Novell ZENworks®
Handheld Management Deployment and Configuration Strategies

Anand Sinha

Senior Technical Consultant

sanand@novell.com

Doc Hodges

Corporate Technical Strategist

dhodges@novell.com

Overview

Managed devices

ZENworks key features

ZENworks Handheld Management and the next generation

Handheld management architecture

Infrastructure communications

Infrastructure data flow

Recap and deployment scenarios

Question and answer

ZENworks Handheld Management

ZENworks 6.5 Handheld Management is part of the Novell ZENworks 6.5 product suite.

This directory enabled systems management package puts you in control of your mobile devices and helps you reduce the cost, and simplify the effort involved in managing handheld devices.

The future for Handheld Management is bright... Novell is commited to providing a best of breed technology set to manage PDA and Cell Phone platforms!

Managed Devices

Managed Devices
BlackBerry

ZENworks Handheld Management allows you to manage BlackBerry devices, with increased platform support on the horizon.

850 / 870 using DataTAC network

950 / 970 using Mobitex network

Growth and development in this space is on the radar!!

Managed Devices
Palm OS

ZENworks Handheld Management allows you to manage Palm OS based devices.

Version 3.5 and later

Version 4.x and later (for expansion card functions)

Includes PDAs and Hybrid phones

Once again... growth and development in this space is on the radar!!

Managed Devices
Windows Mobile

ZENworks Handheld Management allows you to manage Windows Mobile devices, with increased platform support on the horizon.

Version 2.11 and later

Pocket PC 2000, 2002, and 2003

Includes PDAs and Hybrid Phones

And yet again... growth and development in this space is on the radar!!

ZENworks Key Features

ZENworks Key Features
Software and Content Distribution

To ensure that mobile users are kept current with...

Latest applications

Bug fixes

Application updates

Etc.

To facilitate the distribution, the product allows for...

Centralized Scheduling

Monitoring the state of distribution

Reporting

Automatic Grouping of devices

ZENworks Key Features
Hardware and Software Inventory

This is very useful for

Ensuring license compliance

Planning for hardware and software upgrades

Plain old... “what do we have out there?”

Keeps the latest information on hardware and software assets.

ZENworks Key Features
Security Management

ZENworks will allow you to...

Prompt the device user to set a password

Enhance password settings (for Palm / Windows CE)

Wipe off data when incorrect passwords are entered

Wipe off data when device is stolen

To ensure that the required level of security is maintained on each handheld device. Sarbanes Oxley, and governance force you to think about this with all IT related initiatives.

ZENworks Key Features
Automated File Retrieval

To facilitate the retrievals, you need to specify...

A list of files to be retrieved

Network location to copy the retrieved files to

The retrieval feature will allow you to retrieve mission-critical information from the device and copy it to a network location. Optionally, you can choose to delete the file from the device.

ZENworks Key Features
Configuration Management

The product allows for configuring the following...

Sound, Alarm, Beam-state settings

Auto-off and other power settings

Assigning applications to launch from buttons/icons

Automating the configuration of devices ensures that the same standard settings are maintained on all devices which may help to reduce support costs and make users more productive.

ZENworks Key Features
Choice of Management

ZENworks is flexible...

Create Handheld Policy Packages

Create Handheld User Policy Packages

Turn on / off user-based policies globally or for selected handhelds

Associate handheld application objects to either the device object or user object

Really, you have two choices... devices or users

ZENworks Key Features
Connections

To maintain transparency, product does the following:

Normal connection mechanism is used for data transfer

TCP/IP, Hotsync, ActiveSync, wireless emails

No special steps required to install or run the product

Allows administrators to pre-configure ZENworks server address

No special connections or steps required... so users remain happy and a joy to deal with

ZENworks 7 Handheld Management
and the Next Generation

ZENworks 7 Handheld Management
What's New

There are a number of new enhancements coming with ZENworks 7 Handheld Management... these include:

Policy based remote management features

Device, user, and password based... just like desktop management

Users receive notification so things remain secure

Policy based Access Point failover

Multiple Access Point addresses assigned to the device so if one fails, the device will try the next in the list

Password synchronization between eDirectory™ and the device

New application management features

Application uninstall and file removal

Installations can be based on date/time

Even if the device is not connected to the server

Chaining applications (sequential) is now an option!!

ZENworks Handheld Management
The Next Generation of ZENworks

So you are probably wondering what we have planned for the next generation of ZENworks... let's take a look!

You will no longer be constrained to running the backend services on Windows... Linux is now a real option

Backend services completely integrated with other ZENworks related services (eg. Import Services handly both desktops and handhelds)

Increased platform support

Blackberry, Palm, Windows, and others such as Symbian

More devices

Integrated PDA/phone devices

New web services architecture

Web-based administration tool

Common installation... no more ugly stepchild!

New functionality

ZENworks Handheld Management
The Next Generation of ZENworks Architecture

ZENworks Mobile Management Services

Windows, Linux or Novell Open Enterprise Server

Primary and Satellite Servers

Manages communication with clients if the server is a Primary Server or Satellite Server

Manages communication with other servers if the server is a Primary Server

Populates inventory data in the inventory database

Negotiates location with the mobile client

Receives logging information from the mobile client or proxy service and stores this in a central location

ZENworks Control Center®

Distribute and install software

View hardware and software inventory

Troubleshoot client problems

Define policies

Monitor results

Mobile Clients

Palm/Windows/BlackBerry/

Symbian

Collect inventory

Enforce policies

Install applications

Remote management

ZENworks Mobile Management Proxy

(Windows and Linux PCs)

Provide conduit to the mobile device while tethered

Handheld Management
Architecture

Handheld Management
Architecture

Database

ConsoleOne

Handheld devices

ZENworks

Handheld Management

Access Point

eDirectory

ZENworks

Handheld Management Server

Handheld Management Architecture:
Handheld Management Server

The Server is the central point of the ZENworks Handheld Management setup.

It is responsible for:

Handling all communications with Access Points

Handling all communications with Blackberry devices

Updating the eDirectory when handhelds register, and when handhelds send their inventory.

Scanning the eDirectory for Policy/Application configurations

Providing access to the Handheld Management Database

Database

Handheld devices

eDirectory

ZENworks

Handheld Management

Access Point

ZENworks

Handheld Management Server

ConsoleOne

Handheld Management Architecture:
Handheld Management Access Point

Access Point is useful for distribution of communication load and provide better support for WAN configurations

It is responsible for:

Acting as a “proxy” for all communications with the handheld devices

Staging the delivery of applications and policy settings.

Communicating with eDirectory for user authentication (if user-based management is enabled)

Database

Handheld devices

eDirectory

ZENworks

Handheld Management

Access Point

ZENworks

Handheld Management Server

ConsoleOne

Handheld Management Architecture:
Handheld Management Database

You have choice here... the ZENworks Handheld Management server database can be a Microsoft Access or Microsoft SQL Server database.

The primary purpose of the database is to store...

Hardware inventory

Software inventory

Results of operations like application delivery, policy enforcement

Book-keeping related information for internal operations

Database

Handheld devices

eDirectory

ZENworks

Handheld Management

Access Point

ZENworks

Handheld Management Server

ConsoleOne

Handheld Management Architecture:
Novell eDirectory Infrastructure

Novell eDirectory is the central repository for all information related to management and configuration of handheld devices... without eDIrectory the services would be unable to function

Novell eDirectory stores:

Objects such as Handhelds, Handheld Groups, Handheld Applications and Policies

Management Objects such as Handheld Service Object and Handheld Import policy.

Database

Handheld devices

eDirectory

ZENworks

Handheld Management

Access Point

ZENworks

Handheld Management Server

ConsoleOne

Handheld Management Architecture:
ConsoleOne®

Novell ConsoleOne is the administrative console for ZENworks Handheld Management. When displaying information to the administrator, it uses the data stored in eDirectory, and the handheld management database.

ConsoleOne allows you to...

Create and configure policy objects

Manage application distribution

View Hardware and Software Inventory

Monitor the success and failure of operations

Define and view reports

Database

Handheld devices

eDirectory

ZENworks

Handheld Management

Access Point

ZENworks

Handheld Management Server

ConsoleOne

Handheld Management Architecture:
Handheld Devices

The infrastructure is in place to manage handheld devices... so this is really what it is all about.

The following activities take place on the devices:

Hardware/software inventory collection

Policy enforcement

Reporting back of policy enforcement results

Security application processing

Database

Handheld devices

eDirectory

ZENworks

Handheld Management

Access Point

ZENworks

Handheld Management Server

ConsoleOne

Infrastructure Communications

Infrastructure Communication

Server – eDirectory : Secure LDAP

Access Point – eDirectory : Secure LDAP

ConsoleOne – eDirectory : NDAP

Server – Database : ODBC

Server – Access Point : Choice of default TCP/IP protocol, HTTP, SSL

Access Point – Handhelds : Choice of default TCP/IP protocol, HTTP, SSL

Database

Handheld devices

eDirectory

ZENworks

Handheld Management

Access Point

ZENworks

Handheld Management Server

ConsoleOne

Secure LDAP

Secure LDAP

NDAP

ODBC

TCP/IP

HTTP

SSL

TCP/IP

HTTP

SSL

Communication
Server/Access Point Protocols

Protocol choice is something that you need to consider prior to developing your enterprise architecture.

