Posted by

DanielHeth

Posted on

May 4, 2012

Posted under

BigFix, Technology

Comments

NEW Tivoli Endpoint Manager OS Deployment 2.2

IBM just announced the release of our new Tivoli Endpoint Manager for OS Deployment version 2.2!

This release has two new features:

Driver Management – A new dashboard was added that will allow you to upload and manage drivers that would be used during an OS reimaging.
Bootable Media Creation Tool – will allow you to create self contained bootable media for imaging offline for bare metal needs.

A New Driver Library Dashboard:
New Analyses:
New Fixlets… Deploy MDT Media Creator and Update Server Whitelist for Driver Management:

Look for version 13… to get these latest updates:

If you’re looking for more information… visit us over on the IBM forums:

https://www.ibm.com/developerworks/forums/thread.jspa?threadID=427062

Posted by

DanielHeth

Posted on

March 19, 2012

Posted under

BigFix, PowerShell, Programming, Technology

Comments

3 Comments

PowerShell for TEM

I have just published a beautiful new project via CodePlex.

If you manage a TEM/BigFix infrastructure and like using PowerShell for managing your network, you’ll be interested in this one.

Visit http://pstem.codeplex.com

Posted by

DanielHeth

Posted on

January 20, 2012

Posted under

BigFix, Configuration, Technology

Comments

1 Comment

Adding LDAP Authentication to the TEM (BigFix) Console

The latest version (8.2.x) of Tivoli Endpoint Manager comes with it the ability to authenticate console users with your LDAP directory. Here is a simplified step-by-step guide for setting that up.

Open your console and use one of your Master Operator accounts. Find the LDAP Directories branch in the left side tree and right click it. Choose to Add LDAP Directory from that list…

Enter any “Name” you’d like and specify your LDAP authentication server as well as if it is a global catalog server. In my tiny network, I only have the one DC.

Click the Test button to validate the connectivity…

My network is very tiny, however I would encourage you if alternate DC servers are available to specify them in the Backup Server X spaces provided.

Adding the link to the DC is one step… next you’ll probably want to create a special AD group which Console users will belong. Remember that within TEM, we have Console Operators and Master Operators. Each user/group has a specified set of computers they are responsible for and this can be extended into AD. Simply create a AD user group for how your organization is divided and based on their required level of console access.

In my case I created two AD groups: BigFix_Admin and BigFix_Console. Then added my user account to the Admin group.

Our next/last step is to specify the level of access each of these new AD groups have within the TEM infrastructure.

You can name this new Role anything you’d like, however I like to match the AD group name up with this Role name to make it easy to understand.

My Admin group has near unlimited privileges… thus I’ll chose yes to the following options: Master Operator, Custom Content, and Show Other Operators’ Actions.

Next we’ll need to assign the computers that this group will have control over… in my case I’ll be specifying “all computers”

Using this dialog I can specify individual computers as well as systems based on Retrieved Properties or Group Membership.

I will not be adding TEM users to this group as it was setup specifically for my LDAP Admin group… so I’ll skip the “Operators” tab.

Instead I’ll be focusing on the LDAP Groups tab… and Assigning LDAP Group to this TEM Group I’m currently defining…

Search for the group to be added to this TEM group, and Assign it.

Lastly I’ll glaze over the Sites tab since I currently only have 1 site in this new infrastructure, however I can specify specific site permissions just like I can for TEM users.

Don’t forget when you are done to Save Changes…

Since this is a fresh installation, the setting which requires entering your authentication password to authorize this new action has been disabled by default. In a different article I will explain this very cool security feature, how it works and how to force the password requirement just like in previous versions. For now, let’s log in with my Domain credentials to test things out!

Let’s re-launch the console but this time using my Domain credentials…

Be sure to include your Domain within the User name field… In my case it’s “MoranIT\Daniel”

Success!! The authentication was accepted and I’m logging into the console!

Something very important to notice here is that my operator site and account was automatically generated upon login. This means that if too many new users login it could cause network traffic on your network since a subscription action is deployed to the authorized computers list.

Enjoy your new LDAP authenticated user access… let me know if you have any questions or comments in the section below. I respond to all my comments, so please engage…

Posted by

DanielHeth

Posted on

January 20, 2012

Posted under

BigFix, Installation, Technology

Comments

Installing Tivoli Endpoint Manager (BigFix) Console 8.2.1093

My latest installation of the TEM v8.2.1093 server comes with it the installation of the Console. This new console is extremely cool and has features like LDAP authentication, HTTP communications channel, and more. Here is the basic step-by-step installation procedure to get the client installed on your workstation.

If you have any questions, let me know!

Posted by

DanielHeth

Posted on

January 19, 2012

Posted under

BigFix, Installation, Technology

Comments

Installing Tivoli Endpoint Manager (BigFix) Client v8.2.1093

The installation procedures between the various versions of the Client are extremely similar. So the following screenshots will look a lot like the previous version I documented.

If you have any questions, let me know!

Posted by

DanielHeth

Posted on

January 19, 2012

Posted under

BigFix, Installation, Technology

Comments

1 Comment

Installing Tivoli Endpoint Manager (BigFix) v8.2.1093

Installing this newest version of TEM is relative straight forward and easy to do. Drawing from my previous articles, a SQL server Installation (and SP1), and the Installing of Pre-requisites, I give you the full installation of v8.2.1093. I also have downloaded the latest v8.2.1093 version from the TEM website.

I have already attached my new virtual server to my internal Windows Domain so authentication is easily accomplished within my existing network.

I’m going to remove WebReports from this particular installation, favoring to install it onto a different server for simplicity.

I will be using a remote database to a different installed instance of SQL server as noted at the top of this article.

I plan on integrating this newest version of TEM with my Domain. Thus a generic admin account is exactly what I need here.

Everything looking good according to the TEM Server Diagnostics tool. The only error it showed was the resolution of the DNS name used for my new infrastructure. Now I’ll add a quick little entry in my DNS server for this domain name.

There we go… that’s better…

If you have any questions, please them below…

Posted by

DanielHeth

Posted on

December 12, 2011

Posted under

BigFix, Fixlets, Tasks, Technology

Comments

8 Comments

Activating a BigFix Task

The Tivoli Endpoint Manager is a fantastic way of controlling your infrastructure from one central location. One of the most basic skills is activating a task and direct it to do something on an endpoint. Here is a step-by-step for activating a task to perform an action on an endpoint.

First find the task you wish to activate, in my example I will be installing a service onto one of my root servers. Select the task to be activated and click the Take Action button…

Here is our targeting screen… Since I’ll only be installing this service onto one endpoint, I’ll simply select it out of the right side computer list. I could just as easily choose the second radio button called “All computers with the property…” which allows me to target based on endpoint properties, or even “The computers specified in the list…” which allows me to type endpoint hostnames in one line per endpoint. Note that the third option should be limited to <100 endpoints. If you need to target more than that you should utilize the computer groups feature.

I’m very happy with the defaults on this particular task, however the Execution tab will allow me to start a task at a particular time, have it run between certain hours and even control the failure/retry activities of this task. Try not to restrict these options to much… for example, you wouldn’t want to limit the run between to 10min since the larger your infrastructure the more difficult or impossible that will be to happen.

In some cases your action will interact with end users and you may need to prevent the action from running if no user is logged in. The following Users tab allows you to constrain the task to only run with certain users…

Other cases you’ll want to present messaging to the end user or even allow the user to control the processing of this particular action. Maybe you’ll allow the user to determine when the most convenient time for them to have a particular action occur. This screen is used for that purpose…

Here we have the screen to Offer the user this optional action…

What if your action requires a restart, and you want to allow the end user delay the restart till it’s convenient for them.

Rarely will you need to change the Applicability tab. Occasionally I find it necessary to alter the default behavior of an action on a one time basis. This tab allows me to force the installation of something ignoring the default applicability relevance of the original task.

If I’ve modified the applicability relevance, I’ll need to modify the success relevance as well…

Lastly we have the ability to modify the default Action Script of this task.

Once you’re all done modifying the action… click the OK button at the bottom and you’ll be asked for your credentials. (FYI: This is no longer the case in v8.2 unless you upgraded from a previous version or you enabled this validation step)

Our task is now activated and the action status window appears. Here we can monitor the progression of our action to each of the endpoints… on the Computers tab we can see status details on individual computers.

If you have any questions or comments, please leave them below!

Posted by

DanielHeth

Posted on

December 9, 2011

Posted under

BigFix, Technology

Comments

1 Comment

Tivoli Endpoint Manager (BigFix) Creating Custom Sites

Custom sites are an extremely nice way to collect related content together into one easily manageable group. I am an avid believer in Agile software development and believe that BigFix is perfectly setup to support this methodology.

