Endpoint Manager for Mobile Devices Setup Guide

Endpoint Manager for Mobile Devices Setup Guide

ii Endpoint Manager for Mobile Devices Setup Guide

Contents Endpoint Manager for Mobile Devices Setup Guide............. 1 Components.............. 1 Architecture.............. 2 Key Features.............. 2 System Requirements........... 2 General............... 2 For Lotus Traveler........... 3 For Microsoft Exchange.......... 3 Configure Management Extenders dashboard... 4 Installing and Configuring.......... 4 Activate Required Analyses......... 6 Management Extender for Lotus Traveler..... 6 Management Extender for Microsoft Exchange... 9 Management Extender for ios........ 9 ios App Setup............. 11 Android Agent Setup........... 11 Warnings............... 12 Support............... 13 Notices................ 13 iii

iv Endpoint Manager for Mobile Devices Setup Guide

Endpoint Manager for Mobile Devices Setup Guide Components The Endpoint Manager for Mobile Devices (MDM) application manages corporate and employee-owned smartphones and media tablets that access enterprise resources. The application can be used to manage security controls, software and hardware inventory, and application management. This Setup Guide provides IT managers and system administrators instruction on how to install and configure the application and how to set up your mobile devices to integrate with the application. Specifically, it includes setup instructions for ios, Android, Lotus Traveler, and Microsoft Exchange. This guide also includes system requirements for each application component, and provides licensing and installation instructions to enable you to deploy Mobile Devices in your environment. For information on how to use Endpoint Manager for Mobile Devices, see the Endpoint Manager for Mobile Devices User s Guide. The Mobile Devices application includes the following primary components: Server The Endpoint Manager for Mobile Devices server is a database that communicates with the relays and the Tivoli Endpoint Manager console to manage the devices in your deployment. Relay - Relays are network components designed to distribute the download burden from the Tivoli Endpoint Manager server and compile and compress data received from clients. In MDM, the relays process information from your mobile devices and transmit that information to the TEM server. Management Extenders Management Extenders allow devices to be managed without an agent on the device. Email Servers Includes Lotus Traveler and Microsoft Exchange servers. 1

Architecture The diagram below depicts a visual representation of how Mobile Devices is designed to work in your environment. Key Features The following is a list of the most important features of Mobile Devices: v Integration with Tivoli Endpoint Manager platform v Support for basic management of devices using email-based management v Support for advanced management of devices using agent-based management v Device inventory v Security and password policy management v Management commands such as wipe, lock, clear-password, deny email access v App Management v Enterprise access configuration including email, WiFi, and VPN Note: Support for these features varies by device, OS, and management method. System Requirements General v Tivoli Endpoint Manager version 8.2 or higher must be used v All management extenders must be installed on a system running Windows v A TEM relay must already be installed on the system 2 Endpoint Manager for Mobile Devices Setup Guide

Note: Before using this application, select an available port for the ios Management Extender. The default is 443. If you want to use a different port, specify that port in the Configure Management Extender dashboard. For Lotus Traveler On Traveler Server: v Domino server must run the Traveler, DIIOP and HTTP tasks. v HTTP must be listening on ports 80, 443 or both. The URL http(s)://<server>/ diiop_ior.txt must be publicly accessible. v DIIOP must be listening on ports 63148, 63149 or both. For configurations using port 63149, the SSL certificate must be valid and current, and a TrustedCerts.class file must have been generated in the Domino data folder. v Create an administrative user. The administrative user must have both read and edit permissions in the ACL for LotusTraveler.nsf, and must be able to run restricted and unrestricted Domino commands. On Management Extender for Lotus Traveler Server: v The plugin must be able to contact the server in one HTTP and one DIIOP port. If DIIOP listens exclusively on port 63149, the plugin requires the server-specific TrustedCerts.class in its classpath. To do this, include the TrustedCerts.class in a TrustedCerts.jar file and deploy it through the Configure Management Extender dashboard. v The administrative user must have a username and password. Anonymous connections are not supported. For Microsoft Exchange On Exchange Server: v Win 2008 Server v WS-Management protocol v WinRM v Exchange Server 2007 or 2010 On Management Extender for Exchange Server: v WS-Management protocol v WinRM v Exchange Management Tools (Exchange 2007 only) Note: If you intend to use this Management Extender to connect to a remote 2007 Exchange server, first install Exchange Management Tools on the Management Extender so it connects properly to the remote server. For Android v Android 2.2+ (Froyo) running on ARM processors v Ability to connect to a TEM server or relay Setup Guide 3

Configure Management Extenders dashboard The Configure Management Extenders dashboard, located in the Setup and Configuration node of the navigation tree, configures your management extenders to enable them to connect to servers. Click on one of the extenders in the list to select it. Then click Configure. This will open the Configure Extender window for Apple ios, Lotus Traveler, or Microsoft Exchange. In the Configure Extender window, you can set parameters for the configuration. Part Two Installing and Configuring Prior to beginning the installation and setup of Mobile Devices, you should be familiar with the Tivoli Endpoint Manager console and be logged in. For detailed information about the console, see the Tivoli Endpoint Manager Console Operator s Guide. The Mobile Devices navigation tree in the Tivoli Endpoint Manager console will serve as your central command for all Mobile Devices installation, setup, and management functions. The navigation tree gives you easy access to all reports, wizards, Fixlets, analyses, and tasks related to the management of your devices. Specifically, the primary content is organized into the following nodes and content categories: Setup and Configuration, Mobile Device Inventory, Apps Management, Security Policies, Android Settings, Apple ios Profiles, Mobile Device Action History, and Device Management for Windows Mobile. 4 Endpoint Manager for Mobile Devices Setup Guide

Setting up the application in your deployment involves the following processes, which will be described in this section: v Activate Analyses v Setup relays on systems for extenders v Deploy Fixlets for extenders v Run the dashboard to configure extenders v Set up ios App v Set up Android Agent v Warnings The Setup and Configuration node in the navigation tree displays a list of preliminary actions you need to take before using the Mobile Devices application. These include deploying the Management Extender for Microsoft Exchange and Lotus Traveler. Setup Guide 5

Activate Required Analyses The Management Extender provides a mechanism for managing the devices in your deployment by interacting with your existing management process. Note: You cannot have more than one management extender deployed on a system. Begin by clicking the Required Analysis node in the navigation tree. Select all analyses in the list, right click to display the drop down menu, and click Activate. After all analyses are activated, you can begin deploying your management extenders. Management Extender for Lotus Traveler The Management Extender for Lotus Traveler must be installed on the TEM Server or on a relay. The deploy Fixlet is only relevant for computers with a TEM agent and a relay or server installed. Deploy the Management Extender Fixlet Click to expand the Setup and Configuration node in the navigation tree. Then click Deploy Management Extenders and select the Deploy Management Extender for 6 Endpoint Manager for Mobile Devices Setup Guide

Lotus Traveler in the list panel on the right. This opens the Fixlet window below. Under the Description tab, click the link in the Actions box to execute the action. Note: The Management Extenders need to connect to the email servers, but they do not need to be installed on the same computer. After entering the required information in all applicable fields, the Take Action dialog displays. A window displays the results of your completed action. Configure the Management Extender Click the Configure Management Extender dashboard located in the Setup and Configuration node. Click on one of the extenders in the list to select it. Then click Configure. Setup Guide 7

In the Configure Extender window, manually set refresh intervals. If you are deploying your extender directly onto your Lotus Traveler server, check the Use Local Connection checkbox. Otherwise, specify your server and credentials. You may also specify an SSL connection type (HTTP, ORB, none, or both). If you select ORB or both, you need to provide a TrustedCerts.jar file. This file is generated on your Lotus Traveler server. The TrustedCerts.class file is automatically generated by Lotus Domino when SSL configuration is enabled. This file is typically located in the Domino data folder and is regenerated when the Domino server SSL certificates are installed or modified. A TrustedCerts.class file generated by a server is only valid for that particular server. Adding or changing the server certificate will invalidate all previous TrustedCerts.class files from that server. A TrustedCerts.class can be converted to a TrustedCerts.jar by using this ANT script: 8 Endpoint Manager for Mobile Devices Setup Guide

<project name="convert" default="go" basedir="."> <target name="go"> <jar destfile="trustedcerts.jar" basedir="." compress="true"> <include name="trustedcerts.class" /> </jar> </target> </project> This script should generate a TrustedCerts.jar file that can be deployed in the plugin. When you have set all parameters, click Configure Traveler Management Extender. This action takes you to the Take Action dialog, where you can select the server that you want to configure. Click Ok and this will configure the appropriate settings on your extender. After the action completes, you can manage devices enrolled on your Traveler server through the IBM Endpoint Manager. Management Extender for Microsoft Exchange The Management Extender for Microsoft Exchange must be installed on the TEM Server or on a relay. The deploy Fixlet is only relevant for computers with a TEM agent and a relay or server installed. Deploy the Management Extender Fixlet To deploy the Management Extender for Microsoft Exchange Fixlet, click the link in the Actions box of the task window and follow the same procedure as Lotus Traveler. Note: Exchange Management Extender supports connections to Exchange 2007 servers. As a prerequisite, Exchange Management tools need to be installed on the systems where the extenders will be deployed. Configure the Management Extender Open the Configure Management Extender dashboard and click on the Microsoft Exchange extender. Specify your Exchange server address and your credentials. If you are connecting to an Exchange 2007 server, check the Exchange 2007 checkbox in the Configure Extender dialog. When you have set all parameters, click Configure Exchange Management Extender. This action takes you to the Take Action dialog, where you can select the server that you want to configure. Click Ok and this will configure the appropriate settings on your extender. After the action completes, you can manage devices enrolled on your Exchange server through the IBM Endpoint Manager. Management Extender for ios The Management Extender for Apple ios must be installed on the TEM Server or on a relay. The Deploying the Management Extender Fixlet is only relevant for computers with a TEM agent and a relay or server installed. The Apple ios devices must be able to connect to the Management Extender (default port 443) at the DNS name/ip address that you specify during installation. Setup Guide 9

Note: You need to have an Apple ID to complete this process with a valid email address. Create an account that has a non-personal email address to maintain access to the Push Certificate portal in the event of a departure. Setting up the Management Extender involves three basic steps: v Deploying the Management Extender Fixlet v Obtaining a Certificate v Configuring the Management Extender Deploy the Management Extender Fixlet 1. Open the Deploy Management Extender for Apple ios Fixlet. The Fixlet is in the Setup and Configuration node in the navigation tree. 2. Click the button in the Fixlet and select the target computer to deploy the Management Extender. If the target computers are not relevant, make sure that the agent and a relay are installed first. 3. When prompted, use a DNS name (or IP address) that the Apple ios devices can reach. 4. Target the computers to install the Management Extender for Apple ios. 5. The installation will create a certificate request that must be signed by both IBM and Apple before you can manage your Apple ios devices. Obtain a Certificate 1. Download the CSR file that was generated during the installation by opening https://<dns or IP address>/csr. Save the file. 2. Send an email to iem-mdm-signup@wwpdl.vnet.ibm.com and attach the push.csr file. Type MDM APNS CSR <organization name> in the subject line. 3. IBM will respond via email with a signed certificate request. 4. Go to https://identity.apple.com/pushcert/ 5. Log in with your Apple ID. Consider using a non-personal ID so that other members of the organization can use the Apple ID in the future. 6. Select Create Certificate. 7. Read and agree to the Terms and Conditions. 8. Follow the instructions to upload the certificate file that you received from IBM. 9. Download the new signed push certificate "MDM_IBM Global Engineering Solutions_Certificate.pem" file. 10. If you open the.pem file in a text editor, you should see a base64 encoded certificate that starts with BEGIN CERTIFICATE and has several lines of random characters. 11. Rename the file to push.cer and create a backup copy. Configure the Management Extender 1. Open the Configure Management Extender dashboard from the Setup and Configuration node in the navigation tree. 2. Select the Management Extender for Apple ios and click Configure. There will be a delay of a few minutes after deploying the management extender before it will report its configuration information and display in this dashboard. 3. Select the configuration options. It is not common to change the port numbers. The refresh interval controls how often the management extender will send a refresh command to the agents. Using a more frequent refresh interval allows 10 Endpoint Manager for Mobile Devices Setup Guide

you to see updated information from your devices faster, but potentially causes more data and battery usage on the device. 4. Select the certificate that you received from Apple in the section above. If you have a push key file (because you generated the CSR and key pair manually), also include that in this section. 5. If you have an HTTPS key and certificate from a trusted source, you can include them in this section. This will replace the self-signed HTTPS certificate and prevent the HTTPS warnings on the devices. Your Managem ent Extender for Apple ios is now ready to manage ios devices (listening on port 443). You can test it by opening your browser and visiting https://<dns or IP address>. Note: The ios Management Extender requires direct connection to the Apple Push Notification Server. This interaction occurs over TCP/IP and cannot be proxied via HTTP proxies. Back up your Apple Push Notification Private Key After you deploy the Fixlet, back up one of the files to a secure location. The file will likely be in the following path on your management extender: C:\Program Files (x86)\bigfix Enterprise\Management Extender\MDM Provider\private The file will be called push_key.pem. This key is tied to your push certificate, in that if you want to deploy multiple extenders with the same certificate, you need to use the same key for each. ios App Setup Android Agent Setup To set the mobile client on your iphone, use the following steps: 1. From your iphone, open the App Store. 2. Select Search and search for IBM Mobile. 3. Select the IBM Endpoint Manager Mobile Client. 4. Select Free and then Install App. 5. At the Sign In screen, sign in using your existing Apple ID or create a new Apple ID. This will install the mobile client to your device. 6. Launch the app from your device. 7. Enter server address, work email, and device ownership fields. 8. Select Enroll. To set up your Android agent, use the following steps. You will need an internet-facing relay for this process. 1. Launch the Android market app on your device and search for IBM Endpoint Manager for Mobile Devices. Select the app and click download. Click Accept and Download. 2. After the application is installed, select Open. Setup Guide 11

3. Click Activate. 4. Enter the TEM Server address (or internet-facing relay) that you obtained from your administrator and enter your work email address. Select one of the two available options to indicate if the device is personal or enterprise. Click Enroll. 5. If the connection is successful, the message Successful set up of the Mobile Client will display briefly, and service status will indicate that the service is running. Note: To uninstall the TEM Android agent, unselect the Device Administrator option under Settings/Location and Security on the device. Note: To control your device location privacy, deploy the Disable GPS Location Properties Fixlet under Mobile Device Inventory/Data Configuration. Warnings Two possible warning messages will display in the Warnings list panel if they are relevant to your deployment: Android Agent is not marked as a Device Administrator and Proxy Agent Service not Running. To mark your Android Agent as Device Administrator, go to Settings on your Android device. If the Proxy Agent Service is not running on a Management Extender, it will not update device information or issue actions to devices. To start the service, click BES Proxy Agent Service not Running and click in the Actions box to initiate the action. Part Three 12 Endpoint Manager for Mobile Devices Setup Guide

Support Support To learn, understand, and optimize your use of this product, see the following resources: v Tivoli Endpoint Manager Support site v Knowledge Base v Forums and Communities v Endpoint Manager for Mobile Devices Wiki Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan Ltd. 1623-14, Shimotsuruma, Yamato-shi Kanagawa 242-8502 Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. Setup Guide 13

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/101 11400 Burnet Road Austin, TX 78758 U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only. All IBM prices shown are IBM's suggested retail prices, are current and are subject to change without notice. Dealer prices may vary. This information is for planning purposes only. The information herein is subject to change before the products described become available. 14 Endpoint Manager for Mobile Devices Setup Guide

This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. The sample programs are provided "AS IS", without warranty of any kind. IBM shall not be liable for any damages arising out of your use of the sample programs. If you are viewing this information softcopy, the photographs and color illustrations may not appear. Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information at www.ibm.com/legal/copytrade.shtml. Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, other countries, or both. IT Infrastructure Library is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce. Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Linux is a trademark of Linus Torvalds in the United States, other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. ITIL is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office. UNIX is a registered trademark of The Open Group in the United States and other countries. Setup Guide 15

Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom. Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries. Other company, product, and service names may be trademarks or service marks of others. 16 Endpoint Manager for Mobile Devices Setup Guide