KACE Desktop Authority 11.2.1 - Administrator Guide

Desktop Agent

What is the Desktop Agent?

Desktop Authority provides the ability to execute programs when Windows shuts down, restarts or logs off. This happens with the help of the Desktop Agent. The Agent is a program that sits idle in the system tray until a shut down, restart or log off event occurs. When one of these events are triggered, the Agent will seamlessly invoke any queued applications, shell scripts, or service pack installations. Custom Scripts may also be executed at this time providing an unlimited array of functionality.

Configuring the Desktop Agent

To configure the Desktop Agent, select the Desktop Agent object under Global Options.

Desktop Agent client

The Desktop Agent client is an application used to launch specified programs when the client logs off or shuts down the computer. The client side of the Agent also provides several options to control the workstation. The user may Shut down, Restart, Logoff or Lock the workstation if the agents icon is displayed in the system tray. Simply right-click on the icon for the shortcut menu.

About

Select About from the shortcut menu to see version and copyright information regarding the Agent.

Shutdown

Select Shut down from the shortcut menu to shut down the workstation.

Restart

Select Restart from the shortcut menu to restart the workstation.

Logoff

Select Logoff from the shortcut menu to log the current user off of the workstation.

Lock Workstation

Select Lock Workstation from the shortcut menu to lock the workstation. Pressing CTRL-ALT-DEL will allow the user to unlock the workstation.

Special Options

Option files

There are several ways to control the mode in which Desktop Authority executes on the client workstation. This is done with the use of option files that may exist on workstation.

What is an option file?

An option file is simply an ASCII file created using any text editor, including Microsoft’s Notepad. The file has no contents and the filename has no extension.

Creating an option file

The easiest way to create a special option file is using Windows Explorer. Right-click in the appropriate folder. Choose New and select Text Document from the shortcut menu. 

When using Windows Explorer (New / Text Document) to create a Special Option File, make sure you deselect the Hide file extensions for known file types option under Folder Settings. This will allow you to create the file without the ".txt" extension.

Security concerns

To tighten overall security and prevent users/students, etc. from using these special option files to change the behavior of Desktop Authority, you can disable them in the Desktop Authority Manager. This is done in the Global Options Visual, Exceptions and Troubleshooting objects. Clearing the check box disables Desktop Authority from determining if the corresponding option file exists.

SLNOGUI

The presence of this file, (SLNOGUI., no file extension) specifies the selected visual startup option displayed during the logon process is overridden with a textual version of the logon window. If there are problems with any Desktop Authority client configurations, use this option file to figure out what in the logon process is problematic. The use of this file requires the Allow any client to override this setting and always display the text logon screen option to be set. This is done on the Visual object within Global Options.

To turn the SLNOGUI mode on for all clients without the use of this file, select the Display Text Logon check box on the Visual object within Global Options. Setting this global option provides the text dialog for all workstations.

This feature can be enabled for either a specific user or a specific workstation by using this special option file. To enable this feature for all users logging in from a specific workstation, place this file in the root directory of the workstation’s hard drive. To enable this feature for a specific user regardless of which machine they logon from, place this file in the user’s home directory.

SLBYPASS

The presence of this file, (SLBYPASS., no file extension) allows you to exclude certain computers from ever executing Desktop Authority regardless of the options selected in the Desktop Authority Manager.

The use of this file requires the Allow any client to selectively bypass Desktop Authority execution option to be set. This is done on the Exceptions object of Global Options. If this file is present on the client, the Desktop Authority Pre-Flight-Check (SLOGIC.BAT), will detect its presence and immediately exit before launching the main script engine and/or applying any configuration changes to the client.

To enable this feature for all users logging in from a specific workstation, place this file in the root directory of the workstation’s hard drive.

SLNOCSD

The presence of this file, (SLNOCSD., no file extension) allows you to exclude certain computers from automated Service Pack installations, regardless of the Validation Logic applied to the Service Pack configurations by the Desktop Authority Manager.

If this file is present on the client, Desktop Authority will NOT install the Service Pack to the client, regardless of whether or not the user/computer satisfies the criteria specified by the Validation Logic settings for the Service Pack.

To enable this feature for all users logging in from a specific workstation, place this file in the root directory of the workstation’s hard drive.

Other Special options

Force Refresh after desktop has been loaded and logon script has finished executing

This option can be used by admins to delay the initial execution of user elements (eg. printers, drive mappings etc). In some cases, this will help to avoid login delays and potentially resolve timing conflicts. However for this option to be utilized, the applicable user object element MUST be set to be executed at Refresh. This option is configured in the Registry profile object.

Configure the Registry element as follows:

1. Click on the User Management Registry object.
2. Click Add.
3. Optionally, enter a Profile element description at the top of the element.
4. Under the Registry Action, click Add.
5. Set the Action to Write Value.
6. Set the Hive to HKEY_CURRENT_USER.
7. Set the Key to Software\scriptlogic\slagent.
8. Set the Type to REG_DWORD.
9. Set the Value to LaunchFirstRefreshAtDesktop.
10. By default the Data/express is 0, which means, do no launch the refresh event when desktop loads. Setting this Data/expression to 1 (or anything else) means to launch the refresh event once the desktop loads and script finishes. Set this Data/expression to 1 to turn the immediate refresh event on. Select the Decimal data type.
11. Click Confirm.
12. Select the Validation Logic tab.
13. Select the Refresh box in the Timing section. This must be set for this option to work.
14. Click Save to save the new Registry element.

Global Definition Variables List

User Management definitions

Shortcut profile object

When selecting User Start Menu (Pin) or User Taskbar (Pin) with a non-English language workstation operating system, you must define a variable that defines the non-English verbiage to substitute in place of the English "Pin To..." verbiage. The value of these variables should match the "Pin to Taskbar" or "Pin to Start Menu" text on the popup menu of a program shortcut. The following variables can be defined as User Management Global Variables or as a Profile Definition Variable.

Figure 64: Example of "Pin to" options

For the Unpin variables, the value should match the "Unpin from Taskbar" or "Unpin from Start Menu" on the popup menu of a shortcut on the Start Menu or Taskbar.

Figure 65: Example of "Unpin from" options

$PinToTaskbarString

Defines the "Pin to Taskbar" verbiage on non-English client operating systems.

$UnPinFromTaskbarString

Defines the "Unpin from Taskbar" verbiage on non-English client operating systems.

$PinToStartMenuString

Defines the "Pin to Start Menu" verbiage on non-English client operating systems.

$UnPinFromStartMenuString

Defines the "Pin to Start Menu" verbiage on non-English client operating systems.

Web Browser profile object

The Web Browser object allows for the configuration of custom Firefox settings. If you wish to configure something in the Firefox browser that is not offered on the Web Browser object, it can be configured in the Global or Profile Definitions.

Use the following syntax for configuration:

AddCustomFirefoxPref('pref("Name", Value);')

This will set the named Firefox preference to the given value. This configuration can be accessed via the browser and changed by the user.

AddCustomFirefoxPref('lockPref("Name", Value);')

This will set the named Firefox preference to the given value. This configuration will not be able to be changed via the browser about:config dialog by the user.

"Name" is the name of the preference to be set.

Value is the boolean, string, or integer data for the preference.

Preferences and their settings can be seen in Firefox's about:config dialog.

note: Custom Firefox preferences can be researched in this reference to the user preferences in the about:config,

Examples:

Bool Value: - value can be true or false

AddCustomFirefoxPref('pref("privacy.clearonshutdown.cache", true);')

String Value: - add double quotes around value

AddCustomFirefoxPref('pref("network.automatic-ntlm-auth.trusted-uris", "Http://www.google.com");')

Integer Value: - a numeric value

AddCustomFirefoxPref('pref("network.http.connection-retry-timeout", 500);')

Locked Integer Value: (to prevent a setting from being changed by the user, replace pref with lockpref)

AddCustomFirefoxPref('lockPref("network.http.connection-retry-timeout", 500);')

Computer Management definitions

Validation Logic

$VLCheckAllIPAddresses

This setting will enable Validation Logic to validate on any IP address defined for the client, instead of just the first one read. This variable can be defined as a User Management Global Variable or as a Profile Definition Variable.

Registry keys

sqlCommandTimeout

Sometimes, on large database transactions, the default SQL Command timeout value is not big enough to support the command, allowing the transaction to timeout and fail. Creating this new registry key allows this timeout value to be overridden and increased to alleviate a timeout problem.

File Paths

The following table describes the paths that Desktop Authority uses.

Desktop Authority upgrades from previous versions to 11.2.1 will use the existing installation paths.

Server side

Client side