Consider the following...

If you have only one Access Point (on the server machine) use the default TCP/IP protocol

If you are looking for the least amount of data flow use the default TCP/IP protocol

If the Server is behind a fire-wall use HTTP

If you need secure communication use SSL

TCP/IP

TCP/IP

HTTP

SSL

Communication
Server/Access Point Protocols

In order to set your protocol preferences, run CfgIP.exe from server install folder

Communication
Server/Access Point Protocols

In order to set the Proxy Communcations options, run Console.exe from Access Point install folder.

Select Operations > Configure > Server Communications

Communication
Access Point Dial-up Links

If the access point communicates with the server using Dial-up Networking, then ZENworks Handheld Management allows to do the following:

Select the dial-up networking entry to use

Set the bandwidth percentage (%) that should be used when using dial-up connections

Frequency of dial-up session(s)

How long to wait before next dial-up

Enabling or disabling the LAN adapter usage

Communication
Access Point Dial-up Links

In order to set up your dial-up links, run Console.exe from Access Point install folder.

Select Operations > Configure > Server Communications > Network Usage Restrictions

Communication
Access Point Dial-up Links

To set the specific options for dial-up communication, run Console.exe from Access Point install folder.

Select Operations > Configure > Server Communications > Dial-up settings

Communication
More on Server/Access Point Protocols

ZENworks Handheld Management automatically takes care of the following...

Data compression - the data transmitted is compressed for a more efficient use of WAN links

Automatic retransmissions - in case of communication failures, to take care of scenarios when one of the services is down

Check-point restart – in case of retransmissions, the whole data set is not resent... makes sense especially when we are talking about larger distributions

Communication
Access Point/Handheld Protocols

So far we have talked about the protocols used by and between the server and the access point... what about communication between the handheld device and the access point?

If you are looking for the least amount of data flow (automatic selection) use the default TCP/IP protocol

If the handheld is trying to connect to an access point from outside the corporate firewall open up port 2400 or use HTTP

If you need secure communication use SSL

TCP/IP

HTTP

SSL

Communication
Access Point/Handheld Protocols

The following devices support the use of SSL protocols...

Palm devices

Version 5.1 and later

Windows CE devices

Version 3.0 and later

For Pocket PC 2000, you need to install the High Encryption Pack for Pocket PC

Bear in mind, not all devices support SSL communications.

SSL

Communication
More on Access Point/Handheld Protocols

ZENworks Handheld Management automatically takes care of the following wherever possible...

Data compression - the data transmitted is compressed for a more efficient use of WAN links

Automatic retransmissions - in case of communication failures, to take care of scenarios when one of the services is down

Check-point restart – in case of retransmissions, the whole data set is not resent... makes sense especially when we are talking about larger distributions

Infrastructure Data Flow

Infrastructure Data Flow
Hardware Inventory

Don't sweat too much... hardware inventory data is really small, so reporting across big WAN links is an option where necessary.

Keep the following in mind...

Windows CE devices and Palm devices send their hardware inventory on every 'Connect' to the device

If the device is new to the system, then a new device object is created in eDirectory based on the Import policy - the server then returns a unique identifier (GUID) for the device which is used by the device in all future connections

Infrastructure Data Flow
Software Inventory

Keep the following in mind, at all times...

The size of the software inventory depends on the number of applications installed on the device - the average software inventory is a few hundred bytes

Since collection of software inventory is processor intensive, software inventory is sent once every 24 hours for Windows CE and Palm devices

The data sent by the device is sent to the Access Point which in turn sends it to the server to be stored

Software inventory is a little different than hardware inventory..

Infrastructure Data Flow
Optimization for Inventory

Since the size of inventory data is very small, the only method for optimization is to connect less frequently.

This is easily achieved for all platforms...

For IP-based Palm, the connection frequency can be mentioned when the Palm client is being created using the installer

Windows CE devices connect to the Access Point once every hour

For Blackberry devices, you can set the inventory schedule in the “Blackberry Inventory” policy

Infrastructure Data Flow
Good Things to Know About Policies

You need to keep in mind a few basic principles when it comes to setting up policies for device connection...

