Configuration and Maintenance

Cortado Corporate Server Version 6.1 Configuration and Maintenance Cortado AG Alt-Moabit 91 a/b 10559 Berlin Germany/ Alemania Cortado, Inc. 7600 Grandview Avenue Suite 200 Denver, Colorado 80002 USA/EEUU Cortado Pty. Ltd. Level 20, The Zenith Centre, Tower A 821 Pacific Highway Chatswood, NSW 2067 Australia E-mail: info@team.cortado.com Web: www.cortado.com Issued: April 2, 2013 (v213)

Notes Copyright This document is the intellectual property of Cortado AG. This document may be copied in whole or in part, provided this Copyright notice is included in every copy. Registered trade marks All hardware and software names mentioned in this document are the registered trademarks of their respective companies or should be regarded as such. Safety warning All Cortado products are pure software solutions. Please note the safety warnings in the technical documentation from your hardware vendor and from the manufacturer of each device and component. Before beginning installation, we recommend closing all windows and applications and deactivating any virus scanner. 2 Configuration Manual Cortado Corporate Server

Contents Introduction... 7 Precondition... 7 Overview management console... 7 Preparatory work for MDM... 9 BlackBerry... 9 Android... 9 Apple ios... 10 Requesting and installing Apple Push certificates... 11 SCEP server installation... 17 User access... 27 Via Apple ios, Android and BlackBerry... 27 HTML5 Client... 27 User Management... 29 User Import... 29 Defining import source... 29 Selection of users and Import... 32 User Configuration... 35 Overview... 35 Configure network drives... 35 User settings... 39 Mobile printing... 43 Assigning predefined printers... 44 Assigning Network printer... 46 Assigning mobile printer (Wi-Fi, Bluetooth)... 50 Removing printers... 53 Target folders for print jobs... 53 Policies... 55 Cortado Corporate Server Configuration Manual 3

Contents Managing devices... 56 Device information (Details)... 56 Device functions... 57 Device protection (Lock Screen+ Wipe)... 57 Clear Passcode - ios only... 59 Remove a device (Remove)... 59 Locate a device (Locate)... 59 Merging multiple-displayed devices (Merge)... 61 Applications (Apps)... 61 Policies... 61 Certificates... 62 Wi-Fi Profiles... 63 Reports... 64 Overview... 64 Examples... 65 Managing apps... 67 Assigning apps stored by default... 68 Adding new apps... 69 Storing apps as a link (Define App)... 70 Importing apps... 71 Managing intranet apps... 72 Define a link... 73 Assigning links... 74 Managing certificates... 76 Overview... 76 Encryption between browser (end device) and server... 76 Encryption between the Cortado app (end device) and server... 77 Groups of certificates... 78 Types of Cortado certificates... 78 Cortado Corporate Server websites... 78 Cortado server addressing... 78 4 Configuration Manual Cortado Corporate Server

Contents HTTPS encryption between the Cortado app and server... 78 In detail... 78 Setting up root and server certificates for Cortado Corporate Server... 78 Establishing client certificates (optional)... 81 Managing Policies... 85 Define a policy... 86 Assigning policies to users or devices... 87 Wi-Fi Profiles... 89 Creating a Wi-Fi profile... 89 Assigning Wi-Fi profiles... 90 Sending Welcome e-mail... 90 Purpose... 90 Procedure... 91 Global Settings... 91 User Self Service Portal... 96 First Steps Wizard... 96 Apps... 97 Intranet Apps... 97 Setup... 97 Personal Printing... 98 What is Personal Printing?... 98 Opening the configuration console... 98 Settings... 100 ADAM Service Account... 101 Print Job Storage... 101 Authentication... 103 Setting up printers... 104 Personal Printer for Windows machines... 104 Cortado Corporate Server Configuration Manual 5

Contents Setting up Personal Printers for Mac and Linux machines (optional)... 104 Setting up target printers... 104 Font management... 106 Activating authentication methods... 107 Configuring authentication devices for encryption (SSL)... 108 Configuration for each user... 109 Configure each user separate... 109 Appendix... 111 Mail directory on Apple and Android devices... 111 Creating a.csv file for importing users... 111 Creating files for importing apps... 112 Intranet App: Define Cortado server as a proxy... 114 Configure file types... 118 Cortado server ports... 126 Cortado app is inactive... 126 Testing the client certificates in the DMZ... 128 User management using PowerShell... 130 Update to 6.1... 132 Uninstalling the Cortado Corporate Server... 133 Additional sources... 133 Customer service and technical support... 134 Abbreviations... 134 6 Configuration Manual Cortado Corporate Server

Introduction Introduction The consumerization of IT and the growing number of various devices used in the enterprise means that cross-platform, high-performance mobile device management (MDM) is essential. The use of mobile devices in companies can only increase productivity and add optimal capacity to perform outside of traditional office settings when access to key corporate resources and comprehensive file management functions are guaranteed. The most important prerequisite for this is Cortado Corporate Server. The world's first solution to combine powerful MDM with a unique cloud-desktop approach. Whether ipad, iphone, Android, BlackBerry devices or PCs and Macs, all devices can be seamlessly, securely and efficiently integrated into the corporate IT environment as well as be professionally managed. Mobile Application Management (MAM) facilitates the management and administration of enterprise applications such as intranet and internet applications, as well as other apps. In addition apps can be recommended and cross-platform links to the respective app stores deployed to users. At the same time, employees benefit from mobile corporate access and thanks to full desktop capabilities, can work on the go with their mobile device just as productively as in a traditional office setting. The solution is complemented by a comprehensive security concept, which ensures maximum security and control on the mobile device, the server and during data transfer. Thanks to Cortado Corporate Server, Apple ios, Android and BlackBerry users can access through their smartphones or tablets information anytime and anywhere, documents can be viewed on site, copied, printed, faxed, e-mailed or shared. A further option is the secure connection to the HTML5 client which can be established from any desktop while offering all the benefits of Cortado Corporate Server. The result is a complete solution for all mobility, bring your own device (BYOD) and consumerization challenges. Precondition The Installation and initial setup manual shows you how to install and initially configure Cortado Corporate Server. In this manual, you will learn how to configure Cortado Corporate Server and adjust it to the specific needs of your company. For further manuals see Page 133. You have already pre-configured Cortado Corporate Server with the Configuration Assistant (see Installation and initial setup manual, Page 133). However, before the user can use the full range of functions in Cortado Corporate Server, further steps are necessary. Overview management console From a workstation, open the following website: https://<cortado_server_address>/fw An HTML5-enabled browser is needed to this. Log in to the web-based configuration console of the Cortado server with the same user account (CortadoService account) used for the installation (Illus. 1). Cortado Corporate Server Configuration Manual 7

Introduction Illus. 1 Illus. 1 Login of the web based Cortado server s Configuration Console In the Cortado Console you can, amongst other things: import users and assign them certificates and policies assign predefined printers and drives enable Cortado functions make the Cortado app available on mobile devices assign apps to mobile devices block access to mobile devices that are lost delete company data from mobile devices reset factory settings on devices locate devices. Illus. 2 Illus. 2 Control panel of Cortado Corporate Server s Console: Overview 8 Configuration Manual Cortado Corporate Server

Preparatory work for MDM As an example of user management, we explain the Cortado Management Console, in which the user can manage, as well as other things, the devices, printers and certificates. You reach the CONTROL PANEL by clicking on CONTROL PANEL (right arrow in Illus. 2) and here you can select, for example, user management (USERS) (left arrow in Illus. 2). This opens the summary page of the Cortado Management Console (Illus. 3). It is divided into two display columns and two editing columns. In the first column, the items from the selected module are displayed, for example users, devices or certificates. If you highlight at least one of these items, there appear in the corresponding editing column (= second column), actions that you can carry out, e.g. import, add or remove. The data sets of those items selected in the first column are displayed in the third column, and these can, in turn, be edited in the fourth column. Illus. 3 Illus. 3 Cortado Management Console: User management (example) You can also select other aspects from the tabs in column three, e.g. NETWORK DRIVES, PRINTERS, SETTINGS. Preparatory work for MDM BlackBerry See the BlackBerry configuration manual (Page 133). Android In order that you are able to manage the devices of your Android users (MDM), it is necessary for them to enter the Cortado server, rather than the exchange server, as their mail server in the set up of their company e-mail accounts (Exchange Active- Sync account). Inform your users of this. They must enter the Cortado server address instead of the Exchange server address (Illus. 4). Tell the users this information. Once the Cortado server s address is set up, the users receive the automatically created configuration e-mail (see Page 92). Cortado Corporate Server Configuration Manual 9

Preparatory work for MDM Illus. 4 Illus. 4 Setting up the Exchange ActiveSync account (example for Android left and for iphone right) You can use the same email account settings on the ios devices. So if for example, a device is lost, the email account can be blocked (see Page 40). For how to do so, see the chapter First Steps Wizard on Page 96. Apple ios For mobile device management with ios devices you require, in addition to the already installed and configured Cortado components: an Apple issued Push certificate on the Cortado server (see below) an SCEP 1 server to automatically issue SSL certificates (see Illus. 5 and Page 17) 1 SCEP/NDES: Simple Certificate Enrollment Protocol and Network Device Enrollment Service 10 Configuration Manual Cortado Corporate Server

Preparatory work for MDM Illus. 5 Illus. 5 Mobile device management with Cortado and SCEP server Requesting and installing Apple Push certificates To use Apple ios mobile device management for Cortado, you must install an SSL certificate provided by Apple on your Cortado server. This certificate enables you to communicate securely with the Apple Push Notification Service. Before you can request an SSL certificate from Apple, you first have to run a Certificate Signing Request (CSR) on the Cortado server (see below). If your Cortado server wants to establish a connection to an ios device, it sends a notification to the device via the Apple Push Notification Service. This notification prompts a log on to the server. So no information is transmitted. The Apple Push Notification Service only wakes the device from hibernation, so that it can be logged on to the Cortado server. All configuration information, settings and requests go via an (encrypted) SSL connection directly from the Cortado server to the ios devices (Illus. 1). In order that your users' ios devices can communicate with the Cortado server, the devices must be registered there. Note! Please note that your network must also be prepared for Apple ios Mobile Device Management. Particularly Apple uses the following TCP ports: 80, 2195, 2196 and 5223. See table with Cortado ports on Page 126. More information about Apple can be found here: http://images.apple.com/ipad/business/docs/ios_mdm.pdf Cortado Corporate Server Configuration Manual 11

Preparatory work for MDM 1. For CSR, select: CERTIFICATES APPLE PUSH CERTIFICATE (Illus. 6 and 7) in the Cortado Management Console. Illus. 6 Illus. 7 Illus. 6 Control Panel: Select CERTIFICATES Illus. 7 Requesting a certificate from Cortado server 2. Click on GENERATE CERTIFICATE REQUEST (arrow in Illus. 7). 12 Configuration Manual Cortado Corporate Server

Preparatory work for MDM 3. Fill out the form (any text), and confirm with OK (Illus. 8). Illus. 8 Illus. 8 Fill out the request form 4. Click on DOWNLOAD CERTIFICATE REQUEST to save the certificate request (Illus. 9 and 10). Illus. 9 Illus. 10 Illus. 9 Saving the certificate request Illus. 10 Saved certificate request Cortado Corporate Server Configuration Manual 13

Preparatory work for MDM 5. Send this certificate request for signing by e-mail to: certificate@team.cortado.com. Your certificate request will then be signed by Cortado and sent back to you (Illus. 11). Illus. 11 Illus. 11 Signed certificate request received 6. Then go to the Apple website (https://identity.apple.com/pushcert/) and log in using your Apple ID. Click on CREATE A CERTIFICATE (Illus. 12), select your signed certificate request, and upload it (Illus. 13). Shortly after, you can download your SSL certificate in.pem format (Illus. 14 and 15). Illus. 12 Illus. 13 Illus. 12 Create a certificate by using the request Illus. 13 Uploading a Cortado-signed certificate request 14 Configuration Manual Cortado Corporate Server

Preparatory work for MDM Illus. 14 Illus. 15 Illus. 14 Downloading the certificate Illus. 15 Push certificate downloaded from the Apple website 7. Using UPLOAD APPLE CERTIFICATE you can now upload your certificate onto the Cortado server (Illus. 16 and 17). Illus. 16 Illus. 16 Loading the Apple Push certificate onto the Cortado server Cortado Corporate Server Configuration Manual 15

Preparatory work for MDM Illus. 17 Illus. 17 Select certificate 8. Save a backup of the certificate in.pfx format with EXPORT APPLE PUSH CERTIF- ICATE (Illus. 18 and 19). With this version of the certificate, you can avoid future need for the procedure described above. Using IMPORT APPLE PUSH CERTIFICATE you can install it again anytime onto the Cortado server. Illus. 18 Illus. 18 Installed push certificate save backup copy Illus. 19 Illus. 19 Apple Push certificate backup copy saved 16 Configuration Manual Cortado Corporate Server

Preparatory work for MDM SCEP server installation The following steps can serve for a Proof of Concept (because the installation of a Standalone CA is desribed here). For productive environments we recommend the use of descriptions from Microsoft instead (because the installation of an Enterprise CA is desribed there). 1. If possible, select a new server 2 to install as SCEP server (recommended: Windows Server 2008 R2 Enterprise). This server must be accessible for ios devices and be located in the same domain as the Cortado server. 2. Set up a local user account 2 (here: NDESadmin), and include it in the Certificate Service DCOM Access, Cryptographic Operators and IIS_IUSRS groups (Illus. 20). Illus. 20 Illus. 20 Create local user account and include in three groups 2 If you are using two certificate servers (which is recommended in productive environments), use a domain account (domain user) instead of a local user account. Log on as a domain administrator once onto the SCEP server. Then open the Certificate Templates snap-in in the MMC as shown in Illus. 32 on Page 24. Cortado Corporate Server Configuration Manual 17

Preparatory work for MDM 3. Open the Server Manager, and add the role ACTIVE DIRECTORY CERTIFICATE SER- VICES (Illus. 21). Illus. 21 Illus. 21 Add ACTIVE DIRECTORY CERTIFICATES SERVICES role 4. Select CERTIFICATION AUTHORITY as role service (Illus. 22). Illus. 22 Illus. 22 Select role service CERTIFICATION AUTHORITY 18 Configuration Manual Cortado Corporate Server

Preparatory work for MDM 5. Select the setup type STANDALONE (Illus. 23). Illus. 23 Illus. 23 Select setup type STANDALONE 6. Select CREATE A NEW PRIVATE KEY in the SET UP PRIVATE KEY menu (Illus. 24). Illus. 24 Illus. 24 Select CREATE A NEW PRIVATE KEY Cortado Corporate Server Configuration Manual 19

Preparatory work for MDM 7. Select MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER in the CONFIGURE CRYPTO- GRAPHY FOR CA menu (Illus. 25). Illus. 25 Illus. 25 Select MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER 8. Accept the suggested default values in all the remaining windows and start the installation by clicking on INSTALL (Illus. 26). Illus. 26 Illus. 26 Begin installation of the ACTIVE DIRECTORY CERTIFICATE SERVICES role 20 Configuration Manual Cortado Corporate Server

Preparatory work for MDM 9. Then select NETWORK DEVICE ENROLLMENT SERVICE as an additional service of the same role (Illus. 27). Illus. 27 Illus. 27 Add NETWORK DEVICE ENROLLMENT SERVICE 10. Assign the user account (here: NDESadmin) that you created above (Illus 20 and 28). Illus. 28 Illus. 28 Enter NDESadmin as user Cortado Corporate Server Configuration Manual 21

Preparatory work for MDM 11. As before, accept the suggested default values in all the remaining windows, and start the installation by clicking on INSTALL (Illus. 29). Illus. 29 Illus. 29 Start installation of the role service NDES 12. Note that the following registry key must be set to 1 (default): hkey_local_machine\software\microsoft\cryptography\mscep\enforcepassword\enforcepassword (Illus. 30) Confirm with OK. Illus. 30 Illus. 30 Set registry entry EnforcePassword at 1 22 Configuration Manual Cortado Corporate Server

Preparatory work for MDM 13. In the Microsoft Management Console (MMC), open the snap-in CERTIFICATION AUTHORITY. In the properties of the CA (certificate authority), select: POLICY MOD- ULE PROPERTIES FOLLOW THE SETTINGS IN THE CERTIFICATE TEMPLATE, IF APPLI- CABLE. OTHERWISE, AUTOMATICALLY ISSUE THE CERTIFICATE (Illus. 31). Confirm with OK. Illus. 31 Illus. 31 Select... AUTOMATICALLY ISSUE THE CERTIFICATE Cortado Corporate Server Configuration Manual 23

Preparatory work for MDM 14. Then, in the properties of the CA (snap-in CERTIFICATION AUTHORITY) select the tab SECURITY and add the account with which you installed the Cortado Corporate Server software i.e. the recommended CortadoService and give it the permission MANAGE CA (Illus. 32). Illus. 32 Illus. 32 Add CortadoService account and select Manage CA [Alternatively for Enterprise CAs, set the following as the domain admin: In the MMC, switch to the snap-in CERTIFICATE TEMPLATES, and add the account (Illus. 20) created above to the template IPSEC (OFFLINE REQUEST), and give it the permission ENROLL. (Illus. 33).] 24 Configuration Manual Cortado Corporate Server

Preparatory work for MDM Illus. 33 Illus. 33 [for Enterprise CAs: Add user account NDESadmin to the certificate template IPSEC (OFFLINE REQUEST)] 15. Restart first the certificate authority and then the IIS. 16. In the browser (IE) go to the following address: http://<adresse_scep-server>/certsrv/mscep_admin (e.g.: http://192.168.149.51/certsrv/mscep_admin) Authenticate yourself with the login details for the CortadoService account. The thumbprint of the root certificate and a challenge password are displayed here (Illus. 34). Illus. 34 Illus. 34 Network Device Enrollment Service in your browser Cortado Corporate Server Configuration Manual 25

Preparatory work for MDM The challenge password is generated by the server and is only valid for a limited time. The Cortado server accesses the above URL and enters the password into the MDM profile, as it delivers it to the ios device. The user can't install the same profile more than once. As soon as the step ENROLLING CERTIFICATE is completed on the ios device, the password expires. The number of challenge passwords that can be valid simultaneously, and the duration of their validity, is limited by the server. To change these values, you can enter the following registry keys: HKLM:Software\Microsoft\Cryptography\MSCEP\PasswordValidity\Password- Validity (DWORD: validity of the password in minutes) HKLM:Software\Microsoft\Cryptography\MSCEP\PasswordMax\PasswordMax (DWORD: number of simultaneously valid passwords) 17. In the Cortado Management Console, select: CONTROL PANEL GLOBAL SETTINGS CONFIGURE CORTADO PUSH SERVER (Illus. 35). SCEP SERVER URL: Enter here the URL for MSCEP.DLL in the newly installed SCEP server: http://address_scep_server/certsrv/mscep/mscep.dll Example for Microsoft SCEP server: http://192.168.149.51/certsrv/mscep/mscep.dll SCEP SERVER CHALLENGE URL: Enter here the URL, from which the challenge password will be read: http://<addresse_scep_server>/certsrv/mscep_admin (Example: http://192.168.149.51/certsrv/mscep_admin) SCEP SERVER CHALLENGE PATTERN: This is a search pattern for retrieving the challenge passwords. Keep the default values. Confirm with OK. Illus. 35 Illus. 35 Register SCEP server in Management Console 26 Configuration Manual Cortado Corporate Server

User access Note! Please check, if the root certificate of the NDES server is located in the Trusted Root Store of the Cortado server. User access Via the Cortado app and the HTML5 client you can enable your users to access network drives and use various file options (printing, faxing, edit, export etc.). Learn how to assign all those options to the users after the following short survey of the user access. Via Apple ios, Android and BlackBerry The Cortado app is available for Apple-iOS-, Android-OS- and BlackBerry-OS devices (Illus. 36). After installation and configuration of the App in the User Self Service Portal (see Page 96) all enabled options are available for the users (see Page 39). Illus. 36 Illus. 36 Cortado app: start page on different mobile devices: (from left to right: Apple iphone, Android, BlackBerry) User guides for the Cortado apps on mobile devices can be found on our website www.cortado.com under SUPPORT GUIDES & MANUALS CORTADO CORPORATE SERVER USER GUIDES. HTML5 Client With the HTML5 client, users are able to access shared corporate network drives, to edit files and folders, from any HTML5 supporting browser 3. The HTML5 client is accessible via following link: https://cortado_server_address/cortadoexplorer (exam- Cortado Corporate Server Configuration Manual 27

User access ple: https://cortadoserver/cortadoexplorer). This link is part of the welcome e-mail (Page 92). Note! If your Cortado server uses a self-signed certificate (created from Cortado during installation) or an existing, but self-created certificate, The users will see a warning message in the browser when following this link for the first time. They can ignore this message by ciicking on CONTINUE TO THIS WEBSITE. Alternatively use a certificate from a Certification Authority. Users may utilize all options you assigned for them via the HTML5 client (Page 39). A user guide for the HTML5 client can be found on our website www.cortado.com under SUPPORT GUIDES & MANUALS CORTADO CORPORATE SERVER USER GUIDES. Illus. 37 Illus. 37 Login to HTML5 client 3 For example: Safari v5.1.2 or later, Internet Explorer v9 or later, Firefox v8 or later, Google Chrome v16 or later. 28 Configuration Manual Cortado Corporate Server

User Management User Management User Import To enable users for Cortado, open CONTROL PANEL USERS the following window will open (Illus. 38): Illus. 38 Illus. 38 Starting the import wizard To import the users, click on the plus sign (arrow in Illus. 38), the IMPORT WIZ- ARD will start (Illus. 39). Defining import source Here you will chose the source from which the users should be imported 4 : Illus. 39 Illus. 39 Selecting import source ACTIVE DIRECTORY We recommend this type of data import for environments in which Apple or Android devices are in use or in environments in which BlackBerry devices communicate via BIS (when no BES server is available). For more, see Import from Active Directory, Page 30). 4 To import users from different sources, just start Import Wizard several times Cortado Corporate Server Configuration Manual 29

User Management COMMA SEPARATED VALUE (CSV) FILE The users to be imported can be read from a.csv file you have created. This type of data import can be used as an alternative to Active Directory import. Under Import from.csv file (Page 31) you will learn which additional settings to make for the data import. Information on creating a.csv file can be found in the appendix (Creating a.csv file for importing users, Page 111). BLACKBERRY CONFIGURATION DATABASE You can select this option in either a pure BES environment or one for your BlackBerry users. Here the BlackBerry users are selected from the BES database. Read more on this in the BlackBerry configuration manual, Page 133. Note! Importing user data uses one Cortado Corporate Server user license per user. Installing the Cortado Corporate Server automatically installs five demo licenses. The licenses are for user and devices, so every access to the Cortado server by either a device or the HTML5 client, uses up one license. In the Licensing documentation, you will find details about license activation and update subscription (Page 133). Import from Active Directory If you have selected ACTIVE DIRECTORY as the import source (Illus. 39), another window opens, in which you can select a domain where the desired users will be found. Click to mark the desired domain (Illus. 40). If you enable the checkbox in front of the domain name (left arrow in Illus. 40) and then click on NEXT all existing users will be displayed in the next window. Alternatively, if you click on the small arrow on the right (right arrow in Illus. 40) you will go to any existing subfolders. Illus. 40 Illus. 40 Selecting domain 30 Configuration Manual Cortado Corporate Server

User Management Now the users selected to be imported are displayed (Illus. 41). Illus. 41 Illus. 41 Users that can be imported from the AD Proceed as described in Selection of users and Import on Page 32. Import from.csv file If you have selected COMMA SEPARATED VALUE (CSV) FILE as the import source, the window in Illus. 42 opens. Illus. 42 Illus. 42 Selecting.csv file For how to create a.csv file, refer to the appendix on Page 111. Cortado Corporate Server Configuration Manual 31

User Management Via SELECT FILE (left arrow in Illus. 42) you specify the path and file name of the previously created.csv file (Illus. 43). Illus. 43 Illus. 43 Select.csv file Then click OPEN (arrow in Illus. 43). Afterwards click LOAD FILE (right arrow in Illus. 42). Now the users selected to be imported are displayed (Illus. 44). Illus. 44 Illus. 44 Users that can be imported from the.csv file Selection of users and Import In Illus. 41 and Illus. 44 the selected users from the AD, or else the.csv file are displayed. Decide whether all or only certain users are to be imported. To do so, place a checkmark by the corresponding users, or select all users (left arrow in Illus. 45). 32 Configuration Manual Cortado Corporate Server

User Management Illus. 45 Illus. 45 Selecting users Then click IMPORT (right arrow in Illus. 45). Illus. 46 Illus. 46 Users successfully imported (green dot) If a user has been successfully imported, a green dot appears in the status column. (upper arrow in Illus. 46). In addition, the information bar at the bottom of the window (lower arrow in Illus. 46) displays the number of imported users. If the user could not be imported because, for example, no licenses are available, a red dot is displayed. If you roll over it with the mouse, the corresponding error message will be displayed. (Illus. 47). Cortado Corporate Server Configuration Manual 33

User Management Illus. 47 Illus. 47 Users not imported (red dot) When you close the Import Wizard, the successfully imported users will be listed in user management (USERS) (Illus. 48). They are now enabled for use by Cortado Corporate. Illus. 48 Illus. 48 Imported users in user management (USERS) When there are a large number of users, it is recommended to use PowerShell for the import (see Page 130). How to assign users with various drives is explained under Configure network drives (Page 35). In chapter User settings you will find information on special changes in the user management (Page 39). How to make additional printers available to the users is explained under Mobile printing (Page 43). How you can manage your users' devices, read under Managing devices (Page 56). Read how to manage your users' certificates under Managing certificates (Page 76). How you use Cortado Corporate together with Personal Printing Essentials, read under Personal Printing (Page 98). 34 Configuration Manual Cortado Corporate Server

User Management User Configuration Overview Now under CONTROL PANEL USERS, you can further configure and manage settings of the successfully imported users. Illus. 49 Illus. 49 User management with various actions (example: user1) The following options are available if you have marked at least one user (Illus. 49): REMOVE: Here you can remove selected user from Cortado user management. In doing so, the user will not be deleted from AD. The license previously used by this user is then immediately free and can be made available for another user. GET SETTINGS: With this action, you can assign to a user, another user s settings (network drives, printers, settings, max device count, apps, intranet apps and policies). SEND E-MAIL: With this action, users will be sent a welcome e-mail. It contains important informations for the users. There is more on this in the chapter Sending Welcome e-mail (Page 90). SET MAX DEVICE COUNT: By default, one device per user is designated. You can increase that number here. If a user logs in with another device, he will be denied access to the Cortado app. Note! We recommend that the number of devices per user (MAX DEVICE COUNT) should always be set a bit higher than the number of devices available. This is because devices are occasionally listed twice, for instance if a user started the configuration twice. You can consolidate the duplicate devices later (see Page 61). Configure network drives The users can directly access shared folders on the company network using their Cortado app. The user s access rights are completely carried over from the AD. So that the user can see a shared drive in their Cortado app, create an AD group for Cortado users (type: global, example: CORTADO USERS) an. Share the drive for this group (see PROPERTIES SHARING) and grant FULL CONTROL (see Illus. 50, left). Add the same group also to PROPERTIES SECURITY. Grant at least reading rights (see Illus. 50, right). Cortado Corporate Server Configuration Manual 35

User Management Illus. 50 Illus. 50 Minimum share rights of a drive for user access The shared network drives will be shown to the users on their mobile devices (or in HTML5 client) under HOME DRIVE (Illus. 55). Caution! With drive-access users can access your company data with their mobile devices. Please calculate a potential security risk. To give users access to network drives, mark one or more users in User Management (USERS) (arrow in Illus. 49). Then select under NETWORK DRIVES ADD in the context menu (arrow in Illus. 51). Illus. 51 Illus. 51 Managing network drives Assign drives Enter the drive name under LABEL (freely selectable, see Illus. 52, right) and under PATH specify the path to the desired share. Alternatively you can enter a drive letter. Note the following notation style: S_ (see arrow in Illus. 52, right). 36 Configuration Manual Cortado Corporate Server

User Management Illus. 52 Illus. 52 Add network drive (example - left: drive name, right: drive letter) Repeat the procedure for all desired network drives. If the users have a Home Folder (Home Directory) in the AD, it can also be made available. For this purpose, enter one of the following variables under PATH: %HOMEDIR% (for home folder in Active Directory), %USERUPN% (for UPN) or %USERNAME% (for Sam-Account-Name) (Illus. 53). Illus. 53 Illus. 53 Add Home Folder (Example) These network drives are now displayed with network path and the corresponding drive label under USERS NETWORK DRIVES (Illus. 54). Illus. 54 Illus. 54 Network drives of user1 (example) Cortado Corporate Server Configuration Manual 37

User Management The users now have the configured drives available in the Cortado app on their mobile devices (Illus. 55). Illus. 55 Illus. 55 Network drives under HOME DRIVE on iphone (example) Editing shared drives EDIT: If you want to make changes to a shared drive, highlight it and click EDIT (Illus. 56). REMOVE: If you want to delete a shared drive, highlight it and click REMOVE (Illus. 56). Illus. 56 Illus. 56 Created network shares displayed User Storage Directories created in this way can now be found again in the root directory of the Cortado Corporate Server (here: C:\User Storage, see Illus. 57). Illus. 57 Illus. 57 User directories in the User Storage 38 Configuration Manual Cortado Corporate Server

User Management In the Cortado Corporate Server s USER STORAGE, one folder per user is created with the shared AD network drives. Note! If you later change the path to the user storage (for example, while running the Configuration Assistant again), the network drives defined here will be lost. Furthermore, a personal folder (MY DOCUMENTS) is provided for each user on his mobile device (see Illus. 55). The files which were stored there will also be stored in the respective user folders in USER STORAGE on the Cortado server (Illus. 57 and Illus. 87). User settings To configure the users' access rights of the users, highlight one or more users in the user management (CONTROL PANEL USERS, left arrow in Illus. 58). Then select SETTINGS EDIT in the context menu (right arrow in Illus. 58). Illus. 58 Illus. 58 Edit user settings Cortado Corporate Server Configuration Manual 39

User Management Now you can make changes to the default rights settings for the selected users. By default all the settings are checked, except for REPORT GPS DATA, FORCE OFFLINE PASSWORD and FORCE DOWNLOAD AS PDF (Illus. 59). Illus. 59 Illus. 59 Default user settings General Account enabled. By removing this checkmark, you deny the users access to the company drives via the Cortado app. (see Illus. 60). Illus. 60 Illus. 60 Access denied to HOME DRIVE(S) (corporate drives) on the iphone Microsoft Exchange. By removing this checkmark, you deny the users the use of Microsoft Exchange, provided that in the configuration of the Exchange account on the mobile device, the name of the Cortado server, rather than the Exchange server is specified (see Page 9). This has the advantage that if the device is lost or stolen, the e-mail account of the user can be blocked on the mobile device. 40 Configuration Manual Cortado Corporate Server

User Management Report GPS data. With a checkmark placed here, the GPS data can be used to help locate a mobile device (see the selection Locate a device (Locate) on Page 59). Password You can choose here from two options: Force offline password 5. If this option is enabled, the user may not save the password for the Cortado app (see Illus. 61, left). Additionally, he must, even in offline mode, enter the password to gain access to the Local and the Secure drive 6 of the cortado app. Allow local password storage. If this option is enabled, the user may save the password for the Cortado app. (see Illus. 61, right). Illus. 61 Illus. 61 Left: Password entry necessary at each opening of the Cortado app; right: Option REMEMBER PASSWORD activated (iphone) Caution! Storing passwords holds a security risk. If a mobile device gets lost unauthorized persons can access company data. Allowed features Display network drives. By removing this checkmark, you deny the users access to the company's shared network drives (see the chapter Network drives on Page 36). Furthermore, you can withdraw other rights from users to use and edit files located there: 5 When reconfiguring the Cortado app on an ios device (such as when passing the device on to another user), local files are only deleted when this option is enabled. 6 The protected drive is only available for Android devices OS 4 or later Cortado Corporate Server Configuration Manual 41

User Management Send files by e-mail: Allows the sending of files by e-mail (see Illus. 62, left). Delete files: Allows deleting of files (see Illus. 62, left). Upload files to Cortado server: Allows the uploading of files to the Cortado server. Please note, that if you eliminate this option for users, they can no longer save e-mails or e-mail attachments on the company server. Furthermore, the users can neither print nor fax files stored only on the mobile device. The file will first need to be uploaded onto the server. Download files from Cortado server: Allows the downloading of files from the Cortado server. Force download as PDF: If this option is enabled, downloaded files will only be displayed in PDF format. Files such as.txt or.zip files, won't be downloaded. Preview: Allows a preview of a file to be created. (see Illus. 62, left, icon: eye). Export files: Allows exporting files in ZIP or in PDF format. (see Illus. 62, left). Auto Up-/Download 7 : By removing this checkmark, you prevent the users from receiving automatic folder and file updates (see Illus. 62, right). Note! For Android users to be able to use the Auto Up/Download feature, password saving must be allowed. Fax. By removing this checkmark, you prevent the users from sending files via fax. (see Illus. 62, left). (You'll find more information on faxing in the manual Installation and initial configuration, see Page 133). Printing. By removing this checkmark, you prevent the users from printing files (see Illus. 62, left, icon: printer). Wi-Fi printing: By removing this checkmark, you prevent the users from searching for printers via Wi-Fi. Illus. 62 Illus. 62 Left: various file options, right: Auto Download folder (Cortado-App on Android device) 7 The feature Auto Up-/Download is currently available for Android devices only. 42 Configuration Manual Cortado Corporate Server

Mobile printing Secure browser. By removing this checkmark, you prevent the users from making use of SECURE BROWSERS (see Illus. 63, left). This browser is for intranet apps (see Page 72). Embedded browser 8. By removing this checkmark, you prevent the users from making use of the internet browser integrated into the Cortado app. (see Illus. 63, right). Illus. 63 Illus. 63 SECURE BROWSER (left) and integrated default browser (right) in the Cortado app on an iphone Account directory So long as only one user is selected (Illus. 58, left arrow) you also have the option, under ACCOUNT DIRECTORY (Illus. 59) to change the path to the user directory (User Storage) of that user. If more than one user is selected, this path can only be changed by running the Configuration Assistant again (see the chapter User Storage on Page 38). Mobile printing Without any further setup on the server, smartphone users have access to direct printing, within the company and also when outside. With the Cortado app on the mobile device, printers can be searched for locally, i.e. printers that can be found in the same network (Wi-Fi). These can then be printed to via Wi-Fi (see Illus. 64). Furthermore a connection to a Bluetooth 9 printer can be established via the Cortado app. 8 This feature is available for ios users only. 9 Bluetooth printing is for BlackBerry and Android devices only. Cortado Corporate Server Configuration Manual 43

Mobile printing Illus. 64 Illus. 64 Via Wi-Fi or Bluetooth detected printer (example for Android device) Universal drivers are installed on the server with the Cortado installation, allowing problem free printing to most printers. A precondition is that during installation, the checkmark has not been removed from the checkbox DOWNLOAD DEFAULT PRINTER DRIVERS (see Installation and initial setup manual). If a special driver or a particular printing function is required, install the necessary original drivers as well on the Cortado server. Without these drivers, the universal driver will always be used, even when mobile users select the original driver from the list. If you install original drivers for certain printers, they will be used instead of the universal drivers. User guides for the Cortado app on mobile devices can be found on our website www.cortado.com under SUPPORT GUIDES & MANUALS CORTADO CORPORATE SERVER USER GUIDES. Assigning predefined printers In addition to the option described above, you can relieve the users from printer searching. Specific users can be allocated printers, which will display immediately on the mobile (Illus. 65). The advantages: printer searching on the mobile is no longer required network and AD printers can be predefined it can store printer templates with specific settings and drivers that facilitate Bluetooth or Wi-Fi printing 44 Configuration Manual Cortado Corporate Server

Mobile printing Illus. 65 Illus. 65 Preset printers (example for Android device) How to print? The Cortado server prints directly onto the network printers. The mobile device only initiates the print job; the rendering is done on the Cortado server or a print server. Using printers outside the company network (via Wi-Fi or Bluetooth), the print data that was rendered on the Cortado server is forwarded to the printer via the mobile device. This ensures that the print data is always rendered with the preferred driver and prints in original format. See also the scenarios on pages 50 to 51. You can search here for the following printers: printers listed in the AD: Active Directory, Page 47 printers shared on a print server: Single print server, Page 48 printers shared on a print server: Single printer, Page 48 (network) printers installed on Cortado server: Server-attached printer, Page 49 Printer templates created on the Cortado server: Mobile printer, Page 50 Pre-setting printers on the server 1. In CONTROL PANEL USERS, select the tab PRINTERS (Illus. 66, top arrow) and select the users for whom you want to set printers. 2. Select PRINTERS ADD on the right (Illus. 66, bottom arrow). Illus. 66 Illus. 66 Add printers for one or more users Cortado Corporate Server Configuration Manual 45

Mobile printing 3. The following dialog opens (Illus. 67). Illus. 67 Illus. 67 ADD PRINTER dialog Assigning Network printer If you click NETWORK PRINTER (Illus. 67), you can select following shared printers (Illus. 68): Illus. 68 Illus. 68 ADD PRINTER dialog Shared printer Under SHARED PRINTER you will find the following printer (Illus. 69): 46 Configuration Manual Cortado Corporate Server

Mobile printing Illus. 69 Illus. 69 SHARED PRINTER dialog Active Directory printer. If you select ACTIVE DIRECTORY in Illus. 69 you will find the printers listed in the AD. Their print jobs are sent from the print server to the network printer (Illus. 70). Illus. 70 Illus. 70 Shared Printer: Print jobs are rendered on the print server, where the drivers are installed and sent to the network printer (blue arrow) The AD printers appear when NETWORK PRINTER SHARED PRINTER ACTIVE DIREC- TORY is selected (see Illus. 71). Enable the checkbox of your preferred printers and confirm with ADD and CLOSE. Illus. 71 Illus. 71 Select printers in AD shared Cortado Corporate Server Configuration Manual 47

Mobile printing The AD printers selected here will be assigned to the selected users as their preferred printers (see Illus. 72). Requirement: The option LIST IN DIRECTORY has already been enabled on the print server for each printer share. Illus. 72 Illus. 72 AD printers on the mobile device (example for Android) Single print server. If you select SINGLE PRINT SERVER (Illus. 69 on Page 47) you can allocate the shared printers of a print server to users, even if the printers aren't listed in the AD. The print server prints also to the network printer (see Illus. 70). After selecting NETWORK PRINTER SHARED PRINTER SINGLE PRINT SERVER, you can enter the name of the print server directly (Illus. 73). Illus. 73 Illus. 73 Searching for shared printers: enter the print server name All the shared printers appear. Select the preferred printer shares and confirm with NEXT, ADD and CLOSE (Illus. 74). Illus. 74 Illus. 74 Selecting shared printers 48 Configuration Manual Cortado Corporate Server

Mobile printing The shared printers selected here will be assigned to the selected users as their preferred network printers (see Illus. 75): Illus. 75 Illus. 75 Shared printer on mobile device (example for Android) Single printer. Under Single printer (Illus. 69 on Page 47) you can allocate the shared printers of a print server to users, even if the printers aren't listed in the AD. Here, printing will also go from the print server to the network printer (see Illus. 70). Unlike with the option SINGLE PRINT SERVER, here you can enter a direct path to the printer share. If you select NETWORK PRINTER SHARED PRINTER SINGLE PRINTER, you can enter the path to the printer share (Illus. 76). Illus. 76 Illus. 76 Enter the path to the printer Confirm your entry with ADD. Close the confirmation message with CLOSE. This assigns the printer share to the selected users as preferred network printer (see Illus. 75 on Page 49). Note! All printer drivers of network printers that should be used by users on their end devices must be installed on the Cortado Corporate Server. It is enough to manually connect as an administrator from the Cortado server with the relevant network printer (\\servername\sharename). This installs the driver automatically or you will be prompted to select the appropriate driver. Server-attached printer (TCP/IP, USB) These printers appear when NETWORK PRINTER (Illus. 67) SERVER-ATTACHED PRINTER is selected. Furthermore, you can assign users with printers that were created on the Cortado server and which print via Windows provided printing ports, such as Standard TCP/IP port including the Personal Printer (see the chapter Personal Printing, Page 98). Here, Cortado server prints directly to the printer (Illus. 77). Cortado Corporate Server Configuration Manual 49

Mobile printing Illus. 77 Illus. 77 Server-attached printer: Printing with printers created on Cortado server, directly to the printer (blue arrow) All printers created locally on the Cortado server that are not connected to a CORTADO PRINT PORT are now displayed (Illus. 78). Select the relevant printer and click ADD to confirm. Illus. 78 Illus. 78 Server-attached printer: Select printers on the Cortado server These printers appear on the mobile device as NETWORK PRINTERS (see Illus. 79). Illus. 79 Illus. 79 Server-attached printer on mobile device (example for Android device) Assigning mobile printer (Wi-Fi, Bluetooth) 10 MOBILE PRINTER is particularly suitable for printers outside the company, and with which the user is already familiar 11. MOBILE PRINTER (WI-FI, BLUETOOTH) (Illus. 67 10 This option is available for Android and BlackBerry devices.only 50 Configuration Manual Cortado Corporate Server

Mobile printing on Page 46) are printers that can be accessed by the mobile device via Bluetooth or WiFi, and for which preferences can be set on the server, using printer templates. You can then print from the Cortado server via the mobile device (Illus. 80, blue arrows). Illus. 80 Illus. 80 Mobile Printer: Printing from Cortado server via the mobile device with Wi-Fi or Bluetooth For printing via Bluetooth and Wi-Fi universal drivers were installed during the installation routine. If you use printers which need special drivers or on which you wish to make settings (color, duplex...), these still have to be set up on the Cortado server. First create the desired printer in the Cortado server s Printers folder and attach it to a CORTADO PRINT PORT (example in Illus. 81). Illus. 81 Illus. 81 Connecting a printer to Cortado Print Ports 11 For unknown printers, we recommend instead, the printer search integrated into the app on the mobile device, where a suitable driver is selected manually. Cortado Corporate Server Configuration Manual 51

Mobile printing If you assign specific properties to the newly created printer objects (for example duplex printing) these will then be transferred. The user that selects thus printer object on his/her mobile device will then also be able to print in duplex format. Enable the function ENABLE PRINTER POOLING and confirm with APPLY (arrow in Illus. 82). So you can attach a printer to more than one CORTADO PRINT PORT and thus it s not necessary to create an own printer port for each printer. Illus. 82 ILLUS. 82 ENABLE PRINTER POOLING The printer objects set up (in) this way will be displayed in MOBILE PRINTER (WI-FI, BLUETOOTH) (see Illus. 67 on Page 46) and can be assigned to the users. Illus. 83 Illus. 83 Select shared printers 52 Configuration Manual Cortado Corporate Server

Mobile printing Users select on the Android or BlackBerry device this printers in PRESET PRINTERS (Illus. 84 left). Illus. 84 Illus. 84 Shared printers on the mobile device (example for Android) Removing printers For each user, the assigned printers will be displayed in the light gray field. To delete a printer (or rather, its assignment to a user), select the user first, and then the printer or printers (check box). Then click on REMOVE on the right (arrow in Illus. 85). Illus. 85 Illus. 85 Remove predefined printer for selected user Target folders for print jobs Some printers of ThinPrint Server Engine and Personal Printing store their jobs automatically to the Cortado server s User Storage. So, the users can view or print the respective files with their mobile devices (see also Illus. 86): Personal Printer (from Personal Printing, see Page 111) Print-to-Cloud (from Personal Printing or ThinPrint Server Engine, see the ThinPrint Server Engine manual, Page 133) Print-to-ePaper (from Personal Printing or ThinPrint Server Engine Cortado Corporate Server Configuration Manual 53