KACE Systems Management Appliance 14.0 Common Documents - KACE Service Desk Administrator Guide

Click the link to the Knowledge Base article about using the appliance GPO Provisioning Tool for Agent deployment at https://support.quest.com/kb/133776.

Log in to the appliance Administrator Console, https://appliance_hostname/admin. Or, if the Show organization menu in admin header option is enabled in the appliance General Settings, select an organization in the drop-down list in the top-right corner of the page next to the login information.

On the left navigation bar, click Settings, then click Provisioning.

On the Provisioning panel, click Agent Provisioning Assistant.

The Agent Provisioning Assistant: Step 1 of 3 page appears.

Select the check box for Provisioning Using Windows Group Policy (recommended), and click Next to display the Agent Provisioning Assistant: Step 2 of 3 page.

The Knowledge Base article provides a link to download the MSI for the GPO Provisioning Tool.

Installing and starting the tool requires leaving the appliance interface.

Download the MSI, and start it to install the tool.

Start the installed tool from the Start menu.

The deployment wizard leads you through steps to configure and apply a GPO for software deployment. Where possible, the wizard attempts to use defaults that reduce the amount of configuration required.

NOTE: Only GPOs for which you have permission to edit are displayed in the tool.

Return to the Agent Provisioning: Step 2 of 3 page in the appliance when you have completed working in the tool, and click Next.

Click Finish on the Agent Provisioning: Step 3 of 3 page.

Agents are installed on the client devices after the Group Policy is refreshed on those devices. Depending on the environment, this installation takes place either when the device reboots, or after a 90-minute refresh cycle occurs for the Group Policy.

Go to the Devices page to keep track of the progress of devices having the agents installed and checked in.

Provision KACE Agents using the appliance GPO Provisioning Tool

Provisioning the KACE Agent using the GPO Provisioning Tool for Windows devices

Prepare to use the GPO Provisioning Tool for Agent deployment

Provision KACE Agents using the appliance GPO Provisioning Tool

Of the methods for provisioning the Agent on Windows devices, Quest recommends the GPO Provisioning Tool because using the tool minimizes the pre-configuration that must happen on the target devices.

For the Quest Knowledge Base article that contains the link to download the GPO Provisioning Tool, go to https://support.quest.com/kb/133776.

Prepare to use the GPO Provisioning Tool for Agent deployment

Before you can use the GPO Provisioning Tool to deploy Agents to Windows devices, you must ensure that your system is configured to use the tool.

The following system requirements are necessary for using the GPO Provisioning Tool:

•

Go to http://social.technet.microsoft.com/wiki/contents/articles/2202.remote-server-administration-tools-rsat-for-windows-client-and-windows-server-dsforum2wiki.aspx.

•

.NET Framework 3.5.

•

Windows Server 2012 or higher Active Directory Functional Level.

•

Provision KACE Agents using the appliance GPO Provisioning Tool

•

You have an Active Directory environment.

•

You have appropriate access to set up software installations.

•

You have met the system requirement spelled out in Prepare to use the GPO Provisioning Tool for Agent deployment.

Click the link to the Knowledge Base article about using the appliance GPO Provisioning Tool for Agent deployment at https://support.quest.com/kb/133776.

On the left navigation bar, click Settings, then click Provisioning.

On the Provisioning panel, click Agent Provisioning Assistant.

The Agent Provisioning Assistant: Step 1 of 3 page appears.

Select the check box for Provisioning Using Windows Group Policy (recommended), and click Next to display the Agent Provisioning Assistant: Step 2 of 3 page.

The Knowledge Base article provides a link to download the MSI for the GPO Provisioning Tool.

Installing and starting the tool requires leaving the appliance interface.

Download the MSI, and start it to install the tool.

Start the installed tool from the Start menu.

NOTE: Only GPOs for which you have permission to edit are displayed in the tool.

Return to the Agent Provisioning: Step 2 of 3 page in the appliance when you have completed working in the tool, and click Next.

Click Finish on the Agent Provisioning: Step 3 of 3 page.

Go to the Devices page to keep track of the progress of devices having the agents installed and checked in.

•

See the Technical Specifications available on the product documentation page: https://support.quest.com/kace-systems-management-appliance/technical-documents.