If “Device A” connects only to “Access Point 1” and never to “Access Point 2”, then the policy for “Device A” is sent only to “Access Point 1”

If “Device B” connects to only “Access Point 1” and the effective policy for devices A and B are same, then the policy definition is sent exactly once to the “Access Point 1”

If “Device A” starts connecting to “Access Point 2”, then policies for this device would be sent to both “Access Point 1” and “Access Point 2”

Prior to installing any software, document your requirements... in this case the creation and configuration of device connection policies.

Infrastructure Data Flow
Good Things to Know About Policies

Each policy in ZENworks Handheld Management contains a 'Revision Number'... this revision number is incremented every time you edit (and save) a policy using ConsoleOne.

The server keeps track of these revision numbers

A policy is resent to an Access Point only when the revision number with the Access Point is smaller than that with the server

Infrastructure Data Flow
Optimization for Policies

The product automatically optimizes on the data flow for policies. However, you can further optimize the system by ensuring that you do not modify the policies often.

If you want to optimize the system even further...

Ensure that related sets of handhelds always connect to the same Access Point

Ensure that handhelds do not roam across Access Points

Infrastructure Data Flow
Application Distribution

Lot's of efficiency in this area...

The application data is sent from the server to the access point for distribution to the clients

The server scans the application storage area on the network based on the application update schedule

Depending on the policy, an application is resent to the access point only if one of the files has been modified

The server sends only the file that has changed to the access point

The placement of access points becomes more critical when it comes to application distribution.

Infrastructure Data Flow
Application Distribution

The Application data is sent from the Access Point to a handheld device only once...

unless there was a failure during the send process, or if the application data is modified

To force the resend of an application to a device, you should use the “Resend” feature in ConsoleOne

Infrastructure Data Flow
Optimization for Application Distribution

The product automatically optimizes on the data flow for application distribution... however, you can achieve additional optimization by ensuring that the Update Interval is not too short.

In addition to this, you should...

Ensure that the application files are stored on a network location close to the server (or on the server, if possible)

Ensure that related sets of handhelds always connect to the same access point, and they do not roam across access points.

Infrastructure Data Flow
File Retrievals

Things to keep in mind when creating retrieval policies...

Files are retrieved from a location on the handheld device as often as mentioned in the schedule of the File Retrieval Policy

All files are always retrieved irrespective of the fact whether they have changed from the last retrieval

File Retrieval policies are plural and cumulative, so take care when defining the policies – think and document prior to creation and implementation

You can retrieve files from a managed device by creating policies using ConsoleOne.

Infrastructure Data Flow
Optimization for File Retrievals

Sit down and think about these policies before you enforce them... think, document, create, and implement

Limit the files that need to be retrieved from the handheld to those which are critical to your organization

If you know that a particular set of files do not need to reside on the handheld after the retrieval, then ensure that you have set the option to “Delete the Files after Retrieval”

Utilize the fact that this is a plural policy

Store these files to a network location close to the handheld server

Recap and Deployment Scenarios

So Let's Recap

When deploying ZENworks Handheld Management...

Keep the architecture in mind

Keep the various communication options in mind

Although the product automatically helps you by having inbuilt features like “Checkpoint Restart”, “Data Compression”, “Send only the modified data”, you can do your part by planning how and where the handhelds connect

Finalize on the policy definitions at the outset

So Let's Recap

Keep the applications that you need to distribute on the server, if possible

Store the retrieved files as close to the device as possible

If you are not using user-based policies, it may be prudent to have a standalone eDirectory tree for ZENworks Handheld Management

“Plan the Work, then Work the Plan!”

And most importantly...

A simple deployment

When the server software is installed, all relevant components are automatically installed on the machine.

The more standard choice

Handheld devices

ZENworks

Handheld Management Server

Access Point

Access Point

Access Point

Handheld devices

Handheld devices

Don't ignore this one though....

Handheld devices

ZENworks

Handheld Management

Server

eDirectory

ZENworks

Handheld Management Server

ConsoleOne

Access Point

Handheld devices

Question and Answer

Modify this text if necessary

Modify this text if necessary

Access Point is automatically installed on the machine where the ZENworks Handheld Management server is installed.

Database access happens through th e Server Service and not directly.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Resend :

Application > Properties Page > Application Status page > Select a successful application > use Resend button.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Anand : TODO – Find out the exact block size for checkpoint restart.

Novell Brainshare: TUT223

2003-12-08T12:43:39

Anand Sinha