Chat now with support
Chat with Support

KACE as a Service 7.1 - Administrator Guide

About the KACE Systems Management Appliance (K1000) Getting started
Configuring the appliance
Requirements and specifications Power-on the appliance and log in to the Administrator Console Access the Command Line Console Tracking configuration changes Configuring System-level and Admin-level General Settings Configure appliance date and time settings Verifying port settings, NTP service, and website access Configuring network and security settings Configuring Agent settings Configuring session timeout and auto-refresh settings Configuring locale settings Configure data sharing preferences About DIACAP compliance requirements Configuring Mobile Device Access Enable fast switching for organizations and linked appliances Linking Quest KACE appliances Configuring history settings
Setting up and using labels to manage groups of items Configuring user accounts, LDAP authentication, and SSO Using Replication Shares Managing credentials Configuring assets
About the Asset Management component About managing assets Adding and customizing Asset Types and maintaining asset information Managing Software assets Managing physical and logical assets Maintaining and using manual asset information Managing locations
Setting up License Compliance Managing License Compliance Setting up Service Desk Creating and managing organizations Importing and exporting appliance resources
Managing inventory
Using Device Discovery Managing device inventory
About managing devices Features available for each device management method About inventory information Tracking changes to inventory settings Managing inventory information Finding and managing devices Provisioning the K1000 Agent Manually deploying the K1000 Agent Using Agentless management Adding devices manually in the Administrator Console or by using the API Forcing inventory updates Managing MIA devices Obtaining Dell warranty information
Managing applications on the Software page Managing Software Catalog inventory
About the Software Catalog Viewing Software Catalog information Adding applications to the Software Catalog Managing License assets for Software Catalog applications Using software metering Using Application Control Update or reinstall the Software Catalog
Managing process, startup program, and service inventory Writing custom inventory rules
Deploying packages to managed devices
Distributing software and using Wake-on-LAN Broadcasting alerts to managed devices Running scripts on managed devices Managing Mac profiles
Patching devices and maintaining security
About patch management Subscribing to and downloading patches Creating and managing patch schedules Managing patch inventory Managing Dell devices and updates Maintaining device and appliance security
Using reports and scheduling notifications Monitoring servers
Getting started with server monitoring Working with monitoring profiles Managing monitoring for devices Working with alerts
Using the Service Desk
Configuring Service Desk Managing Service Desk tickets, processes, and reports
Overview of Service Desk ticket lifecycle Creating tickets from the Administrator Console and User Console Creating and managing tickets by email Viewing tickets and managing comments, work, and attachments Using the ticket escalation process Using Service Desk processes Using Ticket Rules Run Service Desk reports Archiving, restoring, and deleting tickets Managing ticket deletion
Managing Service Desk ticket queues About User Downloads and Knowledge Base articles Customizing Service Desk ticket settings Configuring SMTP email servers
Maintenance and troubleshooting
Maintaining the appliance Troubleshooting the K1000
Appendixes Glossary About us Legal notices

Configure Quest Identity Broker as the single sign on method

Configure Quest Identity Broker as the single sign on method

You can use Quest Identity Broker (QIB) to enable users to log in to the Administrator Console and User Console using credentials from third-party identity providers, such as your organization's Identity Provider and Microsoft Azure™ Active Directory.

QIB can be enabled for a single organization only. If the Organization component is enabled on your appliance, you can enable QIB for the default organization only. To use single sign on with multiple organizations, use Active Directory authentication. See Configure Active Directory as the single sign on method.

1.
Go to the appliance Control Panel:
◦
If the Organization component is not enabled on the appliance, log in to the K1000 Administrator Console, http://K1000_hostname/admin, then click Settings.
◦
If the Organization component is enabled on the appliance, log in to the K1000 System Administration Console, http://K1000_hostname/system, or select System in the drop-down list in the top-right corner of the page, then click Settings.
2.
In the Single Sign On section of the Security Settings page, select Quest Identity Broker, then provide the following information:

Option

Description

Web Server Assertion Consuming Service URL

The URL associated with your K1000 appliance. This URL is created automatically during appliance configuration. To enable QIB, contact Quest Support and provide this URL to obtain the Relying Party Identifier for your appliance.

* 
IMPORTANT: If you enable or disable SSL for the appliance, this URL changes. As a result, you need to provide this URL to Quest Support and obtain a new Relying Party Identifier any time SSL settings are changed.

