ZENworks® Desktop Management Best Practices

Sam Tessier	David Stagg

Category Specialist	Primary Support Engineer

Novell	Novell

Jeff Loomis

Consulting Practice Lead - NRM

Novell

Objectives

Provide knowledge and tools to assist you in successfully deploying a world-class enterprise desktop management solution using ZENworks Desktop Management to best meet your company’s technical and business requirements.

Discuss what we do to ensure we are deploying the right solution

Provide you with best practices and lessons learned straight from Novell Worldwide Services and Novell Technical ServicesSM

Outline guidelines that will help you avoid common setbacks

Focus on the most difficult parts of these deployments

Tie it all together by outlining other third party vendor products, and reviewing the enterprise solution

Why Use ZENworks?

An enterprise Resource Management solution is developed both on business requirements, and technical requirements. Each need to be considered carefully prior to building your design.

Business reasons

Budgeting and forecasting

Purchasing power

Increase Information Technology productivity

Reduce workstation Total Cost of Ownership

Reduce costs associated to application and/or patch deployment

Technical reasons

Application management

Workstation image management

Inventory management

Remote management

Standardization of packaging procedures

ZENworks Desktop Management
Novell Methodology

Novell Methodology

Deployment

Business Assessment

Technical Assessment

Design

Development & Testing

Novell Methodology

Business Assessment

Assess:

Stakeholders’ needs and concerns

Business requirements

Business Assessment

Meet with your stakeholders

All at once to give an overview of the planned project

Separately to discuss specific requirements and critical success factors for each group

All together again at the end of the separate interviews to present the requirements and resolve concerns

Identify business and IT units within the company that have a stake in the success of this project

Obtaining executive sponsorship is critical

The key to success is communication

Novell Methodology

Business Assessment

Technical Assessment

Assess:

Current environment

Limitations

Technical requirements

Assess:

Stakeholders’ needs and concerns

Business requirements

Technical Assessment
Know the Current Environment

NDS®/eDirectory™ & Active Directory Health

NDS/eDirectory versions and placement

Existing ZENworks environment

User access to environment

Workstation hardware and software

Server hardware and software

Technical Assessment
User Access to the Environment

Remote User on the road using dial-up

Employee working from home

Users connected to the LAN

Users at a remote site with a slow WAN connection

Requirements Assessment
Objectives and Deliverables

Document all business and technical details in document format

Ensure all architecture aspects of the systems are represented in high-level diagram form

Present findings to managerial and senior technical staff

Identify requirements for a formal lab environment

Novell Methodology

Business Assessment

Technical Assessment

Assess:

Stakeholders’ needs and concerns

Business requirements

Assess:

Current environment

Limitations

Technical requirements

Design

Model a technical architecture

that works with current the

environment

Plan configurations to meet

business requirements

Design
Implement Formal Lab Environment(s)

Build your lab environments as identified during your requirements assessment phase

Architecture should represent the high-level proposed design… this may change as the design is detailed and solidified

All components and functional requirements will be tested in the lab, with results fully documented

Design
New Concepts

Server options

Database options

Clientless environments

Middle Tier Server solutions

Deploying the ZENworks Management Agents

Microsoft Active Directory integration

Design
Why should I keep the Novell Client™?

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Discuss challenges for both sides

Design
Clientless Workstations

Web Services Architecture

Requires the Middle Tier Server to communicate

ZENworks Login

Use if you don’t have Microsoft Domains or Active Directory

NOT Novell Client - No NCP™ access to servers

Microsoft Login

Use in a MS Environment”

User ID and password should be synced.

Two options:

1

2

Design
Objectives and Deliverables

Document all technical details in a document that will be kept up to date as the system changes and grows

Ensure all architecture aspects of the systems are represented in diagram form

Present findings to management and senior technical staff

Novell Methodology

Development & Testing

Business Assessment

Technical Assessment

Assess:

Stakeholders’ needs and concerns

Business requirements

Assess:

Current environment

Limitations

Technical requirements

Design

Model a technical architecture that works with current the environment

Plan configurations to meet business requirements

Prototype

Test

Redesign

Development and Testing
Objectives and Deliverables

If you need to readdress the design and architecture, you can do it now… you are looking for the perfect/optimal design

All functional test cases will be run with results fully documented… the more you test, the higher the probability of success

Novell Methodology

Development & Testing

Business Assessment

Technical Assessment

Assess:

Stakeholders’ needs and concerns

Business requirements

Assess:

Current environment

Limitations

Technical requirements

Design

Model a technical architecture that works with current the environment

Plan configurations to meet business requirements

Prototype

Test

Redesign

Deployment

Deploy the ZENworks Solution

Deployment
The Process

Meet the Pre-requisites!

Install the ZENworks Desktop Management Schema

Upgrade ConsoleOne®

Update Search Policies

Update Inventory

Update Imaging

Verify Policies

Update Application Delivery

Update Applications

Update Workstations

Verify Remote Management

Deployment Roadmap

Make sure hardware is to specification

Patch or upgrade your legacy systems if required (NetWare®, Windows, eDirectory, etc.)

Install eDirectory (if required)

If you are migrating from a legacy version of ZENworks for Desktops (v3.2) and you wish to run ZENworks on the same server, create a copy of the PUBLIC directory (if required)

Update the eDirectory schema

Upgrade ConsoleOne and snapins

Deployment Roadmap
(cont.)

Update your login scripts to support the coexistence of legacy clients and clients running the new agents (if required)

Modify Search Policies (if required – may be a post implementation requirement)

Introduce your Middle Tier Servers (if required)

Upgrade or deploy your backend services

For inventory you will take a top-down approach

Be sure you understand all the complexities of migrating/upgrading from other versions of ZENworks...well before you start

Upgrade your clients and deploy the Management Agents

ZENworks Desktop Management
Best Practice Design and Architecture

Design and Architecture
Principles and Rules

9

Centralize what you can… but be realistic

8

Know your policies, and configure them well

7

Avoid the use of “Group” association

6

Work to associate most applications to BU containers

5

Be consistent where you place your service objects

4

Choose a naming convention, document it, and stick with it for the long run

3

Keep objects close to users

2

Use the ZENMaster Container Structure to manage your applications portfolio

1

Structure your directory around the business whenever possible

Design and Architecture
Principles and Rules

Use a staging environment whenever possible

Use Tiered Electronic Distribution (TED) to synchronize critical application source data, and application objects across the enterprise

Separate your testing environment from your production environment

Script and test your production applications outside of the production space

Create addon images for all core business applications (applications that everyone is licensed to use) – treat all other applications as functional business application

Production (Branch Location)

Production (Headquarters)

Staging Environment

1

2

3

4

Document everything!!!

Design and Architecture
ZENMaster Framework

The framework consists of...

Formal methodologies for managing...

Application standardization

Formal QA/QC processes

Methodologies map over to specific ZENworks technology sets

Benefits include...

Reduced administrative overhead required to manage the corporate application library and the replication of application objects to downstream sites.

A formal QA process.

Objects are neatly organized at each site, and containers do not end up cluttered.

Administrators can go from one site or divisional container to another and know where all the sites objects will be located.

Better security control, and less issues.

Application Synchronization Flow

Design and Architecture
ZENMaster Framework

Identify your QA process, and carefully document the following:

Scripting environment

Scripting methodologies

QA process and flow of applications throughout the environment(s)

Test cases (L1, L2, etc.)

Documentation repositories

Application owners

Scripting

Environment

Integration Lab

Environment

Production

Environment

Core Document

Library

Script application

routine

Silver Application

moved to the

Integration Lab

Tree

Golden Application

moved to the

Production Tree

Test application

scripting routine

Test application

scripting routine

Select target

locations for

applications

Pass?

Pass?

Does app need

major revision?

Discard application

and run full

procedure again

Select target

locations for

applications

Pass?

Test application

scripting routine

Document application

scripting results

and requirements

Yes

Yes

No

No

Yes

Yes

Does app need

re-documenting?

No

Filed in document

library

Yes

No

Design and Architecture
ZENMaster Framework

The ZENMaster Container structure contains the following characteristics...

QA container structure to support testing within the production environment (does not have to be within the production tree)

“Golden” or “Mint” container structure for the corporate application portfolio

Applications are propagated from here

Design and Architecture
ZENMaster Framework

The ZENMaster Site Container structure contains the following characteristics...

Consistent container structure for site-based applications and other objects...

Policy objects

TED objects

The container structure should remain consistent at each location... design, and implement it once

Sample Architecture
Heterogeneous Environment – Many Locations

Layer 4 Switch

Head Quarters

Devices include:

Laptops, workstations, handhelds and tablets

Tier 1

Backend Systems

Tier 2

Middle Tier

Server Environment

Branch Office

Tier 3

Branch

Appliance Systems

WAN

T1

Single DNS Record

Layer 4 Switch

Layer 4 Switch

Scripting Environment

Core Campus Locations

T1

T1

T1

Public

Internet

Demilitarized Zone (DMZ)

Laptop PCs

Tablet PCs

Design
Identity Manager with ZENworks

Windows 2003 ZENworks
Middle Tier

Windows 2003
ZENworks Server

Windows 2003

HTTP/HTTPS

SMB

eDir

LDAP

AD

IDMv2

Image Management
Modularize and Simplify

Standard Desktop Build

Universal

Base image

Airport Ticketing

Reservation

Administrative

ZENworks Registration

Install Applications

Join NT Domain/AD

Name Computer

Install Client/Agents

Hardware Driver Add-on

Dell Optiplex

HP D530

Windows 2000

Windows XP

Functional App Add-on

Optimization/Deployment Guidelines
for the Middle Tier Server

Capacity planning

A dedicated Middle Tier Server can service approximately 400 simultaneous HTTP connections

1000-2000 users can point to a single Middle Tier Server (ZEN 6.5sp1a)

Use HTTPS outside the firewall (10-20% overhead)

Load Balancing/Fault Tolerance

Front the Middle Tier Server farm with a Layer 4 switch or use DNS load balancing for agent Middle Tier address

Use multiple eDirectory servers for authentication fault tolerance

Optimization/Deployment Guidelines
for the Middle Tier Server

Other Considerations

All application objects that run programs must access the program from either a local path or a CIFS share

Applications that run programs from a server will not run outside the firewall

Consider either a remote alternate application or a Remote Access system requirement

Ensure that all paths to files are listed in UNC format

Required in applications, policies, etc

Using ZENworks Desktop Management
Outside the Firewall

If the client is installed only application management will function

VPN connections are limited to user based policy and applications

If the client is not installed then as long as the computer is connected to the Internet on boot-up all features will be available

HTTPS should be used to secure the connection

Assign the Middle Tier a certificate

Ensure that the certificate is trusted by the workstation

Set the Middle Tier port to the secure port

3rd Party Software
Things That Help

ENGL	www.engl.co.uk

TouchPaper	www.touchpaper.com

ZENith	www.performingpcs.com

Macrovision AdminStudio	www.macrovision.com

rKaid	www.rkaid.com

Progression Desktop	www.versora.com

ZENworks Desktop Management
Lessons Learned

Application Basics

Use the latest available code from the Support Site

Shipping code

Support packs

Patches (even Beta – check the readme files)

ConsoleOne Snapins

Ensure that everyone has the same versions of ConsoleOne and all snapins

Define your application standards early in the development cycle

Application Scripting

AOT (Snapshot) style applications are still supported

Use MSI and MSP packaging to script your applications

Invest in training on your chosen MSI packaging tool

Create a new object for each new MSI

MSI's have a 164 path length limitation (including drive)

MSP's have a 100 path length limitation (including drive)

Naming standards will have a huge impact on path length

If you are using TED you have different limits for naming

Use UNC, drive letter, macros that meet TED requirements

Application Options

Show install progress will also show uninstall progress

Use the disconnectable option in a Middle Tier Server environment

Set the launcher uninstall when unassociated to > zero

Use the force cache selectively

Bump the version # when you change an application

Use system requirements primarily for the OS settings

Use chaining for application dependencies

Use macros where ever possible

Use enhanced scripting utilities for internal scripts

Pre and post distribution and launch scripts

Application Chaining

Use application chaining for dependant applications

Make your applications modular and chain them

Create separate uninstall applications to upgrade

Use the MSI GUID of the previous version

Make the uninstall a dependant of the new application

Unlink a dependant application BEFORE you delete it

You may corrupt the application object otherwise

If you are using complex chaining – TEST! TEST! TEST!

Deliver core applications using addon imaging

Deliver business or functional applications with chaining

Imaging/PXE

Check Fast Port switch settings

Ensure most efficient Linux NIC driver is being used for your hardware

Realize the benefits of scripted imaging

ZENworks Middle Tier Server
So What are the Numbers??

Does moving to ZENworks 6.5 Desktop Management Service Pack 1 make a difference with Microsoft IIS? The numbers speak for themselves...

* Numbers based on refresh times with 100 applications associated to 460 user accounts

** Numbers based on refresh times with 100 applications associated to 240 user accounts

Middle Tier Platform

ZENworks 6.5

ZENworks 6.5+SP1

Microsoft Windows Server 2003*

Microsoft Windows 2000 Server**

18 m 26 s

16 m 59 s

2 m 35 s

3 m 17 s

Numbers include workstation boot time calculated at 1 m 30 s per workstation

Question and Answer

A “methodology” is…

A body of practices, procedures, and rules used by those who work in a discipline

A set of working methods

It is a means, technique, or procedure

A “best practice” is…

A benchmark to be measured by

A proven, reproducible, innovative process

Best of breed

It is important to first have a clear picture of your current environment. Is it ready to meet the minimum requirements of ZENworks for Desktops?

Identify technical/business limitations in which you must be aware before designing the architecture. (i.e. WAN/LAN constraints, remote user connectivity, corporate political boundaries, etc.)

Identify gaps that most be resolved to ensure that the environment is ready to deploy ZFD. (eDir versions, over worked servers, etc.)

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Container Packages and Search Policies

Must be in place before you extend the schema for ZENworks for Desktops 4

Set the “Search for Policies Up To” to Container Selected Application Objects

Application Objects

To support Application distribution through the middle-tier you must change to UNC paths

See www.novell.com/documentation/zfdpr

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Minimize business risk—change and reconfiguration costs

Support staff are familiar with the client

Performance and scalability inside the firewall

It is already installed on your workstations

Novell Client is required for other Novell solutions

Picture of AD to eDir account synchronization to provide seemless user access to eDirectory when connecting to a clientless workstation and authenticating to AD.

Workstation Rename (WSNAME) http://www.novell.com/coolsolutions/tools/1087.html (and ZCNC) http://www.novell.com/coolsolutions/tools/1414.html

ZENWSBrowser http://www.novell.com/coolsolutions/tools/1593.html

Tweak Manager http://www.winguides.com/tweak/

ZENith http://www.performingpcs.com.au/index_new.asp

2003-12-08T12:43:39