•

See Verifying port settings, NTP service, and website access.

Prepare Windows devices to have the Agent installed

Before you install the KACE Agent on Windows devices, you must configure file sharing and User Account Control (UAC) properly.

•

Prepare a Windows 7 or Windows 8 device

Provide Administrator credentials for each device. To install the KACE Agent on multiple devices, the Administrator credentials must be the same for all devices.

To configure User Account Control (UAC), do one of the following:

◦

Set User Account Control: Run all administrators in Admin Approval Mode to Disabled. This option is recommended, because it is more secure and can be centrally configured using GPO. To find this setting, open the Group Policy (type secpol.msc into the Search programs and files field under the Start menu), then go to Local Policies > Security Options. Restart the device after applying the settings.

◦

Disable UAC. On Windows 7, go to Control Panel > System and Security > Action Center > Change User Account Control Settings. On Windows 8, go to Control Panel > System and Security > Administrative Tools > Local Security Policy, then in Security Options in the Local Policies section choose Disabled for each of the items labeled User Account Control.

On the Advanced Sharing Settings page, enable network discovery and file and printer sharing.

•

Prepare Windows Firewall

If Windows Firewall is enabled, you must enable File and Print Sharing in the Exceptions list of the Firewall Configuration. For instructions, see the Microsoft Support website.

•

Verify port availability

Verify the availability of ports 139 and 445.

The appliance verifies the availability of ports 139 and 445 on target devices before attempting to run any remote installation procedures.

NOTE: On Windows devices, ports 139 and 445, File and Print Sharing, and Administrator credentials are required only during Agent installation. You can disable access to these ports and services after installation if necessary. The Agent uses port 443 for ongoing communications.

NOTE: After installation, the Agent runs within the context of the Local System Account, which is a built-in account used by Windows operating systems.

Install the KACE Agent on a device or multiple devices

You can install the KACE Agent on a single device, or on multiple devices by specifying a range of IP addresses as targets for installation, using the Agent Provisioning Assistant. You can use this method to provision Windows, Mac, or Linux devices.

•

You have prepared all the target devices. See Preparing to install the KACE Agent.

•

You have information for the administrator account that has the necessary privileges to install Agents on the target devices.

With the Agent Provisioning Assistant, you can create provisioning schedules to specify how and when to install the KACE Agent on devices in your network. Provisioning according to a schedule is useful to help ensure that devices in an IP address range have the Agent installed.

Provisioning schedules configure the appliance to periodically check devices in a specified IP address range and install, reinstall, or uninstall the KACE Agent as needed.

For provisioning Windows devices, you can also use the appliance GPO Provisioning Tool. Using the tool minimizes the pre-configuration that must happen on the target device. See Provisioning the KACE Agent using the GPO Provisioning Tool for Windows devices.

On the left navigation bar, click Settings, then click Provisioning.

On the Provisioning panel, click Agent Provisioning Assistant.

The Agent Provisioning Assistant: Step 1 of 3 page appears.

Select Provisioning Using IP Range (Windows, Mac, Linux) and click Next to display the Provisioning Schedule Detail page.

In the Configure section, name the schedule, enable provisioning, and provide platform information:

Enable provisioning schedules. Schedules run only if this check box is selected.

Name

A unique name that identifies this configuration. The name appears on the Provisioning Schedules page.

Enabled

Install/Uninstall

Indicates whether the provisioning schedule deals with installing or uninstalling Agents.

Agent Token

The token the Agent uses to connect to the appliance. Select an existing Agent token or add a new one:

Select Add Agent Token.

In the Add Agent Token dialog box, provide the following information:

◦

Name:

◦

Enable Expiration: If you want this token to be valid for a limited time, select this check box, and specify the expiration date and time, as required. To change the specified date and time, click Clear, and provide the new expiration deadline.

◦

Enable Use Limit: If you want to specify the number of times the token can be used to register one or more agents with the appliance, select this check box, and in the field that appears, specify the maximum use count. Unless an agent's history is deleted from the appliance, the agent registers with the appliance only once, so this number represents the total number of times one or more agents can register with the appliance.

Click Save.

If you do not select an Agent token, when the Agent connects to the appliance for the first time, it remains in the quarantine list until the appliance administrator approves its connection request. For more information, see Registering KACE Agent with the appliance.

Credentials

Separate rows for the credentials needed to connect to the device and run commands for the particular platform targeted by the schedule. The first column contains the operating system. The second column contains the Agent Version in place for installation. The third column contains a drop-down list from which to select existing credentials. You can select Add new credential to add credentials not already listed.

See Add and edit User/Password credentials.

In the Deploy section, identify the devices to be included in the schedule:

Target IP addresses or hostnames

A comma-separated list of the IP addresses or host names of the target devices. Use hyphens to specify individual IP address class ranges.

Tip:	TIP: The appliance supports both IPv6 (Internet Protocol version 6) and IPv4 addresses.

The Help me pick devices link enables you to add devices to the Target IP addresses or Hostnames list:

•

Provisioning IP Range: Use hyphens to specify individual IP address class ranges. For example:

◦

IPv6: fdef:22b9:e8ae:14a9::1a0:f000-f0aa

◦

IPv4: 192.168.2-5.1-200

After specifying a range, click Add All

•

Select Devices from Discovery: This drop-down list is populated from the Discovery Results. To filter the contents, start typing in the field. After selecting a device, click Add All.

Set the time for the schedule to run.

Run in combination with an event rather than on a specific date or at a specific time.

None

Every n hours

Run at a specified interval.

Every day/specific day at HH:MM

Run daily at a specified time, or run on a designated day of the week at a specified time.

Run on the nth of every month/specific month at HH:MM

Run on the same day every month, or a specific month, at the specified time.

Run on the nth weekday of every month/specific month at HH:MM

Run on the specific weekday of every month, or a specific month, at the specified time.

Custom

Run according to a custom schedule.

Use standard 5-field cron format (extended cron format is not supported):

Use the following when specifying values:

•

Spaces ( ): Separate each field with a space.

•

Asterisks (*): Include the entire range of values in a field with an asterisk. For example, an asterisk in the hour field indicates every hour.

•

Commas (,): Separate multiple values in a field with a comma. For example, 0,6 in the day of the week field indicates Sunday and Saturday.

•

Hyphens (-): Indicate a range of values in a field with a hyphen. For example, 1-5 in the day of the week field is equivalent to 1,2,3,4,5, which indicates Monday through Friday.

•

Slashes (/): Specify the intervals at which to repeat an action with a slash. For example, */3 in the hour field is equivalent to 0,3,6,9,12,15,18,21. The asterisk (*) specifies every hour, but /3 restricts this to hours divisible by 3.

Examples:

•

15 * * * * Run 15 minutes after every hour every day

•

0 22 * * * Run at 22:00 every day

•

0 0 1 1,6 * Run at 00:00 on January 1 and June 1

•

30 8,12 * * 1-5 Run weekdays at 08:30 and 12:30

•

0 2 */2 * * Run every other day at 02:00

View Task Schedule

Click to view the task schedule. The Task Schedule dialog box displays a list of scheduled tasks. Click a task to review the task details. For more information, see View task schedules.

Optional: Use Advanced settings to:

◦

Customize the ports the appliance uses to deploy the Agent.

◦

Designate an alternative download location for the Agent installer.

NOTE: Newer versions of MS Windows such as Windows 10 do not support downloading files from file shares which prevents alternate location WinRM provisioning to work as expected.

◦

Specify the WinRM port used for agent provisioning on Windows devices. For those schedules using a legacy method to provision Windows devices, you have an option to change it to WinRM. For more information about WinRM configuration, see https://support.quest.com/kb/260699/agent-provisioning-with-winrm.

◦

Choose the level of information to display in the log. To see only the most important messages, select Critical. To see all messages, select Debug. Other options include Error, Warning, Notice, and Info.

◦

Specify the device that you want to use as a relay for agentless device inventory. A relay device that is used during discovery as a relay is used for agentless inventory, when a new device is provisioned automatically from discovery results. For more information, see Add a Discovery Schedule to perform a quick "what and where" scan of your network.

◦

Enable a complete uninstall of the Agent. Selecting Remove KUID during uninstall results in an existing Agent being removed from the device before the Agent is installed again. In this case, the appliance generates a new KUID for the asset, and it appears as a new device in the appliance.

