QMX ios MDM Pre-Requisites and Installation Guide QMX System Requirements The following requirements apply to the system that QMX will be installed on. This system will host the QMX MDM Service. These are in addition to the basic QMX system requirements. Follow the steps in this ios installation guide after successfully installing the QMX base framework using the QMX Configuration Manager Installation Guide. 1..Net 4.0 2. IIS must be installed. a. The IIS Management Scripts and Tools feature (Server 2008 and 2008 R2 only) should be added to the IIS Server role. This is not a requirement but it will ensure that the QMX MDM service will use the correct SSL certificate when signing messages sent to mobile devices. b. SSL Bindings must be configured on port 443 with a valid certificate and certificate chain. c. The subject of the SSL certificate must match the DNS name that Mobile Devices will use to connect to the QMX MDM Service. Devices will be asked to trust the Root CA of this certificate upon enrollment. 3. An MDM APNS certificate (including its corresponding private key) must be installed in the local certificate store (See section titled Acquiring and MDM APNS Certificate). Microsoft Simple Certificate Enrollment Protocol (MSCEP) System Requirements The QMX MDM service requires an MSCEP service to supply client enrollment certificates to mobile devices. This system does not need to be the same system QMX is installed on. 1. MSCEP for Active Directory Certificates Role Installed (Requires Enterprise Server) a. For more information regarding MSCEP, go to http://www.microsoft.com/downloads/details.aspx?familyid=e11780de-819f-40d7-8b8e- 10845BC8D446&displaylang=en 2. Hot-Fix for KB2483564 Installed - http://support.microsoft.com/kb/2483564 3. To allow for requests with long query strings, cut & paste the following command into a command window (required for ios devices): %systemroot%\system32\inetsrv\appcmd.exe set config /section:system.webserver/security/requestfiltering /requestlimits.maxquerystring:"3072" /commit:apphost Acquiring an MDM APNS Certificate To use MDM, you must be part of the Apple Developers program and have access to the portal for generating an App ID and generating a cert for MDM use with QMX.
Generate a Certificate Request through IIS on the QMX server 1. Select Start > Administrative Tools > Internet Information Services (IIS) Manager. 2. Select the server name. 3. From the center menu, double-click the Server Certificates button in the Security section. 4. Next, from the Actions menu on the right, select Create Certificate Request. This will open the Request Certificate wizard. 5. In the Distinguished Name Properties window, enter the following: a. Common Name - The name associated with the developer account. Organization - The legally registered name of your organization/company Organizational unit -The name of your department within the organization City/locality -The city in which your organization is located State/province -The state in which your organization is located Country/region The country in which your organization is located 6. Click Next 7. In the Cryptographic Service Provider Properties window, select the following: a. Cryptographic service provider: Microsoft RSA SChannel b. Bit length: 2048 8. Save the CSR to your computer. Remember the filename and location that you save the file. Submitting your certificate request to the Apple Developer Portal 1. From the QMX server, go to - http://developer.apple.com/devcenter/ios/index.action 2. Log in 3. Click ios Provisioning Portal, click App IDs, click New App ID. 4. Enter a common name for your App ID. [ Example: QMX MDM 1 ] 5. select an existing Bundle Seed ID for your App ID 6. Do NOT select Use Team ID 7. Enter a unique bundle identifier. Note: This must begin with com.apple.mgmt and end with a unique string. [ Example: com.apple.mgmt.qmxmdm1 ] 8. Click Submit. 9. Locate the certificate in the list of certificates and click Configure (on the right). 10. Click Configure under Production Push SSL Certificate. 11. Upload the certificate signing request (CSR), and then click Generate. 12. When the assistant is finished generating the certificate, click Continue. 13. Click Download. 14. Specify a location to download the certificate when prompted, then done. Installing the certificate on the QMX server 1. After you have copied the file to the Windows Server, go back to the Internet Information Services (IIS) Manager > Server Certificates and select Complete Certificate Request from the Actions menu on the right. This will open the Complete Certificate Request wizard. 2. Browse to the.pem file that was provided to you from the Apple Push Certificates Portal and enter a friendly name. a. *The friendly name is not part of the certificate itself, but is used by the server administrator to easily distinguish the certificate. Call it QMX MDM 3. Selecting OK will install the certificate to the server. You should now see the server listed in the Server Certificates section.
Configuration After installing QMX and configuring it for integration with SCCM the ios extension must be installed. The QMX MDM service requires configuration items to be supplied on the following screens in the QMX Configuration console. System Center > MDM Global Variables System Center > SCCM > SMS > ios > Global Variables These screens contain the documentation for each item. The WMI Service on the QMX System must be restarted after configuring the values. Note: You do not add devices manually or through discovery within the QMX config tool as you normally would with another extension type. Device enrollment does this for you. Extending the SCCM Managed Object Format (MOF) SCCM 2007: 1. Open and Copy the entire contents of the QMX ios extension file: <install location of SCCM>\eXc Software\WMI Providers\nonWindows\Virtual Agent Library\SMS\iOS\def_mof\SCCM 2007\QMX_iOS.mof 2. Edit SCCM directory file: <install location of SCCM>\Microsoft Configuration Manager\inboxes\clifiles.src\hinv\sms_def.mof a. Paste copied content to the end of the sms_def.mof 3. Restart the executive and component manager services. SCCM 2012: 1. Under Administration > Client Settings, right click and choose properties 2. Within the properties console, select Hardware Inventory, then click the button Set Classes 3. Within the Hardware Inventory Classes console, choose import, select the mof file from the ios extension directory: <install location of SCCM>\eXc Software\WMI Providers\nonWindows\Virtual Agent Library\SMS\iOS\def_mof\SCCM 2012\QMX_iOS.mof, and choose open, then import. You will see the new class definition with the defined properties 4. Choose ok to close all consoles
Network Topology Requirements SCCM Certificate Authority QMX Device Enrollment Service (MSCEP) SSL Port 2195 HTTPS HTTPS Apple Push Notification Service Mobile Device 1. Mobile devices need to have HTTPS access to the MSCEP server 2. Mobile devices need to have HTTPS access to the QMX server 3. The QMX server needs permission to make an outgoing SSL connection on port 2195
Device Enrollment Mobile ios devices can be enrolled in the QMX MDM service by browsing to the following URL: https://<external_qmx_host_name>/mdm/ Note: external_qmx_host_name is the host name of the QMX system that can be resolved externally by the device. They will be presented with the following screen: The user must select Trust MDM Service if the device does not already trust the certificate authority that issued the SSL certificate configured for the IIS SSL bindings. This will be the case if you are using an internal Certificate Authority. Once the MDM Service is trusted the User can select Enroll Device to enroll the device in the MDM Service. Once the device has been enrolled, the node will automatically be added to the QMX configuration tool under and registered with SCCM along with the asset data. Note: You must follow the section Extending the SCCM mof in order to prep SCCM for data integration. Self-Service Device Profiles The QMX MDM Service provides a repository for Self-Service ios Device Profiles. Profiles can be added to the repository located in the Virtual Agent Libray\MDM\Profiles directory of the QMX installation directory (typically Program Files\eXc Software\WMI Providers\nonWindows). Mobile devices can access this repository with the following URL: https://<external_qmx_host_name>/mdm/profiles ios Profile Installation using Software Distribution ios Profiles can be installed using the QMX SCCM Software Distribution process. This lets and administrator track the compliance of a profile distribution using SCCM reporting tools. The integrated QMX Software Distribution Wizard now supports a new ios Profile package type that can be used for this purpose. Currently the SCCM Distribution Point is the only distribution method supported.