Relying Party Identifier

A unique identifier provided by Quest Support to enable QIB. This identifier determines which identity provider, such as your organization's Identity Provider or Microsoft Azure Active Directory, is used for authentication. You must provide your Web Server Assertion Consuming Service URL to Quest Support to receive this identifier.

Automatically approve user requests

Users requesting single sign on access are automatically granted access to the K1000 User Console if they are authenticated by the third-party identity provider. Accounts for these users are created automatically on the K1000 appliance.

Manually approve user requests

Administrators must approve access requests before users can access the K1000 Administrator Console or User Console. When users attempt to sign on to the K1000 using third-party credentials, the K1000 creates approval requests. When administrators log in to the Administrator Console, a notification stating that approval requests are pending appears on the information bar at the top of the Dashboard page. When administrators approve requests, user accounts are created on the K1000 appliance and users can access the K1000 Administrator Console or User Console.

3.
To specify identity provider settings, click Advanced Settings.
* 
NOTE: Do not change these settings unless directed to do so by Quest Support.

Option

Description

Quest Identity BrokerURL

The URL of the identity provider.

Quest Identity BrokerIdentifier

The unique identifier of the identity provider.

Quest Identity BrokerCertificate

The certificate used to verify communications with the identity provider.

4.
Click Save and Restart Services.

Generate an SSL certificate

Generate an SSL certificate

You can generate a self-signed SSL certificate, or generate a certificate signing request for third-party certificates, using the Administrator Console.

1.
Go to the appliance Control Panel:
◦
If the Organization component is not enabled on the appliance, log in to the K1000 Administrator Console, http://K1000_hostname/admin, then click Settings.
◦
If the Organization component is enabled on the appliance, log in to the K1000 System Administration Console, http://K1000_hostname/system, or select System in the drop-down list in the top-right corner of the page, then click Settings.
2.
Click Security Settings to display the Security Settings page.
3.
In the SSL section, click Enable SSL.
Additional SSL options are displayed.
4.
Click SSL Certificate Form to display the SSL Certificate Form page.
* 
NOTE: If a certificate signing request has previously been generated, it appears on the page. To generate a new request, you need to update the information in the Configure section, then click Save before you click Generate Self-Signed Certificate.
5.
In the Configure section, provide the following information:

Option

Description

Company Name

The name of your company.

Organization Name

The name of your organizational unit or business group.

Common Name

The common name of the appliance you are creating the SSL certificate for.

Email

Your email address.

City Name

The name of your locality.

State or Province Name

The name of your state or province.

Country Name

The name of your country.

6.
Click Save.
If this is the first time the SSL Certificate Form has been saved, the Certificate Signing Request section appears. If the form has previously been saved, the Certificate Signing Request section is updated.
7.
Do one of the following:
◦
To generate a certificate using a third-party certificate issuer:
1.
Copy all of the text in the Certificate Signing Request section, including the lines "-----BEGIN CERTIFICATE REQUEST-----" and "-----END CERTIFICATE REQUEST-----" and everything in between, then send it to the certificate issuer or the person who provides your company with web server certificates.
2.
When you receive a certificate from the third party, return to the Security Settings page and upload the certificate. See Configure security settings for the appliance.
◦
To generate a self-signed certificate:
1.
Click Generate Self-Signed Certificate to generate and display the certificate below the Certificate Signing Request section.
2.
Click Deploy Self-Signed Certificate, then click Yes.
3.
On the Security Settings page, click Save and Restart Services.
Self-signed certificates are converted to PEM files, named kbox.pem, and the files are placed in K1000 Agent data folders.
* 
NOTE: Your private key appears in the Private Key field. It is deployed to the appliance when you deploy a valid certificate. Do not send the private key to anyone. It is displayed here in case you want to deploy this certificate to another web server.
NOTE: The certificate and private key for SSL are not included in the appliance’s daily backups for security reasons. Retain these two files for your own records.

Configuring Agent settings

Configuring Agent settings

About Konea
Configure Agent settings

Agent settings determine the port and security settings used by the K1000 Agent. These settings are specific to the Agent infrastructure and do not affect other appliance configuration settings or runtime operations.

* 
NOTE: Changing Agent settings temporarily interrupts communications between the appliance and the Agents installed on managed devices, so use caution. For more information, contact Quest Support at https://support.quest.com/contact-support.

About Konea

About Konea

Konea is a component that enables the communication between the K1000 Agent, which is installed on Agent-managed devices, and the K1000 appliance.

Konea provides optimized real-time communications for systems-management operations.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating