Installing Tivoli Endpoint Manager (BigFix) Console 8.2.1093

My latest installation of the TEM v8.2.1093 server comes with it the installation of the Console.  This new console is extremely cool and has features like LDAP authentication, HTTP communications channel, and more.  Here is the basic step-by-step installation procedure to get the client installed on your workstation.

image_thumb[44]_thumb

image_thumb[45]_thumb

image_thumb[46]_thumb

image_thumb[47]_thumb

image_thumb[48]_thumb

 

If you have any questions, let me know!

Installing Tivoli Endpoint Manager (BigFix) v8.2.1093

imageInstalling this newest version of TEM is relative straight forward and easy to do.  Drawing from my previous articles, a SQL server Installation (and SP1), and the Installing of Pre-requisites, I give you the full installation of v8.2.1093.  I also have downloaded the latest v8.2.1093 version from the TEM website.

I have already attached my new virtual server to my internal Windows Domain so authentication is easily accomplished within my existing network.

image

image

image

I’m going to remove WebReports from this particular installation, favoring to install it onto a different server for simplicity.

image

image

I will be using a remote database to a different installed instance of SQL server as noted at the top of this article.

image

image

image

image

image

image

image

image

image

I plan on integrating this newest version of TEM with my Domain.  Thus a generic admin account is exactly what I need here.

image

image

image

Everything looking good according to the TEM Server Diagnostics tool.  The only error it showed was the resolution of the DNS name used for my new infrastructure.  Now I’ll add a quick little entry in my DNS server for this domain name.

image

There we go… that’s better…

image

 

If you have any questions, please them below…

Activating a BigFix Task

The Tivoli Endpoint Manager is a fantastic way of controlling your infrastructure from one central location.  One of the most basic skills is activating a task and direct it to do something on an endpoint.  Here is a step-by-step for activating a task to perform an action on an endpoint.

First find the task you wish to activate, in my example I will be installing a service onto one of my root servers.  Select the task to be activated and click the Take Action button…

SNAGHTML1e2b905b

image

Here is our targeting screen… Since I’ll only be installing this service onto one endpoint, I’ll simply select it out of the right side computer list.  I could just as easily choose the second radio button called “All computers with the property…” which allows me to target based on endpoint properties, or even “The computers specified in the list…” which allows me to type endpoint hostnames in one line per endpoint.  Note that the third option should be limited to <100 endpoints.  If you need to target more than that you should utilize the computer groups feature.

SNAGHTML1e2e5281

I’m very happy with the defaults on this particular task, however the Execution tab will allow me to start a task at a particular time, have it run between certain hours and even control the failure/retry activities of this task.  Try not to restrict these options to much… for example, you wouldn’t want to limit the run between to 10min since the larger your infrastructure the more difficult or impossible that will be to happen.

SNAGHTML1e308c84

In some cases your action will interact with end users and you may need to prevent the action from running if no user is logged in.  The following Users tab allows you to constrain the task to only run with certain users…

SNAGHTML1e33c060

Other cases you’ll want to present messaging to the end user or even allow the user to control the processing of this particular action.  Maybe you’ll allow the user to determine when the most convenient time for them to have a particular action occur.  This screen is used for that purpose…

SNAGHTML1e34db5f

Here we have the screen to Offer the user this optional action…

SNAGHTML1e35d759

What if your action requires a restart, and you want to allow the end user delay the restart till it’s convenient for them.

SNAGHTML1e35fb3e

Rarely will you need to change the Applicability tab.   Occasionally I find it necessary to alter the default behavior of an action on a one time basis.  This tab allows me to force the installation of something ignoring the default applicability relevance of the original task.

SNAGHTML1e37de6b

If I’ve modified the applicability relevance, I’ll need to modify the success relevance as well…

SNAGHTML1e385a1f

Lastly we have the ability to modify the default Action Script of this task.
SNAGHTML1e38dc78

Once you’re all done modifying the action… click the OK button at the bottom and you’ll be asked for your credentials.  (FYI:  This is no longer the case in v8.2 unless you upgraded from a previous version or you enabled this validation step)

SNAGHTML1e39ef0e

Our task is now activated and the action status window appears.  Here we can monitor the progression of our action to each of the endpoints… on the Computers tab we can see status details on individual computers.

image

 

If you have any questions or comments, please leave them below!

Tivoli Endpoint Manager (BigFix) Creating Custom Sites

Custom sites are an extremely nice way to collect related content together into one easily manageable group.  I am an avid believer in Agile software development and believe that BigFix is perfectly setup to support this methodology.

The use of custom sites is great way to organize content (IE: Tasks, Fixlets and Analyses) together and also allow for sub-categorizing using Domains… don’t forget to learn how to fill in the extra properties related to custom content.  They also allow for multiple non-master operators to work with content generated by other users including editing and stopping actions.

Creating a custom site is easy… here’s a simple step-by-step to do so:

SNAGHTML1e09615e

SNAGHTML1e0a6352

You’ll need to enter a short-name for your project.  In many cases I’ll just name it the vendor of the software… for example, I have published multiple free software under the name Moran IT, therefore it’s logical that my custom site be called “Moran IT”.  This could also be the name of your project… in one project I developed content related to the management of BigFix.  I called my project and my custom site “Core Infrastructure” since it directly relates.

SNAGHTML1e0ae923

I now have my custom site.. but I’ll need to add further detail like the description and put it into the correct Domain.  (FYI: For simplification, try not to put anything into the “All Content” domain.  You will benefit long-term if you avoid this domain.)

image

You’ll need to specify which endpoints are part of this project.  In some cases this might be all Windows computers, in others it might be all Windows computers with a certain software already installed.  You have very granular control over which endpoints are subscribed.  You can even use a complex relevance statement to subscribe only the computers related to the project.  I would encourage you to get very specific here since it will make it easier to not affect systems not part of your project.

SNAGHTML1e112c4b   image

The next most important part is specifying the operators that are allowed to view and manipulate your content as well as actions.  If you have a 5-person team of developers, with only one on-call at any one time… you’ll want to give all 5 appropriate permissions to this custom site.  If you get that 2am page, they can stop actions or activate troubleshooting tasks without engaging team mates in the middle of the night.

image

 

I hope you’ve come to realize the true value of sites in the organization of projects and developers… if you have any questions or comments please leave them below!

Tivoli Endpoint Manager (BigFix) Understanding Domains

It is important to properly organize and categorize custom content within your BigFix infrastructure.  Below is a very simple outline of the Domain feature built into BigFix called Domains.  They are used as organizing buckets for custom content that goes beyond content collecting ability of Sites.

The first thing to ask yourself in any custom content creation project is under what “domain” this task, fixlet or analysis falls under?

imageAll Content, I would consider this domain a cop-out.  Basically it is the bucket you put things that do not properly fit into any of the other buckets.  Choose this bucket only after examining and considering any of the others with great detail.

image

BigFix Management is a vital domain since it relates to the health, maintenance, and management of the BigFix infrastructure itself.  If you are creating any content (tasks, fixlets, analyses) which relate to the health of the infrastructure… put it in this bucket.

image

Endpoint Protection relates to the Antivirus, malware, and adware protection of endpoints.  Put anything related to those products in here.  If your intention is to protect the system from outside threats by using integrated or 3rd party apps, put it in here.

image

Patch Management involves the updating of any software.  Typically it involves Operating System patches but doesn’t stop there.  If you have a software update that must be distributed and has a priority… call it a fixlet and put it under this Domain.

image

Security Configuration is the place where all system changes go if they affect the security of an endpoint or environment.  If there are settings that can be changed to make a system, software, or network more secure it falls under this Domain.

image

Systems Lifecycle is a Domain that holds a lot of content related to the use of an endpoint.  Software Distribution, configuration changes, Power Management, RDP configurations, etc… all fall under the Systems Lifecycle domain.

image

BigFix Labs is a new Domain that allows us to distribute the toys.  Here you’ll find simple add-ons, prototypes, and other pretty cool and useful extensions of the BigFix platform and applications.  This is of course a use at your own risk bucket which is provided “as is” with no corp support.

 

Hopefully with this article you’ll have learned another way to organize your custom content and make your BigFix infrastructure easier to manage.

If you have any questions or comments, please leave it below!

Migrating BigFix v8.1 Root Server

In a previous article I described how to install the pre-requisites for BigFix v8.1.  In this article I’ll demonstrate the process for installing the root server and attaching it to a previously existing database.  I’ll be following the How to guide created by BigFix corp (KB133) to migrate my old BigFix physical computer to a freshly installed BigFix virtual computer.

I encountered some major problems with this process… so follow along but remember this is not a perfect migration.

image

image

image

image

image

image

 

I will be using this virtual as a root server only.  My web-reports service will be setup virtual to keep the installations and the processes of upgrading as simple as possible.  So… I unchecked the Web Reports option during the features selection part.

image

image

image

My SQL server is a separate system, so I had to specify the “Remote Database” option and on the next window give the details of connecting to the DB.

image

While specifying the SQL server, it needed to utilize the Computer Browser service.  This service was stopped and/or disabled on my virtual by default.

image

The service was disabled, so I will need to manually enable it so the installer can start it up for use.

image

image

image

image

image

Now, back to the installation…

hitting ok to the error, I hit Next again and answered Yes and all went well… we’re back on track…

image

image

image

image

image

image

image

image

image

image

image

I am utilizing a database that was moved from a previous instance of this license.  Thus many of my logins were already added to the database.  So there is no need to modify this…

image

image

Looks like during the startup process I ran into a little problem.  My FillDB service would not start.

image

Just finish up the install and cancel out of the diagnostics part, we’ll come back to it later.  (since filldb failed to start, expect to see lots of errors)

image


A quick look back at the Services MSC showed the Root Server also failed to start, however the Gather Service and GatherDB started just fine.  This points me to the either database connectivity or a permissions as the cause of their startup failures. 

First I’ll launch the 32bit version of ODBC to confirm connectivity with the database.  C:\Windows\SysWow64\odbcad32.exe

image  image

I don’t need to change anything, just want to test connectivity.  This function is on the last form and the “Finish” button is a shortcut there…

image

image

This shows that my DB connectivity is working through the firewalls that are configured… so I’ll ignore them.

image


Let’s look into permissions.  One of the most important permissions your service account requires is admin permissions to the server you’re running the root server on.  This will allow it access to the Program Files and other special directories.  Let’s start there… and test.

image

image

I don’t see my BigFix service user account listed, so we’ll have to add it.

image

image

image

There it is… now let’s try to start up our failed services… FillDB and Root Server

image


image

image

IT WORKED!!!  Excellent, next I started the Root Server which also worked.  Let’s turn our attention to validation of our installation.

image

image

image

So far so good… let’s take a quick look at our log files to confirm everything is functioning properly…

Two files I’ll be interested in is the BESRelay.log and the FillDBData\FillDB.log  these reside under the Root Servers path… “C:\Program Files (x86)\BigFix Enterprise\BES Server”.

Due to this being a pre-existing database these errors were expected…

image

I’ll first stop all of the services so I can complete step 9 on the How to guide (KB133).

image

Step 9 says to copy the following folders from the old server to the new server:

BigFix Enterprise\BES Server\wwwrootbes
BigFix Enterprise\BES Server\ClientRegisterData
BigFix Enterprise\BES Server\Mirror Server\Inbox

Using a little Robocopy magic… I’m done with this step in.. 2 hours!

Started the services back up and no go… grrrr what was up?

After a lot more research I came across KB215 which discussed the details of “Using NT Authentication with Domain Users or User Groups”.  On step 2 was my answer… my domain service account did not have SA authority in the database.

image

Added the required permission and restarted my services… and I’m done!

Let’s do a little bit more validation…


Validation Part 1

Back to the logs mentioned above… no errors… this is a good sign!



Validation Part 2

Visit http://localhost:52311/rd  for some simple server diagnostics like filldb status, actionsite status as well as downloads status…

image



Validation Part 3

Launch the BES Console, ensure you can connect into the DB and see computers checking in properly…

image


What I’ve learned from this process is pretty simple… you only need a few items in order to completely re-create your infrastructure if something bad happens.

1. (3) folders…
    a. BigFix Enterprise\BES Server\wwwrootbes
    b. BigFix Enterprise\BES Server\ClientRegisterData
    c. BigFix Enterprise\BES Server\Mirror Server\Inbox

2. Database

3. Masthead & auth keys (license.pvk and user keys)

4. Installer which is available at the BigFix website.

 

If you have any questions or comments, please leave them below!