Managing Windows Environments
with Novell® ZENworks®

Mark Schouls

ZENworks Product Manager / NRM Practice Lead

Novell, Inc.

Sam Tessier

Category Specialist

Novell, Inc.

Overview

ZENworks Desktop Management

Middle Tier architecture

Middle Tier Server scalability, load balancing and fault tolerance

ZENworks Management Agent installation

ZENworks Server Management

ZENworks Handheld Management

Directory integration

The principles of ZENworks design and architecture

Sample architecture

Got ZENworks... Got Linux?

Question and answer

Customer Success:
Allina Health

“ ZENworks saves us millions of dollars a year that we can put toward providing better patient services. The fact that we can support 15,000 workstations across 100 locations with only 21 traveling members of our IT staff is phenomenal,” said David Lind, Director of Corporate Business Systems

Business Issue

Novell Solution

Novell ZENworks

ZENworks Desktop Management

Remote Control

ZENworks chosen over SMS

Pure Windows at branch offices

Result

Can now deliver new applications and patches across its enterprise in hours, rather than days or weeks

Significantly reduced IT travel time by 40 percent

Reduced its overall help-desk calls by 50 percent

Saving millions of dollars per year

Can now support 15,000 workstations across 100 locations with only 21 traveling members

With 15,000 workstations across 100 locations, Allina needed a way to manage its complex and disparate environment

Challenged with technicians spending too much time traveling to individual sites to install new applications, without consistent results

Increased number of helpdesk calls burdening the IT staff

ZENworks Desktop Management

ZENworks Desktop Management

Patch Management

Personality Migration

Software Distribution

Application Packaging

OS Migration

Application self-healing

Remote management

Asset Management

Extended Windows management

Manage mobile workstations

Server Management

Handheld Management

Novell

ZENworks

Linux Management

Desktop Management

ZENworks Desktop Management
Application Management

If the organization is new to ZENworks, start packaging all applications in MSI format. If the organization is moving from a traditional Novell environment to Microsoft centric and uses ZENworks with AOT/AXT based objects... convert them to MSI.

Chain your applications together... get creative... utilize the power of ZENworks!!

Think “Lights-out-Distribution” for updating your virus patterns, or making modifications to the workstation or applications during the evening when no one is around.

Use Add On Imaging for your Core Business Applications... more to come on this later in the session!

ZENworks Desktop Management
Image Management

Stick with the Base Operating System for your image – your Standard Operating Environment (SOE).

Modularize your image process - extract your applications (previous section talks about add on imaging), and add in drivers.

Use the ENGL Imaging Toolkit for greater flexibility, and to extend your imaging solution to the next level!!

Shoot for small and many... not large and few.

ZENworks Desktop Management
Image Management... Modularize and Simplify

Before

After

Windows XP + SP 2

Dell Latitude C610

All Core Applications

2 GB Total

Windows XP + SP 2

Compaq Presario X6000

All Core Applications

2 GB Total

Windows XP + SP 2

Dell Latitude D800

All Core Applications

2 GB Total

Windows XP + SP 2

Compaq Presario M2000

All Core Applications

2 GB Total

Windows XP + SP 2

Dell Latitude D600

All Core Applications

2 GB Total

Windows XP + SP 2

IBM ThinkPad T41P

All Core Applications

2 GB Total

Windows XP + SP 2

Toshiba Tecra M2

All Core Applications

2 GB Total

Windows XP + SP 2

Sony VAIO T140

All Core Applications

2 GB Total

Windows XP + SP 2

500 MB Total

Core Business Application

Core Business Application

Core Business Application

Core Business Application

Core Business Application

Core Business Application

Core Business Application

Core Business Application

...

Methodologies and Approach

ZENworks Desktop Management
Inventory Management

Place inventory servers and databases carefully.

Smaller sites do not necessarily need an inventory server to collect inventory information... report across the network if possible.

Larger sites should report to a site based inventory server to keep WAN traffic to a minimum.

You do not necessarily need to place databases out at remote sites unless you plan on doing site-based reporting

Document and schedule your inventory rollup during OFF peak hours

ZENworks Desktop Management
Remote Management

Use the Remote Operators wizard to identify and manage the roles of your staff, and what they get to do from a remote management perspective.

Consider providing remote management tools to your Tier 1 helpdesk staff instead of ConsoleOne®:

Rkaid Software: Workstation Aid

ZENworks Workstation Browser

Develop your own

If you currently use Touchpaper ensure you integrate...
http://www.touchpaper.com/uploaded_images/placeholders/Novell%20Touchpaper%20Integration.pdf

Use Password-based Remote Management if you do not want to import your workstations, or for an added level of security.

ZENworks Desktop Management
Automatic Workstation Import and Removal

Should I centralize this service, or decentralize it???

Centralization can be a benefit for small to medium sized organizations...

Little administrative overhead

Less potential for network overhauling (DNS)

Decentralize if...

you need to get specific on where workstations get imported to

if your DNS infrastructure supports resolving ZENWSIMPORT in multiple DNS zones

If all else fails and you need to decentralize in a single DNS Zone environment... use the Import Registry Key

Middle Tier Architecture

Middle Tier Architecture
So What is a Middle Tier Server Exactly??

The ZENworks Middle Tier Server runs on either Windows Internet Information Server, or Apache and acts as a proxy on behalf of the client to provide access to the core ZENworks Desktop Management services.

You only need the Middle Tier Server if you are NOT installing the Novell Client™ on your desktops or if you are removing them from existing ones.

Middle Tier Architecture
Let's Kill Some Myths

There is no need for:

eDirectory™ to be installed on the Middle Tier Server (although you can if you want to)

Client32™ to be installed on the Middle Tier Server (although you can if you want to)

Service Location Protocol (SLP) to be configured on the Middle Tier Server (although you can if you want to)

The Middle Tier Server requires no retraining for your IIS Administration team... the extensions are running in the default web site.

Middle Tier Architecture
Service and File Access

ZENworks managed workstation

Middle Tier Server

Windows 2000/2003

with IIS

2. User authenticates to Active Directory

3. ZENworks management agent passes same credentials to Middle Tier Server

4. Middle Tier Server authenticates user and workstation to eDirectory

1. ZENworks workstation object authenticates to eDirectory via the Middle Tier Server

Middle Tier Architecture
Why Do I Need Them?

The main reasons why you would need to investigate implementing the Middle Tier architecture is for the following:

Removes the dependancy upon the Novell Client

Remove it from existing desktop systems

Implement the full ZENworks Desktop Management stack in an existing environment without it

Provide full ZENworks Desktop Management functionality to employees inside and outside of the corporate boundaries

Now you can track and manage everyone!!

1

2

Middle Tier Architecture
Hybrid Environments

So maybe you do not have a “pure” Microsoft environment... maybe you have both NetWare® and Windows...

Middle Tier Platform

Backend Platform

Microsoft Windows

Microsoft Windows

NetWare

Microsoft Windows

NetWare

NetWare

What works with what?

Middle Tier Architecture
LDAP and Contextless Login

For servers that are running both Microsoft Active Directory, and Novell eDirectory, please keep the following in mind.

Active Directory uses the standard LDAP ports to communicate with other domain controllers, and these cannot be changed

If you are planning on installing eDirectory on a domain controller running Active Directory, make sure you specify alternate LDAP ports during the installation process

Use NSADMIN on each Middle Tier Server to change the LDAP port setting for the eDirectory Servers it is communicating with

LDAP search
NCP login

Middle Tier Server
Scalability, Fault Tolerance, and Load Balancing

Middle Tier Server
Activities

There are three main activities for the Middle Tier Server:

Authentication

Low impact ZENworks Desktop Management activities

Policy distribution, inventory collection

High impact ZENworks Desktop Management activities

Application distribution via Middle Tier

1

2

3

Middle Tier Server
Scalability Factors

There are a number of variables that enhance/impact the scalability of the Middle Tier Server in any environment. Some of these factors include:

Speed of the processor

Multi-processor server(s)

Physical memory

Speed of the NIC

Speed of the LAN/WAN

Staggered login times

Staggered Launcher refresh intervals

Frequency of distributions (applications, policies, etc.)

Whether or not application distributions are being cached

Location of eDirectory and connection speed

Policies handled through eDirectory or Active Directory

Typically, the bottleneck is the CPU and memory. The overall performance of the Middle Tier can be increased by addressing these factors prior to the implementation.

Middle Tier Server
Fault Tolerance and Load Balancing

Although the Middle Tier Server fault tolerance cannot be achieved through clustering the service, some form of fault tolerance and load balancing can be achieved through the implementation of Microsoft Network Load Balancing, with real fault tolerance and load balancing achieved by fronting the Middle Tier Server farm with a Layer 4 switch

Middle Tier Server
Fault Tolerance for eDirectory

Providing fault tolerance by farming together Middle Tier Servers, and fronting them with a Layer 4 switch is pointless unless there is eDirectory redundancy behind the Middle Tier Server farm...

Put replica servers behind your Middle Tier Server farm, and point your Middle Tier Servers to each of them

Middle Tier Scalability
So What are the Numbers??

Does moving to ZENworks 6.5 Desktop Management Service Pack 1 make a difference with Microsoft IIS? The numbers speak for themselves...

* Numbers based on refresh times with 100 applications associated to 460 user accounts

** Numbers based on refresh times with 100 applications associated to 240 user accounts

Middle Tier Platform

ZENworks 6.5

ZENworks 6.5+SP1

Microsoft Windows Server 2003*

Microsoft Windows 2000 Server**

18 m 26 s

16 m 59 s

2 m 35 s

3 m 17 s

Numbers include workstation boot time calculated at 1 m 30 s per workstation

ZENworks Management Agent Installation

ZENworks Management Agent

The ZENworks Management Agent is needed on all managed workstations

Installation requires local administrator rights

Several options including:

Inclusion in login script or Active Directory Group Policy

Manual visit to workstations

Winbatch install of MSI using a Transform to tailor

Inclusion in Standard Operating Environment build

None of which are ideal for a rapid, low impact installation of ZENworks Desktop Management

ZENworks Agent Distributor

The ZENworks Agent Distributor works in a Microsoft Active Directory environment and uses domain administrative credentials to automatically push out the ZENworks Desktop Management Agent to workstations within Active Directory.

Windows Server

Member of Active Directory

ZENworks Agent Distributor

Push out ZENworks Management Agent to target workstations

Management agent silently installed without requiring user to have Administrative permissions

ZENworks Server Management

ZENworks Server Management

Cross-platform server consistency

Patch management

Manage critical resources

Monitor and manage server infrastructure

Automated server configuration

Asset management

Application packaging and distribution

Remote management

Server Management

Handheld Management

Novell

ZENworks

Linux Management

Desktop Management

ZENworks Server Management
Tiered Electronic Distribution

ZENworks Server Management includes Tiered Electronic Distribution (TED) that ships as a core component of the Policy and Distribution Services technology set.

Integration hot-points:

Design and implementation of an automated provisioning framework (ITIL)

Automated application object/file provisioning throughout the infrastructure (directory and file server)

Maintains application object group association and/or container structure

Rapid application propagation

Lower administrative overhead

ZENworks Server Management
Tiered Electronic Distribution
Automated Provisioning and Standardization

ZENworks Desktop Management components integrate nicely with ZENworks Server Management Tiered Electronic Distribution (TED)

Methodology for controlling the creation and flow of application objects as they move through the Quality Assurance Process

Create application objects only once

Recommended to create a “Scripting Tree” for initial creation and testing

Application objects

Application source files

ZENworks Server Management
Tiered Electronic Distribution
Automated Provisioning and Standardization

Tiered Electronic Distribution services synchronizes and creates the necessary information on the target side

Application objects

Application source files

Group objects, container structure (associations)

Linked folder objects

Reduce administrative costs dramatically

Goals of standardization and rigor around testing

ZENworks Handheld Management

ZENworks Handheld Management

Manages Palm, Pocket PC, Windows CE and RIM BlackBerry devices

Self-destruct and password enforcement

Asset Management

Handheld restore

Software Distribution

User-based management

Support for wireless connected devices

Optimized for mobile communication

Server Management

Handheld Management

Novell

ZENworks

Linux Management

Desktop Management

Directory Integration

Directory Integration
Active Directory and eDirectory

ZENworks Administration is inside ConsoleOne

This will be moving to a web-based interface in the future

Look at delivery of ConsoleOne via thin-client for administrators.

Also investigate the ZEN WorkstationBrowser from CoolSolutions or Rkaid Software

Day to Day administration of users, permissions, Exchange, passwords, group memberships remain in Active Directory using Microsoft Management Console

No retraining for your helpdesk staff

Windows Server infrastructure

Novell eDirectory

ZENworks services

Integration of Active Directory and eDirectory

- DirXML®

Active Directory or NT Domain Driver

Password Sync

The Principles of ZENworks
Design and Architecture

Design and Architecture
Principles

Production (Branch Location)

Production (Headquarters)

Staging Environment

1

2

3

4

Use a staging environment whenever possible

Use TED to synchronize critical application source data, and application objects across the enterprise

Separate your testing environment from your production environment

Script and test your production applications outside of the production space

Create addon images for all core business applications (applications that everyone is licensed to use) – treat all other applications as functional business applications

Document everything!!!

Design and Architecture
Principles

Use the Middle Tier architecture in your DMZ to provide full ZENworks functionality to your mobile workforce

Keep objects and services close to users if your network does not support the traffic – accomplished by distributing services, synchronizing content, and eDirectory partitioning and replication

Standardize on MSI for packaging your applications

Deliver your applications via UNC, and with no force caching... unless you are delivering your applications to the mobile workforce outside the corporate boundaries

Keep you ZENworks architecture as simple as possible... centralize what you can and use schedules and policies to spread out traffic

Modularize your imaging process... keep it simple and spend time doing other things!!

Design and Architecture
Principles

Configure the Windows services and registry to display service screens if you need or want to...

Automatic Workstation Import and Removal

Wake-on-LAN

Tiered Electronic Distribution

ZENworks Web Server

Sample Architecture

Sample Architecture
Centralized Services

Layer 4 Switch

Head Quarters

Devices include:

Laptops, workstations, handhelds and tablets

Tier 1

Backend Systems

Tier 2

Middle Tier

Server Environment

Branch Office

Tier 3

Branch

Appliance Systems

WAN

Sample Architecture
Distributed Services

Layer 4 Switch

Head Quarters

Devices include:

Laptops, workstations, handhelds and tablets

Tier 1

Backend Systems

Tier 2

Middle Tier

Server Environment

Branch Office

Tier 3

Branch

Appliance Systems

WAN

Sample Architecture
Hybrid Centralized and Distributed Services

Layer 4 Switch

Head Quarters

Devices include:

Laptops, workstations, handhelds and tablets

Tier 1

Backend Systems

Tier 2

Middle Tier

Server Environment

Branch Office

Tier 3

Branch

Appliance Systems

WAN

T1

Single DNS Record

Layer 4 Switch

Layer 4 Switch

Scripting Environment

Core Campus Locations

T1

T1

T1

Public

Internet

Demilitarized Zone (DMZ)

Laptop PCs

Tablet PCs

Got ZENworks... Got Linux?

Got ZENworks... Got Linux?
Bringing ZENworks to Linux

The soon to be released ZENworks 7

ZENworks Desktop Management backend services running on a SUSE LINUX Enterprise Server

Benefits to any environment, including Microsoft centric

Reduced licensing costs

More stable, and less susceptible to attack specifically virus based attacks

Better scalability specifically with services that are web-based services

Less complex (domains, memberships, etc.)

Get ready for Linux... it's coming fast!!

Question and Answer

Allina Hospitals and Clinics

Based in Minnesota and Wisconsin

22,000 employees

operates 11 hospitals and 42 clinics

also own pharmacies, medical equipment etc.

15,000 workstations across 100 locations

too much time traveling to individual sites

lost a lot of money

have a large MS environment also NW, Unix and Linux

they evaluated SMS and we beat them

we offered a superior set of management tools

What’s so special about Allina? Using ZEN to do OS migration to 14000 workstations to XP, IT staff created a “one button upgrade icon” and distributed it to all users. Users can schedule their own upgrade.

They do 500,000 automated updates and installations a year

ZENworks for Handhelds was designed for mobile computing and communications. Based on market-proven technology from the acquisition of Callisto Software and their Orbiter product, ZENworks optimizes low-bandwidth, unreliable connectivity.

Communication support is offered for both synchronization (using Palm HotSync, PUMA’s Intellisync, or Microsoft ActiveSync) and IP. Many handhelds only synchronize to communicate with the corporate network, while others use IP for wired or wireless connectivity.

Communication is optimized for low-bandwidth connections using techniques such as:

checkpoint restart - to resume transmissions right where they left off after broken connections

compression - to reduce the amount of data send over low-bandwidth

delta technology - so that only new or changed information is sent for software and content distributions

bandwidth management - to throttle back the usage of shared connections

ZENworks for Handhelds is transparent to the handheld user. No special connections. No need for users to initiate management operations. They are free to spend their time on their jobs because their device is managed for them. When they sync or dial-in, management information is transferred transparently.

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

TUT115

2003-12-08T12:43:39