WIXLIB

5 Select the check box next to ZENworks 2020 Update1, then click Action Deploy Update to Devices tolaunch the deployment wizard.11 When the update has successfully completed, log in toZENworks Control Center.12 Go to the System Update page (Configuration System Updates).In the Deploying System Updates panel, notice thatthe update is still listed as Pending.6 Select the Deploy System Updates to All Devices inthe Management Zone option, then click Next.Normally, you would want to deploy to selecteddevices rather than all, but since your zone only hasthe one Primary Server at this point you can use thisoption to avoid having to select your Primary Server aspart of the wizard process.7 Leave the Prompt user for reboot when updatefinishes applying option selected, then click Next.8 In the Schedule Type list, select Now, then click Next.9 Click Finish to start the update and display thefollowing dialog box.Although the ZENworks Server software was updated,there are still some update tasks, such as rebuildingthe deployment packages used when distributing theZENworks Agent to devices, that need to becompleted.When all update tasks are complete, the update statusis changed to Successful.13 (Optional) To apply the PRU at this time:13a Select the check box next to the PRU, then selectAction Authorize Update.13b Select the check box next to the PRU, then selectAction Deploy PRU Now.Connect to a User SourceZENworks ties into your LDAP user directory in order toprovide user-based management of devices.During update, the ZENworks Server is not accessiblethrough ZENworks Control Center. Therefore, youneed to use the System Update console to monitorsystem update progress.10 Click the link to open the System Update console thenclick OK to start the update.If the link cannot be clicked, copy the displayed URL toyour web browser and replace SERVER NAME withthe IP address or DNS name of your ZENworksPrimary Server. For example:With mobile devices, a user source is required becausedevice authentication and enrollment are both associatedwith the device’s user, not the device.With workstations and laptops, a user source is notrequired; however, connecting to a user source providesdevice management based on both the device and thelogged-in user. Selecting an Evaluation User (page 5) Connecting to an LDAP Directory (page 6)S ELECTING AN E VALUATION U ate/sustatusThe System Update console is displayed, showing thecurrent status of the update.You need an LDAP user account that you can use for theevaluation. To enroll mobile devices with the user, you’llneed to know the account credentials (username and5

password). You can use an existing account, or you cancreate an account. Throughout this evaluation, we useZENUser.C ONNECTING TO AN LDAP D IRECTORY1 Log in to ZENworks Control Center:1a In a web browser, enter the following URL:https://ZENworks Server Address:portReplace ZENworks Server Address with the IPaddress or DNS name of the ZENworks PrimaryServer. You only need to specify the port if youare not using one of the default ports (80 or 443).1b Specify Administrator as the username, specifythe password you defined during installation, thenclick Login to display the Welcome page.4 On the Connection Information page, define thefollowing connection information, then click Next: Connection Name: Specify a descriptive namefor the connection to the LDAP directory. Address: Specify the IP address or DNShostname of the LDAP directory server. Use SSL: Disable the option if the LDAP server isnot using the Secure Socket Layer protocol. Port: If your LDAP server is listening on a nondefault port (636 or 389), select that port number. Root LDAP Context: The root contextestablishes the ZENworks entry point into thedirectory. If you don’t specify a root context, thedirectory’s root container is used. Ignore Dynamic Groups in eDirectory: Leavethis option unchecked.5 (Conditional) On the Certificate page (which isdisplayed only if the connection is using SSL), verifythe certificate information, then click Next.6 On the Credentials page, specify a Read-onlyusername and password that ZENworks can use toaccess the directory, then click Next.2 Click Configuration (in the left navigation pane).7 On the Authentication Mechanisms page, selectUsername/Password, then click Next.8 On the User Containers page, add the container whereyour evaluation user resides, then click Next.9 Complete the wizard.Enable Communication with Mobile DevicesYou need to complete several system configuration tasks toenable ZENworks to communicate with mobile devices.This includes defining your ZENworks Primary Server asthe Mobile Device Management (MDM) Server that youwant communicating with mobile devices, and thenconfiguring ZENworks to communicate with the devices viathe Apple and Google push notification services.3 In the User Sources panel, click New to launch theCreate New User Source wizard. Designating an MDM Server (page 7) Enabling Push Notifications for iOS Devices (page 7) Enabling Push Notifications for Android Devices(page 8)6

D ESIGNATING AN MDM S ERVERA ZENworks Management Zone must have at least oneZENworks Primary Server that is designated as a MobileDevice Management (MDM) Server. MDM Servers are theonly servers in your zone that communicate with mobiledevices.For this evaluation, you only have one ZENworks PrimaryServer, so you need to designate it as your MDM Server:Apple Push Notification service certificates are issued byApple. The following steps help you create the CertificateSigning Request (CSR), submit the request to Apple, andimport the Apple-issued APNs certificate into yourZENworks zone.1 In ZENworks Control Center, click Configuration (inthe left navigation pane).1 In ZENworks Control Center, click Configuration (inthe left navigation pane).2 In the Management Zone Settings panel, click PushNotification, then click Apple Push NotificationService to display the Apple Push Notification servicesettings.2 In the Management Zone Settings panel, clickInfrastructure Management, then click MDM Serversto display the MDM Servers page.3 Create a Certificate Signing Request:3 In the MDM Servers list, click Add, select yourZENworks Primary Server, then click OK to add it tothe list.4 Click OK to save the MDM Servers list.E NABLING P USH N OTIFICATIONS FOR I OS D EVICESApple Push Notification service (APNs) enables theZENworks MDM Server to notify an iOS device when theserver requires information from the device or has changesfor the device. The ZENworks Primary Servercommunicates with the Apple Push Notification service,which then pushes the notification to the device. Afterreceiving the push notification, the device contacts theMDM Server directly to provide the requested informationor receive the changes.In order to use the Apple Push Notification service, anApple Push Notification service certificate is required. TheAPNs certificate allows the ZENworks MDM Server andiOS devices to authenticate securely to the service.3a Click Create a Certificate Request.3b Fill in the certificate details needed in the request:Organization Apple ID: Specify a valid Apple IDin email format (for example,apns@microfocus.com).Best practice dictates that this should be an AppleID created specifically for managing yourcorporate Apple Push Notification servicecertificate and not an Apple ID used for a personalaccount.Organization Unit: Specify the name of theorganizational unit (division, department, or soforth) to which you belong. For example, IT, ISDepartment, Technical Services Group, orBusiness Services.Organization Name: Specify the name of yourorganization. For example, Micro Focus.City or Locality/State/Country: Specify thelocation information for your organization.7

Key Length: Specify the key length that satisfiesyour corporate policy.3c For the Micro Focus (Novell) Customer Centercredentials, use ZENeval as the username andzeneval! as the password).The Certificate Signing Request must be signedby an approved Mobile Device Management(MDM) vendor, in this case Micro Focus. TheMicro Focus Customer Center credentials enableMicro Focus to sign the request.3d Click Submit for Signing.3e After the Certificate Signing Request file is signedby Micro Focus, save the signed CSR file to alocation of your choice.If desired, you can change the default filename,apns-novell.csr, before saving the file.4 Submit the Certificate Request to Apple:4a Click Apple Push Certificates Portal to open theE NABLING P USH N OTIFICATIONS FOR A NDROID D EVICESFirebase Cloud Messaging (FCM) enables a ZENworksMDM Server to notify an Android device when the serverrequires information from the device or has changes for thedevice.The MDM Server communicates with the Firebase CloudMessaging service, which then pushes the notification tothe device. After receiving the push notification, the devicecontacts the MDM Server directly to provide the requestedinformation or receive the changes.In order to use Firebase Cloud Messaging, you must havean existing Firebase project or use the Firebase Console tocreate a Firebase project. The Firebase project providesthe api/server key and project/sender ID used by your MDMServer to send notifications to Android devices.1 In ZENworks Control Center, click Configuration (inthe left navigation pane).Apple Push Certificates Portal web site.4b Sign in with your Apple ID and password.2 In the Management Zone Settings panel, click PushNotification, then click Firebase Cloud Messaging todisplay the Firebase Cloud Messaging settings.4c Click Create a Certificate, then follow the promptsto upload your Certificate Signing Request fileand create an APNs certificate.4d After the APNs certificate is created, downloadthe certificate.5 Import the APNs Certificate:5a Click Import APNs Certificate.5b Browse for and select the APNs certificate file,then click OK.The default name for the certificate file is MDMNovell Inc Certificate.pem. The certificate isimported into your zone and the certificate’ssubject, expiration date, and key length aredisplayed.5c To check that the certificate is valid and that yourZENworks MDM Server can communicate withthe Apple Push Notification service, click TestNow.6 Click OK to save your Apple Push Notificationchanges.83 Create a Firebase Project:3a Click Firebase Developers Console.3b Sign in using your Google account credentials.Best practice dictates that this should be Googleaccount created specifically for managing yourcorporate Firebase projects and not a personalGoogle account.3c Click Add Project, supply a name for your project(such as ZENworks) and follow the remainingprompts to create the project.

3d After the project is created, the Firebase Consoleis displayed.4 Configure ZENworks with the JSON file and ServerKey:4a In ZENworks Control Center (in the FirebaseCloud Messing settings), click the EnableFirebase Cloud Messaging check box to turn onthe option.3e Click the Android app icon (circled in red above)to display the app registration page.4b Configure the following:Project JSON File: Add the JSON file youdownloaded from Firebase.Server Key: Add the Server Key.Key activation date: Specify the key’s activationdate.Google user ID: Specify the Google account IDused to create the project.4c Click Test Server Key to validate that the3f In the Android package name field, entercom.novell.zapp, then click Register app.3g Click Download google-services.json todownload the .JSON file.3h Complete the wizard and return to the Firebaseconsole.3i In the console’s upper-left corner, click theicon, then click Project Settings.3j Click Cloud Messaging.information is entered correctly and the key isactive.4d Click OK to save your Firebase Cloud Messagingconfiguration.Enroll Mobile DevicesWhew! You’ve made it through the ZENworks installationand configuration tasks! Now it’s time to enroll an iOS andAndroid device in your system so that you can get on withthe fun stuff like distributing apps to the devices andsecuring them. Creating a Mobile Enrollment Policy (page 9) Enrolling an iOS Device (page 11) Enrolling an Apple DEP iOS Device (page 12) Enrolling an Android Device (page 16)C REATING A M OBILE E NROLLMENT P OLICY3k Copy the Server Key so that you can paste it intoZENworks Control Center.In order for mobile devices to be enrolled in your ZENworksManagement Zone, you must create a Mobile Enrollmentpolicy and assign it to any users who will enroll devices.The Mobile Enrollment policy not only allows users to enrolldevices but also assigns specific management settings tothe device. For example, the policy determines theZENworks name and group memberships assigned to the9

device, whether the device is designated as corporateowned or personal, and what happens to the device when itis unenrolled.Depending on the diversity of needs in your organization,you can create a single Mobile Enrollment policy for allusers or you can create multiple policies for users withdifferent needs. For the purpose of this evaluation, we’llhave you create a single policy.1 In ZENworks Control Center, click Policies (in the leftnavigation pane).For example, the Mobile Security policy lets youconfigure different password, encryption, andlockout settings for corporate devices versuspersonal devices. When the Mobile Securitypolicy is applied to a device, the device’sownership type determines which group ofsettings is applied7b Under the Enrollment using the ZENworks UserPortal or the ZENworks Agent app method,enable the Allow the device user to selectownership type option.In a production environment, your corporatepolicy might dictate that you don’t allow users toselect the ownership type during enrollment. Forthis evaluation, however, we suggest that youenable the option so that you experience thisenrollment method.This option is not available for the Enrollmentthrough the Apple Device Enrollment Program(DEP) or Apple Configurator (during initial devicesetup) method because these are silentenrollments; no options are displayed to the user.7c Click Next2 In the Policies panel, click New Policy to display theCreate New Policy wizard.8 On the Configure Device Management Level page:8a Review the differences between a fully manageddevice and an ActiveSync-only device:3 On the Select Platform page, select Mobile, then clickNext.4 On the Select Policy Category page, select GeneralMobile Policies, then click Next.5 On the Select Policy Type page, select MobileEnrollment Policy, then click Next.6 On the Define Details page, specify a name for thepolicy (for example, Mobile Enrollment), then clickNext.7 On the Configure Device Ownership page:7a Leave the Default Ownership set to Corporate forboth enrollment methods.Every mobile policy includes two groups ofsettings, one group that is applied to corporatedevices and a second group that is applied topersonal devices.10 Fully managed: ZENworks can performvarious device management operations suchas apply policies to the device, deployapplications on the device, synchronizeemail from Exchange ActiveSync accounts,and capture device information (inventory).Only iOS or Android devices can be enrolledas managed devices. Full management of anAndroid device is performed through theZENworks App that is hosted on the GooglePlay Store. Full management of an iOSdevice is performed through the device’snative MDM client. ActiveSync only: ZENworks can managecorporate emails on the device. Also, certainpolicies that are enforceable through theActiveSync protocol, such as the DeviceControl Policy and Mobile Security Policy,can be applied to these device. Android, iOS,Blackberry, and Windows devices can beenrolled as ActiveSync only devices.The default setting prompts the user to enroll as afully managed device but allows the change fromfully managed to ActiveSync-only. In a productionenvironment, your corporate policy might dictatethat you don’t allow users to select themanagement level during enrollment. For this

evaluation, however, we suggest that you allowthe choice so that you can see what the optionlooks like when enrolling devices.8b Keep the default setting so that devices areenrolled as fully managed, then click Next.9 On the Configure Mobile Enrollment Rules page, notethe folder and naming settings for the default AllDevices rule in the list, then click Next.Enrollment rules establish the criteria that a user’sdevice must meet in order to enroll, and determinesthe enrolling device’s display name, folder placement,and group assignments in ZENworks Control Center.(available for Apple devices running iOS version 11 ornewer), use the instructions in “Enrolling an Apple DEP iOSDevice” on page 12 instead.1 In the Safari browser on the iOS device, enter thefollowing URL:ZENworks server address/zenworks-eupReplace ZENworks server address with the DNSname or IP address of your ZENworks Primary Server.The login screen for the ZENworks User Portal isdisplayed.10 On the Configure the Un-enrollment Settings page,keep the default settings, then click Next.11 On the Summary page, deselect Create as Sandbox,select Define Additional Properties, then click Finishto create the policy.2 Enter the evaluation user’s username and password,skip the Domain field, then tap Sign In to display theMy Devices screen.12 Assign the policy to your evaluation user:The Domain name field is not needed because thesystem is configured for simple enrollment, whichallows users to log in with only their username ratherthan their full domain name.12a Click Relationships.12b In the User Assignments list, click Add.12c Select the evaluation user, then click OK to addthe user to the assignment list.12d Click Next Finish to complete the assignment.E NROLLING AN I OS D EVICEYou can enroll any device running iOS version 10 or newer.We used an iPhone running iOS version 13.1.2. Obviously,the screens and steps might vary slightly on other iOSdevices and versions.If the device you want to enroll is factory fresh and waspurchased through the Apple Device Enrollment Programor has been added to the program via Apple Configurator3 Tap Enroll in the upper-right corner to display theEnroll Device Modes screen.The available enrollment options are determined bythe Mobile Enrollment policy. If you configured thepolicy as recommended in “Creating a Mobile11

Enrollment Policy” on page 9, both options areavailable as shown below. Otherwise, only one of thetwo options is available.4 Tap Managed Device Only to display the Enroll DeviceOptions screen.7 After you’ve finished enrollment, tap Home to return tothe Home page.The enrolled device is displayed in the My Devices list.8 In ZENworks Control Center, go to the Devices Mobile Devices list to confirm that the device isenrolled in the zone.9 (Optional) In the list, click the iOS device to display itsDevice Information page.5 Click OK to enroll the device as a corporate device anddisplay the Enroll as Managed Device screen.The Device Information page provides inventorydetails collected from the device.6 Complete the steps to enroll the device.Note: If you enroll multiple devices, the steps might notbe the same on all devices. This is because ofdifferences in iOS versions. ZENworks displays onlythe steps required to complete enrollment on thecurrent device.E NROLLING AN A PPLE DEP

4 2Click Configuration (in the left navigation pane). 3In the Management Zone Settings panel, click Infrastructure Management to expand the section, then click System Update Settings to display the System Update Settings page. 4In the System Update Entitlement panel, click Configure to display the Configure System Update Entitlement dialog box. 5Enter the email address used to request your