Installation and Configuration Guide

Installation and Configuration Guide BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Version 10.2

Published: 2015-11-12 SWD-20151112124827386

Contents Overview: BlackBerry Enterprise Service 10... 5 Overview: The BlackBerry Resource Kit for BlackBerry Enterprise Service 10... 7 Download the BlackBerry Resource Kit for BlackBerry Enterprise Service 10... 8 System requirements...9 Compatibility with other releases...9 System requirements: BlackBerry Enterprise Service 10 User Administration Tool... 9 System requirements: BlackBerry Directory Sync Tool... 11 System requirements: BlackBerry IT Policy Import and Export Tool... 13 System requirements: BlackBerry Enterprise Service 10 Log Monitoring Tool... 15 System requirements: BlackBerry Push Initiator Tool... 17 Installing tools from the BlackBerry Resource Kit...19 Install tools from the BlackBerry Resource Kit...19 Files for the BlackBerry Resource Kit tools...20 Support for UTF-8 encoding...20 Configuring command-line tools to use UAC-compliant file paths...21 Postinstallation tasks... 22 BlackBerry Enterprise Service 10 User Administration Tool...22 Supported authentication models... 22 Verify that the BlackBerry Enterprise Service 10 User Administration Tool was installed correctly... 23 BlackBerry Directory Sync Tool... 23 Permit SSL authentication with an LDAP directory... 23 Configure the BlackBerry Directory Sync Tool to search for directory groups... 24 Configure the BlackBerry Directory Sync Tool to search for groups in a BlackBerry Enterprise Service 10 domain...25 Configure provisioning options... 25 Configure reporting preferences...26 Change the performance and configuration settings for the BlackBerry Directory Sync Tool... 26 Configure the BlackBerry Directory Sync Tool to skip certificate validation... 29 BlackBerry Push Initiator Tool... 30 Configure the BlackBerry Push Initiator Tool for a BlackBerry Device Service connection... 30 Configure the BlackBerry Push Initiator Tool for a BlackBerry MDS Connection Service connection...31

Troubleshooting...32 BlackBerry Enterprise Service 10 User Administration Tool...32 Check the status of the BlackBerry Enterprise Service 10 User Administration Tool... 32 BlackBerry Directory Sync Tool... 33 No Directory groups to display. Please check the configuration...33 No BlackBerry groups to display. Please check the configuration...34 Exception retrieving BlackBerry groups...34 Invalid URI: The hostname could not be parsed...35 Remove the BlackBerry Resource Kit tools...36 Glossary... 37 Provide feedback...38 Legal notice...39

Overview: BlackBerry Enterprise Service 10 Overview: BlackBerry Enterprise Service 10 1 BlackBerry Enterprise Service 10 is an enterprise solution that allows administrators to manage an organization s mobile devices. Whether employees are using devices that their organization provides, or their own personal devices, BlackBerry Enterprise Service 10 drives business forward by giving users a reliable and secure mobile connection to enterprise resources. BlackBerry Enterprise Service 10 consists of the following products: Product BlackBerry Device Service Universal Device Service BlackBerry Management Studio Description The BlackBerry Enterprise Service 10 component that allows administrators to manage users BlackBerry 10 smartphones and BlackBerry PlayBook tablets. Various server components manage the transfer of data to and from devices. Administrators manage user accounts and devices using a web-based console called the BlackBerry Administration Service. The BlackBerry Enterprise Service 10 component that allows administrators to manage users ios devices and Android devices. Various server components manage the transfer of data to and from devices. Administrators manage user accounts and devices using a web-based console called the Administration Console. A unified management console that connects with the BlackBerry Device Service, Universal Device Service, and supported versions of the BlackBerry Enterprise Server. BlackBerry Management Studio offers administrators a single access point for performing basic administrative tasks for any type of device, for example, creating and managing groups, managing device controls, and activating devices. Administrators can perform more advanced administrative tasks using the BlackBerry Administration Service or the Administration Console. BlackBerry Enterprise Service 10 allows you to perform the following management tasks: Provision and activate devices to synchronize email and other enterprise services Create groups to configure and manage multiple user accounts at once Manage multiple devices for each user Assign IT policies to control device permissions and functionality Assign software configurations to install, upgrade, and manage applications Assign profiles to control how devices connect to the organization s network Manage the work data on devices while maintaining the integrity and privacy of personal data 5

Overview: BlackBerry Enterprise Service 10 Monitor devices and review device statistics Manage a wide range of device features For more information about BlackBerry Enterprise Service 10, visit http://help.blackberry.com/en/bes10/10.2/ to read the product documentation. 6

Overview: The BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Overview: The BlackBerry Resource Kit for BlackBerry Enterprise Service 10 2 The BlackBerry Resource Kit is a collection of tools that you can use to manage, monitor, and troubleshoot user accounts and devices that are associated with BlackBerry Enterprise Service 10. You can download the BlackBerry Resource Kit from www.blackberry.com/support/downloads. The BlackBerry Resource Kit for BlackBerry Enterprise Service 10 includes the following tools: Tool Supported by Description BlackBerry Enterprise Service 10 User Administration Tool BlackBerry Directory Sync Tool BlackBerry Device Service only BlackBerry Device Service Universal Device Service A command-line tool that you can use to manage the BlackBerry Device Service, user accounts, and BlackBerry devices. For example, you can add, find, and remove user accounts, or you can configure various settings for devices, including assigning software configurations or IT policies. You can also use the tool to collect information about servers, devices, and users that you can use to monitor your organization's environment and troubleshoot issues. An application that you can use to synchronize the membership of directory groups with groups on a BlackBerry Device Service or Universal Device Service. BlackBerry IT Policy Import and Export Tool BlackBerry Enterprise Service 10 Log Monitoring Tool BlackBerry Device Service only BlackBerry Device Service only A command-line tool that you can use to export IT policy information from a BlackBerry Configuration Database to a backup file. You can use the backup file to import the information to a different BlackBerry Configuration Database so that you can make the IT policies available to a different domain. A command-line tool that you can use to monitor the information that is written to the log files for BlackBerry Device Service components. You can specify actions that you want the tool to perform when it finds specific values, such as events or text strings. For example, you can configure the tool 7

Overview: The BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Tool Supported by Description to run a custom batch file when it finds a specific event ID in the BlackBerry Dispatcher log file. BlackBerry Push Initiator Tool BlackBerry Device Service only An application that you can use to push data to apps installed on BlackBerry devices. For example, you can push mapping information about folders in an organization's network that BlackBerry device users can then access using the BlackBerry Work Drives app without the users needing to configure access to the folders. You can customize the data for group members or individuals. You can create a batch file to specify the mapping information used by the BlackBerry Push Initiator Tool. You can use a scheduling tool to run the batch file. This document assumes that you are using the tools in the BlackBerry Resource Kit to manage BlackBerry Enterprise Service 10. If you want to use the tools with previous releases that are supported, visit http://help.blackberry.com/en/category/ enterprise-services/ to see the documentation for the appropriate version of the BlackBerry Resource Kit. Download the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 You can download the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 from www.blackberry.com/support/ downloads. Related information System requirements, on page 9 Install tools from the BlackBerry Resource Kit, on page 19 8

System requirements System requirements 3 Compatibility with other releases This document assumes that you are using the tools in the BlackBerry Resource Kit to manage BlackBerry Enterprise Service 10 version 10.2.1. If you want to use the tools with previous releases that are supported, visit http://help.blackberry.com/en/ category/enterprise-services/ to see the documentation for the appropriate version of the BlackBerry Resource Kit. Previous versions of the tools have been released for use with the BlackBerry Enterprise Server, BlackBerry Device Service, and Universal Device Service. You cannot use the setup application for the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 version 10.2.1 to upgrade previous versions of the tools. Related information System requirements: BlackBerry Enterprise Service 10 User Administration Tool, on page 9 System requirements: BlackBerry Directory Sync Tool, on page 11 System requirements: BlackBerry IT Policy Import and Export Tool, on page 13 System requirements: BlackBerry Enterprise Service 10 Log Monitoring Tool, on page 15 System requirements: BlackBerry Enterprise Service 10 User Administration Tool Item Operating system Supported environments Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit http:// help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. The following environments have been fully tested with and are recommended for use with the tool: BlackBerry Enterprise Service 10 version 10.1 or later (BlackBerry Device Service only) BlackBerry Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 or later for IBM Domino BlackBerry Enterprise Server 5.0 SP4 or later for Novell GroupWise 9

System requirements Item Requirement The following environments have been partially tested and are supported for use with the tool: BlackBerry Enterprise Server Express 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 or later for IBM Domino Unsupported environments The following environments are not supported for use with the tool: Universal Device Service component of BlackBerry Enterprise Service 10 version 10.1 Universal Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP2 or earlier for IBM Domino BlackBerry Enterprise Server 5.0 SP1 or earlier for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP2 or earlier for IBM Domino BlackBerry Administration Service Memory Browser Running the tool from a remote computer User Account Control restrictions The tool must be able to connect to the BlackBerry Administration Service. At least 2 GB of memory. Windows Internet Explorer 6.0 or later with language preferences configured to display encoded webpages. Running the tool from a remote computer using the UNC path is not supported. If you did not run the setup application for the tool on the computer, the computer might not have the security requirements to run the tool. When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Enterprise Service 10 User Administration Tool Client). 10

System requirements System requirements: BlackBerry Directory Sync Tool Item Operating system User directory Supported environments Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit http:// help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. Any user directory that BlackBerry Enterprise Service 10 supports. The following environments have been fully tested and are recommended for use with the tool: BlackBerry Enterprise Service 10 version 10.1 or later (BlackBerry Device Service and Universal Device Service) BlackBerry Device Service 6.2 Universal Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP3 MR5 or later for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 MR5 or later for IBM Domino BlackBerry Enterprise Server Express 5.0 SP3 MR2 or later for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 MR2 or later for IBM Domino Unsupported environments The following environments are not supported for use with the tool: BlackBerry Device Service 6.1 and earlier BlackBerry Enterprise Server 5.0 SP3 MR4 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 MR4 or earlier for IBM Domino BlackBerry Enterprise Server Express 5.0 SP3 MR1 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 MR1 or earlier for IBM Domino Running the tool in a Microsoft Exchange Resource Forest Topology is not supported. Remote computer Install the tool on a computer that does not host an instance of the BlackBerry Device Service or Universal Device Service. 11

System requirements Item Microsoft.NET Framework Access to the user directory and server instances Administrator permissions Requirement Microsoft.NET Framework 3.5 (full package) must be installed on the computer that hosts the BlackBerry Directory Sync Tool. The computer that hosts the tool must be able to access the user directory and the computers that host instances of the BlackBerry Device Service and Universal Device Service. The Windows account that you use to run the tool must have read permissions for the directory. The administrator account that you configure the tool to use must exist on every server instance that you want the tool to connect to. For example, if you configure the tool to access a BlackBerry Device Service and a Universal Device Service, the administrator account must exist on both server instances. The administrator account must have one of the following roles, or a role with equivalent permissions: Security Administrator Enterprise Administrator Senior Helpdesk Administrator For more information about administrator roles and permissions, visit http:// help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 documentation. User accounts must exist on the server instance The tool can synchronize groups only if the directory users have matching user accounts on the BlackBerry Device Service or the Universal Device Service. Before you run the tool, verify that the user accounts that you want to synchronize exist in both the directory and on the appropriate server instance. If matching user accounts do not exist on the server, you can add the user accounts manually using the administration console, or you can enable the provisioning feature so that the tool can add user accounts during the synchronization process. For more information about adding user accounts to a server, visit http:// help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 documentation. Group size limit By default, the tool cannot synchronize changes to BlackBerry Enterprise Service 10 groups that have more than 2000 members. There is no size limit for directory groups. If you want to synchronize changes to groups that have more than 2000 members, change the maximum group size limit in the configuration file (DirectorySync.exe.config). 12

System requirements Item Requirement For more information about changing the configuration file, see Change the performance and configuration settings for the BlackBerry Directory Synchronization Tool. Multiple instances are not supported Property names Do not install more than one instance of the tool on the same computer. You cannot run multiple instances of the tool at the same time. The tool reads the following property names from the directory: "name" for group names, "mail" for email addresses, and "displayname" for display names. If your organization uses different property names, add the property names to the configuration file (DirectorySync.exe.config). For instructions, see Change the performance and configuration settings for the BlackBerry Directory Synchronization Tool. User Account Control restrictions When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Directory Sync Tool). Related information Change the performance and configuration settings for the BlackBerry Directory Sync Tool, on page 26 System requirements: BlackBerry IT Policy Import and Export Tool Item Operating system Database management system for the BlackBerry Configuration Database Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit http:// help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. Any version of Microsoft SQL Server that BlackBerry Enterprise Service 10 supports. Visit http://help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. 13

System requirements Item Supported environments Requirement The following environments have been fully tested and are recommended for use with the tool: BlackBerry Enterprise Service 10 version 10.1 or later (BlackBerry Device Service only) BlackBerry Device Service 6.0 or later The following environments have been partially tested and are supported for use with the tool: BlackBerry Enterprise Server 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 or later for IBM Domino BlackBerry Enterprise Server 5.0 SP4 or later for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 or later for IBM Domino Unsupported environments The following environments are not supported for use with the tool: Universal Device Service component of BlackBerry Enterprise Service 10 version 10.1 Universal Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP2 or earlier for IBM Domino BlackBerry Enterprise Server 5.0 SP1 or earlier for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP2 or earlier for IBM Domino Same type of domain Same platform Version compatibility The source and destination BlackBerry Configuration Database must be associated with the same type of product. For example, you cannot export IT policy information from the BlackBerry Configuration Database for the BlackBerry Enterprise Server and import the IT policy information to the BlackBerry Configuration Database for the BlackBerry Device Service. Each product supports a different set of IT policy rules. The tool does not support exporting and importing IT policy information between different platforms of the BlackBerry Enterprise Server. For example, you cannot export IT policy information from the BlackBerry Enterprise Server for Microsoft Exchange and import the IT policy information to the BlackBerry Enterprise Server for IBM Domino. The tool does not support importing IT policy information to a version of a product that is earlier than the version that you exported the IT policy information from. For example, you 14

System requirements Item Requirement cannot export IT policy information from BlackBerry Enterprise Service 10 version 10.1 and import the information to BlackBerry Device Service 6.2. Importing custom IT policy rules User Account Control restrictions The BlackBerry IT Policy Import and Export Tool 10.1 and later does not import custom IT policy rules to the destination BlackBerry Configuration Database (this functionality is relevant only to BlackBerry Enterprise Server 5.0 SP4 and earlier). If the destination domain supports custom IT policy rules, and you want to import custom IT policy rules, download and use a version of the tool that matches the version of the destination domain. When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry IT Policy Import and Export Tool). System requirements: BlackBerry Enterprise Service 10 Log Monitoring Tool Item Operating system Supported environments Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit http:// help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. The following environments have been fully tested and are recommended for use with the tool: BlackBerry Enterprise Service 10 version 10.1 or later (BlackBerry Device Service only) BlackBerry Device Service 6.0 or later The following environments have been partially tested and are supported for use with the tool: 15

System requirements Item Requirement BlackBerry Enterprise Server 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 or later for IBM Domino BlackBerry Enterprise Server 5.0 SP4 or later for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP3 or later for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 or later for IBM Domino Unsupported environments The following environments are not supported for use with the tool: Universal Device Service component of BlackBerry Enterprise Service 10 version 10.1 Universal Device Service 6.0 or later BlackBerry Enterprise Server 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP2 or earlier for IBM Domino BlackBerry Enterprise Server 5.0 SP1 or earlier for Novell GroupWise BlackBerry Enterprise Server Express 5.0 SP2 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP2 or earlier for IBM Domino Computer that hosts the BlackBerry Device Service Log files User Account Control restrictions You must run the BlackBerry Enterprise Service 10 Log Monitoring Tool on the computer that hosts the BlackBerry Device Service. The BlackBerry Enterprise Service 10 Log Monitoring Tool can monitor only one log file at a time. When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Enterprise Service 10 Log Monitoring Tool). 16

System requirements System requirements: BlackBerry Push Initiator Tool Item Operating system Supported environments Requirement Any operating system that BlackBerry Enterprise Service 10 supports. Visit http:// help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 Compatibility Matrix. The following environment has been fully tested and is recommended for use with the tool: BlackBerry Enterprise Service 10 version 10.2.1 or later (BlackBerry Device Service only) Unsupported environments The following environments are not supported for use with the tool: BlackBerry Device Service 6.1 and earlier BlackBerry Enterprise Server 5.0 SP3 MR5 or earlier for Microsoft Exchange BlackBerry Enterprise Server 5.0 SP3 MR4 or earlier for IBM Domino BlackBerry Enterprise Server Express 5.0 SP3 MR1 or earlier for Microsoft Exchange BlackBerry Enterprise Server Express 5.0 SP3 MR1 or earlier for IBM Domino Running the tool in a Microsoft Exchange Resource Forest Topology is not supported. Remote computer Microsoft.NET Framework Access to the server instances Administrator permissions Install the tool on a computer that does not host an instance of the BlackBerry Device Service or Universal Device Service. Microsoft.NET Framework 3.5 (full package) must be installed on the computer that hosts the BlackBerry Push Initiator Tool. The computer that hosts the tool must be able to access the computers that host instances of the BlackBerry Device Service. The administrator account that you configure the tool to use must exist on the server instance that you want the tool to connect to. For example, if you configure the tool to access a BlackBerry Device Service, the administrator account must exist on the server instances. The administrator account must have one of the following roles, or a role with equivalent permissions: 17

System requirements Item Requirement Security Administrator Enterprise Administrator Senior Helpdesk Administrator Junior Helpdesk Administrator User Only Administrator For more information about administrative roles and permissions, visit http:// help.blackberry.com/en/bes10/10.2/ to see the BlackBerry Enterprise Service 10 documentation. Multiple instances are not supported User Account Control restrictions Do not install more than one instance of the tool on the same computer. You cannot run multiple instances of the tool at the same time. When using the tool on an operating system that features User Account Control (UAC), such as Windows Server 2008, you might receive an error message when you try to run commands. If you are using the tool on an operating system that uses UAC, run the tool as an administrator (right-click the application on the start menu, or the.exe file, and click Run as administrator). Type cd\ to reset the directory to "C:\", then type cd "<file_path>", where <file_path> is the full path to the.exe file for the tool (for example, Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Push Initiator Tool). BlackBerry MDS Connection Service BlackBerry Enterprise Service 10 version 10.2 or later 18

Installing tools from the BlackBerry Resource Kit Installing tools from the BlackBerry Resource Kit 4 Install tools from the BlackBerry Resource Kit Before you begin: Check the system requirements for the tools that you want to install. 1. On the computer where you plan to install the tools, create a folder for the installation files. 2. In a browser, visit www.blackberry.com/support/downloads, and navigate to the Downloads area for the BlackBerry Resource Kit for BlackBerry Enterprise Service 10. 3. Download the installation package for the BlackBerry Resource Kit for BlackBerry Enterprise Service 10. 4. Extract the contents of the installation package to the folder that you created. 5. Double-click the brk<version>.msi file. 6. Click Next. 7. In the drop-down list, click your location. Read and accept the end-user license agreement. Click Next. 8. In the drop-down list for each tool, perform one of the following actions: To install the tool, click Will be installed on local hard drive. To prevent the setup application from installing the tool, click Entire feature will be unavailable. 9. Click Next. 10. If you chose to install the BlackBerry Enterprise Service 10 User Administration Tool, you are prompted for the DNS name of the BlackBerry Administration Service. Type the DNS name and port of the BlackBerry Administration Service that you use to manage the BlackBerry Device Service, using the following format: <DNS_name>:<port>. For example, server1.test.company.com:38443. 11. If necessary, click Verify DNS Name. After the DNS name is verified, click Next. 12. Verify the file path where the tools will be installed. If you want to change the file path, click Change and select a new location. 13. Click Next. 14. If you do not want the tools to use UAC-compliant file paths for configuration files, input files, output files, and log files, clear the Use Windows UAC compliant paths check box. 15. Click Next. 19

Installing tools from the BlackBerry Resource Kit 16. Click Install. 17. When the installation process completes, click Finish. After you finish: Complete the postinstallation tasks for the tools that you installed. For more information, see Post-installation tasks. If you want to change the information that you specified for the BlackBerry Enterprise Service 10 User Administration Tool, you can edit the BESUserAdminClient.exe.config file located at the file path that you specified in step 12. If your computer's operating system uses UAC and does not permit you to modify the configuration file at this location, open the virtualized copy of the BESUserAdminClient.exe.config file in the application data folder for the current user (for example, <drive>\users\<user_name>\appdata\local\virtualstore\program Files (x86)\research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10). Related information System requirements, on page 9 Postinstallation tasks, on page 22 Files for the BlackBerry Resource Kit tools The default location of the files for the BlackBerry Resource Kit tools is <drive>:\program Files\Research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\. After you install the tools, you can access them from the Start menu. Tool Executable file Configuration file BlackBerry Enterprise Service 10 User Administration Tool BESUserAdminClient.exe BESUserAdminClient.exe.config BlackBerry Directory Sync Tool DirectorySync.exe DirectorySync.exe.config BlackBerry IT Policy Import and Export Tool ITPolicyImportExport.exe BlackBerry Enterprise Service 10 Log Monitoring Tool LogMonitor.exe BlackBerry Push Initiator Tool PushInitiator.exe PushInitiator.exe.config Support for UTF-8 encoding The tools in the BlackBerry Resource Kit support UTF-8 encoding for input files. The command-line tools support UTF-8 encoded characters that you type using keystroke commands or that you copy and paste from the character map. 20

Installing tools from the BlackBerry Resource Kit Configuring command-line tools to use UACcompliant file paths If you install any tools that use a command-line interface, when you run the setup application, you specify whether you want the tools to use UAC-compliant file paths for configuration files, input files, output files, and log files. The setup application creates a subfolder for the files in the application data folder for the current user. For example: Configuration files: <drive>:\users\<user_name>\appdata\local\virtualstore\program Files (x86)\research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Log files, reports, input files and output files: <drive>:\users\<user_name>\appdata\roaming\research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10 or <drive>:\documents and Settings\<user_name> \Application Data\Research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10 When you use any of the command-line tools, you can use the -uac or -no_uac subparameters to override the setting that you configured when you installed the tool. For example, if you configured the BlackBerry Enterprise Service 10 User Administration Tool to use a UAC-compliant file path, you can use the -no_uac subparameter to write output files and log files to a file path that is relative to the current working directory (for example, <drive>:\program Files\Research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Enterprise Service 10 User Administration Tool). 21

Postinstallation tasks Postinstallation tasks 5 BlackBerry Enterprise Service 10 User Administration Tool Supported authentication models The BlackBerry Device Service supports the following authentication models for BlackBerry Administration Service administrator accounts: BlackBerry Administration Service authentication Microsoft Active Directory authentication LDAP authentication Single sign-on authentication (uses Microsoft Active Directory authentication) To use the tool, you must create an administrator account (or use an existing account) that uses any of the authentication types. When you specify commands to run a task, you must use authentication parameters to specify the login information for the administrator account that you want to use to perform the task. By default, if you do not specify login information, the tool tries to log in to the BlackBerry Administration Service using your current Windows authentication credentials. This behavior assumes that you configured the BlackBerry Administration Service for single sign-on authentication. For more information about creating an administrator account or how to configure single sign-on authentication, visit http:// help.blackberry.com/en/bes10/10.2/ to read the BlackBerry Enterprise Service 10 documentation. Certain tasks can be performed only if the administrator account that you specify has a role with the required permissions. For example, the command to add a user account to the BlackBerry Device Service can complete successfully only if the administrator account that you specify has a role with the "Create a user" permission. For more information about the roles that can perform different administrative tasks, visit http://help.blackberry.com/en/ blackberry-resource-kit-for-bes10/10.2/ to see the "Parameters for the BlackBerry Enterprise Service 10 User Administration Tool" section of the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Administration Guide. 22

Postinstallation tasks Verify that the BlackBerry Enterprise Service 10 User Administration Tool was installed correctly Before you begin: Verify that you have the required permissions to manage users in the BlackBerry Administration Service. 1. On the computer that hosts the BlackBerry Enterprise Service 10 User Administration Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Enterprise Service 10 User Administration Tool. 2. Using the BlackBerry Enterprise Service 10 User Administration Tool, add a user account to the BlackBerry Device Service. For instructions on how to perform this task, visit http://help.blackberry.com/en/blackberry-resource-kit-for-bes10/10.2/ to read the BlackBerry Resource Kit for BlackBerry Enterprise Service 10 Administration Guide. 3. In the BlackBerry Administration Service, verify that the user account was added correctly and that you can manage and make changes to the user account, including adding the user account to a group, assigning an IT policy or a software configuration to the user account, and assigning a device to the user account. For instructions on how to perform these tasks, visit http://help.blackberry.com/en/bes10/10.2/ to read the BlackBerry Enterprise Service 10 documentation. BlackBerry Directory Sync Tool Permit SSL authentication with an LDAP directory This task is only required if your organization uses an LDAP directory that requires SSL authentication. You must import the SSL certificate of the LDAP server into the Trusted Root Certification Authorities certificate store of the computer that hosts the BlackBerry Directory Sync Tool. This allows the tool to authenticate with the LDAP server when it tries to search for directory groups. Before you begin: Obtain the SSL certificate (.der) for the LDAP server. 1. On the computer that hosts the BlackBerry Directory Sync Tool, open the Microsoft Management Console. If a Windows message appears and requests permission to make changes to the computer, click Yes. 2. Click Console Root. 3. Click File > Add/Remove Snap-in. 4. In the Available snap-ins list, click Certificates. Click Add. 5. In the Certificates snap-in dialog, select the Computer account option. Click Next. 6. In the Select Computer dialog, select the Local computer option. Click Finish. 23

Postinstallation tasks 7. Click OK. 8. Expand Certificates (Local Computer) > Trusted Root Certification Authorities. 9. Right-click Certificates. Click All Tasks > Import. 10. In the Certificate Import Wizard, click Next. 11. Click Browse. Navigate to and select the SSL certificate for the LDAP server. Click Open. 12. Click Next. 13. Verify that Place all certificates in the following store is selected. Click Next. 14. Click Finish. Click OK. After you finish: Configure the BlackBerry Directory Sync Tool to search for directory groups. Configure the BlackBerry Directory Sync Tool to search for directory groups You can configure the tool to search for directory groups in Microsoft Active Directory or in a supported LDAP directory. 1. On the computer that hosts the BlackBerry Directory Sync Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Directory Sync Tool Client. 2. In the Directory Group Search section, click Configure. 3. In the Server Discovery drop-down list, perform one of the following actions: If you want the tool to search for directory groups in the domain that you are currently logged in to, click Automatic. The account that you are currently using must have read permissions for your organization's directory. If you want the tool to search for directory groups in a specific domain or server, click Manual. 4. If necessary, in the Domain or Server field, type the name of the domain or server that hosts the directory. 5. If necessary, in the Port field, type the port number that you want the tool to use to connect to the directory. The default port number is 389 (used if you leave the Port field blank). If your organization uses an LDAP directory that requires SSL authentication, specify the port to use for the SSL connection. The default port for an SSL connection is 636. 6. If you want the tool to limit the search to a specific DN, in the Search Path DN field, type the path of the DN (for example, OU=Groups,DC=sample,DC=net). 7. If you want to search an LDAP directory, select the Provide credentials check box. Specify the username and password of the account that you want to use to authenticate with the LDAP directory. 8. In the Maximum Results field, type the maximum number of directory groups that you want the tool to find and display. 9. In the Group search drop-down list, perform one of the following actions: 24

Postinstallation tasks If you want the tool to discover and list the directory groups automatically, click Automatic. If you want to search for directory groups manually using a search field, click Manual. 10. Click Save. Configure the BlackBerry Directory Sync Tool to search for groups in a BlackBerry Enterprise Service 10 domain Create an administrator account (or use an existing account) that you will use to access the BlackBerry Device Service and/or the Universal Device Service. The administrator account must exist in and have the required permissions on every server that you want the tool to connect to. 1. On the computer that hosts the BlackBerry Directory Sync Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Directory Sync Tool Client. 2. In the BlackBerry Group Search section, click Configure. 3. In the Administrator Credentials section, in the Authentication Type drop-down list, select the authentication type for the administrator account that you want to use. 4. In the Username field, type the user name of the administrator account. 5. In the Password field, type the password of the administrator account. 6. If you selected Microsoft Active Directory authentication, in the Domain field, type the name of the Microsoft Active Directory domain. 7. In the Add BlackBerry Domain section, in the Label field, type a label for a BlackBerry Enterprise Service 10 domain. 8. In the Hostname field, type the FQDN of the BlackBerry Administration Service pool. You can find the BlackBerry Administration Service pool name on the BlackBerry Administration Service Pool tab in the BES10 Configuration Tool. 9. In the Port field, type the port number for the administration console. The default value for the BlackBerry Device Service is 38443. The default value for the Universal Device Service is 18082. 10. Click Add. 11. Repeat steps 7 to 10 for each server instance that you want the tool to connect to. 12. Click Save. Configure provisioning options The tool can only synchronize groups if the directory users have matching user accounts on the BlackBerry Device Service or Universal Device Service. If matching user accounts do not exist, you can use the appropriate administration console to manually add the user accounts, or you can enable the provisioning feature so that the tool can add user accounts during the synchronization process. 25

Postinstallation tasks 1. On the computer that hosts the BlackBerry Directory Sync Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Directory Sync Tool Client. 2. In the BlackBerry Group Search section, click Configure. 3. In the Provisioning Options section, select Enable user provisioning with virtual provisioning mappings. 4. If you want the tool to manage the removal of user accounts from the BlackBerry Device Service or Universal Device Service, select Enable user de-provisioning when removed from provisioning mappings. In the De-provisioning Warning dialog box, click Yes. In the De-provisioning action drop-down list, perform one of the following actions: If you want the tool to remove user accounts from the server if they do not exist in directory groups that are mapped to virtual provisioning groups, click Delete users. If you want the tool to identify in the report and the log file the user accounts that should be deleted, and you do not want the tool to delete the user accounts, click Log only. Use the information in the report or log file to remove the user accounts using the administration console. 5. Click Save. After you finish: Configure mappings between directory groups and virtual provisioning groups. Configure reporting preferences 1. On the computer that hosts the BlackBerry Directory Sync Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Directory Sync Tool Client. 2. Click Edit > Preferences. 3. If you want to hide "User not found" warning messages in the report when the tool tries to assign user accounts to BlackBerry Enterprise Service 10 groups, select the Suppress "User not found" warnings when assigning users to groups check box. 4. Click Save. Change the performance and configuration settings for the BlackBerry Directory Sync Tool The tool retrieves information from the directory by reading the following object class names and property names: Object class names Group object class name: group User object class name: user Property names 26

Postinstallation tasks Group name: name Email address: mail Display name: displayname User logon name: samaccountname Domain name: domaindns If your organization's directory uses different object class names or property names, you can edit the configuration file (DirectorySync.exe.config) to specify the names that you want the tool to use. You can also change how the tool completes the synchronization process. It is a best practice to use the default performance settings. Changing the settings might have a performance impact on your organization's BlackBerry Enterprise Service 10 domain. 1. On the computer that hosts the BlackBerry Directory Sync Tool, navigate to <drive>:\program Files\Research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Directory Sync Tool. 2. In a text editor, open the DirectorySync.exe.config file. If your computer's operating system uses UAC and does not permit you to modify the configuration file at this location, open the virtualized copy of the DirectorySync.exe.config file in the application data folder for the current user (for example, <drive>\users\<user_name>\appdata\local\virtualstore\program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10). 3. Perform any of the following actions: Action Change the group object class name Change the user object class name Change the property name for group names Change the property name for email addresses Change the property name for user display names Change the property name for user logon names Steps In the <appsettings> section, type <add key="groupobjectclassnameproperty" value="<group_oc_property_name>"/>. In the <appsettings> section, type <add key="userobjectclassnameproperty" value="<user_oc_property_name>"/>. In the <appsettings> section, type <add key="groupnameproperty" value="<group_property_name>"/>. In the <appsettings> section, type <add key="emailaddressproperty" value="<email_property_name>"/>. In the <appsettings> section, type <add key="displaynameproperty" value="<display_property_name>"/>. In the <appsettings> section, type <add key="logonnameproperty" value="<logon_property_name>"/>. 27

Postinstallation tasks Action Change the property name for the domain name Specify the maximum number of changes that you want the tool to synchronize to a group Specify the maximum size of a group that the tool can synchronize changes to Steps In the <appsettings> section, type <add key="domainnameproperty" value="<domain_property_name>"/>. In the <appsettings> section, type <add key="maxnumberofchanges" value="<max_changes>"/>, where <max_changes> is a value greater than 0. The default value is 0 (no limit). When you start the synchronization process, the tool counts the number of changes to be made to a group. If the number of changes exceeds the value that you specified, the tool does not make any changes to the group. In the <appsettings> section, change the value of <add key="maxnumberofusersinbasgroup" value="<max_users_group>"/>, where <max_users_group> is the maximum number of user accounts in a group. Specify how long you want the tool to wait before synchronizing each change The default value is 2000. The tool does not synchronize changes to groups with more user accounts than the value that you specify. In the <appsettings> section, change the value of <add key="changedelay" value="<change_delay>"/>, where <change_delay> is a value greater than 0, in seconds. The default value is 1 second. Specify the maximum level of nested groups that the tool can synchronize In the <appsettings> section, type <add key="maxnestinglevel" value="<max_nesting_level>"/>, where <max_nesting_level> is a value of 0 or greater. The default value is -1 (no limit). Specify the maximum number of errors that can occur before the tool stops performing actions In the <appsettings> section, type <add key="maxnumberoferrors" value="<max_errors>"/>, where <max_errors> is a value of 0 (no limit) or greater. The default value is 5. Specify the minimum number of assignments before the tool caches all of the users on a server instead of searching for the users individually Change the level of logging information written to the console In the <appsettings> section, type <add key="bbusercachethreshold" value="<threshold>"/>, where <threshold> is a value of 0 (no cache) or greater. The default value is 100. If you want the tool to perform a large number of synchronization tasks, caching might improve the tool's performance. In the <appsettings> section, type <add key="consoleloglevel" value="<log_level>"/>, where <log_level> is a value between 0 (no logging) and 5 (trace log level). 28

Postinstallation tasks Action Change the level of logging information written to the log files Steps In the <appsettings> section, type <add key="fileloglevel" value="<log_level>"/>, where <log_level> is a value between 0 (no logging) and 5 (trace log level). 4. Save and close the DirectorySync.exe.config file. Example appsettings section <appsettings> <add key="groupobjectclassnameproperty" value="groupocexample"/> <add key="userobjectclassnameproperty" value="userocexample"/> <add key="groupnameproperty" value="groupexample"/> <add key="emailaddressproperty" value="emailexample"/> <add key="displaynameproperty" value="displaynameexample"/> <add key="logonnameproperty" value="logonexample"/> <add key="domainnameproperty" value="domainexample"/> <add key="maxnumberofchanges" value="1000"/> <add key="maxnumberofusersinbasgroup" value="1000"/> <add key="changedelay" value="2"/> <add key="maxnestinglevel" value="5"/> <add key="maxnumberoferrors" value="10"/> <add key="bbusercachethreshold" value="150"/> <add key="consoleloglevel" value="5"/> <add key="fileloglevel" value="5"/> </appsettings> Configure the BlackBerry Directory Sync Tool to skip certificate validation When the BlackBerry Directory Sync Tool connects to the administration console, it verifies that the FQDN that you configured the tool to use matches the SSL certificate of the administration console. You can configure the tool to skip this verification process for specific servers. 1. On the computer that hosts the BlackBerry Directory Sync Tool, navigate to <drive>:\program Files\Research In Motion \BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Directory Sync Tool. 2. In a text editor, open the DirectorySync.exe.config file. If your computer's operating system uses UAC and does not permit you to modify the configuration file at this location, open the virtualized copy of the DirectorySync.exe.config file in the application data folder for the current user (for example, <drive>\users\<user_name>\appdata\local\virtualstore\program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10). 3. In the <appsettings> section, type the following: <add key="certvalidationexcludedhosts" value="<server>"/>, where <server> is the FQDN or IP address of the computer that hosts the administration console. If you want to specify multiple computers, separate each FQDN or IP address using a comma (, ) or semi-colon ( ; ). 29

Postinstallation tasks Example: <add key="certvalidationexcludedhosts" value="server1.testnet.company.net;192.0.2.124"/> 4. Save and close the DirectorySync.exe.config file. After you finish: Restart the BlackBerry Directory Sync Tool. BlackBerry Push Initiator Tool Before you can push data to BlackBerry devices, you must configure a connection to the BlackBerry Device Service and the BlackBerry MDS Connection Service. The BlackBerry Device Service provides access to the groups, email accounts and BlackBerry device applications, (for example, the BlackBerry Work Drives app), that you must specify when configuring the data that you need to push to BlackBerry devices. The BlackBerry MDS Connection Service is responsible for providing enterprise push functionality to push data to BlackBerry devices. Configure the BlackBerry Push Initiator Tool for a BlackBerry Device Service connection 1. On the computer that hosts the BlackBerry Push Initiator Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Push Initiator Tool Client. 2. On the Configuration tab, click BlackBerry Web Service Connection. 3. In the Authentication Type drop-down list, select the authentication method for the administrator account that you want to use to log in. Active Directory LDAP Directory Native Single Sign On 4. Type the username and password of the administrator account. 5. In the Domain field, type the name of the BlackBerry Enterprise Service 10 domain. 6. In the Label field, type a label for a BlackBerry Enterprise Service 10 domain. 7. In the Hostname field, type the FQDN of the BlackBerry Administration Service pool. You can find the BlackBerry Administration Service pool name on the BlackBerry Administration Service Pool tab in the BES10 Configuration Tool. 8. In the Port field, type the port number for the administration console. The default value for the BlackBerry Web Service Connection is 38443. 9. Click Save. 30

Postinstallation tasks Configure the BlackBerry Push Initiator Tool for a BlackBerry MDS Connection Service connection 1. On the computer that hosts the BlackBerry Push Initiator Tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Push Initiator Tool Client. 2. On the Configuration tab, click MDS-CS Push Service Connection. 3. In the Authentication Type drop-down list, select the authentication method for the administrator account that you want to use. No Authentication Native 4. If you selected Native authentication, in the Username and Password fields, type the username and password of the administrator account. 5. In the Domain field, type the name of the BlackBerry Enterprise Service 10 domain. 6. In the Hostname field, type the FQDN of the push server that hosts the BlackBerry MDS Connection Service. 7. In the Port field, type the port number for the administration console. The default value for the BlackBerry MDS Connection Service is 9080. 8. Click Save. 31

Troubleshooting Troubleshooting 6 BlackBerry Enterprise Service 10 User Administration Tool Check the status of the BlackBerry Enterprise Service 10 User Administration Tool You can use this command to verify that there is a valid connection between the BlackBerry Administration Service and the BlackBerry Enterprise Service 10 User Administration Tool and that the credentials are valid. 1. To open the command window for the BlackBerry Enterprise Service 10 User Administration Tool, on the computer that hosts the tool, on the taskbar, click Start > Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Enterprise Service 10 User Administration Tool. 2. Type besuseradminclient -n <server_name> <credentials> -status. Example besuseradminclient -username admin -password password -status Example output BlackBerry(R) Enterprise Service 10 User Administration Tool Copyright (c) Research In Motion, Ltd. 2009-2013. All rights reserved. Log files being written to C:\Users\besadmin\AppData\Roaming\Research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Enterprise Service 10 User Administration Tool Client\Logs. (01/17 15:58:36) Running command... (01/17 15:58:36)...Done (01/17 15:58:36) Command Results: Property,Value BAS Version,10.2 BAA Version,10.2 32

Troubleshooting When I check the status of the BlackBerry Enterprise Service 10 User Administration Tool I receive an "Error while initializing the logs" error message When you use the -status parameter to check the status of the BlackBerry Enterprise Service 10 User Administration Tool, the "Error while initializing the logs" error message appears. This error message indicates the location where the tool tried to write the log files, and a stack trace. Possible cause If you are using Windows Server 2008, the UAC security infrastructure might prevent the tool from opening and writing information to log files. Possible solution Perform one of the following actions: The error message indicates the folder that the tool tried to write the log files to. If the folder does not exist, create the folder. Configure security permissions on the folder that permit your user account to write log files to the folder. Open the BESUserAdminClient.exe.config file in a text editor and change the LogFolder value to a folder that your user account has permissions to write to. The default location of the configuration file is <drive>:\program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10\BlackBerry Enterprise Service 10 User Administration Tool Client. If your computer's operating system uses UAC and does not permit you to modify the configuration file at this location, open the virtualized copy of the BESUserAdminClient.exe.config file in the application data folder for the current user (for example, <drive>\users\<user_name>\appdata\local\virtualstore \Program Files (x86)\research In Motion\BlackBerry Resource Kit for BlackBerry Enterprise Service 10). BlackBerry Directory Sync Tool No Directory groups to display. Please check the configuration. Description This message appears when the BlackBerry Directory Sync Tool cannot connect to the directory using the information that you specified. Possible solution Perform any of the following actions: Verify that the directory settings that you specified are correct. 33

Troubleshooting Verify that the Search Path DN that you specified is a valid path. From left to right, the path should specify the general organizational units (OU) to the specific domain components (DC) (for example, OU=Groups,DC=sample,DC=net). If you selected Automatic in the Server Discovery drop-down list, verify that the Windows account that you are currently using has read permissions for the directory. No BlackBerry groups to display. Please check the configuration. Description This message appears when the BlackBerry Directory Sync Tool cannot connect to a server instance using the information that you specified. Possible solution Perform any of the following actions: Verify that the login information that you specified for the administrator account is correct. Verify that the administrator account has the required permissions. Verify that the information that you specified for the server instance is correct, including the port number. The default value for the BlackBerry Device Service is 38443. The default value for the Universal Device Service is 18082. Verify that groups exist on the servier. Verify that the server that you are trying to connect to is running. Verify that the administrator account exists on each server that you want the tool to connect to. Exception retrieving BlackBerry groups Description This message appears if the computer that hosts the tool does not have Microsoft.NET Framework 3.5 (full package) installed. Possible solution Install the Microsoft.NET Framework 3.5 (full package). 34

Troubleshooting Invalid URI: The hostname could not be parsed Description This message appears if the tool cannot process the hostname that you specified for a server instance. Possible solution In the Hostname field, verify that you typed the correct full path name of the computer that hosts the server (for example, BDS- HOST1.company.com). Do not include http:// or https://. 35

Remove the BlackBerry Resource Kit tools Remove the BlackBerry Resource Kit tools 7 1. On the computer that hosts the tools, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > Uninstall or Modify Installation. 2. Click Next. 3. Click Remove. 4. Click Remove again. 5. Click Finish. 36

Glossary Glossary 8 API BlackBerry Enterprise Service 10 domain DNS FQDN IT policy LDAP SSL UNC UTF-8 application programming interface A BlackBerry Enterprise Service 10 domain consists of the BlackBerry Enterprise Service 10 databases and any BlackBerry Enterprise Service 10 instances that connect to them. Domain Name System fully qualified domain name An IT policy consists of various IT policy rules that control the security features and behavior of BlackBerry smartphones, BlackBerry PlayBook tablets, the BlackBerry Desktop Software, and the BlackBerry Web Desktop Manager. Lightweight Directory Access Protocol Secure Sockets Layer Universal Naming Convention 8-bit UCS/Unicode Transformation Format 37

Provide feedback Provide feedback 9 To provide feedback on this content, visit www.blackberry.com/docsfeedback. 38

Legal notice Legal notice 10 2015 BlackBerry. Trademarks, including but not limited to BLACKBERRY, EMBLEM Design, BBM, BES, MANYME, VIRTUAL SIM PLATFORM, WORKLIFE, MOVIRTU, SECUSMART, SECUSMART & Design, SECUSUITE, WATCHDOX, WATCHDOX & Design and WATCHDOX & EMBLEM Design are the trademarks or registered trademarks of BlackBerry Limited, its subsidiaries and/or affiliates, used under license, the exclusive rights to which are expressly reserved. IBM, Lotus, and Domino are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide. Microsoft, Internet Explorer, SQL Server, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Novell and GroupWise are trademarks of Novell, Inc.All other trademarks are the property of their respective owners. This documentation including all documentation incorporated by reference herein such as documentation provided or made available on the BlackBerry website provided or made accessible "AS IS" and "AS AVAILABLE" and without condition, endorsement, guarantee, representation, or warranty of any kind by BlackBerry Limited and its affiliated companies ("BlackBerry") and BlackBerry assumes no responsibility for any typographical, technical, or other inaccuracies, errors, or omissions in this documentation. In order to protect BlackBerry proprietary and confidential information and/or trade secrets, this documentation may describe some aspects of BlackBerry technology in generalized terms. BlackBerry reserves the right to periodically change information that is contained in this documentation; however, BlackBerry makes no commitment to provide any such changes, updates, enhancements, or other additions to this documentation to you in a timely manner or at all. This documentation might contain references to third-party sources of information, hardware or software, products or services including components and content such as content protected by copyright and/or third-party websites (collectively the "Third Party Products and Services"). BlackBerry does not control, and is not responsible for, any Third Party Products and Services including, without limitation the content, accuracy, copyright compliance, compatibility, performance, trustworthiness, legality, decency, links, or any other aspect of Third Party Products and Services. The inclusion of a reference to Third Party Products and Services in this documentation does not imply endorsement by BlackBerry of the Third Party Products and Services or the third party in any way. EXCEPT TO THE EXTENT SPECIFICALLY PROHIBITED BY APPLICABLE LAW IN YOUR JURISDICTION, ALL CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS, OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS OR WARRANTIES OF DURABILITY, FITNESS FOR A PARTICULAR PURPOSE OR USE, MERCHANTABILITY, MERCHANTABLE QUALITY, NON- INFRINGEMENT, SATISFACTORY QUALITY, OR TITLE, OR ARISING FROM A STATUTE OR CUSTOM OR A COURSE OF DEALING OR USAGE OF TRADE, OR RELATED TO THE DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN, ARE HEREBY EXCLUDED. YOU MAY ALSO HAVE OTHER RIGHTS THAT VARY BY STATE OR PROVINCE. SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES AND CONDITIONS. TO THE EXTENT PERMITTED BY LAW, ANY IMPLIED WARRANTIES OR CONDITIONS RELATING TO THE DOCUMENTATION TO THE EXTENT THEY CANNOT BE EXCLUDED AS SET OUT ABOVE, BUT CAN BE LIMITED, ARE HEREBY LIMITED TO NINETY (90) DAYS FROM THE DATE YOU FIRST ACQUIRED THE DOCUMENTATION OR THE ITEM THAT IS THE SUBJECT OF THE CLAIM. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, IN NO EVENT SHALL BLACKBERRY BE LIABLE FOR ANY TYPE OF DAMAGES RELATED TO THIS DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON- 39

Legal notice PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN INCLUDING WITHOUT LIMITATION ANY OF THE FOLLOWING DAMAGES: DIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE, OR AGGRAVATED DAMAGES, DAMAGES FOR LOSS OF PROFITS OR REVENUES, FAILURE TO REALIZE ANY EXPECTED SAVINGS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, LOSS OF BUSINESS OPPORTUNITY, OR CORRUPTION OR LOSS OF DATA, FAILURES TO TRANSMIT OR RECEIVE ANY DATA, PROBLEMS ASSOCIATED WITH ANY APPLICATIONS USED IN CONJUNCTION WITH BLACKBERRY PRODUCTS OR SERVICES, DOWNTIME COSTS, LOSS OF THE USE OF BLACKBERRY PRODUCTS OR SERVICES OR ANY PORTION THEREOF OR OF ANY AIRTIME SERVICES, COST OF SUBSTITUTE GOODS, COSTS OF COVER, FACILITIES OR SERVICES, COST OF CAPITAL, OR OTHER SIMILAR PECUNIARY LOSSES, WHETHER OR NOT SUCH DAMAGES WERE FORESEEN OR UNFORESEEN, AND EVEN IF BLACKBERRY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, BLACKBERRY SHALL HAVE NO OTHER OBLIGATION, DUTY, OR LIABILITY WHATSOEVER IN CONTRACT, TORT, OR OTHERWISE TO YOU INCLUDING ANY LIABILITY FOR NEGLIGENCE OR STRICT LIABILITY. THE LIMITATIONS, EXCLUSIONS, AND DISCLAIMERS HEREIN SHALL APPLY: (A) IRRESPECTIVE OF THE NATURE OF THE CAUSE OF ACTION, DEMAND, OR ACTION BY YOU INCLUDING BUT NOT LIMITED TO BREACH OF CONTRACT, NEGLIGENCE, TORT, STRICT LIABILITY OR ANY OTHER LEGAL THEORY AND SHALL SURVIVE A FUNDAMENTAL BREACH OR BREACHES OR THE FAILURE OF THE ESSENTIAL PURPOSE OF THIS AGREEMENT OR OF ANY REMEDY CONTAINED HEREIN; AND (B) TO BLACKBERRY AND ITS AFFILIATED COMPANIES, THEIR SUCCESSORS, ASSIGNS, AGENTS, SUPPLIERS (INCLUDING AIRTIME SERVICE PROVIDERS), AUTHORIZED BLACKBERRY DISTRIBUTORS (ALSO INCLUDING AIRTIME SERVICE PROVIDERS) AND THEIR RESPECTIVE DIRECTORS, EMPLOYEES, AND INDEPENDENT CONTRACTORS. IN ADDITION TO THE LIMITATIONS AND EXCLUSIONS SET OUT ABOVE, IN NO EVENT SHALL ANY DIRECTOR, EMPLOYEE, AGENT, DISTRIBUTOR, SUPPLIER, INDEPENDENT CONTRACTOR OF BLACKBERRY OR ANY AFFILIATES OF BLACKBERRY HAVE ANY LIABILITY ARISING FROM OR RELATED TO THE DOCUMENTATION. Prior to subscribing for, installing, or using any Third Party Products and Services, it is your responsibility to ensure that your airtime service provider has agreed to support all of their features. Some airtime service providers might not offer Internet browsing functionality with a subscription to the BlackBerry Internet Service. Check with your service provider for availability, roaming arrangements, service plans and features. Installation or use of Third Party Products and Services with BlackBerry's products and services may require one or more patent, trademark, copyright, or other licenses in order to avoid infringement or violation of third party rights. You are solely responsible for determining whether to use Third Party Products and Services and if any third party licenses are required to do so. If required you are responsible for acquiring them. You should not install or use Third Party Products and Services until all necessary licenses have been acquired. Any Third Party Products and Services that are provided with BlackBerry's products and services are provided as a convenience to you and are provided "AS IS" with no express or implied conditions, endorsements, guarantees, representations, or warranties of any kind by BlackBerry and BlackBerry assumes no liability whatsoever, in relation thereto. Your use of Third Party Products and Services shall be governed by and subject to you agreeing to the terms of separate licenses and other agreements applicable thereto with third parties, except to the extent expressly covered by a license or other agreement with BlackBerry. The terms of use of any BlackBerry product or service are set out in a separate license or other agreement with BlackBerry applicable thereto. NOTHING IN THIS DOCUMENTATION IS INTENDED TO SUPERSEDE ANY EXPRESS WRITTEN AGREEMENTS OR WARRANTIES PROVIDED BY BLACKBERRY FOR PORTIONS OF ANY BLACKBERRY PRODUCT OR SERVICE OTHER THAN THIS DOCUMENTATION. 40

Legal notice BlackBerry Limited 2200 University Avenue East Waterloo, Ontario Canada N2K 0A7 BlackBerry UK Limited 200 Bath Road Slough, Berkshire SL1 3XE United Kingdom Published in Canada 41