data Usage Lg Allws yu t track the amunt f data being exchanged: Between the device s ZENwrks Mbile Management app and the ZENwrks Mbile Management server Between the device s ActiveSync client and the ZENwrks Mbile Management server As ios MDM traffic between the device and the ZENwrks Mbile Management servers Between the ZENwrks Mbile Management and ActiveSync servers. Device Lg Allws yu t view a list f the device lgs that have been previusly requested. T request a new lg, use the user level Device Lg ptin assciated with a user s prfile. Errr Chain Lg Allws yu t view detailed messages fr errrs lgged in the ios MDM Sync lg. (ios device specific) The fllwing lg can be selected fr viewing infrmatin fr ne r mre rganizatins. Mail Message Lg Allws yu t view recrds f grup s sent frm the dashbard. The fllwing lgs nly display system-wide infrmatin. Database Task Scheduler Lg Allws yu t view all database task scheduler tasks that executed successfully r that gave an errr. Licensing Lg Allws yu t view server license validatins that executed successfully r that gave an errr. ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 26

27 Synchrnizatin Lgs Synchrnizatin lgs give administratrs the ability t view events lgged during cnnectins between servers and events lgged during device cnnectins with servers. There are three lgs f this type: The ActiveSync Lg lgs events that ccur during cnnectins between the ZENwrks Mbile Management server and the ActiveSync server and between the devices ActiveSync client and the ZENwrks Mbile Management server. The ios MDM Sync Lg lgs successful events that ccur during cnnectins between the ZENwrks Mbile Management server and the Apple ios MDM server and between the ZENwrks Mbile Management server and the device s ios MDM functins. Unsuccessful events (errrs) are lgged in the Errr Chain Lg. (ios device specific) The ZENwrks Sync Lg lgs events that ccur during cnnectins between the device s ZENwrks Mbile Management app and the ZENwrks Mbile Management server. The lgs display: Organizatin Organizatin name DeviceSAKey A device s internal identifier Lg cde Cde number assciated with the lgged event Descriptin Descriptin assciated with the lg cde Functin Name Displays a returned errr; blank when lg event is successful Details Descriptin r reasn fr the errr; blank when lg event is successful Time stamp Date and time f the lg event Select ActiveSync Lg, ZENwrks Sync Lg, r ios MDM Sync Lg. The Lg Level defaults t Nrmal and the lg ppulates the grid with system-wide data frm the past hur. If yu change the lg level t Verbse, click Search. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the server lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 27

28 Sample Sync Lg Grid ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 28

29 Database Task Scheduler Lg The Database Task Scheduler Lg enables the administratr t view all database cleanup jbs that executed successfully r that gave an errr. The lg displays: Database Task Name Name assigned t the database cleanup task Lg Cde Cde number assciated with the lgged event Descriptin Descriptin assciated with the lg cde Functin Name Displays a returned errr; blank when the lg event is successful Details Descriptin r reasn fr the errr; blank when the lg event is successful Time stamp Date and time a database cleanup jb was executed Select Database Task Scheduler Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by editing the Frm/T filter. Click Search. When yu edit the date/time filter, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the database task scheduler lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 29

30 Data Usage Lg The data usage lg displays the amunt f data being exchanged between the device and servers; and the amunt f data assciated with the device that is prxied t and frm the ActiveSync server. The types f data traffic that are lgged include: Data between the device s ZENwrks Mbile Management app and the ZENwrks Mbile Management server Data between the device s ActiveSync client and the ZENwrks Mbile Management server ios MDM traffic between the device and the ZENwrks Mbile Management servers (ios devices nly) Data between the ZENwrks Mbile Management and ActiveSync servers A summary reprt f data usage statistics is als available in the Reprting sectin. The lg displays: Organizatin Organizatin name DeviceSAKey A device s internal identifier Traffic Type ActiveSync, ios MDM Sync, r ZENwrks Directin Incming r Outging Size (Bytes) Size f the data transferred Time stamp Date and time f the data transfer Select Data Usage Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the data usage lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 30