Click Run now to display the Provisioning Schedules page and the new configuration.

The appliance saves the configuration with the name you supplied, and then runs the configuration against the targeted IP addresses.

The Provisioning Schedules page displays the progress of the successful installations after the schedule's start time.

Preparing to install the KACE Agent

Provisioning the KACE Agent using onboard provisioning

Preparing to install the KACE Agent

Install the KACE Agent on a device or multiple devices

After you have prepared each of your target client devices, you use the Agent Provisioning Assistant in the appliance to identify the devices and set up a provisioning schedule.

Preparing to install the KACE Agent

Before you install the KACE Agent on devices using onboard provisioning, you must verify system requirements, enable file sharing, and prepare devices.

For information on file sharing, see Enabling file sharing.

Verifying system requirements for the KACE Agent installation

Before you install the KACE Agent on devices, verify that the required ports are accessible, and that managed devices meet system requirements.

Managed devices must meet the following system requirements and be able to access the required ports:

•

See the Technical Specifications available on the product documentation page: https://support.quest.com/kace-systems-management-appliance/technical-documents.

•

See Verifying port settings, NTP service, and website access.

Prepare Windows devices to have the Agent installed

Before you install the KACE Agent on Windows devices, you must configure file sharing and User Account Control (UAC) properly.

•

Prepare a Windows 7 or Windows 8 device

Provide Administrator credentials for each device. To install the KACE Agent on multiple devices, the Administrator credentials must be the same for all devices.

To configure User Account Control (UAC), do one of the following:

◦

On the Advanced Sharing Settings page, enable network discovery and file and printer sharing.

•

Prepare Windows Firewall

If Windows Firewall is enabled, you must enable File and Print Sharing in the Exceptions list of the Firewall Configuration. For instructions, see the Microsoft Support website.

•

Verify port availability

Verify the availability of ports 139 and 445.

The appliance verifies the availability of ports 139 and 445 on target devices before attempting to run any remote installation procedures.

NOTE: After installation, the Agent runs within the context of the Local System Account, which is a built-in account used by Windows operating systems.

Install the KACE Agent on a device or multiple devices

•

You have prepared all the target devices. See Preparing to install the KACE Agent.

•

You have information for the administrator account that has the necessary privileges to install Agents on the target devices.

Provisioning schedules configure the appliance to periodically check devices in a specified IP address range and install, reinstall, or uninstall the KACE Agent as needed.

On the left navigation bar, click Settings, then click Provisioning.

On the Provisioning panel, click Agent Provisioning Assistant.

The Agent Provisioning Assistant: Step 1 of 3 page appears.

Select Provisioning Using IP Range (Windows, Mac, Linux) and click Next to display the Provisioning Schedule Detail page.

In the Configure section, name the schedule, enable provisioning, and provide platform information:

Enable provisioning schedules. Schedules run only if this check box is selected.

Name

A unique name that identifies this configuration. The name appears on the Provisioning Schedules page.

Enabled

Install/Uninstall

Indicates whether the provisioning schedule deals with installing or uninstalling Agents.

Agent Token

The token the Agent uses to connect to the appliance. Select an existing Agent token or add a new one:

Select Add Agent Token.

In the Add Agent Token dialog box, provide the following information:

◦

Name:

◦

Click Save.

Credentials

See Add and edit User/Password credentials.

In the Deploy section, identify the devices to be included in the schedule:

Target IP addresses or hostnames

A comma-separated list of the IP addresses or host names of the target devices. Use hyphens to specify individual IP address class ranges.

Tip:	TIP: The appliance supports both IPv6 (Internet Protocol version 6) and IPv4 addresses.

The Help me pick devices link enables you to add devices to the Target IP addresses or Hostnames list:

•

Provisioning IP Range: Use hyphens to specify individual IP address class ranges. For example:

◦

IPv6: fdef:22b9:e8ae:14a9::1a0:f000-f0aa

◦

IPv4: 192.168.2-5.1-200

After specifying a range, click Add All

•

Select Devices from Discovery: This drop-down list is populated from the Discovery Results. To filter the contents, start typing in the field. After selecting a device, click Add All.

Set the time for the schedule to run.