The use of custom sites is great way to organize content (IE: Tasks, Fixlets and Analyses) together and also allow for sub-categorizing using Domains… don’t forget to learn how to fill in the extra properties related to custom content. They also allow for multiple non-master operators to work with content generated by other users including editing and stopping actions.

Creating a custom site is easy… here’s a simple step-by-step to do so:

You’ll need to enter a short-name for your project. In many cases I’ll just name it the vendor of the software… for example, I have published multiple free software under the name Moran IT, therefore it’s logical that my custom site be called “Moran IT”. This could also be the name of your project… in one project I developed content related to the management of BigFix. I called my project and my custom site “Core Infrastructure” since it directly relates.

I now have my custom site.. but I’ll need to add further detail like the description and put it into the correct Domain. (FYI: For simplification, try not to put anything into the “All Content” domain. You will benefit long-term if you avoid this domain.)

You’ll need to specify which endpoints are part of this project. In some cases this might be all Windows computers, in others it might be all Windows computers with a certain software already installed. You have very granular control over which endpoints are subscribed. You can even use a complex relevance statement to subscribe only the computers related to the project. I would encourage you to get very specific here since it will make it easier to not affect systems not part of your project.

The next most important part is specifying the operators that are allowed to view and manipulate your content as well as actions. If you have a 5-person team of developers, with only one on-call at any one time… you’ll want to give all 5 appropriate permissions to this custom site. If you get that 2am page, they can stop actions or activate troubleshooting tasks without engaging team mates in the middle of the night.

I hope you’ve come to realize the true value of sites in the organization of projects and developers… if you have any questions or comments please leave them below!

Posted by

DanielHeth

Posted on

December 8, 2011

Posted under

BigFix, Technology

Comments

3 Comments

Tivoli Endpoint Manager (BigFix) Understanding Domains

It is important to properly organize and categorize custom content within your BigFix infrastructure. Below is a very simple outline of the Domain feature built into BigFix called Domains. They are used as organizing buckets for custom content that goes beyond content collecting ability of Sites.

The first thing to ask yourself in any custom content creation project is under what “domain” this task, fixlet or analysis falls under?

All Content, I would consider this domain a cop-out. Basically it is the bucket you put things that do not properly fit into any of the other buckets. Choose this bucket only after examining and considering any of the others with great detail.

BigFix Management is a vital domain since it relates to the health, maintenance, and management of the BigFix infrastructure itself. If you are creating any content (tasks, fixlets, analyses) which relate to the health of the infrastructure… put it in this bucket.

Endpoint Protection relates to the Antivirus, malware, and adware protection of endpoints. Put anything related to those products in here. If your intention is to protect the system from outside threats by using integrated or 3rd party apps, put it in here.

Patch Management involves the updating of any software. Typically it involves Operating System patches but doesn’t stop there. If you have a software update that must be distributed and has a priority… call it a fixlet and put it under this Domain.

Security Configuration is the place where all system changes go if they affect the security of an endpoint or environment. If there are settings that can be changed to make a system, software, or network more secure it falls under this Domain.

Systems Lifecycle is a Domain that holds a lot of content related to the use of an endpoint. Software Distribution, configuration changes, Power Management, RDP configurations, etc… all fall under the Systems Lifecycle domain.

BigFix Labs is a new Domain that allows us to distribute the toys. Here you’ll find simple add-ons, prototypes, and other pretty cool and useful extensions of the BigFix platform and applications. This is of course a use at your own risk bucket which is provided “as is” with no corp support.

Hopefully with this article you’ll have learned another way to organize your custom content and make your BigFix infrastructure easier to manage.

If you have any questions or comments, please leave it below!

Posted by

DanielHeth

Posted on

December 5, 2011

Posted under

BigFix, Installation, Technology

Comments

1 Comment

Migrating BigFix v8.1 Root Server

In a previous article I described how to install the pre-requisites for BigFix v8.1. In this article I’ll demonstrate the process for installing the root server and attaching it to a previously existing database. I’ll be following the How to guide created by BigFix corp (KB133) to migrate my old BigFix physical computer to a freshly installed BigFix virtual computer.

I encountered some major problems with this process… so follow along but remember this is not a perfect migration.

I will be using this virtual as a root server only. My web-reports service will be setup virtual to keep the installations and the processes of upgrading as simple as possible. So… I unchecked the Web Reports option during the features selection part.

My SQL server is a separate system, so I had to specify the “Remote Database” option and on the next window give the details of connecting to the DB.

While specifying the SQL server, it needed to utilize the Computer Browser service. This service was stopped and/or disabled on my virtual by default.

The service was disabled, so I will need to manually enable it so the installer can start it up for use.

Now, back to the installation…

hitting ok to the error, I hit Next again and answered Yes and all went well… we’re back on track…

I am utilizing a database that was moved from a previous instance of this license. Thus many of my logins were already added to the database. So there is no need to modify this…

Looks like during the startup process I ran into a little problem. My FillDB service would not start.

Just finish up the install and cancel out of the diagnostics part, we’ll come back to it later. (since filldb failed to start, expect to see lots of errors)

A quick look back at the Services MSC showed the Root Server also failed to start, however the Gather Service and GatherDB started just fine. This points me to the either database connectivity or a permissions as the cause of their startup failures.

First I’ll launch the 32bit version of ODBC to confirm connectivity with the database. C:\Windows\SysWow64\odbcad32.exe

I don’t need to change anything, just want to test connectivity. This function is on the last form and the “Finish” button is a shortcut there…

This shows that my DB connectivity is working through the firewalls that are configured… so I’ll ignore them.

Let’s look into permissions. One of the most important permissions your service account requires is admin permissions to the server you’re running the root server on. This will allow it access to the Program Files and other special directories. Let’s start there… and test.

I don’t see my BigFix service user account listed, so we’ll have to add it.

There it is… now let’s try to start up our failed services… FillDB and Root Server

IT WORKED!!! Excellent, next I started the Root Server which also worked. Let’s turn our attention to validation of our installation.

So far so good… let’s take a quick look at our log files to confirm everything is functioning properly…

Two files I’ll be interested in is the BESRelay.log and the FillDBData\FillDB.log these reside under the Root Servers path… “C:\Program Files (x86)\BigFix Enterprise\BES Server”.

Due to this being a pre-existing database these errors were expected…

I’ll first stop all of the services so I can complete step 9 on the How to guide (KB133).

Step 9 says to copy the following folders from the old server to the new server:

BigFix Enterprise\BES Server\wwwrootbes
BigFix Enterprise\BES Server\ClientRegisterData
BigFix Enterprise\BES Server\Mirror Server\Inbox

Using a little Robocopy magic… I’m done with this step in.. 2 hours!

Started the services back up and no go… grrrr what was up?

After a lot more research I came across KB215 which discussed the details of “Using NT Authentication with Domain Users or User Groups”. On step 2 was my answer… my domain service account did not have SA authority in the database.

Added the required permission and restarted my services… and I’m done!

Let’s do a little bit more validation…

Validation Part 1

Back to the logs mentioned above… no errors… this is a good sign!

Validation Part 2

Visit http://localhost:52311/rd for some simple server diagnostics like filldb status, actionsite status as well as downloads status…

Validation Part 3

Launch the BES Console, ensure you can connect into the DB and see computers checking in properly…

What I’ve learned from this process is pretty simple… you only need a few items in order to completely re-create your infrastructure if something bad happens.

1. (3) folders…
    a. BigFix Enterprise\BES Server\wwwrootbes
    b. BigFix Enterprise\BES Server\ClientRegisterData
    c. BigFix Enterprise\BES Server\Mirror Server\Inbox

2. Database

3. Masthead & auth keys (license.pvk and user keys)

4. Installer which is available at the BigFix website.

If you have any questions or comments, please leave them below!

danielheth

Tag Archives: Tivoli Endpoint Manager

NEW Tivoli Endpoint Manager OS Deployment 2.2

PowerShell for TEM

Adding LDAP Authentication to the TEM (BigFix) Console

Installing Tivoli Endpoint Manager (BigFix) Console 8.2.1093

Installing Tivoli Endpoint Manager (BigFix) Client v8.2.1093

Installing Tivoli Endpoint Manager (BigFix) v8.2.1093

Activating a BigFix Task

Tivoli Endpoint Manager (BigFix) Creating Custom Sites

Tivoli Endpoint Manager (BigFix) Understanding Domains

Migrating BigFix v8.1 Root Server