Getting to Know Afaria

Getting to Know Afaria® 6.6 FP1

Afaria provides comprehensive management and critical security features to ensure that data and devices are up-to-date, reliable and secure. Based on a profile-based model for automating and managing security, work assignments and schedules, IT departments have full control of devices, while frontline workers are free to focus on business objectives. Whether Afaria deployment is over-the-air or wired, all users benefit through simplified workflows and increased productivity.

Getting to Know Afaria presents an overview of Afaria architecture, what’s new in Afaria, using the Afaria Administrator and Afaria standalone components, as well as how you can use Afaria to face the challenge of managing devices at the front lines.

Getting to Know Afaria 6.6 FP1

Document version 6.60.01

Copyright © 2010 Sybase, Inc. All rights reserved.

This publication pertains to Sybase software and to any subsequent release until otherwise indicated in new editions or technical notes. Information in this document is subject to change without notice. The software described herein is furnished under a license agreement, and it may be used or copied only in accordance with the terms of that agreement. To order additional documents, U.S. and Canadian customers should call Customer Fulfillment at (800) 685-8225, fax (617) 229-9845. Customers in other countries with a U.S. license agreement may contact Customer Fulfillment via the above fax number. All other international customers should contact their Sybase subsidiary or local distributor. Upgrades are provided only at regularly scheduled software release dates. No part of this publication may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical, or otherwise, without the prior written permission of Sybase, Inc. Sybase trademarks can be viewed at the Sybase trademarks page at http://www.sybase.com/detail?id=1011207. Sybase and the marks listed are trademarks of Sybase, Inc. A ® indicates registration in the United States of America.

SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Ger-many and in several other countries all over the world.

Java and all Java-based marks are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries.

Unicode and the Unicode Logo are registered trademarks of Unicode, Inc.

All other company and product names used herein may be trademarks or registered trademarks of the respective companies with which they are associ-ated.

Use, duplication, or disclosure by the government is subject to the restrictions set forth in subparagraph (c)(1)(ii) of DFARS 52.227-7013 for the DOD and as set forth in FAR 52.227-19(a)-(d) for civilian agencies.

Sybase, Inc., One Sybase Drive, Dublin, CA 94568

Getting to Know Afaria 6.6 FP1 Table of Contents

Table of ContentsIntroducing Afaria........................................................................................................ 5

Afaria Architecture................................................................................................ 6Afaria Server ........................................................................................................ 9Afaria Administrator............................................................................................ 10Afaria Support Services...................................................................................... 11Sybase Social Media Channels .......................................................................... 11

What’s New in Afaria 6.6 FP1?................................................................................. 12Afaria 6.6 Feature Pack 1 ................................................................................... 12Afaria 6.6 Platform .............................................................................................. 13Afaria 6.5 Feature Pack 1 ................................................................................... 15Afaria 6.5 Feature Pack 2 ................................................................................... 16

Server Access........................................................................................................... 18Server Status and Reports........................................................................................ 19

Home: Server Status .......................................................................................... 19Home: Active Sessions ...................................................................................... 20Home: Alerts....................................................................................................... 21Home: Reports ................................................................................................... 22Home: Client Deployment .................................................................................. 23

Server Configuration................................................................................................. 24Properties: Communications .............................................................................. 24Properties: Servers............................................................................................. 25Properties: Component Configuration ................................................................ 27Server Configuration: Server Schedules ............................................................ 28Server Configuration: Client Types .................................................................... 29Server Configuration: Alert Definitions ............................................................... 30Server Configuration: License Compliance ........................................................ 31Server Configuration: Patch Console ................................................................. 32

Client Management with Group Profiles ................................................................... 33Assignments ....................................................................................................... 34Client Actions ..................................................................................................... 34Allowed Channels ............................................................................................... 34Policies ............................................................................................................... 35Portal Packages ................................................................................................. 35

Client Groups............................................................................................................ 36Monitors .................................................................................................................... 37Channels................................................................................................................... 38

Backup Manager ................................................................................................ 39Configuration Manager....................................................................................... 40

Configuration Features ................................................................................ 40

3

Getting to Know Afaria 6.6 FP1 Table of Contents

Configuration and Enforcement Features .................................................... 41Data Security Manager for Handheld Clients ..................................................... 42

Features ....................................................................................................... 42Data Security Manager for Windows Clients...................................................... 45

Features ....................................................................................................... 45Document Manager............................................................................................ 46

Features ....................................................................................................... 46Inventory Manager ............................................................................................. 48

Features ....................................................................................................... 48Patch Manager ................................................................................................... 50Server Listing ..................................................................................................... 52Session Manager ............................................................................................... 53

Features ....................................................................................................... 53Software Manager .............................................................................................. 55

Features ....................................................................................................... 55Channel Availability for Clients........................................................................... 57Channel Availability for Servers ......................................................................... 59

Import and Export Channels ........................................................................ 59Replication ................................................................................................... 59

Policies...................................................................................................................... 60Policy Category – Application Control ................................................................ 60Policy Category – Antivirus/Firewall ................................................................... 60Policy Category – Device Configuration ............................................................. 61Policy Category – OMA DM ............................................................................... 61

Portal Packages........................................................................................................ 63Package Category – Application ........................................................................ 63

Tenants and Multitenancy......................................................................................... 64Features ............................................................................................................. 64

Clients in Afaria......................................................................................................... 65Client Data ................................................................................................................ 66

Clients View ........................................................................................................ 66Logs View........................................................................................................... 67Inventory View.................................................................................................... 69Package Tracking View...................................................................................... 70Backup View....................................................................................................... 71License Compliance View .................................................................................. 72Client Patches View ........................................................................................... 73Client Deployment View ..................................................................................... 74

Remote Control......................................................................................................... 75

4

Getting to Know Afaria 6.6 FP1 Introducing Afaria

Introducing AfariaAfaria is recognized as a leader in the client systems management space by industry analysts and device manufacturers. Afaria enables you manage your remote and mobile computing devices, including handheld devices, laptops, and desktops.

Afaria’s bandwidth optimizations provide efficient wireless support:

• Push capabilities let you distribute various content to and perform various tasks for your client users in a sequence, and at a rate determined by the server. Pull capabilities let client users request specific content from a server through subscriptions.

• Dynamic bandwidth throttling optimizes client connections to take maximum advantage of available bandwidth, while giving way to other applications when their activity levels increase.

• Byte-level differencing detects and extracts the difference between two versions of a file or software package and then sends only the byte-level changes or updates to the mobile user, reducing the volume of data sent, bandwidth demands, and connection time.

• Segmented file and package delivery breaks files and software packages into smaller distribution packets, allowing you to transmit large volumes of data in time or size increments across several connections until the transfer is complete.

• Check point restart picks up an interrupted communication connection where it left off the next time the client connects to the server, avoiding redundant data transmission and reducing connection time and user frustration.

• Offline installations and processing allows offline processing to minimize connection time and costs. While data and software applications are transferred during connections, client agents on mobile devices automatically install software applications and updates and initiate scheduled asset inventories after the connection has ended, increasing productivity by allowing the user to work offline more effectively.

• Compression optimizes client data traffic for low bandwidth connections by shrinking large files for fast, efficient transmission.

• Outbound notification lets you notify clients or client groups to connect to the server to perform a specific task.

Afaria protects your data, as well as your computing devices. It includes security features, such as server and client authentication, SSL encryption, and user authentication and assignments using enterprise user directories. It also provides “device wipe” capabilities for most device types.

5


Afaria ArchitectureAfaria’s tiered architecture provides information distribution from headquarters to computing devices, or direct from headquarters to devices across a WAN. Afaria lets you define an unlimited number of customized channels to manage your computing devices from anywhere, anytime.

The following diagram illustrates Afaria’s architecture.

1 Clients – user devices, such as handheld devices, smartphones, and laptops that Afaria manages. Clients either have an Afaria agent installed or have a native capability or third-party application that Afaria features use to interact with the hosting device.

2 Network connection – connections with clients occur via inbound and outbound connections, using HTTP or HTTPS protocols. Although not reflected in the diagram, clients may also connect using the XNET or XNETS protocols from behind the corporate firewall.

3 External firewall – protects the corporate network from unauthorized access from the Internet. The external firewall permits inbound Afaria connections.

4 Relay server – Afaria bundles an optional relay server to operate as a proxy for HTTP and HTTPS sessions between the Afaria server and its Afaria clients. Using a relay server lets

6


you further secure your enterprise network by moving the session connection point from within your firewall to a location outside of your firewall, to your Demilitarized Zone (DMZ).

5 Internal firewall – protects corporate network assets, such as your Afaria server, from the DMZ. When using the optional relay server, inbound connections are not permitted from the relay server. The Afaria server establishes an outbound connection to the relay server, allowing an Afaria implementation without any open ports on your internal firewall.

6 Afaria server – Afaria is a server-based solution that can operate as a single, standalone server or as multiple servers in a server farm environment. The Afaria server communicates with the Afaria database and additional components or clients as necessary.

• Standalone Afaria server – a single Afaria server operating as the only server in an Afaria installation. The server has a one-to-one relationship with the Afaria database.

• Afaria server farm – multiple Afaria servers operating together in an Afaria installation. The servers have a many-to-one relationship with the Afaria database. A server farm includes one main Afaria server and one or more replication servers. All servers in the farm can access the database and host Afaria client sessions.

• Peer Afaria servers – Afaria servers that operate as separate Afaria installations. Peer servers access different Afaria databases and support different sets of Afaria clients.

7 Afaria database server – the database server contains your Afaria database, and can be any database platform supported by Afaria.

8 Directory server – if providing authentication using an NT domain or LDAP service, such as Active Directory, you can designate your authentication method and the domain to be used by Afaria.

9 Afaria Administrator, the application – the Web application that provides an interface for the Afaria server. Use Afaria Administrator to define the server configuration, define access policies for Afaria Administrator users, manage Afaria clients, monitor system activity, and communicate with other Afaria servers.

10 Afaria administrator, the individual – the person that installs and operates the Afaria product.

The following features, although part of Afaria, are not are illustrated in the architectural diagram:

• OTA Deployment Center – Afaria supports using an optional Over-The-Air (OTA) Deployment Center, which is a Web server that you establish to provide software deployment services. An administrator pushes Afaria client installation packages out to the deployment center and then sends notices to device holders. Device holders can download the client directly onto their device for installation.

• iOS provisioning server – the iOS provisioning server sends device configuration policies to iOS devices.

• Portal Package server – for optional portal package operations, and for content not delivered from another source, the portal package server hosts and serves Afaria application packages to clients.

• OMA DM server – the Open Mobile Alliance (OMA) Device Management (DM) server operates as a proxy between the Afaria server and the OMA DM clients. It runs sessions

7


with known OMA DM clients to serve OMA-DM-compliant messages, as formatted by an Afaria OMA DM policy editor.

• Certificate authority server – for iOS features, the certificate authority is a required server component that issues certificates to iOS devices as part of the process for delivering device configuration policies to devices.

8


Afaria ServerAfaria server operates without its own user interface. It’s engines process all the Afaria tasks for database communication, authentication, logging, reporting, channel management, and client management. Use Afaria Administrator as the tool that provides a user interface for Afaria server operations.

Afaria provides two methods for servers to communicate with other servers: import/export and replication.

Import and export lets you move copies of editable channels from one server to another. Replication lets you send or receive read-only copies of channels that exist on your server on an automated, scheduled basis. You can also use replication to create a “server farm” scenario, using multiple servers for scalability and fault-tolerance, or to create a distributed server scenario.

For more information about the server farm environment, see “Replication” on page 59.

9


Afaria AdministratorThe Server List page displays all of the servers within your environment that you can access.When you click a server link in the list, that server’s status page appears.

The table below briefly describes the contents of each global link.

Global navigation link Description

Home Use the Home area of the Afaria Administrator to view the current status of your Afaria server, see alert notifications you may need to resolve, run reports, as well as access a wealth of additional information about your Afaria server.

Server Configuration Use the Server Configuration area to define system-wide properties for your Afaria server, including behavioral settings, client type definitions, and alert definitions.

Administration Use the Administration area for day-to-day tasks. It provides tools for managing profiles, client groups, policies, portal packages, monitors, administering channels and channel replication, and creating OMA DM clients.

Data Views Use the Data views area to view and manage detailed information about your clients. For example, you can see message logs, hardware and software inventory changes, track software package delivery, installation, and more.

10


Afaria Support ServicesSybase provides industry-leading support and a variety of downloads to help you get the most out of your Sybase products and solutions.

For more information about Sybase Customer Service and Support, you can visit www.sybase.com/support.

If you have a technical support contract, you can locate your local technical support center at www.sybase.com/contactus/support.

Sybase Social Media ChannelsVisit us online for our social media channels at www.sybase.com/resources/socialmedia.

11

http://www.sybase.com/support

http://www.sybase.com/contactus/support

http://www.sybase.com/resources/socialmedia

Getting to Know Afaria 6.6 FP1 What’s New in Afaria 6.6 FP1?

What’s New in Afaria 6.6 FP1?The Afaria product development team continues to drive the industry with innovative enhancements for the latest server and device platforms. You benefit from performance, feature, and security enhancements.

• Afaria 6.6 Feature Pack 1

• Afaria 6.6 Platform



Afaria 6.6 Feature Pack 1The Afaria 6.6 FP1 adds iOS, Android, and Afaria Access Control for Microsoft Exchange features and fixes to your Afaria 6.6 installation.

Support for iOS 4 devices

• Ability to manage iOS 4.0 devices using the new Mobile Device Management (MDM) service and protocol

• Enhanced device policy controls

• Apply policies to devices without user interaction

• More granular policy status logging

• Support for additional policy settings

• New Inventory Manager component with expanded hardware and software inventory collection

• Expanded security actions available for device, including removing the MDM payload from the device, locking the device, remote erase (device wipe), and clear device passcode.

Application deployment for iOS devices

• New App Portal component for iOS devices

• Manage application distribution and installation on iOS devices

• Support for both enterprise applications and "App Store" applications

• Applications can be required or optional on end-user devices

12


• Assignments and distribution managed using Afaria policy and profile infrastructure, applications are a type of "portal package"

• Client-side interface for application packages

• Displays applications as grouped by administrator-defined categories

• User can browse list and launch installation

Application deployment for Android devices

• New App Portal component for Android devices

• Manage application distribution and installation on Android devices

• Support for both enterprise applications and "Android Market" applications

• Applications are optional on end-user devices

• Assignments and distribution managed using Afaria policy and profile infrastructure, applications are a type of "portal package"

• Client-side interface for application packages

• Displays applications as grouped by administrator-defined categories

• User can browse list and launch installation

Afaria Access Control for Microsoft Exchange

The release adds new policy definitions for iOS clients

Afaria 6.6 PlatformAfaria 6.6 is integrated into Afaria 6.6 FP1. It introduced support for new platforms and client management enhancements.

iOS Device Management Console Integration

• Create and manage iOS devices in client data views

• Create, import, and manage iOS policies from within the policies and profiles infrastructure

• View client inventory in inventory data views

• Use system variables in iOS policies

13


Android Device Management

• Afaria client to install on Android devices

• Expanded Configuration Manager support to include WiFi and password settings

• New Android licensable components:

• Inventory Manager – hardware and software inventory

• License Manager – tracks software licenses

• Session Manager – limited event support for file manipulation and client messages

• Android 2.2 device support

• Native device lock and wipe options for 2.2 devices without dependency on a Microsoft Exchange server

Server Infrastructure Enhancements

• Windows Server 2008 R2 (64-bit) support for these components:

• Afaria server

• Afaria Administrator

• Browsing workstation

• Access Control Utility

• OTA Deployment server

• OMA DM server

• SMS gateway

• iOS provisioning server

• Microsoft SQL Server 2008 support for the Afaria database

• Set up menu includes access to install programs for all server components

Windows Mobile Device Management Improvements

• Updated user interface and improved navigation for the Afaria client on Windows Mobile Professional devices

• Windows Mobile Software Manager improvements:

• Support for silent installations

• Soft reset after installation controls

• Control over CAB status after installation

14


• Package tracking & logging improvements

• Session Manager event to end a process

• Localization for Japanese language

Roaming Controls

• Roaming controls for Windows Mobile devices in Configuration Manager channel

• Disable data connections when roaming

• Disable email attachments when roaming

• Disable Afaria scheduled or client-initiated connections when roaming

• Disable IMAP and POP3 email when roaming

• Display message on device when entering or exiting roaming state

• Roaming controls for Symbian devices in Configuration Manager channel

• Disable data connections when roaming

• Disable Afaria scheduled or client-initiated connections when roaming

• Display message on device when entering or exiting roaming state

• New roaming monitor available for Windows Mobile and Symbian devices to trigger custom actions when roaming

Other Client Management Updates

• OMA DM - ability to import existing policy files (DDFs), modify them and create OMA-formatted XML for deployment to devices

• Symbian devices – Session Manager set time event support

Afaria 6.5 Feature Pack 1The Afaria 6.5 FP1 is integrated into Afaria 6.6 FP1. It introduced support for managing iOS devices.

• Integration with the Afaria management console

• Over-the-air provisioning of iOS devices

• Manage assignments of the following iOS configuration policies to devices:

• Password formats

15


• Restrictions on use of specific applications and device features

• WIFI settings

• VPN settings

• Email settings

• Exchange Server connection settings

• LDAP settings

• CalDAV settings

• Calendar Subscription settings

• Web clip configurations

• Credentials/certificates

• SCEP server location settings

• APN and proxy server settings

• Log data that tracks the provisioning of iOS devices and deployment of policies

Afaria 6.5 Feature Pack 2The Afaria 6.5 FP2 is integrated into Afaria 6.6 FP1. It introduced fixed issues, hot fix rollups, and new and enhanced functionality.

Enhanced iOS management capabilities

• New remote wipe for iOS, iTouch, and iPad devices, as managed using your enterprise Microsoft Exchange environment.

• New Exchange Access Control support for iOS devices, providing the ability to block or allow ActiveSync requests with Exchange.

• Additional configuration policy distribution options:

• Support variables for user-specific data in configuration policies.

• Support for delivering signed and encrypted configuration policy files, which triggers encrypted backups to the iTunes server.

• Option to display profiles on device after installation.

• Additional inventory and tracking data:

• Collect and display device serial number and operating system with device information.

• New report to identify devices missing Exchange identifiers.

16


• New wizard for importing multiple iOS device definitions from a CSV file.

• Enhanced iOS provisioning server scalable design:

• Support for multiple provisioning servers per farm.

• Provisioning server installs on own server or Afaria Administrator server.

New Android Device Management

• Remote wipe for Android devices, as managed using your enterprise Microsoft Exchange environment.

• Exchange Access Control support for Android devices, providing the ability to block or allow ActiveSync requests with Exchange.

• Wizard for importing multiple Android device definitions from a CSV file.

Enhanced Exchange Access Control

• Support for Android, iOS, and Symbian devices, in addition to the originally supported Windows Mobile devices. Provides the ability to block or allow ActiveSync requests with your enterprise Exchange environment.

• Define policies for unknown devices on a per-domain basis.

• For multitenant implementations, each tenant's Exchange environment polls the Afaria server for a list of its devices and policies and keeps the list locally.

• Support for Microsoft Exchange Server 2010.

• See Installing Afaria for Exchange Access Control architectural diagrams and discussion.

17

Getting to Know Afaria 6.6 FP1 Server Access

Server AccessAfaria Administrator uses the Access Policies link to add and remove servers, as well as define users and security roles for those servers.

The Server List page displays each server’s name, assigned roles, description, and address.

Server List

When you click a server in the list, that server’s home status page opens.

18

Getting to Know Afaria 6.6 FP1 Server Status and Reports

Server Status and ReportsUse the home links to view the server’s status, active client sessions, client deployment email notification messages and their related address books and distribution lists, current active alerts on your system, as well as view and print reports.

Home: Server StatusThe Server Status page displays all of the client sessions that have occurred in the last 24 hours, as well as the allocated and used disk space for your server, compression cache, and differencing cache.

Additional links let you stop and start the server, or navigate high-use items.

Home > Server status

19


Home: Active SessionsThe Active Sessions page provides a real-time monitor and a means for gauging the server’s current workload and performance. It displays all active client sessions in your system with supporting details concerning the client and connection activity.

Home > Active sessions

20


Home: AlertsThe Alerts page lets you view events that trigger alerts on your system so that you can acknowledge and resolve them quickly. Alerts notify you when some incident arises on your server, server components, or clients.

Home > Alerts

21


Home: ReportsThe Reports page lets you access key system and activity data stored in the server database schema through predefined reports.

Home > Reports

Reports make it easy for you to monitor and analyze your Afaria server and Afaria client base. Each report provides filters, graphical data views, subtotals and totals, and can be viewed on screen, printed, or exported.

22


Home: Client DeploymentThe Client Deployment area allows you to manage tasks related to deploying clients over the air.

Use the area to:

• Maintain your address book – Use the address book links to manage client addresses and distribution lists for deployment notifications, as well as to send client notifications.

• Maintain notification message templates – Message templates enable you predefine notification messages to use multiple times.

• Send notification messages – Send Over-the-Air (OTA) notifications as well as Open Mobile Alliance Client Provisioning (OMA CP) notifications.

• Configure a self-service portal – Access tools used to support your custom-developed, self-service portal, as well as to manage network access points used for client deployment.

Home > Client deployment

23

Getting to Know Afaria 6.6 FP1 Server Configuration

Server ConfigurationUser Server Configuration links to set server properties, define schedules for the server, define client types, define alerts for your system, track corporate software licenses, and prepare Microsoft patches for deployment.

Properties: CommunicationsUse communication properties to configure parameters for communication sessions with your clients.

These parameters include:

• Bandwidth throttling – increase or decrease the communication rate throughout the course of a client session, allowing client users to run other network applications more effectively when they communicate with the Afaria server.

• Compression – add files to or view the cache of compressed files that are frequently sent to clients. This reduces connection time and improves system performance.

• Client communication – use the Client Communication page to define communicating with your Afaria clients including communication protocol, SSL certificate and key, and server address seed value for creating new clients.

• Differencing – maintain different versions of files that you frequently send to clients; the server sends only the updated bytes of each file in the differencing cache.

• Server identification – set or change the server’s friendly name, which is visible to some clients.

24


Properties: ServersUse server properties to configure parameters for server information and behavior.


• Contact – provide Channel Viewer users with information regarding the person to contact if they have questions with their client devices or encounter problems during a communication session with the server.

• Exchange Access Config – for the Afaria Access Control for Microsoft Exchange feature, the Exchange Access Config property page lets you define parameters for operating the ISAPI listener on the Afaria server.

• Failed session cleanup – control how the system handles failed communication sessions between clients and the server.

• License – view information about your system, including a list of licensed components and client types, the number of licensed sessions, expiration dates (if any), and a brief description of the license type.

• Logging policy – determine the global logging policy settings. All logs are enabled by default.

• Log cleanup – specify the cleanup time for the individual logs.

• OTA Deployment Center – establish settings for Afaria client and Afaria server communication with the OTA Deployment Center.

• SMS Gateway – define settings for an Afaria Short Message Service (SMS) gateway.

• Security – configure settings for security measures, including authentication, domain assignments, and client approval. If you are using LDAP for authentication and assignments, you can also enable and configure SSL for LDAP to increase security when you communicate with your Windows clients.

• SMTP – establish SMTP server settings for your Afaria-initiated, SMTP-based communications.

• User-defined fields – create new fields in your database tables related to the A_CLIENTS table and read from/write to these fields using the session worklist variables Set Database Field and Get Database Field used for writing to or reading from the database.

• Outbound notification – control the volume parameters for outbound notification sessions to keep the Afaria server from being overwhelmed with incoming sessions.

• Relay server – define settings for using a relay server for your Afaria operations. The relay server operates as a proxy for HTTP and HTTPS sessions between the Afaria server and its Afaria clients.

25


Additional Security Features

Additional security features include server, client, and user authentication.These security features are subject to client type.

• Server authentication – The client requests a certificate from the server during the communication handshake to verify that the server is trusted. Server authentication prevents a rogue server from intercepting communications between the client and the intended server.

• Client authentication – The server requests a certificate from the client during the communication handshake to verify that the client is trusted. Client authentication prevents rogue devices from running sessions with the server.

• SSL encryption and user authentication – User authentication and assignments using LDAP directories include additional SSL security for client sessions.

26


Properties: Component ConfigurationUse component configuration properties to configure global settings for installed optional components.


• AV/Firewall – define the disposition of new client files or pattern files and identifies the date of the last update.

• Backup Manager – define the physical location for backup storage and define associated log and alert thresholds.

• Document Manager – apply default location settings for your file selections and settings for alternate media sources.

• Exchange Access Policy – define a synchronization policy for your enterprise’s devices that use Microsoft Exchange ActiveSync to synchronize with your organization’s Microsoft Exchange server.

• iOS Server – define properties for the Afaria iOS provisioning server and the certificate authority (CA) server.

• iOS Notification – use the iOS Notification page to define the Apple Mobile Device Management (MDM) certificate and push notification service used for Afaria MDM control, and define the user-facing messages for outbound notifications.

• OMA DM – define the OMA DM server address properties that OMA DM clients need to communicate with the OMA DM server.

• Portal Package Server – use the Portal Package Server page to define configuration properties for the Afaria portal package server.

• Patch Manager – define the location for storing downloaded patches.

27


Server Configuration: Server SchedulesUse the Server Schedules page to define a schedule for tasks you perform on a regular basis, such as updating channel content or distributing software, so that these tasks run automatically at regular intervals. There are several predefined schedules that you can edit to meet your needs.

Server configuration > Server schedules

28


Server Configuration: Client TypesClient types group clients that share one or more of the same attributes for operating system, processor, or service pack.

A single client type may contain one or more subtypes. Use the client type attribute when you create channels; channels are specific for one client type. The server is installed with predefined client types and it allows you to add new definitions.

Server configuration > Client types

29


Server Configuration: Alert DefinitionsUse the Alert definitions page to define and manage alerts and the events that trigger them on your server.

Alerts notify a contact when some incident arises on your server, server components, or clients, so that you can acknowledge and resolve it quickly. Review alerts that are currently raised on the Home, Alerts page. A raised alerts count also displays on the Home Server status page.

Server configuration > Alert definitions

Alert definitions include these property pages:

• Defined alerts – Displays the name, description, contact, threshold, threshold interval, and state of the alerts you have defined on your system.

• Defined contacts – Displays each contact’s name, pager, and/or email address.

• Defined events – Displays the name, description, and the component associated with the event system-defined and user-defined events on your system.

30


Server Configuration: License ComplianceLicense compliance is a feature of License Manager. Use the License compliance page to track software licenses, installed and purchased, and how often users run specific applications.

This page appears empty until you define software licenses in your database. Once you have defined these software licenses, the page displays data for client category, Manufacturer, Application, Size, Version, # (number) Purchased, Effective and Expiration dates, and any Notes you may add. You can define schedules that control license compliance processes, set license compliance event thresholds, work with predefined and custom views in Data views, License compliance, as well as print the various license compliance reports.

Server configuration > License compliance

License Manager supports all versions of client operating systems that are supported by Inventory Manager; however, all client types do not have exactly the same level of supported data. For instance, software size is tracked on some client types and not others.

31


Server Configuration: Patch ConsoleUse the Patch Console page to view current Microsoft patches. Select and download patches for deployment at your organization.

Patches are arranged in a tree hierarchy by product name for quick navigation and patch selection. A default server schedule runs nightly to synchronize the Patch Console page with Microsoft’s current data and download your selections. You can also initiate patch downloads on demand from the Patch console or from Data Views > Client Patches page.

Server configuration > Patch console

Patch descriptions include links directly to the Microsoft download site. You can apply properties to individual patches that define installation switches to use when the patch runs on a client and indicate whether to force a reboot after the patch installs.

32

Getting to Know Afaria 6.6 FP1 Client Management with Group Profiles

Client Management with Group ProfilesUse the Policies and Profiles area of Afaria Administrator to manage profiles. In a server farm environment, you can view profiles from any server. However, you must be on the main server to create or edit profiles.

Profiles are the primary mechanism for managing the work performed by groups of clients. The Afaria administrator creates profiles to define the work to be performed, and then to associate that work with client device types or groups of clients.

Profiles are made up of the following major components:

• Client types – a client type filter defines the types of client devices that can use a profile. For example, you can define a profile to be eligible for all Afaria-supported device types, only one device type, or some combination of multiple device types.

• Assignments – assignments define the list of groups that receive a profile.

• Policies – profiles Profiles let you apply policies to groups that are enforced either continuously or according to a schedule.

• Packages – portal packages let you deliver applications to clients.

• Automated work – automated work executes without user interaction. Define monitor-action pairs to automate work. A monitor-action pair is a single schedule or other monitor paired with a single action. The paired action may be to connect to an Afaria server to request a channel, to launch a program, or some other supported action.

• Allowed work – allowed work executes when it is requested by a client and is defined as allowed on the profile. Create a list of allowed channels to define the work that the group is allowed to perform.

Administration > Policies and Profiles

33


AssignmentsThe Assignments area lets you assign a work profile to specific groups. Groups are first filtered by the work profile’s client types attribute, then by the Assignments properties.

While groups’ clients may receive a work profile, each client must meet any channel-level requirements to be able to run the channels contained in the work profile. Similarly, a client receives monitor-action pair definitions from the client actions list only when the client type supports the monitor type.

Afaria supports the following types of client groups:

• Afaria client groups

• Afaria built-in group “All Clients”; the All Clients group is a dynamic group that includes every known client and its use simplifies assigning a work profile to all clients

• LDAP groups and organizational units

• Local user groups

• Domain user groups

Client ActionsUse the Client Actions tab to define monitor-action pairs, and affect automation as a result. Monitors detect specific events at a client or run as schedules. When monitors or schedules are paired with actions, you can automate tasks on a client each time the schedule or monitor fires.

Each monitor-action pair requires one monitor and one action type. Eligible action types include:

• Log event only

• Execute program

• Run channel

• Run script

Allowed ChannelsUse Allowed Channels tab to manage the channels and channel sets that a profile’s assigned groups are allowed to run.

Clients request channels in a variety of ways:

• Scheduled connection – A client makes a scheduled connection after its schedule monitor prompts its associated run channel action to execute.

34


• Windows client with Channel Viewer – A user selects the channel’s name in the Channel Viewer application and issues the connect command.

• Windows client or handheld client – Client opens the channel’s parameter file (.XEC).

• API client – A client runs a session using the channel’s name as the channel parameter.

• Monitor-action pair – A run channel action executes, as defined by a monitor-action pair that used a connection monitor to detect an active connection.

• Default channel – A client’s Afaria configuration settings do not define any channel when the client is connecting.

PoliciesUse the Policies tab to manage policy deployment. Policies are collections of settings and tasks to define and enforce on your clients.

Policy types include:

• Application Control – Lets you control which applications your device users can execute.

• Antivirus/Firewall – Lets you provide antivirus and firewall security for your devices, and can block incoming phone calls and SMS messages from defined sources.

• OMA DM – Open Mobile Alliance (OMA) Device Management (DM) policies are settings and actions for Afaria OMA DM clients that are based on DM objects, as defined by OMA. The policy’s content—OMA DM objects—is applied at the client according to each device’s OMA DM implementation.

Portal PackagesUse the Portal Packages tab to review and manage the profile’s portal packages. Packages let you deliver applications to your clients. A list of packages is available on the Afaria agent at the client. Users can browse the list and select packages.

35

Getting to Know Afaria 6.6 FP1 Client Groups

Client GroupsThe Client Groups page lets you manage groups of clients that function similar to Windows NT and LDAP groups. Instead of containing users as members, Client groups contain client devices.

Administration > Client groups

Types of client groups.

• Dynamic groups – Membership changes to always reflect the custom views you create in Data views, Clients and Inventory.

• Static groups – Membership always reflects only the members you select from the list of all client views. The list of members does not change unless you edit it.

36

Getting to Know Afaria 6.6 FP1 Monitors

MonitorsUse the Monitors page to manage schedules and device monitors to deploy to your Afaria clients. Pair your monitors with an action on a profile to automate work on a client device.

For example, you can create a schedule monitor to detect when the last Friday of the month occurs, and then take some type of predefined action. You create monitors on the server and deploy them to clients as part of a group profile. When the monitored condition or event occurs, the predefined action is taken automatically.

Additional events you can monitor on Afaria clients include changes to files and directories in the file system, battery capacity, processes starting and stopping, as well as memory usage.

Although device monitors are not device-specific, feature availability depends on client type features and platform support. For this reason, device monitors may function differently between client types.

Administration > Monitors

The system-defined folders in the Monitors column—All and By Type—organize your event monitors. Select a folder or monitor in the left pane to view it in the right pane.

37

Getting to Know Afaria 6.6 FP1 Channels

ChannelsChannels are sets of tasks and instructions that an Afaria client runs when it connects to an Afaria server.

Channels may change device settings, push content out to a client, pull content from a client, or execute other behaviors on a client. Channels types are specialized by component, such as Configuration Manager, Document Manager, Data Security Manager, and others.

Use the Channel Administration area to manage channels and channel sets. You can also import and export channels to and from other Afaria servers in your system.

Administration > Channel Administration

The tree structure lets you organize your channels by your Afaria server, as well as any number of folders you wish to create beneath the server.

38


Backup ManagerUse Backup Manager to back up and restore large quantities of data from specified files, folders, and applications to a specific folder structure on the corporate network.

Supported client types – Palm, Symbian, Windows, Windows Mobile Professional (including Windows CE), Windows Mobile Standard

Create backup and restore channels:

• Backup – Backup channels let you specify the folder and file names to back up on the client computer. It uses Session Manager’s Get Files from Client event to retrieve the designated backup sets.

• Restore – Restore lets you selectively recover files that you specify on a per client basis (Selective Restore), or recover files that are different than those from which they were originally restored (Full Restore).

File differencing – For Windows clients, file differencing detects, extracts, and sends only byte-level file differences to the server, reducing the time required to back up changed files.

Data backup – For Palm, Symbian, and Windows Mobile clients you can back up data files and databases when these clients connect to the server.

Schedules – For Windows and Windows Mobile clients, Backup channels can be scheduled to run on a regular basis.

Clean up backed up items – In Data views, Backup you can determine the number of days after a specified date when all backed up items are deleted.

Change the backup location and set thresholds – In Server Configuration, Properties, Backup Manager you can change the default location for backed up information, as well as set thresholds for backed up items space usage.

39


Configuration ManagerUse Configuration Manager to remotely configure devices that are deployed to your mobile workforce.

You can create channels to specify particular attributes, preferences, and settings. Configuration Manager offers features that are:

• Subject to client type.

• Either for configuration or configuration and enforcement.

• Configuration – affect device settings during an Afaria session. Subsequent to the session, the device holder may be able to change the settings.

• Configuration and enforcement – affect device settings either during an Afaria session or when a device enters a defined state, based on the nature of the settings. Subsequent to the session, configured setting cannot be changed by the user.

Configuration FeaturesConfiguration features affect device settings during an Afaria session. Subsequent to the session, the device holder may be able to change the settings. Features are subject to client type.

• Connectivity – configure a variety of connectivity settings for WiFi, Bluetooth, VPN, proxy, WAP proxy, dial up, APN, access points, and service provider.

• Device security – establish and enforce your device security policy using security settings that include password controls, security time-outs, login scripts, and encryption options.

• Synchronization activity – define the behaviors for synchronization using settings that define synchronization profiles; identify email, PIM and non-PIM application synchronization behavior; and resolve synchronization conflicts.

• Custom XML provisioning – configuration Manager includes a custom provisioning page for Windows Mobile Professional and Windows Mobile Standard clients. The custom page allows you to use the Open Mobile Alliance’s (OMA) Client Provisioning standards to compose provisioning XML scripts that you can deliver to your devices. Use the custom feature to configure settings that are not available on the Configuration Manager Channel Editor. This custom provisioning feature provides a method for you to configure even the newest devices as they hit the market.

• Email controls – define settings that route email traffic to defined email servers, provide passwords, and create restrictions for message and attachment sizes.

• Device application and feature controls – control the applications and features that your devices support using application settings related to application downloads, application data storage, email service use, device to device messaging, SMS messaging, browser controls, and phone use.

40


Configuration and Enforcement FeaturesConfiguration and enforcement features affect device settings either during an Afaria session or when a device enters a defined state, based on the nature of the settings. Subsequent to the session, configured setting cannot be changed by the user. Features are subject to client type.

• Port Control – enable, limit, or disable the usage of hardware ports on devices. By regulating the use of hardware ports, you can enforce the availability of key device features, such as Bluetooth connectivity, data transfer methods, and the use of external data cards.

• Windows Mobile Update – control how software and security updates issued by Microsoft are applied to the device.

• Roaming controls – define settings to affect when a device enters a roaming state.

41


Data Security Manager for Handheld ClientsData Security Manager lets you establish security policies for Afaria clients. Security policies for handheld clients can include a policy for protecting against unauthorized user access, security action against excessive password retry attempts, encrypting sensitive data, and for security action against absentee devices.

Supported client types – Windows Mobile Professional (excluding Windows CE), Windows Mobile Standard, Symbian, Palm

FeaturesData Security Manager allows you to manage client security.

Features are subject to client type and include:

• Device support – Supports a diverse set of Windows Mobile Professional, Windows Mobile Standard, Symbian, and Palm devices. Data Security Manager’s implementation accommodates many different screen resolutions, orientations, and sizes.

• Password options – Allows you to establish a password policy for locking the device to restrict user access. The password is required to use the device, thereby protecting device data and all device applications from unauthorized access. The password is also used to verify authorization for device state changes such as the insertion of a data card or an attempt to use desktop synchronization tools. Data Security Manager implements the following password features:

• Power-on password – Allows you to enforce password use at the client. Data Security Manager offers flexible password criteria so that you can define a device password that meets your enterprise’s password strength requirements.

• Administrator password – Allows you to implement an administrator password on the client. You can use the administrator password to access the user interface at any time, including when the device enters a lock down state with the user password disabled.

• Remote-based recovery – Allows you to issue a temporary recovery password for a client user that has control of the device but has forgotten the password. You can use the recovery password to access the user interface any time that the device is locked. Remote-based recovery requires Afaria administrator assistance.

• Device-based recovery – Provides password recovery on the device without the need for Afaria administrator assistance. Client users configure secret questions and answers, which must be answered correctly on the device prior to resetting a forgotten device password. Use of this recovery method on the device can be enabled or disabled.

• Manual lock – Allows a device user to force the device into a locked state without waiting for an automatic lock to engage. Users must supply a valid user, administrator, or temporary recovery password to unlock the device. This locked state provides protection against unauthorized users attempting to gain access to a device’s applications and data.

• Automatic lock – Data Security Manager locks the device after a defined period of inactivity.

42


• Data encryption – Allows you to establish an encryption policy for encrypting sensitive data located on the device or on any of the device’s external data storage cards. You use a channel editor to select personal information management (PIM) and other data to encrypt. You may also allow Windows Mobile Professional and Palm users to select data for encryption on their devices. You may choose your preferred encryption algorithms for Afaria to use for encrypting data, including Federal Information Processing Standards-certified (FIPS) Advanced Encryption Standard (AES) encryption algorithms. Data encryption is protection against intruders who use advanced techniques to bypass the user interface and access the data directly, or who gain control of removable media that contains sensitive data.

• Password lock down policy – Allows you to establish a password lock down policy for security action against excessive password retry attempts. You define an action to take when locking the device in response to a defined number of user password failures. Lock down action options include disabling a user password, deleting data, and hard resetting the device to its default state. This lock down state is protection against unintended users attempting to guess the user password to gain access to a device’s applications and data.

• Connection lock down policy – Allows you to establish a connection policy for security action against absentee devices. You define an action to take when locking the device in response to a client device failing to establish a connection within a defined period of time. Lock down action options include disabling a user password, deleting data, and hard resetting the device to its default state. This lock down state is protection against the possibility that a device that does not connect in a timely manner has an unknown status. The device may be in the hands of unintended users attempting to gain access to device applications and data, or have obsolete data that may put business-critical operations at risk of error.

• SIM lock down policy – Allows you to establish a policy for security action against a device with a SIM card that is changed or missing. You can define an action to take when locking the device in response to a SIM card that is changed or missing. Lock down action options include disabling a user password, deleting data, and hard resetting the device to its default state. This lock down state is protection against the possibility that a device that does not have a proper SIM card. The device may be in the hands of unintended users attempting to gain access to device applications and data.

• Emergency call support – Allows users to make emergency phone calls while the device is in a locked state. You can define the security policy for the locked state to allow other outgoing phone calls as well.

• Custom user interface – Allows you to customize several elements of the user interface that your users encounter when they use Data Security Manager, including the password prompt text and the password screen graphic.

• Email and personal information management (PIM) application compatibility – Integration with your iAnywhere Mobile Office client, Microsoft Exchange push email client, or similar solutions, enables your users to receive ongoing email and PIM update notifications, including notifications received while the device is in a locked state. Afaria supports receiving Short Message Service (SMS) and Hypertext Transfer Protocol (HTTP) notifications.

43


• Global Positioning System (GPS) service application compatibility – Afaria includes a policy setting for organizations that run GPS applications on their handheld devices. Enabling the feature keeps the user interface on and the device unlocked while the GPS radio is active. Users have access to the GPS application without the device automatically locking. Users may engage the manual lock at any time.

• Data Security Manager client uninstall channel – Allows you to uninstall Data Security Manager from your Afaria client. The uninstall process decrypts any associated data on the device or on an inserted external data card.

• Server-side decryption utility – Allows you run the File Decryption Utility program on the Afaria server to decrypt external card files encrypted by Afaria Data Security Manager clients. This is particularly useful if encrypted files become orphaned due to the device experiencing a hard reset, uninstalling the client, or some other circumstance which prevents the original client from decrypting the files.

• Log entries and registered events – Afaria records Data Security Manager events during event logging. You can examine occurrences of Data Security Manager events in the Messages log. You can also define alerts that monitor specific Data Security Manager events.

• Data Security Manager reports – Data Security Manager includes the following predefined reports that you can view and print:

• Client Lock Down Detail – Identifies any clients that have entered a lock down state.

• Administrator Password Detail – Identifies any clients that have been unlocked using the administrator password.

• Client Password Changed – Identifies any clients that have had their passwords changed.

• Client Password Unchanged – Identifies any clients that have not had their passwords changed.

44


Data Security Manager for Windows ClientsAfaria Data Security Manager clients is an encryption solution that lets you define and implement a security policy for Afaria Windows clients. Anyone making direct access to the hard drive, without using the authentication process, encounters encrypted data that is unintelligible without the encryption key.

FeaturesThe security manager provides layers of security: full-disk encryption, boot-time authentication, and challenge-response recovery.

• Full-disk encryption – The full-disk encryption feature uses the AES encryption algorithm to transparently encrypt a computer's hard disks. Data is automatically decrypted and re-encrypted during subsequent user sessions as required, without interrupting normal application operations.

• Boot-time authentication – Boot-time authentication prompts for and authenticates user credentials before the operating system loads and when returning from hibernation.

• Challenge-response recovery – The challenge-response recovery process is a secure mechanism that allows for an authorized user to regain control of a computer from a state of denied access after having accidentally entered the wrong password too many times.

45


Document ManagerDocument Manager lets you publish groups of documents for client users to access. Document Manager channels can include text files, bitmaps, HTML files, and more. You can define channels to “push” content to connected client users, or you can allow users to decide whether they want to subscribe.

Supported client types – Palm, Windows, Windows Mobile Professional, Windows Mobile Standard

Document Manager lets you:

• Cost-effectively deliver and automatically update important documents

• Ensure end-users have access to the most up-to-date information and are automatically notified of updates

• Decrease the time users spend navigating through the LAN, Internet, or intranet for pertinent information

• Reduce the total cost of ownership associated with managing content

FeaturesDocument Manager has several features that help manage documents for client use.

These features include:

• Dependent file support – Document Manager channels can include dependent files associated with a main file. The dependent files are delivered to the client when the user subscribes to the document. For example, you may want to distribute an HTML page that includes.jpg graphic files. The.jpg files are required to display the HTML file correctly. By making the graphic files dependent upon the main HTML file, the user receives the dependent .jpg files automatically when receiving the subscribed HTML file.

• Hidden file support – You can hide selected files included in a Document Manager channel. Using hidden file support, you can send a group of dependent files, but show only the main file in the list of documents. For example, an HTML page (main file) may include graphics (dependent files) the user does not need to view separately. By hiding the dependent files, you permit the user to access the main document but not individual graphic files.

• Channel refresh – You can use channel refresh to ensure your channel files are consistent with original source files. When you first add a file to a Document Manager channel, Afaria makes a copy of the file and places the copy in the temporary area. When Afaria refreshes channel data, it copies the current version of the file from the source and updates the temporary area. Afaria automatically runs channel refresh using the settings you specify through global settings. In Document Manager, you can quickly refresh channel data at any time with the click of a button.

• External media support – For Windows client Channel Viewer users, you can create channels using external media sources such as CD-ROMs. You can initially distribute

46


information to your users on a CD or disk and then periodically deliver updated files via “normal” Document Manager channels. The Document Manager channels you create can contain both server-based files and external files.

• Channel export – You can export a selected Document Manager channel to a single designated file.

• Byte-level file differencing – When Afaria clients request a file that already exists on their system, Afaria detects the differences between the file at the client and the source file on the server and sends only the differences, resulting in reduced connection times and improved system performance.

47


Inventory ManagerThe Inventory Manager lets you centralize the monitoring and reporting of hardware and software resources installed on your clients. Inventory Manager silently detects installed hardware and software on the client during the connection or while the client is disconnected.

Supported client types – BlackBerry, Palm, Symbian, Windows, Windows Mobile Professional (including Windows CE), Windows Mobile Standard

FeaturesInventory Manager offers several features that help you manage your hardware and software. These features are subject to client type.

Features include:

• Automatic scanning and reporting – Inventory Manager automatically scans and retrieves detailed hardware and software inventory data from remote computing devices. Data retrieved is dependent upon the client type, but includes commercial software usage, battery amount remaining, processor type, amount of memory, operating system installed, language that displays on the device, and more. You’ll find this information beneficial prior to performing hardware and software updates, troubleshooting, or other administrative tasks.

• Efficient inventory scanning and collection – Inventory Manager is specifically designed to work efficiently in the remote and mobile environment where connections are intermittent and unreliable. File compression ensures inventory collection sessions are efficient and quick. Built-in error checking ensures that data is always complete. Checkpoint restart is used to resume failed transfers at the point of failure, rather than from the beginning.

• Delta scans – Windows clients only. Inventory Manager reduces the amount of data that is transferred from Windows client devices to the Afaria server by transmitting only data that has changed from a previous inventory scan.

• Support for DMI standards – Inventory Manager supports Desktop Management Interface (DMI) 2.0, which is the Distributed Management Task Force (DMTF) industry standard specifications supported by major hardware and software manufacturers. During client inventory scans, Inventory Manager collects and reports DMI-compliant hardware or software inventory located on the system.

• Inventory scheduling options for Windows clients – You can schedule inventory scanning to take place offline, lowering communications time and cost. Scans can run at the client during a connection with the server, immediately after the connection with the server, or on specific dates and times.

The DMI Agent—provided by the computer manufacturer—is a system-specific executable file that scans inventory information. If a DMI Agent is enabled at the client, Inventory Manager can collect more detailed client information, such as additional data about the BIOS, Keyboard, Motherboard, Network Adapters, OS Drivers and Services, System, or Video.

48


• Data storage in the Afaria database – Inventory scan results are maintained in the Afaria database, allowing you to use existing database infrastructure and tools to access, query, and report on client inventory data.

• Configuration information for Windows clients – During sessions, all inventory-scanning results are automatically transferred to the database server. Data views, Inventory allows you to view configuration files on a per-client basis.

• Client change detection – Using the Change detection views folder in Data views, Inventory, you can choose inventory attributes to monitor on a selected client type. Once set, you can view those clients that have detected inventory changes, and acknowledge that you’ve seen those changes. You can view clients with inventory changes in the right pane of Inventory view and via the clients view right pane shortcut menu.

49


Patch ManagerUse the Patch Manager Channel Editor to view and edit channel properties.

A new Patch Manager channel launches the channel editor with the same view as the Server Configuration Patch console page, except it is filtered to include only those patches you have selected and saved in the Patch Console page. When you select a product in the left pane, the patches associated with that product appear in the top half of the right pane. Use the list’s check boxes to change an selections.

Supported client types – Windows

Administration > Channel Administration > Patch Manager channel > Edit

The channel editor provides access to channels you to set and control for installing the patches and delivering patch content.

Install properties include the following items:

• Reboot mode – Choose the reboot behavior for the client computer after the patch installs.

• Impersonation – Supply impersonation credentials for an account with local administration privileges. Supplying these credentials allows you to ensure that the channel's patches can run with local administrator rights.

Delivery properties include the following items:

50


• Segment delivery – Apply segment delivery time allowance or segment file size criteria to channel content delivery to ensure that patch delivery does not overload your network.

• Bandwidth throttle – Override the bandwidth configuration settings that you defined on the Bandwidth Throttling page.

51


Server ListingServer Listing uses the client Channel Viewer to define the name, address, and description of each server in the channel list. When the client connects to your server, the Server Listing channel content is automatically sent to the client, allowing the user to receive content without subscribing to the channel.

Supported client types – Windows

52


Session ManagerUse Session Manager to automate electronic file distribution, file and directory management, notifications, and system registry management tasks. Session Manager channels are composed of worklists and sendlists that you create to meet your specific needs.

Worklists and sendlists are the fundamental units of activity for all work on and between the server and clients. Session Manager channels include properties for fault tolerance. Use Data Views, Logs to view client session activity and file transfer information.

Supported client types – All Afaria clients

FeaturesThe Session Manager offers several features that help distribute and manage files.


• Simple session channel editing – The Session Manager Channel Editor displays all of your Session Manager channels, worklists, and sendlists in a tree structure so you can visually organize your channels and their components. The selected channel appears at the top of the structure, while the other channels are contained within a separate folder. You can position the moveable Session variables selector box where it’s most convenient for you.

• Indirect file support – Session Manager supports indirect files for Message, Insert Worklist, Send File to Client, Get File from Client, Notify Program, and Set Variable events. Using indirect file support, you can specify event-specific information in a referenced file rather

Complete event list Current worklist or sendlist object

Object’s event list

53


than directly embedding it in an event, which lets you update the indirect file without having to update the actual event.

• Worklist, sendlist, and event availability – You can specify when a worklist, sendlist, or event is available for execution. You may want to disable items and keep them disabled until they’re fully defined and ready to be executed.

• Control object display – Assignments for object view lets you control the display of worklist and sendlist objects that reside in the channel by selecting the respective option from the View drop-down list. Display items from which you can choose include all worklist and sendlist objects, sendlists only, or worklists only.

• Assign objects to your channel – When you create a new worklist or sendlist, Session Manager automatically assigns it to your channel, but you can also assign it to any worklist and sendlist object that resides in any other channel.

• Use wildcards in events – Wildcards are reserved characters that perform a task on multiple files with similar names or extensions. Instead of individually selecting many files and directories, a wildcard references files or directories as a group.

• Optimize event execution – You can fine-tune worklists and sendlists to increase resource efficiency and decrease session completion time by pre-processing tasks that can be performed on the client by the client before a session begins.

• Use variables in events – Variables in events are placeholders for different event parameters. Session Manager replaces the variable placeholders with the appropriate information when the event executes. Variables available include predefined variables, user-defined variables, environment variables, and variable modifiers.

54


Software ManagerUse Software Manager to distribute and install commercial or custom-built software applications on Afaria clients.

You can push software packages to your clients after they initiate a connection to ensure that users have the latest software, or you can let client users subscribe to channels so that they install only the software they need. Software Manager channels include properties for fault tolerance and incremental changes. Use Data Views, Package tracking to see client software package information.

Supported client types – Palm, Symbian, Windows, Windows Mobile Professional (including Windows CE), Windows Mobile Standard

FeaturesSoftware Manager offers several features that help you distribute and install application on Afaria clients.


• Installation type – Software Manager provides two types of installations at the Windows client. Setup based installations are used for applications that provide their own installation program to perform file copy and system update operations. Non-Setup based installations are used for applications that have no installation program and are distributed as a custom application or a collection of files. In these channels, Software Manager provides the installation services to the client.

• Deployment method – Software Manager provides two methods of channel deployment at the Windows client. Deliver package files to the client—“local-based” installation—is used for users wishing to install offline. This option sends the package files to the client machine; installation runs from a temporary location on the client. Run installation from a LAN location—“LAN-based” installations—is used for networked users. This option runs the installation using channel contents that reside on a LAN location.

• Channel file/folder – You can add and remove installation/non-installation files; define file-level target destinations; view file properties; force an installation target directory; include a guidance file for Windows client setup-based installations; include file shortcuts for Windows client non-setup-based installations; instruct Software Manager to send only differences of a specific file or a collection of files; and more.

• Installation process – Software Manager includes specific options for controlling installations so that you can give as little or as much control as needed to your client users. Depending upon the client type, you can specify what to install; choose how the installation makes programs available; provide command line arguments to add parameters to the channel installation settings; determine how much of the installation the client should display; start installations automatically; and more.

55


• Delivery and installation time frame – Software Manager lets you determine the daily time period during which channels can be delivered to clients, as well as valid install dates and time frames for Windows client channels.

• Criteria checking – Software Manager supports channel criteria requirements such as hard disk space; file/registry key; operating system/service pack; and more for your Windows and Windows Mobile clients. Criteria are checked twice at the client: before software delivery so that the channel is sent only to clients that meet or exceed the criteria; and prior to installation to cover situations in which software is received but not immediately installed, after which criteria are no longer met.

• Segmented channel transfer – Software Manager lets you transmit large Windows client channels efficiently by splitting channel content into sections based on delivery time or size. When the limit that you define is met, channel transmission stops. Subsequent sessions with the client transmit remaining sections.

• Browser delivery – Software Manager lets you create channels that your Windows client users can install, clean up, and uninstall from a Web browser by including the channel in a channel set and incorporating the automatically-generated HTML code onto a Web page.

• Uninstall – You can uninstall a software channel at the Windows client if it was initially delivered and installed using Software Manager. You can also activate a Channel Viewer icon or a link on a Web page to let client users uninstall channels.

• Advanced features – Depending upon the client type, Software Manager lets you create user defined fields; execute published Session Manager channels; check for minimum device RAM; map source share points to target share points for Windows client remote LAN based channels; and include pre/post delivery/installation options. Software Manager also lets you define special administrator user rights to elevated privileges in order to complete tasks on Windows clients.

• Successful installation – Software Manager reports the success/failure of the distribution and installation of Setup based software applications back to the server.

56


Channel Availability for ClientsAfaria provides several channel-level features that enable you to control how channels run at the Afaria client. You can publish channels, create channel sets, and define security settings for individual channels.

Group profiles are the vehicles for distributing channel and channel set tasks to client devices; through the profile, you can also associate a channel with a monitor, which lets you base channel execution on a schedule and/or a monitored event or condition. For Afaria clients to have access to channels or channel sets, associate them with work profiles.

Publish Channels

Publish individual channels when they are ready to be used by clients. Channel publication is the first step toward making a channel available to clients.

Create Channel Sets

Assemble multiple channels in a channel set. The channel set executes the collection of channels automatically in a set order when clients connect. Channel sets don’t appear at the client; instead, you control how and in what order channels execute at the client.

For example, you may have several clients who need both accounting and human resources information updated every quarter. You can create a schedule in the work profile to run at the end of each quarter a channel set containing accounting updates, human resources documents, and new audit software you need clients to use. When clients connect, all of the channels in the set execute automatically in the set order.

Set Automatic Channel Actions

Set options for automatic actions. You can create a channel ahead of time and set it to publish automatically, or you can set a time for a channel to unpublish itself automatically after the information is no longer valid. You can also automatically delete a channel when a project is over or set a channel to update itself automatically.

Secure Channels and Channel Information

Enhance the security of your channels and channel content, as well as restricting channels to authorized users.

• Encrypt channel for all clients – encrypts all information in transit so that it can’t be viewed by unauthorized users.

57


• Authenticate user – verities the identity of clients attempting to connect to the channel before making channel contents available to the user.

• Password required – requires Windows client users to enter the correct password before accessing the channel or folder in the Channel Viewer application.

Group Profiles and Channels

Profiles are the vehicles for distributing channel and channel set tasks to client devices; channels and channel sets are components in the profile’s definition. Include channels and channel sets with profiles, either via a profile’s Client actions list, or its allowed channels list, or both in some cases in order to associate them with Afaria Clients.

See “Client Management with Group Profiles” on page 33.

58


Channel Availability for ServersAfaria provides two features that let you make channels available to other servers within your Afaria system: import/export and replication.

Import and Export ChannelsYou can import and export channels from one server to another server that are not in a server farm relationship with each other.

Exported channels are independent from their source server. After exported channels are imported into another server, they are subject to any editing tasks the administrator wants to exercise. This differs from replication, in that replicated channels are read-only channels that you can edit only at the source server.

The product includes an import/export wizard, to import and export using the user interface, and a command line utility, to import and export from a command line.

ReplicationReplication lets you use a single Afaria server to manage channels for one or more other Afaria servers. In the context of replication, the single, managing server is referred to as the source server and the other servers are referred to as the target servers.

The source server may be in a main-to-farm relationship or a peer-to-peer relationship with the target servers. A main-to-farm relationship is one in which the source and target servers operate as a single Afaria entity, sharing a single Afaria database. A peer-to-peer relationship is one in which the source and target servers operate as separate Afaria entities, each using their own Afaria database.

Channels are replicated from the source server to the target servers in a read-only state. In the farm relationship, the target servers are not able to create any channels on their own. In the peer-to-peer relationship, the target server may create and manage channels additional to those replicated from the source server.

Replication differs from importing and exporting channels. Once an Afaria Server exports channels, the server retains no further control over the channels. When an Afaria Server imports channels, the server takes complete ownership of the channels and is able to exercise any channel management tasks over them.

59

Getting to Know Afaria 6.6 FP1 Policies

PoliciesUse the Policies area of Afaria Administrator to define and manage policies. Policies let you create focused collections of tasks and actions to define and enforce on your clients.

Policy Category – Application ControlApplication control policies let you control which applications your device users can execute.

Supported client types – Windows Mobile Professional and Windows Mobile Standard

The policies manage different types of applications:

• Embedded applications – Applications that come preinstalled on the device.

• Installed applications – Applications that are installed on your device after purchase.

• Settings menu applications – Applications that are available on the device’s Settings menu. Controlling these settings is often critical to device management, as they may control sensitive areas of device functionality.

Policy management compiles a client application library. The library is a list of applications that are on your client devices, as queried by a client-side agent and reported back to the server. It is a reference for your use when defining policies.

Policy Category – Antivirus/FirewallAntivirus Firewall (AV/F) policies allow you to control and provide security for your device, and restrict calls and SMS messages to a device. Policies are placed on the document server as part of a group profile and are passed to connected clients.

Supported client types – Windows Mobile Professional, Symbian, Windows Mobile Standard

Antivirus Firewall policies include the following policy types:

• Antivirus policy – Protect and safeguard devices from viruses.

• Firewall policy – Establish a firewall for each device to guarantee its integrity.

• Call Filtering policy – Block incoming calls, block incoming SMS messages, or both.

60


Policy Category – Device ConfigurationAfaria device configuration policies let you manage device settings for items such as WiFi, passwords, and email. Policy definitions are consistent with the Apple iPhone Configuration Utility definitions.

Device configuration policies are supported on iOS client types.

Policies include these and additional types:

• Passcode

• Restrictions

• WiFi

• Credentials

• Simple Certificate Enrollment Protocol (SCEP)

• Exchange ActiveSync

Policy Category – OMA DMOpen Mobile Alliance (OMA) Device Management (DM) policies are settings and actions for Afaria OMA DM Clients that are based on DM objects, as defined by OMA.

The settings and actions that you define using the Afaria OMA DM policy editor are formulated into OMA-DM-compliant message that the Afaria OMA DM server delivers to the client during connections with the client. The policy’s content—OMA DM objects—is applied at the client according to each device’s OMA DM implementation.

To learn more about OMA DM, visit the Open Mobile Alliance’s Web site, www.openmobilealliance.org and search for the Device Management workgroup.

OMA DM policies may include one or more of the following OMA DM tasks:

• Trust – Establish a trusted relationship between the client and the OMA DM server. Trusted relationships let you initiate a client connection to the OMA DM server without prompting for user interaction.

• Access Point (AP) – Configure an access point for network connectivity.

• Mail for Exchange (MfE) – Initialize or change the settings for the Mail for Exchange client. MfE is also used to create an MfE profile if one does not exist.

• Objects – create a set of object operations based on a set of Device Description Files (DDF) for a single manufacturer, model, or version.

• Session Control – Allow the user to control subsequent tasks in the same policy by setting and interrogating variables, and branching to out-of-sequence tasks.

61

http://www.openmobilealliance.org/


• Skinny Client Control Protocol (SCCP) – Configure clients to use the Intellisync Call Connect application with the Cisco Unified Communications Manager product.

• Software Configuration Management (SCM) – Install, update, or remove software applications at the client.

• Session Initiation Protocol (SIP) – Configure profiles for multimedia communication sessions, such as Internet calls with one or more participants.

• Terminal Security – Allow a trusted OMA DM server to perform additional terminal security activities, on a device, such as Wipe, Lock, Unlock, and Reboot.

• VoiceOverIP – Configure clients to use Internet telephony.

• Free-form – Use custom XML to define actions on a device-supported OMA DM object.

62

Getting to Know Afaria 6.6 FP1 Portal Packages

Portal PackagesUse the Portal Packages area of Afaria Administrator to define and manage packages. Packages let you manage applications for your iOS and Android clients. A list of packages is available on the Afaria agent at the client. Users can browse the list and install packages.

Package Category – ApplicationApplication packages let you manage applications for your iOS and Android clients. Application management creates a list of applications on the Afaria agent installed on the device and categories to group the applications. Users can browse the list and install applications.

Packages can include these types of applications:

• iOS enterprise – as developed by your organization and delivered from the Afaria Portal Package server

• iOS App Store – as delivered from the Apple App Store

• Android enterprise – as developed by your organization and delivered from the Afaria Portal Package server

• Android Market – as delivered from the Google Android Market

63

Getting to Know Afaria 6.6 FP1 Tenants and Multitenancy

Tenants and MultitenancyMultitenancy is a separately licensed product feature that allows hosting providers to manage multiple enterprises from a single Afaria implementation.

A tenant is an entity defined within the Afaria environment that is associated with a subset of the client base and its related operations and assets. Assets include nonclient items that support operations and profiles, such as policies and channels. Tenant features let you maintain clients and assets for multiple tenants. For example, you may want to operate your Afaria installation as a hosting environment to multiple customers or multiple enterprise divisions, with each customer or division assigned to a different tenant identity. Multitenancy is the state of an Afaria installation that has the tenant features enabled.

FeaturesTenant features let you take actions to maintain clients and assets for multiple tenants.

These actions include:

• Add tenants.

• Assign Afaria Administrator users to roles that define which tenants they can administer.

• Add new clients for a tenant.

• Move a client from one tenant to another.

• Use the system tenant as an entity for creating assets to share with all tenants.

• Manage operations and assets, and review data, for a specific tenant.

• Filter Afaria Administrator pages to contain results only for a specific tenant.

• Monitor operations and review data across all tenants.

• Use product APIs and Web services to create your own Web portal for tenant administrators or tenant users to provide access to tenant-specific information.

64

Getting to Know Afaria 6.6 FP1 Clients in Afaria

Clients in AfariaThe Create Client Installation program is a wizard that guides you through creating a client setup file. A client setup is then used to install the Afaria Client software on a supported computing device.

Start > Programs > Afaria > Afaria Create Client Install

This wizard guides you through creating an Afaria agent installation package. Based on client type and your environment, you can choose different options that allow you to deploy the agent via a companion PC, a network, or the OTA Deployment Center.

65

Getting to Know Afaria 6.6 FP1 Client Data

Client DataData views provides a variety of ways for you to view and manage client information. You can view client data by client type, log, and inventory.

You can also view the status of software channels in different delivery/installation positions at the client, restore backed up data to individual clients, work with deployed corporate software licenses, view the status of deployed client patches, and view client deployment notification status information.

Clients ViewThe Data Views Clients view presents client-specific data. You can examine client data, create iOS clients, and take some actions on all clients. You can also create folders, views, groups, and SQL views to collect client data.

Data views > Clients

You can also open multiple, smaller views of software package tracking, inventory change detection and data, and log data. You’ll find this feature convenient because you can open the same mini-views for several clients and/or different mini-views for the same client and keep them all open at the same time without leaving clients view.

66


Logs ViewLogs view presents client data logs. Afaria installs with several pre-defined logs, but you can also create custom views.

Data views > Logs

The view includes the following pre-defined logs:

• Alerts – Displays a view of events that were raised, as well as a view of the alerts that were closed. Raised Events view displays the name of the event and the machine on which it occurred; time it occurred and the time it was received at the server; and more. Closed Alerts view displays the name of the alert; time the alert was raised, acknowledged, or closed; and more.

• File transfers – Displays views that record every instance when the server sends or receives a file. The right pane displays the date and time the event stopped transferring the file; server that originated the transfer; completion status or error type; path from which the server downloads information to the client; and more.

• Messages – Displays views that record messages specific to the server and to OMA DM session processing.

• Replication – Displays log views that record messages specific to replication. The right pane displays the date and time when replication occurred with the most recent entry at the top; server on which the message was recorded; and more.

• Sessions – Displays views that record information about past sessions. The right pane displays the date and time when the session with the client ended; completion status or error type; session length in hours, minutes, and seconds; and more.

• Client triggered actions – Displays log views for event monitors that record successes or failures for associated trigger action-pairs that occur on a client.

• Handheld Security – Displays all messages related to Data Security Manager for handheld clients. The Afaria client collects Data Security Manager events and Bluetooth connection activity events as they occur, and then delivers the collection to the Afaria server during Afaria sessions.

• Windows Security – Displays all messages related to Data Security Manager for Windows clients. The Afaria client collects all Data Security Manager events as they occur on the client, and then delivers the collection to the Afaria server during Afaria sessions.

67


• Policy Delivery – Displays views related to policy delivery and updates. Logs record the nature and status of a policy and whether updates succeeded, failed, or deleted the policy.

• iOS Connection – The iOS Connection log captures the timing and sequence of actions occurring between the Afaria iOS provisioning server and the iOS devices.

68


Inventory ViewInventory view lets you monitor specific data that changes, as well as creates custom folders and views for storing inventory data.

Data views > Inventory

Inventory data is organized by client type for the following categories:

• Change Detection Views —Choose inventory attributes to monitor on clients. You can use the right pane to view and acknowledge receipt of changes for those clients that have detected inventory changes.

• Custom Views – Create custom folders and views of inventory information within the parent folder. You can also create groups with views. Once created, you can edit, rename, and delete these folders and views.

• Inventory Views – View detailed inventory data for clients. Use the right pane to view inventory data for a specific client, including a full directory scan and subsequent delta scans of data (Windows clients only) and configuration files.

69


Package Tracking ViewPackage tracking view lets you examine the delivery and installation status of Software Manager channels and portal application packages on your clients.

Supported client types – Android, iOS, Palm, Symbian, Windows, Windows Mobile Professional (including Windows CE), Windows Mobile Standard

Data views > Package tracking

When you select a channel or package to track in the left pane, the right pane displays a summary of the following client status information specific to that item.

70


Backup ViewBackup view displays backup content from Backup Manager channels. Use it to restore items to those clients, and if copy items from one client to another of the same client type.

Data views > Backup

You can also use the page to delete all backed up items older than a defined number of days.

71


License Compliance ViewLicense compliance view lets you examine software license compliance and usage data collected from Inventory Manager scans. The License Compliance Views folder contains predefined views for most client types.

Data views > License compliance

You can use the predefined views to collect data, or you can define your own folders and views within the Custom Views folder.

72


Client Patches ViewThe Client Patches view provides powerful query and action tools.

The view is based on the current patch selection you have in the Server Configuration Patch console page, rather than all possible Microsoft patches identified in the Patch console page. Use the view for several queries and actions. You can use a page-level filter to query which patches have, or have not, been applied to clients or client groups.

Data views > Client patches

The following context menu query and action items are available when you multi-select patches from the top right pane:

• Query – View all the clients that are missing a selection of patches. The client list appears in the bottom right pane.

• Action – Create a dynamic client group for all clients that are missing a selection of patches.

• Action – Create an unpublished Patch Manager channel for all clients that are missing a selection of patches.

• Action – Download a selection of patches.

73


Client Deployment ViewClient deployment view allows you to view information about client deployment notification messages processed from the client deployment center.

Notifications include OTA deployment center messages, which include a download path for downloading the client to the device, as well as OMA CP network provisioning notifications sent to provision a device for the download and installation of the Afaria client.

When the Client Deployment page opens, you see the client deployment folder views tree structure with the following predefined views:

• Notification batches – Displays all the client deployment notifications batches sent from the client deployment center for a specific set of clients in your database.

• Notifications – Displays all client notifications sent from the deployment center for all clients in your database.

• Uncompleted notifications – Displays all client notifications in your database for which the client installation has not been downloaded to a specific client.

Data views > Client deployment

74

Getting to Know Afaria 6.6 FP1 Remote Control

Remote ControlAfaria uses Danware’s NetOp Remote Control for the Afaria Remote Control solution. Remote Control helps you manage frontline devices by allowing you to view and manipulate a client’s environment in real time. Use this capability for problem resolution or application training, saving time and expense.

Remote Control supports Windows and Windows Mobile clients. It uses role-based administration so you can carefully define the nature of changes that you allow different administrators to make. All Remote Control communication is AES encrypted and authenticated against your centralized authentication system. Additional features include audio chat and client-initiated requests.

Visit Danware’s product site at www.netop.com for more NetOp Remote Control information and product documentation.

75

http://www.netop.com

Documents

Getting to Know Afaria