31 ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 31

32 Device Lgs The Device Lgs ptin at the system level is simply a list f previus requests fr device lgs. The dashbard grid des nt display lg recrds, but gives infrmatin n when lgs were received. Device lgs are available frm any device running the ZENwrks Mbile Management app. The grid displays: Organizatin Organizatin name DeviceSAKey A device s internal identifier Time Requested and Requester Received Whether r nt lg has been received Time Received Date and time a respnse was received Errr Errr message if lg culd nt be btained Select Device Lg. The lg ppulates the grid with system-wide ntificatins f lg receipts frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter t filters the time stamp f the lgs (nt the recrds in the lg) Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. Device Lg Grid Select a lg file and click the Dwnlad Lg buttn. Save the lg file n the desktp r in anther designated flder. The file can be viewed in the.txt frmat. ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 32

33 Errr Chain Lg (ios device specific) The errr chain lg prvides a view f messages detailing errrs lgged in the ios MDM Sync lg. The lg displays: Organizatin Organizatin name DeviceSAKey A device s internal identifier Errr Cde Cde number assciated with the errr Errr Dmain Cntains internal cdes used by Apple useful fr diagnstics (may change between Apple releases) Lcalized Descriptin Descriptin f cdes Time stamp Date and time the errr ccurred Select Errr Chain Usage Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Chsing ne device by entering its DeviceSAKey, all devices, r devices withut an SAKey (Null) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the errr chain lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 33

34 Licensing Lg The licensing lg is a lg f license validatins that executed successfully r that gave an errr. The lg displays: Lg Cde Cde number assciated with the lgged event Descriptin Descriptin assciated with the lg cde Functin Name Displays a returned errr; blank when lg event is successful Details Descriptin r reasn fr the errr; blank when lg event is successful Time stamp Date and time the license validatin ccurred Select Licensing Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by editing the Frm/T filter. Click Search. When yu edit the date/time filter, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the licensing lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 34

35 Mail Message Lg The mail message lg prvides an administratr with a methd t view the recrds f grup s sent frm the dashbard. The lg displays: Organizatin Organizatin name t which the was sent Administratr The administratr wh sent the SMTP Server The SMTP server thrugh which the was sent Subject subject Message Bdy text f the message Recipients s addresses f recipients f the Timestamp Date and time the was sent Ownership Whether device wnership was specified as criteria fr recipients; cmpany/persnal/any Liability Whether device liability was specified as criteria fr recipients; crprate/individual/any Select Mail Message Lg. The lg ppulates the grid with system-wide data frm the past hur. Narrw r expand the results f the search by: Editing the Frm/T filter Selecting ne r mre Organizatins (hld the SHIFT r CTRL key t select multiple items; hld the CTRL key t unselect an item) Click Search. When yu edit the date/time filter r the search criteria, the system maintains the changes as preferred settings fr all system level lg views until yu change the settings r lg ut f the dashbard. When the mail message lg has ppulated, it can be srted by any f the grid clumns and data can be exprted t a.csv r.xls file. ZENwrks Mbile Management 2.7.x System Administratin Guide Server Lgging 35

36 System Administratin This sectin f the guide dcuments tpics related t system level management f the ZENwrks Mbile Management server. The dashbard areas where system tasks are perfrmed require system administratr lgin credentials. System administratins can include the management f multiple rganizatins. In additin t all the Organizatin administratin permissins dcumented in the first part f this guide, a system administratr with full admin status has the fllwing system level permissins: View all rganizatins n the ZENwrks Mbile Management server Add, edit r remve rganizatins Switch rganizatins withut lgging ut and back in t anther rganizatin Create administrative rles and administrative lgins Send grup t ne r all rganizatins, administratrs, and users Access System Settings t uplad a signing certificate View server and device lgs Set database cleanup tasks Apply a plug-in Check fr and dwnlad ZENwrks Mbile Management server sftware updates System management tasks are perfrmed frm the System view. This view is nly accessible with a system administratr lgin. The lgin yu create when installing the ZENwrks Mbile Management server sftware is a system administratr lgin. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 36

37 Managing Multiple Organizatins Multi-Tenant ZENwrks Mbile Management Systems A single instance f the ZENwrks Mbile Management server applicatin supprts a multi-tenant architecture, which allws an enterprise t manage ne r multiple rganizatins. Multiple rganizatins might be used t categrize varius divisins f a cmpany. Fr example: Prductin/Sales/Management departments can each be an rganizatin n the same ZENwrks Mbile Management server r Seattle/Chicag/Bstn divisins can each be a separate rganizatin. Switching Organizatins When yu are lgged in t the ZENwrks Mbile Management system with a system administratr lgin, yu initially chse the rganizatin yu want t view. Yu als have access t all ther rganizatins existing n the server thrugh the System Administratin menu. Switching frm ne rganizatin t anther is accmplished by using the Switch Organizatins ptin. Frm the System view, select System Administratin > Organizatins. Click Switch Organizatins in the gray ptin bar. The Organizatin List The rganizatin list gives yu access t the cnfigured settings f each rganizatin n the server. Select an rganizatin frm the list t view r edit the cnfigured settings fr the rganizatin. Organizatin name and cntact infrmatin Welcme letter enablement s a welcme letter EULA enablement - when this ptin is enabled, users must accept an End User License Agreement t cmplete ZENwrks Mbile Management app enrllment SMTP server name Signing certificate Uplad buttn (see descriptin belw) Hands-Off enrllment cnfiguratin Default Plicy Suite Default Device Cnnectin Schedule Default (Administrative) LDAP Server Default Liability ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 37

38 Signing Certificate Uplad The signing certificate is a security measure that authenticates the server and allws ios devices t recgnize it as a trusted surce. The signing certificate Uplad buttn allws yu t add a signing certificate fr the rganizatin. This must be a CA signed certificate, because self-signed certificates are currently nt supprted. The SSL certificate being used n the server can als be used as the signing certificate. Exprt the SSL certificate t a file, selecting the bx that ensures that the private key gets exprted with the certificate. Then uplad it t the ZENwrks Mbile Management server. A signing certificate designated here fr the rganizatin verrides the system-wide signing certificate defined in System Settings. 1. Select System > System Administratin > Organizatins. 2. Select an rganizatin frm the list and click the Uplad buttn next t the Signing Certificate field. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 38

39 3. Click the Brwse buttn, then navigate t and select the file cntaining the certificate. 4. Enter the Private Key assciated with the certificate and click Uplad. 5. Click Save Changes n the gray ptin bar. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 39

40 Managing the License If yu are extending a ZENwrks Mbile Management sftware evaluatin license r mving an rganizatin t a license fr a purchased cpy f the sftware, yu must enter a new license key fr the server. Yu can als enter the TuchDwn vlume license key here, then enable the TuchDwn plicy t push the license t Andrid devices using TuchDwn. (Organizatin > Plicy Suites > (plicy suite) > TuchDwn > Installatin > Push TD enterprise license t device) Updating licenses requires full system admin lgin credentials. The Organizatin License 1. T access the License page, select System > License. 2. The License Type and number f Days Remaining n the license display. 3. Enter the license key prvided by yur Nvell Sales Representative in the ZMM License Key field and click Update. 4. Enter the license key prvided by yur Nvell Sales Representative in the TuchDwn Vlume License Key field and click Update. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 40

41 Licenses fr Multiple Organizatins If there are multiple rganizatins n the ZENwrks Mbile Management server, System Administratrs can view a list f rganizatins and the assciated licenses. Any ne f the licenses can be updated frm this page, as lng as the administratr has full system admin lgin credentials. 1. T access the Organizatin Licensing page, select System > System Administratin > Organizatin Licensing. 2. The grid displays each rganizatin n the server, its Status, License Type, and number f Days Remaining n the license. 3. T update a license, select it n the grid and enter the new license key prvided by yur Nvell Sales Representative in the Update License Key field. Click Save Changes. Database Task Scheduler Fr full dcumentatin n the Database Task Scheduler, see the Database Table Maintenance guide. When devices make a cnnectin t the ZENwrks Mbile Management Server, infrmatin regarding thse cnnectins is lgged in the database and stred fr ptential trubleshting purpses. The amunt f infrmatin that is lgged depends n several factrs, such as the number f users n the ZENwrks Mbile Management Server, the type f traffic being sent back and frth, the amunt f lgging taking place, and the frequency f device cnnectin intervals. Over time, this infrmatin can build up in the database and grw excessively. Administratrs with full admin lgin credentials can use the Database Task Scheduler t set clean-up jbs t run at regular intervals in rder t clear excess data and maintain ptimal database perfrmance. T access the Database Task Manager, select System > System Administratin > Database Task Scheduler. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 41

42 Plug-Ins The ZENwrks Mbile Management Plug-Ins feature allws administratrs t plug a SWF (Adbe Flash file) int the ZENwrks Mbile Management dashbard. This lets yu add a way t interface with anther cnsle t the dashbard. Frm the System page f dashbard, administratrs can define the lcatin f any SWF (Adbe Flash file) they have created. T further custmize the ZENwrks Mbile Management server pages, administratrs can insert custm lgs and icns via the System Settings that appear n the ZENwrks Mbile Management lgin page and in ZENwrks Mbile Management dashbard navigatin menu. T access Plug-Ins, select System > System Administratin > Plug-Ins. Yu must be a system administratr with full admin lgin credentials. Sample ZENwrks Dashbard with SWF Plugged In ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 42

43 Adding a Plug-In 1. Click Add Plug-In in the ptin bar. 2. Enter a Display Name and Descriptin. The name yu enter appears in the ZENwrks Mbile Management dashbard navigatin menu under the plug-in s icn. 3. In the SWF File field, enter a URL fr a remte strage lcatin r stre the.swf file n the ZENwrks Mbile Management server and enter the file name. A file stred lcally shuld be in /Nvell/ZENwrks/mbile/web/dashbard/plugins/swfs/ 4. In the Icn File field, enter a URL fr a remte strage lcatin r stre the icn file n the ZENwrks Mbile Management server and enter the file name. This icn appears in the ZENwrks Mbile Management dashbard navigatin menu. Clicking n this icn in the ZENwrks menu pens the Plug-In display area. A file stred lcally shuld be in /Nvell/ZENwrks/mbile/web/dashbard/plugins/icns/ Acceptable file frmats are.png,.jpg, r.gif Image size - W:34px, H:35px 5. If yu are using URLs, place an XML Crss Dmain Plicy File at the rt f the hsting server. S that Adbe Flash des nt prevent ZENwrks Mbile Management frm accessing data n the remte lcatins yu have designated, the crss plicy file must define exceptins. Click Dwnlad Example t dwnlad a template t assist yu in creating an XML file with the apprpriate cntent. 6. Mark the plug-in as Active fr it t take effect. Sample f the plug-in display area ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 43

44 System Administratr Rles See als Organizatin Administratr Rles Predefined System Administratr Rles There are six predefined rles built in t the ZENwrks Mbile Management system. The permissins fr these rles cannt be altered. Yu can view the set permissins fr these rles via the Rle Permissins ptin in the System view: System Administrative Rles r Organizatin Administratin Rles. Three f the predefined rles are used fr rganizatin administratr lgins. (See Predefined Organizatin Administratr Rles.) The three predefined system administratr rles are: Full System Admin There are n limitatins with this type f lgin credential. It gives full administrative permissins in every rganizatin created n the ZENwrks Mbile Management server. An administratr with this type f lgin can add rganizatins and switch rganizatins withut lgging ff the ZENwrks Mbile Management server. They can als apply ZENwrks Mbile Management server updates via the ZENwrks Mbile Management Update Manager applicatin and cnfigure the Database Task Scheduler. Supprt System Admin Gives limited administrative access r read nly access in every rganizatin created n the ZENwrks Mbile Management server. System Administratrs can switch rganizatins withut lgging ut f the ZENwrks Mbile Management server. Althugh they cannt apply ZENwrks Mbile Management server sftware updates, they can access the Update Management page in the dashbard where they can check fr and dwnlad ZENwrks Mbile Management patches in preparatin fr the applicatin f the update. Restricted System Admin Restricted frm viewing private data such as Lcatin, MMS/SMS Lg, Phne Lg, and File Archive. Has Read nly permissins fr all ther views. Restricted administratrs can switch rganizatins withut lgging ut f the ZENwrks Mbile Management server. System Administratr credentials give access t all rganizatins n the ZENwrks Mbile Management server. System Administratrs can switch rganizatins withut lgging ff the ZENwrks Mbile Management server. Credentials may be authenticated via an LDAP server and may be assigned Full Admin, Supprt Admin (read nly), r Restricted Admin (limited read nly) permissins. System Administratrs als have access t the Update Management infrmatin n the dashbard. System administratr credentials with Full Admin permissins are required t use the Update Manager applicatin. The administrative lgin created during the prcess f installing the ZENwrks Mbile Management server applicatin is a System Administratr Lgin with the predefined Full Admin permissins. See the table belw fr details n the varius System Administratr rles r view the permissins via the Rle Permissins ptin in the System view. Wh Shuld Have System Administratr Lgins A system administratr lgin is required fr anyne wh needs access t all rganizatins n the ZENwrks Mbile Management server. Sme examples are: Administratrs f a system where users have been gruped int separate rganizatins. Administratrs wh will apply ZENwrks Mbile Management server sftware updates. Administratrs wh will cnfigure database cleanup tasks. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 44

45 SYSTEM ADMINISTRATOR ROLES Dashbard View Supprt System Admin Restricted System Admin Activity Mnitr Read-nly access; cannt disable r snze alerts Users Can add r remve users and perfrm all the functins in the right-hand Details panel, except Shw Recvery Passwrd Can an individual user, but cannt use Grup ing Can perfrm mst functins in the left panel f User Prfile Can view the grids in the Audit Data and Search Text Message Lg ptins (User Prfile), but cannt view the bdy r attachments f a text message Can chse the Visible Clumns fr the Users list Read-nly access; cannt disable r snze alerts Restricted frm adding r remving users and frm all functins in the right Details panel Restricted frm sending an t an individual user r a grup Restricted frm the Lcatin Data, Audit Data, Search Phne Lg, Search Text Message Lg, and File Archive ptins in the lefthand panel f User Prfile Read-nly access t ptins in the left panel f User Prfile Can chse the Visible Clumns fr the Users list Organizatin Read-nly access Read-nly access Reprting Full access (view and exprt) Full access (view and exprt) System Read-nly access Can switch between rganizatins withut lgging ut f the ZENwrks Mbile Management server Can view the Update Management page; Can check fr and dwnlad server sftware updates. Cannt apply updates, because Supprt Admins d nt have access t the Update Manager Read-nly access Can switch between rganizatins withut lgging ut f the ZENwrks Mbile Management server Can view the Update Management page; Can check fr and dwnlad server sftware updates. Cannt apply updates, because Restricted Admins d nt have access t the Update Manager ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 45

46 Custmized System Administratr Rles Administratrs can create custmized system administratr rles t tailr the permissins assciated with ZENwrks Mbile Management dashbard lgin credentials. When a custm rle has been created, it appears as a chice in the drp-dwn list f the Add Administratr wizard s Rle field. See System Administratr Lgins. Administratrs wh are lgged in when changes are made t rle permissins must lg ut and lg in again fr permissin changes t take effect. 1. Select System > System Administratin > System Administrative Rles > Rle Permissins > Add Rle. 2. Chse a methd fr creating a System Administrative Rle: Use the sliders t determine the rle s initial settings. The new rle cpies the settings f the predefined System Full Admin, Supprt Admin, r Restricted Admin. Cpy the settings f an existing rle 3. Specify the rle permissins t cpy. 4. Enter a Rle Name and Descriptin. 5. Click Finish t save the new rle. 6. Find and select the rle in the System Administrative Rles grid. 7. Set the permissins assciated with dashbard access. See Appendix A: Rle Permissins fr a cmprehensive list. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 46

47 Cnfiguring an OpenID Prvider fr System Administratrs OpenID is an pen standard that allws administratrs t lg in and authenticate using an utside surce. Cnfiguring the system includes defining the OpenID prvider settings and enabling r disabling the OpenID ptin fr each administratr. See als OpenID Cnfiguratin fr Organizatin Administratrs. Manage the OpenID Prvider fr System Administratrs Yu can enable r disable the OpenID prvider cnfigured fr System Administratrs. Yu can als change its settings r reset the OpenID Pin fr all users lgging in thrugh this OpenID prvider. 1. Select System > System Administratin > OpenID Prvider. 2. Cnfigure the fllwing settings: Enabled mark the checkbx t enable the prvider; t disable a prvider, verify that n administratrs are using the prvider, then remve the mark frm this checkbx. Predefined Prviders select frm a drpdwn list f prvider types: Facebk, Ggle, Yah!, r ZENwrks OpenID Prvider URL (ZENwrks prvider) enter the URL f the ZENwrks Primary Server in the fllwing frm: andler=zenopenidhandler OpenID Return URL enter the URL f the server t which the user is returned after successful prvider validatin. The default is the current ZENwrks Mbile Management server URL. Descriptin and Ntes 3. The OpenID Pin reset buttn will reset all administratr pins and issue s t administratrs with the new 4 character pin. The first time administratrs lg in t ZENwrks Mbile Management with an OpenID they are prmpted fr a PIN cde befre entering the ZENwrks Mbile Management dashbard. If any f the prvider settings are updated r yu reset pins with this buttn, new PIN cdes are generated and ed t administratrs frm the ZENwrks Mbile Management server. 4. Enable the OpenID ptin fr each administratr yu will allw t lg in with OpenID credentials. See als OpenID Authenticated Administratr Lgins. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 47

48 System Administratr Lgins See als, Organizatin Administratr Lgins Creating System Administratr Lgins A System Administratr with full admin privileges is created during the initial installatin f ZENwrks Mbile Management. It is a lcal system administratr lgin in that it authenticates directly against the ZENwrks Mbile Management server with the unique passwrd yu created during the installatin. Additinal system administratr lgins with assigned rles can be created thrugh the dashbard. Fr infrmatin n rles see System Administratr Rles. Lgin Passwrds: Administratrs can change their lgin passwrds frm an ptin lcated in the dashbard header. Best Practices: Always maintain at least ne lcal system administratr that authenticates directly against the ZENwrks Mbile Management server and that des nt use LDAP r OpenID authenticatin. This will prvide access t the dashbard that is nt subject t the availability f external authrities. T create a System Administratr Lgin, select System > System Administratin > System Administratrs > Add System Administratr. Chse hw the administratr shuld be authenticated: Manual (lcal), LDAP, OpenID. The Add System Administratr wizard steps yu thrugh creating lgin credentials fr system administratrs. Add a Manually (lcally) Authenticated Administratr Lgin Add an LDAP Authenticated Administratr Lgin Add an OpenID Authenticated Administratr Lgin Enter the administratr details, then chse the accunt settings. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 48

49 Add a Manually (lcally) Authenticated System Administratr Lgin Add a system administratr lgin that authenticates directly against the ZENwrks Mbile Management server with a unique passwrd. 1. Use the administratr s address fr the Administratr Lgin. 2. Enter a Display Name. 3. Enter the administratr s Address. 4. Create and cnfirm a Passwrd fr the administratr lgin. 5. Mark the checkbx t prmpt the administratr fr a Passwrd Change at his/her first lgin. 6. Click Next. 7. Enter the Accunt Settings. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 49

50 Add an LDAP Authenticated System Administratr Lgin Add a system administratr lgin that authenticates using the administratr s LDAP credentials. 1. Select an LDAP server and brwse the LDAP flders/grups t select the administratr, r manually enter the administratr s LDAP server user name in the LDAP Administratr Lgin field. 2. Click Next. 3. Enter a Display Name and the Address fr the administratr. 4. Enter the remainder f the Accunt Settings. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 50

51 Add an OpenID Authenticated System Administratr Lgin Add a system administratr lgin that authenticates using the administratr s OpenID credentials. 1. Enter the Display Name fr this lgin. 2. Enter the administratr s Address. 3. Click Next. 4. Enter the Accunt Settings. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 51

52 System Administratrs Accunt Settings Rle Assign a permissins level t the lgin. Chse frm: Predefined Full Admin Full administrative permissins Predefined Supprt Admin Read-nly permissins with limited editing capabilities Predefined Restricted Admin Read-nly permissins with private data restrictins; cannt view Lcatin Data, Audit Data, MMS/SMS r Phne Lgs, and File Archive Any custm System Administratr rle created fr the system Default View Select the default view at lgin System Timeut Select an inactivity timeut in minutes fr this lgin Active Status Select the bx t enable this administrative lgin Passwrd Assign a passwrd if yu are creating a lgin that des nt use LDAP authenticatin. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 52

53 Managing System Administratr Lgins Yu must be lgged int the ZENwrks Mbile Management server with system administratr (Full Admin) credentials in rder t edit r remve a System Administratr. Best Practices: Always maintain at least ne System Administratr that authenticates directly against the ZENwrks Mbile Management server and that des nt use LDAP r OpenID authenticatin. Managing Individual Administratr Lgins 1. Select System > System Administratin > System Administratrs. Click the System Administratrs tab. 2. Select an administratr frm the list. Edit the settings and click Save Changes. Yu can als remve the administratr by clicking Remve System Administratr. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 53

54 Imprting System Administratr LDAP Grups Imprting system administratr LDAP grups int the ZENwrks Mbile Management server eliminates the need t create administratr lgins. Any member f the imprted LDAP grup can lg in t the ZENwrks Mbile Management dashbard as lng as their LDAP credentials are successfully authenticated. At the first successful lgin, an accunt n the ZENwrks server is created fr the administratr using the prvisining settings assciated with the grup. 1. Select System > System Administratin > System Administratrs. Click the Administratr Grups tab. 2. T imprt an LDAP administratr grup, select an LDAP server frm the drpdwn list. Click the Imprt LDAP Grup buttn t select an administratr grup t imprt. Administratrs shuld familiarize themselves with the LDAP server structure and verify that grups they chse fr use with the ZENwrks Mbile Management server cntain the fllwing necessary attributes: User Identificatin Attribute, Grup Membership Attribute, Grup Object Class, and User Object Class. Grups withut these attributes shuld nt be used. 3. Select a grup t imprt and click Finish. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 54

55 4. T chse prvisining settings fr members f this grup, select an Administratr Grup frm the grid and cnfigure these settings fr the grup. Enfrced Rle Default View System Timeut Is Alert Recipient (administratrs receive ZENwrks Mbile Management SMS/ alerts) Carrier (required if administratrs are an alert recipients) 5. If there are administratrs that belng t multiple grups, use the arrws t the right f the grup grid t priritize the grups. The grup with the highest pririty will determine an administratr s prvisining assignments when he r she is added at the first successful lgin. ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 55

56 System Grup ing System Grup ing gives the administratr the ability t send a system-wide t ne r multiple rganizatins and can include administratrs, users r bth. The sender can als elect t cpy the rganizatin cntacts. T send a grup , select System > System Grup . ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 56

57 System Settings Custm Dashbard and Lgin Lgs T custmize the ZENwrks Mbile Management server pages, administratrs can insert custm lgs and icns that appear in ZENwrks Mbile Management s dashbard navigatin menu and n the ZENwrks Mbile Management lgin page. T insert lgs, select System > System Administratin > System Settings. Yu must be a system administratr with full admin lgin credentials. In the Dashbard Lg File field, enter a URL fr a remte strage lcatin r stre the file n the ZENwrks Mbile Management server and brwse t select the file name. This lg appears in the upper left crner f the ZENwrks Mbile Management dashbard, next t the navigatin menu. A file stred lcally shuld be in Nvell/ZENwrks/mbile/web/dashbard/images/CustmLgs/ Acceptable file frmats are.png,.jpg, r.gif Image size: W:34px, H:35px Sample Custmized Dashbard Lg ZENwrks Mbile Management 2.7.x System Administratin Guide System Administratin 57