KACE Systems Management Appliance 13.0 Common Documents - Administrator Guide

Unique identifier for the volume on the system.

MACHINE_BITLOCKER_VOLUME

Database field

Device ID

DEVICE_ID

Persistent Volume ID

A persistent identifier for the volume on the system.

PERSISTENT_VOLUME_ID

Protection status

Denotes whether BitLocker is protecting the volume.

•

•

•

•

Type of encryption used. For example, AES-128. Possible values:

•

_ENCRYPTION_METHOD (self-encrypting drives only)

•

AES-128 with Diffuser

•

AES-256 with Diffuser

•

•

•

•

SELF_ENCRYPTION_DRIVE

ENCRYPTION_METHOD (software-based encryption only)

Hardware Encryption Status

NOTE: The Hardware Encryption Status property is supported on Windows 8 and higher systems.

•

•

•

•

•

HARDWARE_ENCRYPTION_STATUS

•

•

•

Status of the conversion. Possible values:

•

Unknown

•

Fully Decrypted

•

Fully Encrypted

•

Encryption In Progress

•

Decryption In Progress

•

Encryption Paused

•

Decryption Paused

CONVERSION_STATUS

Encryption Percentage

The extent of conversion, shown as a percentage.

ENCRYPTION_PERCENTAGE

Wiping Status

Status of any wiping of free space. Possible values:

•

Unknown

•

Free Space Not Wiped

•

Free Space Wiped

•

Free Space Wiping In Progress

•

Free Space Wiping Paused

WIPING_STATUS

Wiping Percentage

The extent of free space wiping, shown as a percentage.

WIPING_PERCENTAGE

Key Protectors

Key protectors in place. Possible values:

•

Unknown

•

Trusted Platform Module (TPM)

•

•

•

•

•

TPM and PIN and Startup Key

•

Public Key

•

Passphrase

•

TPM Certificate

•

CryptoAPI Next Generation (CNG) Protector

KEY_PROTECTORS

FileVault 2

FileVault 2 is a full disk encryption feature included with Mac OS X.

Table 16. Supported OSs for FileVault 2
Operating system	Versions
Mac OS X	10.8, 10.9, 10.10

Table 17. FileVault 2 information displayed on the Device Detail page
Item	Description	MACHINE_FILEVAULT_VOLUME Database field
Enabled	Indicates if FileVault is enabled.	IS_ENABLED
Personal Recovery Key	Indicates the existence of a Personal Recovery Key.	HAS_PERSONAL_RECOVERY_KEY
Institutional Recovery Key	Indicates the existence of a corporate-provisioned X.509-based asymmetric key pair.	HAS_INSTITUTIONAL_RECOVERY _KEY
Authorized Users	A list of accounts that can unlock the drive in EFI.	AUTHORIZED_USERS
Conversion Status	The status of the encryption process. Examples include Pending Conversion, Converting, Encryption Paused, and Complete.	CONVERSION_STATUS
Conversion Percentage	The extent of conversion, shown as a percentage.	CONVERSION_PERCENTAGE
Encryption Status	Status of the encryption. For example, Locked or Unlocked.	ENCRYPTION_STATUS
Encryption Type	Type of encryption used. For example, AES-XTS.	ENCRYPTION_TYPE
Device	Unique identifier for the volume on the system.	DEVICE_ID
Version		VERSION

Trusted Platform Module (TPM)

TPM is a dedicated microprocessor that secures hardware by integrating cryptographic keys into devices.

Table 18. Supported OSs for TPM
Operating system	Versions
Windows	Vista, 7, 8, 8.1
Windows Server	2008, 2008 R2, 2012, 2012 R2

Table 19. TPM information displayed on the Device Detail page
Item	Description	MACHINE_TPM Database field
Manufacturer	Manufacturer of the TPM chip.	MANUFACTURER_ID_TEXT
Manufacturer Version	Version of the TPM chip.	MANUFACTURER_VERSION
Manufacturer Version Info	Additional version information that is specific to the manufacturer.	MANUFACTURER_VERSION_INFO
Specification Version	The version of the Trusted Computing Group (TCG) specification that the TPM supports.	SPECIFICATION_VERSION
Physical Presence Version	The version of the Physical Presence Interface that the device supports. The Physical Presence Interface is a communication mechanism that runs device operations that require physical presence.	PHYSICAL_PRESENCE_VERSION _INFO
TPM Enabled	Step 1 of TPM initialization.	IS_TPM_ENABLED
TPM Activated	Step 2 of TPM initialization.	IS_TPM_ACTIVATED
TPM Owned	Step 3 of TPM initialization.	IS_TPM_OWNED

Add a Dump Inventory registry key to permit inventory collection on Windows DDP|E client devices

Add the DumpXmlInventory registry key to an Agent-managed Windows device

Add the DumpXmlInventory registry key to an Agentless-managed Windows device

If DumpXmlInventory is absent on a Windows DDP|E client, the appliance cannot get access to the inventory .xml file in order to collect the relevant field information.

Dell Data Protection | Encryption is installed on the Windows device. Go to http://www.dell.com/support/home/us/en/19/product-support/product/dell-data-protection-encryption/drivers.

The procedure for adding the key is different for Agent-managed devices and Agentless-managed devices.

Add the DumpXmlInventory registry key to an Agent-managed Windows device

You must add DumpXmlInventory to a Windows DDP|E client before the appliance can collect field information from that client's inventory.xml file.

For Agent-managed Windows devices, you can use a default offline KScript from the appliance scripting feature to set the "dump inventory" registry key. This key is necessary for the DDP|E agent to write the detailed inventory XML data to the appliance file system.

NOTE: After you set the registry key, the DDP|E service requires a full policy update schedule before the appliance is able to collect inventory.

Go to the Script Detail page for the K1000 Enable Detailed DDPE Inventory (Windows) script.

Log in to the appliance Administrator Console, https://appliance_hostname/admin. Or, if the Show organization menu in admin header option is enabled in the appliance General Settings, select an organization in the drop-down list in the top-right corner of the page next to the login information.

On the left navigation bar, click Scripting, then click Scripts.

From the list, select K1000 Enable Detailed DDPE Inventory (Windows).

In the Configure section, specify script settings:

Option	Description
Name	K1000 Enable Detailed DDPE Inventory (Windows), the name of this default script.
Enabled	Select this check box to run the script on the target devices. Do not enable a script until you are finished testing it and are ready to run it. Enable the script on a test label before you enable it on all devices.
Type	The script type is Offline KScripts.
Status	Indicates the readiness of the script to be rolled out to the network. Set the status to Production.
Description	Contains the brief description of the actions the default script performs.
Notes	Any additional information you want to provide.

In the Deploy section specify deployment options:

Deploy to all devices. Clear the check box to limit the deployment to specific labels or devices.

All Devices

Labels

Limit deployment to devices that belong to specified labels. To select labels, click Edit, drag labels to the Limit Deployment to window, then click Save.

If you select a label that has a Replication Share or an alternate download location, the appliance copies digital assets from that Replication Share or alternate download location instead of downloading them directly from the appliance.

NOTE: The appliance uses a Replication Share before it uses the KACE Alt Location.

Devices

Limit deployment to one or more devices. To find devices, begin typing in the field.

Operating Systems

The operating systems on which the application runs. Applications are deployed only to devices with the selected operating systems.

Click Manage Operating Systems.

In the Operating Systems dialog box that appears, select the OS versions in the navigation tree, as applicable.

You have an option to select OS versions by their family, product, architecture, release ID, or build version. You can choose a specific build version, or a parent node, as needed. Selecting a parent node in the tree automatically selects the associated child nodes. This behavior allows you to select any future OS versions, as devices are added or upgraded in your managed environment. For example, to select all build current and future versions associated with the Windows 10 x64 architecture, under All > Windows > Windows 10, select x64.

In the Schedule section, specify run options:

Run in combination with an event rather than on a specific date or at a specific time.

Every n hours

Run at a specified interval.

Every day/specific day at HH:MM

Run daily at a specified time, or run on a designated day of the week at a specified time.

Run on the nth of every month/specific month at HH:MM

Run on the same day every month, or a specific month, at the specified time.

Run on the nth weekday of every month/specific month at HH:MM

Run on the specific weekday of every month, or a specific month, at the specified time.

Custom

Run according to a custom schedule.

Use standard 5-field cron format (extended cron format is not supported):

Use the following when specifying values:

•

Spaces ( ): Separate each field with a space.

•

Asterisks (*): Include the entire range of values in a field with an asterisk. For example, an asterisk in the hour field indicates every hour.

•

Commas (,): Separate multiple values in a field with a comma. For example, 0,6 in the day of the week field indicates Sunday and Saturday.

•

Hyphens (-): Indicate a range of values in a field with a hyphen. For example, 1-5 in the day of the week field is equivalent to 1,2,3,4,5, which indicates Monday through Friday.

•

Slashes (/): Specify the intervals at which to repeat an action with a slash. For example, */3 in the hour field is equivalent to 0,3,6,9,12,15,18,21. The asterisk (*) specifies every hour, but /3 restricts this to hours divisible by 3.

Examples:

•

15 * * * * Run 15 minutes after every hour every day

•

0 22 * * * Run at 22:00 every day

•

0 0 1 1,6 * Run at 00:00 on January 1 and June 1

•

30 8,12 * * 1-5 Run weekdays at 08:30 and 12:30

•

0 2 */2 * * Run every other day at 02:00

View Task Schedule

Click to view the task schedule. The Task Schedule dialog box displays a list of scheduled tasks. Click a task to review the task details. For more information, see View task schedules.

Skip the Dependencies and Tasks sections.

Do one of the following:

◦

Click Run Now to immediately push the script to all devices.

Use this option with caution. See Using the Run and Run Now commands.

◦

Click Save.

Add the DumpXmlInventory registry key to an Agentless-managed Windows device

You must add DumpXmlInventory to a Windows DDP|E client before the appliance can collect field information from that client's inventory.xml file.

For an Agentless-managed Windows device, the process requires that you create a new Group Policy Object on a Windows Server 2008 or 2012 device so that you can deploy the registry setting to multiple devices in a domain.

On a Windows Server 2008 or 2012 device, open the Group Policy Management Console.

Right-click Group Policy Objects and click New.

Provide a description name for the new GPO (for instance, Dell Data Protection | Encryption: Inventory Registry Setting) and click OK.

Right-click the new GPO and click Edit.

Browse to Computer Configuration > Preferences > Windows Settings > Registry.

Right-click Registry and select New > Registry Item.

On the General tab, select Update in the Action drop-down menu.

Select HKEY_LOCAL_MACHINE in the Hive drop-down list.

Specify a Key Path of SYSTEM\CurrentControlSet\services\DellMgmtAgent\Parameters.

10.

Specify a Value name of DumpXmlInventory.

11.

Select REG_DWORD in the Value type drop-down list.

12.

Specify 1 in the Value data field.

13.

Select the Hexadecimal option in the Base group, and click OK.

14.

Close the Group Policy Management Editor.

You can now link this new group policy object to a specific domain, Organizational Unit, and so on.

IMPORTANT: You should test the GPO on a specific computer or set of computers before deploying it to all systems.

Add the DumpXmlInventory registry key to an Agent-managed Windows device

Add a Dump Inventory registry key to permit inventory collection on Windows DDP|E client devices

Add the DumpXmlInventory registry key to an Agent-managed Windows device

Add the DumpXmlInventory registry key to an Agentless-managed Windows device

If DumpXmlInventory is absent on a Windows DDP|E client, the appliance cannot get access to the inventory .xml file in order to collect the relevant field information.

Dell Data Protection | Encryption is installed on the Windows device. Go to http://www.dell.com/support/home/us/en/19/product-support/product/dell-data-protection-encryption/drivers.

The procedure for adding the key is different for Agent-managed devices and Agentless-managed devices.

Add the DumpXmlInventory registry key to an Agent-managed Windows device

You must add DumpXmlInventory to a Windows DDP|E client before the appliance can collect field information from that client's inventory.xml file.

NOTE: After you set the registry key, the DDP|E service requires a full policy update schedule before the appliance is able to collect inventory.

Go to the Script Detail page for the K1000 Enable Detailed DDPE Inventory (Windows) script.

On the left navigation bar, click Scripting, then click Scripts.

From the list, select K1000 Enable Detailed DDPE Inventory (Windows).

In the Configure section, specify script settings:

Option	Description
Name	K1000 Enable Detailed DDPE Inventory (Windows), the name of this default script.
Enabled	Select this check box to run the script on the target devices. Do not enable a script until you are finished testing it and are ready to run it. Enable the script on a test label before you enable it on all devices.
Type	The script type is Offline KScripts.
Status	Indicates the readiness of the script to be rolled out to the network. Set the status to Production.
Description	Contains the brief description of the actions the default script performs.
Notes	Any additional information you want to provide.

In the Deploy section specify deployment options:

Deploy to all devices. Clear the check box to limit the deployment to specific labels or devices.

All Devices

Labels

Limit deployment to devices that belong to specified labels. To select labels, click Edit, drag labels to the Limit Deployment to window, then click Save.

NOTE: The appliance uses a Replication Share before it uses the KACE Alt Location.

Devices

Limit deployment to one or more devices. To find devices, begin typing in the field.

Operating Systems

The operating systems on which the application runs. Applications are deployed only to devices with the selected operating systems.

Click Manage Operating Systems.

In the Operating Systems dialog box that appears, select the OS versions in the navigation tree, as applicable.

In the Schedule section, specify run options:

Run in combination with an event rather than on a specific date or at a specific time.

Every n hours

Run at a specified interval.

Every day/specific day at HH:MM

Run daily at a specified time, or run on a designated day of the week at a specified time.

Run on the nth of every month/specific month at HH:MM

Run on the same day every month, or a specific month, at the specified time.

Run on the nth weekday of every month/specific month at HH:MM

Run on the specific weekday of every month, or a specific month, at the specified time.

Custom

Run according to a custom schedule.

Use standard 5-field cron format (extended cron format is not supported):

Use the following when specifying values:

•

Spaces ( ): Separate each field with a space.

•

Asterisks (*): Include the entire range of values in a field with an asterisk. For example, an asterisk in the hour field indicates every hour.

•

Commas (,): Separate multiple values in a field with a comma. For example, 0,6 in the day of the week field indicates Sunday and Saturday.

•

Hyphens (-): Indicate a range of values in a field with a hyphen. For example, 1-5 in the day of the week field is equivalent to 1,2,3,4,5, which indicates Monday through Friday.

•

Examples:

•

15 * * * * Run 15 minutes after every hour every day

•

0 22 * * * Run at 22:00 every day

•

0 0 1 1,6 * Run at 00:00 on January 1 and June 1

•

30 8,12 * * 1-5 Run weekdays at 08:30 and 12:30

•

0 2 */2 * * Run every other day at 02:00

View Task Schedule

Click to view the task schedule. The Task Schedule dialog box displays a list of scheduled tasks. Click a task to review the task details. For more information, see View task schedules.

Skip the Dependencies and Tasks sections.

Do one of the following:

◦

Click Run Now to immediately push the script to all devices.

Use this option with caution. See Using the Run and Run Now commands.

◦

Click Save.

Add the DumpXmlInventory registry key to an Agentless-managed Windows device

You must add DumpXmlInventory to a Windows DDP|E client before the appliance can collect field information from that client's inventory.xml file.

On a Windows Server 2008 or 2012 device, open the Group Policy Management Console.

Right-click Group Policy Objects and click New.

Provide a description name for the new GPO (for instance, Dell Data Protection | Encryption: Inventory Registry Setting) and click OK.

Right-click the new GPO and click Edit.

Browse to Computer Configuration > Preferences > Windows Settings > Registry.

Right-click Registry and select New > Registry Item.

On the General tab, select Update in the Action drop-down menu.

Select HKEY_LOCAL_MACHINE in the Hive drop-down list.

Specify a Key Path of SYSTEM\CurrentControlSet\services\DellMgmtAgent\Parameters.

10.

Specify a Value name of DumpXmlInventory.

11.

Select REG_DWORD in the Value type drop-down list.

12.

Specify 1 in the Value data field.

13.

Select the Hexadecimal option in the Base group, and click OK.

14.

Close the Group Policy Management Editor.

You can now link this new group policy object to a specific domain, Organizational Unit, and so on.

IMPORTANT: You should test the GPO on a specific computer or set of computers before deploying it to all systems.

Add the DumpXmlInventory registry key to an Agentless-managed Windows device

Add a Dump Inventory registry key to permit inventory collection on Windows DDP|E client devices

Add the DumpXmlInventory registry key to an Agent-managed Windows device

Add the DumpXmlInventory registry key to an Agentless-managed Windows device

If DumpXmlInventory is absent on a Windows DDP|E client, the appliance cannot get access to the inventory .xml file in order to collect the relevant field information.

Dell Data Protection | Encryption is installed on the Windows device. Go to http://www.dell.com/support/home/us/en/19/product-support/product/dell-data-protection-encryption/drivers.

The procedure for adding the key is different for Agent-managed devices and Agentless-managed devices.

Add the DumpXmlInventory registry key to an Agent-managed Windows device

You must add DumpXmlInventory to a Windows DDP|E client before the appliance can collect field information from that client's inventory.xml file.

NOTE: After you set the registry key, the DDP|E service requires a full policy update schedule before the appliance is able to collect inventory.

Go to the Script Detail page for the K1000 Enable Detailed DDPE Inventory (Windows) script.

On the left navigation bar, click Scripting, then click Scripts.

From the list, select K1000 Enable Detailed DDPE Inventory (Windows).

In the Configure section, specify script settings:

Option	Description
Name	K1000 Enable Detailed DDPE Inventory (Windows), the name of this default script.
Enabled	Select this check box to run the script on the target devices. Do not enable a script until you are finished testing it and are ready to run it. Enable the script on a test label before you enable it on all devices.
Type	The script type is Offline KScripts.
Status	Indicates the readiness of the script to be rolled out to the network. Set the status to Production.
Description	Contains the brief description of the actions the default script performs.
Notes	Any additional information you want to provide.

In the Deploy section specify deployment options:

Deploy to all devices. Clear the check box to limit the deployment to specific labels or devices.

All Devices

Labels

Limit deployment to devices that belong to specified labels. To select labels, click Edit, drag labels to the Limit Deployment to window, then click Save.

NOTE: The appliance uses a Replication Share before it uses the KACE Alt Location.

Devices

Limit deployment to one or more devices. To find devices, begin typing in the field.

Operating Systems

The operating systems on which the application runs. Applications are deployed only to devices with the selected operating systems.

Click Manage Operating Systems.

In the Operating Systems dialog box that appears, select the OS versions in the navigation tree, as applicable.

In the Schedule section, specify run options: