Parallels Management Suite SCCM manual

Copyright © 1999-2014 Parallels IP Holdings GmbH and it s affiliates. All rights reserved. Parallels Mac Management for Microsoft SCCM 2012 Administrator's Guide v3.1[...]

Parallels IP Holdings GmbH Vordergasse 59 8200 Schaffhausen Switzerland Tel: + 41 52 632 0411 Fax: + 41 52 672 2010 www.parallels.com Copyright © 1999-2014 Parallels IP Holdings GmbH and it s affiliates. All rights reserved. This product is protected by United States and internation al copyright laws. The product’s underlying technology, patents[...]

Contents Introduc tion ............................................................................................................... 7 About This Guide .............................................................................................................. 7 About Parallels Mac Management for Microsoft SCCM 2012 ............................[...]

Contents Configuring Configuration Manager Boundaries .............................................................. 36 Configuring Windows Firewall.......................................................................................... 37 Viewing Proxy Service Certificate Details ..................................................................[...]

Contents Preparing Mac Appli cation for Configurat ion Manager ........................................................... 89 Creating Configuration Ma nager Application .......................................................................... 90 Configuring Deployment Type ..........................................................................[...]

Contents Send Problem Report Di alog ............................................................................................... 145 Problem Reports Dial og ...................................................................................................... 145 Appendices .......................................................................[...]

In This Chapter About This Guide ..................................................................................................... 7 About Parallels Mac Management for Microsoft SCCM 2012 ................................... 7 About This Guide This guide contains information about how to dep loy and use Parallels Mac Management for Microsoft SCC[...]

8 Introduction system administrator. Mac OS X configuration manag ement via Confi guration Profiles (p. 59) Allows to configure Macs and enforce compliance with SCCM Desired Config uration Management functionality. FileVault 2 Encryption Management (p. 66) Allows to use FileVault 2 to encrypt the contents of disk drives on managed Macs with the abi[...]

This chapter contains information about how to d eploy Parallels Mac Management for Microsoft SCCM 2012 in an enterprise computing environment. In This Chapter Parallels Mac Management Component Overview .................................................... 9 Checking Installation Requirements ........................................................[...]

10 Deploying Parallels Mac Management for Microsoft SCCM 2012 Supported SCCM Versions Parallels Mac Management supports Microsoft System Center Configuration Manager 2012 and 2012 R2. Please make sure that you have the latest service pack and critic al updates installed. Supported Windows Versions Parallels Mac Management supports all versions of W[...]

11 Deploying Parallels Mac Management for Microsoft SCCM 2012 • The Distribution Point role is installed on this server. • The server is a PXE service point. • WDS is installed and running. If WDS and DH C P are both installed on this s erver, the Do not listen on port 67 option must be selected in the WDS s ervice properties. • BITS 4.0 is[...]

12 Deploying Parallels Mac Management for Microsoft SCCM 2012 5 Check that authorization is allowed to all users Verify that WebDAV is enabled In Windows Server 2008: 1 Click Start > Administrative tools > Internet Information Services (IIS) Manager . 2 Select the server name and expand Sites . 3 Click Default Web Site . 4 Double-click IIS &g[...]

13 Deploying Parallels Mac Management for Microsoft SCCM 2012 5 Right-click any of the available reports and check that the Run item is available in the po p-up menu. Check that the Report Viewer is installed Note: The Report Viewer is not required for Parall els Mac Management installation, but it is needed for viewing reports. On the computer run[...]

14 Deploying Parallels Mac Management for Microsoft SCCM 2012 Check the date and time synchronization Date and time must be synchronized between the servers running the Confi guration Manager, Configuration Manager Proxy, Active Directory, Manage ment Point, Distribution Point, and th e Mac computers. If that's not done, the Par allels Mac Cli[...]

15 Deploying Parallels Mac Management for Microsoft SCCM 2012 • Permissions to register and unregister Service Principal Name s for the user account us ed to run the Parallels Configuration Manager Proxy service. • Administrative rights on the computer where the installation is p erformed. The following step-by-step instructions describe how to[...]

16 Deploying Parallels Mac Management for Microsoft SCCM 2012 6 Grant the user Full Write permissions . 7 Click OK to close the dialog. 8 Click OK to close the WMI Control Properties dialog. Grant the user administrative rights on the computer(s) where you’ll be installing Parallels Configuration Manager Proxy and NetBoot Server 1 Log in to a com[...]

17 Deploying Parallels Mac Management for Microsoft SCCM 2012 3 Right-click CN=System and select New > Object... in the context menu. 4 In the Select a class list, select container and click Next . 5 In the value field, type "ParallelsServices" (without quotes) and click Next . 6 Click Finish . 7 In the ADSI Edit window, right-click CN[...]

18 Deploying Parallels Mac Management for Microsoft SCCM 2012 Please note that the user y ou select in this step must be the user that will be us ed to run the service, not the user installing it. If you’ll be using the same us er to install and to run the Pa rallels Configuratio n Manager Proxy service, then se lect the domain user that you crea[...]

19 Deploying Parallels Mac Management for Microsoft SCCM 2012 Create a New Domain User Note: You may skip this section if you wa nt to use an existing domain user. 1 On the computer running Active Directory, click Start > Administrative Tools > Server Manage r. 2 In the Server Manager window, navigate to Roles / Active Directory Domain Servic[...]

20 Deploying Parallels Mac Management for Microsoft SCCM 2012 5 Click the Add... button in the Assigned security roles section. 6 In the Available security roles list, select Full Administrator and click OK . 7 Click OK in the Add User or Group dialog. Grant the User Administrative Rights on the Local Computer 1 Log in to the computer where you&apo[...]

21 Deploying Parallels Mac Management for Microsoft SCCM 2012 • SCCM 2012 SP1 • SCCM 2012 R2 Certificate Authority on the following versions of Windows is supported: • Windows Server 2003 • Windows Server 2008 • Windows Server 2008 R2 • Windows Server 2012 • Windows Server 2012 R2 Note: Integration is provided for Micr osoft Certifica[...]

22 Deploying Parallels Mac Management for Microsoft SCCM 2012 11 On the Confirm Installation Selections page, click Install and wait for the role installation to finish. 12 Review the info on the Installation Results page and click Close . Deploying Certificate to Web Server The Web Server certificate must be deployed to si te systems that run IIS.[...]

23 Deploying Parallels Mac Management for Microsoft SCCM 2012 6 The Properties of New Template dialog opens. 7 On the General tab page, type the template name (e.g. ConfigMgr Web Server Certificate). 8 Click the Subject Name tab and make sure tha t the Supply in the request option is selected. 9 Click the Security tab and remove the Enroll permissi[...]

24 Deploying Parallels Mac Management for Microsoft SCCM 2012 13 In the Alternative name / Value field, type FQDN values of the site system server (speci fied in site system properties in Configuration Manager) and click Add. For example: • If the site system will only accept client conn ections from the intr anet, and the intranet FQDN of the si[...]

25 Deploying Parallels Mac Management for Microsoft SCCM 2012 • The certificate is used to authentica te the distribution point to a n HTTPS-enabled management point before the distribution point sends status messages. • When the Enable PXE support for clients distribution point option is selected, the certificate is sent to PXE boot servers so[...]

26 Deploying Parallels Mac Management for Microsoft SCCM 2012 Installing Custom Workstation Authentication Certificate This section describes how to request and install th e custom client certificate on a me mber server that runs IIS (configured as distribution point): To accomplish this task: 1 Open Microsoft Management Consol e (run mmc.exe). 2 C[...]

27 Deploying Parallels Mac Management for Microsoft SCCM 2012 6 Make sure that the Personal Information Exchange - PKCS #12 (.PFX) option is selected and click Next. 7 On the Password page, choose and type the password and cl ick Next . You will need to specify the password when you'll be importing the certificate later. 8 On the File to Expor[...]

28 Deploying Parallels Mac Management for Microsoft SCCM 2012 Completed validation of Certificate [Thumbprint 4ac41a85e45b805ae765422b18975f356b57de80] issued to 'sccm2012.PRL.LOCAL' >>> Selected Certificate [Thumbprint 4ac41a85e45b805ae765422b18975f356b57de80] issued to 'sccm2012.PRL.LOCAL' for HTTPS Client Authenticat[...]

29 Deploying Parallels Mac Management for Microsoft SCCM 2012 Creating a Certificate Template for Par allels Configuration Manager Proxy To create a certificate template: 1 In Windows, click Start > Administrative Tools > Certification Authority . 2 Expand the CA tree, right-click Certificate Templates and click Manage . 3 The Certificate Tem[...]

30 Deploying Parallels Mac Management for Microsoft SCCM 2012 4 In the template list, locate Workstation Authentication , right-click it and then click Duplicate Template in the context menu. 5 In the Duplicate Template dialog, choose Windows Server 2003 Enterprise and click OK. 6 The Properties of New Template dialog opens. 7 On the General page, [...]

31 Deploying Parallels Mac Management for Microsoft SCCM 2012 Installing Parallels Mac Management for Microsoft SCCM 2012 The installation of Parallels Mac Management fo r Microsoft SCCM 2012 involves installing Parallels Configuration Manager Proxy, Configuration Manager Console Extension, and the optional NetBoo t Server. All components are insta[...]

32 Deploying Parallels Mac Management for Microsoft SCCM 2012 If you are installing all of the components on the same server, select all of them. If you are installing them on separate computers, sel ect the component(s) you wish to install. 4 Ready to Install the Program . Click the Install button to begin the Parallels Mac Management for Microsof[...]

33 Deploying Parallels Mac Management for Microsoft SCCM 2012 • First, select the protocol (HTTP or HTTPS) wh ich the Parallels Proxy and Mac clients will use to communicate with management points and distribution poi nts. To use PKI, select the HTTPS option. If you don't want to use PKI, select the HTTP option. If your distribution points a[...]

34 Deploying Parallels Mac Management for Microsoft SCCM 2012 • FileVault Key Administrator . This role provides read access rights to the Parallels Mac Management SQL Server database (p. 153). The database is installed by Parallels Mac Manag ement on the primary SCCM site and is use d to store FileVault 2 recovery information for Mac computers. [...]

35 Deploying Parallels Mac Management for Microsoft SCCM 2012 1 SMS Provider location . Use this page to specify the hostname or IP address of the server where the SMS Provider is installed. If the SMS Pr ovider and the NetBoot server are installed on the same server (the server where you are running this wizard), select the Local server option. If[...]

36 Deploying Parallels Mac Management for Microsoft SCCM 2012 Upgrading Parallels Mac Manage ment for Microsoft SCCM 2012 To upgrade Parallels Mac Management for Microsoft SCCM 2012 to a newer version, you need to uninstall the current version and then install a new one. To run the uninstaller, navigate to Start > Control Panel > Programs >[...]

37 Deploying Parallels Mac Management for Microsoft SCCM 2012 3 On the General tab of the boundary group properties window type in the boundary na me and an optional description. 4 Click the Add button and select a boundary fro m the list. Click OK . 5 On the References tab page, select the Use this boundary group for sit e assignment option. 6 Sel[...]

38 Deploying Parallels Mac Management for Microsoft SCCM 2012 To view the certificate store permissions 1 Run regedit.exe on the computer where the Configuration Ma nager Proxy is installed. 2 Navigate to HKLMSoftwareMicrosoftSystemCertificates . 3 Right-click SystemCertificates and select Permissions from the pop-up menu. 4 In the Permissions f[...]

39 Deploying Parallels Mac Management for Microsoft SCCM 2012 4 Install the Configuration Manag er Proxy on the new server. The following describes how to export the existing certificate and import it on a new se rver. The Proxy uninstallation and installation should be performed normally, as described in Inst all Parallels Mac Management for Micro[...]

40 Deploying Parallels Mac Management for Microsoft SCCM 2012 Importing Certificate into Certificate Store To import a certificate: 1 In Windows, click Start > Run... 2 Type mmc in the Open box and click OK . This will open the Micr osoft Management Co nsole. 3 In the console, click File > Add/Remove Snap-in to open the Add or Remove Snap-ins[...]

After Parallels Mac Management for Microsoft S CCM 2012 has been installed and configured, you need to install the Parallels Mac Client software on Mac computers that you want to manage. The client software can be installed o n Mac computers using one of the following methods: • Deploying via Network Discovery. This method scans your network for [...]

42 Deploying Parallels Mac Client Configuring Network Discovery To configure network discovery: 1 In the Configuration Manager console , navigate to Administration / Overvie w / Parallels Mac Management / Discovery Methods . The list in the right pane will be populated with o ne or more "Parallels Network Discovery" entries according to t[...]

43 Deploying Parallels Mac Client 5 Use the Boundaries tab page to specify Configuration Manag er boundaries to search. You can use this search option together with t he options on the Subnets tab page, but searching boundaries should be the primary method. If you haven't configured boundaries and boundary groups yet, you need to configure the[...]

44 Deploying Parallels Mac Client 1 When discovery finds a Mac, it will try to conn ect to it over SSH using user accounts that you specified in the discovery configuration. The acco unts will be used in the order listed. If you haven't specified any acc ounts (or if a connection with the Mac cannot be establishe d for any reason), the Mac wil[...]

45 Deploying Parallels Mac Client • If you don't have secondary sites, the list will contain just one "Mac Client Enrollment" entry. • If you have secondary sites but you've installed th e Configuration Manager Proxy only on the primary site, the list will contain just one entry. • If you have secondary sites and installed[...]

46 Deploying Parallels Mac Client If you close the wizard without completing the registration, it will run auto matically at predefined intervals (5-10 minutes) and every time you restart the Mac. To stop this from happeni ng, either resolve the problem and register the client with the Configuration Manager Proxy or uninstall it from the Mac (p. 49[...]

47 Deploying Parallels Mac Client Example: $ sudo ./InstallAgentUnattended.sh http://myhost.local:8761/files/pma_agent.dmg myname mypass mydomain If you receive the "Permission denied " error when executing the script, run the following command to set the file permissions and the n execute the script again: $ chmod 755 InstallAgentUnatten[...]

48 Deploying Parallels Mac Client Verifying Mac Client Deployment To verify that the Parallels Mac Management deplo yment was successful, open the Configuration Manager console and navigate to Assets and Collections / Devices / All Mac OS X Systems . You should see some Mac computers in the lis t. If you ran Network Discovery to discover Macs, some[...]

49 Deploying Parallels Mac Client Upgrading Parallels Mac Client When you upgrade Parallels Mac Ma nagement for Microsoft SCCM, the Parallels Mac Client must also be upgraded on every Mac computer. This task can be accomplis hed by distributing the client installation package to Macs using the standard s o ftware distribution functionality of Co nf[...]

50 Deploying Parallels Mac Client The Mac will remain in the Configuration Manager database, but its management will not be possible. You can reinstall the client on the Mac la ter to restore management functions.[...]

After you install Parallels Mac Client on a Mac and register it with Parallels Configuration Manager Proxy, you can begin managing the Mac in Configuration Manager. The P arallels Mac Client itself can also be managed on the Mac where it is installed. This chapter describes the common Parallels Mac Client managemen t tasks. In This Chapter Viewing [...]

52 Managing Parallels Mac Client When you click the Parallels Mac Management icon, the following dialog opens: The General box contains the Parallels Mac Client properties and their values: • Certificate expiration date . The date and time when the Mac client certificate expires. • Certificate subject name . A globally unique name identifying t[...]

53 Managing Parallels Mac Client Initiating Policy Retrieval Parallels Mac Client downloads its policy from Co nfiguratio n Manager automatically according to a schedule. There may be a need to download the latest policy before the scheduled do wnload occurs. Parallels Mac Client provides this ability. Using Graphical User Interface to Initiate Pol[...]

54 Managing Parallels Mac Client Using Command Line to Initiate Policy Retrieval To initiate policy retrieval from a command line, change directory to /Library/Parallels/pma_agent.app/Contents/MacOS and type the following command in Terminal: $ pmmctl get-policies On completion, the command returns one of the following XML documents depending on th[...]

55 Managing Parallels Mac Client Sending Problem Reports From Mac Client If you are experiencing a problem with Parallels Mac Client, you can ob tain a problem report and then send it to Parallels Support. To obtain a report, open System Preferences and then click the Parallels Mac Management icon. The following dialog opens: Click the Send Problem[...]

56 Managing Parallels Mac Client This is the same dialog as the one that opens wh en you click the Send Problem Report button described above.[...]

This chapter contains information about how to use Parallels Mac Management featur es. In This Chapter Using Configuration Manager 2012 Console............................................................. 57 Understanding Collections in Parallels Mac Management ......................................... 57 Hardware and Software Inventory............[...]

58 Parallels Mac Management Features To see the All Mac OS X Systems collection, open the Configuration Manager 2012 console and navigate to Assets and Compliance / Overview / Devi ce Collections / All Mac OS X Systems . The collection can contain both managed and unmanaged Macs. A Mac is added to a collection as an unmanaged resource if the clie n[...]

59 Parallels Mac Management Features 5 In the Default Settings dialog, select Hardware Inventory in the left pane. 6 Use the controls in the right pane to enable and schedule hardware invento ry. 7 To select the classes to be collected by hardware inventory, click the Set Classes button. Review the selected classes and mak e changes if needed. Plea[...]

60 Parallels Mac Management Features Parallels Mac Management provides two methods of defining an OS X con figuration profile: • Using a custom configuration ite m dialog in the Configuration Manag er Console to define a profile from scratch. • Creating a profile from an existing file containi ng the OS X profile data. Such a file can be create[...]

61 Parallels Mac Management Features The dialog mimics the interface of the Mac OS X Se rver’s Profile Manager. The left pane of the dialog contains the list of payloads that define groups of settings. The right pane contains the settings for a selected payload. When you select a payload for the first time, the right pane will only contain a shor[...]

62 Parallels Mac Management Features Some of the items will be populated with the defaul t values, so me will be empty. If this is a new configuration profile, only the Configuration Item and the General payloads will show the editable fields. All others will contain just the Configure button. Specifying the values for a parti cular payload is opti[...]

63 Parallels Mac Management Features Payload Overview The first item in the payload list is Configuration I tem . It is not really a payload and is used to specify the configuration item name and an optional description. This is the name that will appear in the Configuration Items list in the Configuratio n Manager console after you save the profil[...]

64 Parallels Mac Management Features 1 In the Configuration Manager console , navigate to Assets and Compliance / Overview / Compliance Settings . 2 Right-click Configuration Items and then point to Create Parallels Config uration Item and click Mac OS X Configuration Profile from File . 3 The Mac OS X Configuration Profile dialog opens. 4 Enter th[...]

65 Parallels Mac Management Features 8 To edit the profile data after the configuration item has been sa ved, right-click the profile and select Edit Parallels Configuration Item from the pop-up menu. The Mac OS X Configuration Profile dialog will now have the Import from .mobilecon fig and Export to .mobileconfig buttons. Using these two buttons, [...]

66 Parallels Mac Management Features • To use the interactive mode, enter the %user_interaction_required% tag into a field instead of the actual value. If a payload contains this tag in at least one fiel d, the Mac user will be prompted to manually enter all of the missing settings. The interactive mode will be used even if none of the missi ng s[...]

67 Parallels Mac Management Features • Personal . A personal recovery key is created automatically for each individual Mac duri ng the encryption procedure and is saved in the database on the primary SCCM site (p. 153). If a Mac user forgets the password for unlocking the disk, the personal recovery key for the disk can be retrieved from the data[...]

68 Parallels Mac Management Features 4 Choose the name and location for the new file. Make sure that the File Format fiel d has "Certificate (.cer)" option selected. 5 Click Save to export the certificate. 6 Copy the exported .cer file to a location wher e it c an be accessed from the computer running the Configuration Manager 2012 consol[...]

69 Parallels Mac Management Features When a Mac is evaluated for compliance, an attemp t will be made to enable FileVault 2 on it. The Mac user will be notified as follows: 1 A message box is displayed informin g the user that the Mac is about to be encrypted. The dialog has two buttons: Encrypt and Postpone . 2 If the user clicks Postpone , the en[...]

70 Parallels Mac Management Features • Institutional — institutional recovery key. • Status — the current encryption status. The possible values ar e described in the table below. • Volume — the volume name. Viewing the FileVault 2 Disk Encryption Report 5 In the Configuration Manager console , navigate to Monitoring / Reporting / Repor[...]

71 Parallels Mac Management Features After the Macs have been encrypted, the best way for the system administrator to monitor the Mac encryption status is to configure the baseline contai ning th e FileVault 2 configuration item to run as often as necessary (e.g. daily). If an unauthoriz ed change have been made to the FileVault 2 encryption, the b[...]

72 Parallels Mac Management Features Finding the Correct FileVau ltMaster.keychain File If you have more than one FileVaultMaster.keychain file a nd you forgot which one is which, you can compare the SHA1 fingerprint of the c ertificate in the file to the fingerprint of the original certificate that Parallels Mac Management has saved in its databas[...]

73 Parallels Mac Management Features 3 In the FileVault 2 Encryption Information dialog, enter the Mac's serial number of hardware ID. Click Search . 4 If the Mac was previously encrypted through Parallels Mac Management, a dialog will open containing the FileVault 2 encryption properties for this Mac. 5 Use the value of the Institutional key [...]

74 Parallels Mac Management Features Creating FileVault 2 Configuration Item To create a FileVault 2 configuration item using a personal rec overy key: Note: If you want to use an instit utional recovery key, jump to FileVault 2 Encryption with Institutional Recovery Key (p. 67). 1 In the Configuration Manager console , navigate to Assets and Compl[...]

75 Parallels Mac Management Features 2 If the user clicks Postpone , the encryption operation will be postponed. The dialog will be displayed to the user again after a predefined peri od of time (five minutes). The user has the ability to keep postponing the encryption indefini tely. The time period after which the dialog is displayed again is doub[...]

76 Parallels Mac Management Features Viewing the FileVault 2 Disk Encryption Report 5 In the Configuration Manager console , navigate to Monitoring / Reporting / Reports . 6 Locate the FileVault 2 Disk Encryption report and double-click it. The FileVault 2 Disk Encryption dialog opens displaying the report. 7 Each row in the report represents a cor[...]

77 Parallels Mac Management Features Note: You should be aware of on e scenario when th e FileVault 2 encryption st atus may not be reported accurately in the Mac hardware inventory. This will happen wh en a Mac is removed from the Configuration Manag er site, the Parallels Mac Client is uninstalled from it, and the Mac is then assigned to the site[...]

78 Parallels Mac Management Features 4 In the Properties dialog, click the FileVault 2 tab to view the FileVault 2 enc ryption information for the Mac. The properties are: • Hardware ID . Contains the Mac hardware ID. • Serial Number . Contains the Mac serial number. • Personal Key. Contains the personal recovery key (will be blank if an inst[...]

79 Parallels Mac Management Features 3 Look for the UUID of a Logical Volume, usually the l ast in the list. Select and copy the UUID to be used in the next step. 4 Use the following command to unlock the encrypte d disk. Be sure to insert the UUID from the previous step: $ diskutil cs unlockVolume UUID -passphrase recoverykey 5 When the command co[...]

80 Parallels Mac Management Features 2 Right-click Configuration Items , point to Create Parallels Configuration Item and click Parallels Desktop Configuration . The Parallels Desktop Configuration Profile dialog opens. The following list describes the organization of the Parallels Desktop Confi guration Profile dialog: • Configuration Item . Spe[...]

81 Parallels Mac Management Features To evaluate Mac computers for compliance, you need to add the configuration item to a baseline and then deploy it to a Mac collection. See Deploying Configuration Bas eline (p. 86) for more information. Enforcing Parallels Desktop VM Settings A Parallels Desktop virtual machine has nu merous co nfiguration optio[...]

82 Parallels Mac Management Features 4 To include an option in the configuration profile and to specify its value click the ON/OFF switch to toggle it to "ON". To exclude an option, toggl e the switch to "OFF". The excluded options will not be evaluated on managed Macs. 5 When finished, click the OK button to close the dialog. T[...]

83 Parallels Mac Management Features General Page Specify the general properties of the configuratio n item: 1 Specify the configuration item Na me and an optional Description . 2 Select Mac OS X in the Specify the type of configuration item that you want to create list box. 3 Click Next . Supported Platforms Page Select the OS X versions to which [...]

84 Parallels Mac Management Features Compliance Rules Page The Compliance Rules page lists the compliance rules that you've created earlier. You can review and modify them if necessary. You ca n also create new rules here if needed. Click Next when ready. Summary, Progress, and Completion Pages Review the configuration item summar y and click [...]

85 Parallels Mac Management Features You can type (or copy and paste) the script into the Script edit box. If you have the script saved in a file, click the Open button to browse for it. A remediation script is used to remediate nonco mpliant setting values found on a Mac. The noncompliant value is passed to the script as an input parameter after o[...]

86 Parallels Mac Management Features To create a rule, do the following in the Create Rule dialog: 1 Specify the rule Name and an optional Description . 2 Set the Rule type to Value . 3 Use the The setting must comply with the following rule section to specify the rule. 4 If you specified a remediation script for this config uration item setting, y[...]

87 Parallels Mac Management Features 1 In the Configuration Manager console, right-click the baseline that you've cr eated and click Deploy in the pop-up menu. 2 In the Deploy Configuration Baselines dialog, click the Bro wse button. 3 In the Select Collection dialog, select Device Collections in the drop-down list box and then select the All [...]

88 Parallels Mac Management Features 3 Specify the report criteria using the provided optio ns (computer name, configuration item name). 4 Click Display to view the report. A compliance report contains the basi c informatio n about the Mac computer and the configuration item (or configuration baseline) together with the following items des cribing [...]

89 Parallels Mac Management Features Silent Installation If you configure the application to install silently, it will be delivered to a Mac and installed without giving the user any control over the installation process. The only operation that the user will be asked to confirm is restarting the Mac if it is required by a particular application. T[...]

90 Parallels Mac Management Features 1 Download the ConfigmgrMacClient.msi file from the Microsoft Download Center. Use one of the following URLs depending on the SCCM version you are using: • SCCM 2012 R2: http://www.microsoft.co m/en-us/download/details.aspx?id=39360 • SCCM 2012: http://www.microsoft.com /en-us/download/details.aspx?id=36212 [...]

91 Parallels Mac Management Features 7 On the General Information page, specify the application na me, and optionally publisher, and version. Click Next . 8 Review the application settings on the Summary page and click Next . 9 Wait until the application is created and then click Close to close the wizard. The new application will appear in the App[...]

92 Parallels Mac Management Features To modify the properties of the deployment type: 1 Select the Deployment Types tab at the bottom of the Applications workspace. 2 Right-click the deployment type and click Properties in the c ontext menu. 3 The <application_name> - Mac OS X Properties dialog opens. Use the following instructions to modify [...]

93 Parallels Mac Management Features Specify Detection Method The Detection Method tab page allows to specify how Configuration Manager deter mines whether this deployment type is already present on a Mac. This information is automatically imported when you convert the OS X installation image to a .cmmac file.You can modify the imported information[...]

94 Parallels Mac Management Features 3 In the Select Collection dialog, select Device Collection in the drop-down list, and then select the target collection (e.g. All Mac OS X Systems ). Click OK . 4 Click Next . 5 On the Content page, click Add to add a Distribution Point that will host this content. Select a Distribution Point and click OK . 6 C[...]

95 Parallels Mac Management Features • Display in Software Center and only show notifications for computer restarts — T his option is similar to the Display in Software Center and sho w all notifications option (above) with one exception: the installer will run in the background, so the user will have no control over the installation process. T[...]

96 Parallels Mac Management Features • If the policy was downloaded after the deadline has passed, the effective deadline will be set to the time of the policy download plus 24 hours. • Install now — Clicking this button will close the dialog and will run the appli cation installer. Installation is Silent If the installation type was specifie[...]

97 Parallels Mac Management Features The Parallels Application Portal window has the following elements: • All Applications tab — Lists all application, including installed applications and applicati ons that are available for installation. If at least one application was configured a s "featured", the list will be split into two part[...]

98 Parallels Mac Management Features The Package page 14 Specify the package name and an optional description, ma nufacturer, language, and version information. 15 Select the T his package contains source files option and then click the Browse button to select the source folder. 16 Click Next . The Program Type page Select the Standard program opti[...]

99 Parallels Mac Management Features $ /usr/sbin/installer -pkg "packages/mysoft_v1.pkg" -target / The following example will similarly mount an .iso image file: :MySoft/MySoft-1.0.iso/packages/mysoft_v1.pkg:: 3 Specify whether you want to allow Mac users to interact with the program installation. • To enable user interaction, in the Ru[...]

100 Parallels Mac Management Features 2 Select the program and click Properties on the toolbar. The program Prop erties dialog opens. 3 On the General tab, in the After running list, select the a ction that should be perfor med after the package installation finishes: • No action required. This is the default option. If selected, no additional ac[...]

101 Parallels Mac Management Features 2 On the General page, click the Browse button next to the Collection field and selec t the collection containing the desired Ma c resources (e.g. All Mac OS X Systems ). Click OK and then click Next. 3 On the Content page, verify the distribution point i nfo and click Next . 4 Click Next on the Deployment Sett[...]

102 Parallels Mac Management Features Additionally, the Windows server running the Configuration Manager consol e must have the Windows Assessment and Deployment Kit (Windows ADK) installed. When installing ADK, make sure that the Deployment Tools option is selected. Step 2: Create a bootable Mac OS X USB drive You need a bootable Mac OS X USB driv[...]

103 Parallels Mac Management Features 4 In the Network Disk field, choose a nd type in the name for the image (e.g. MyNetRestore ). 5 Click Create and choose a location on the slave partition. A folder containing the imag e will be created (e.g. MyNetRestore.nbi ). 6 Copy the folder to the Windows server r unning the Configuration Manager co nsole.[...]

104 Parallels Mac Management Features 3 On the new device record select Add selected items to new device collection to create new collection. Type the desired Collection Name and in Limiting Collection select All Systems . Step 7: Create a Task Sequence associated with the OS X image 1 In the Configuration Manager console , navigate to Software Lib[...]

105 Parallels Mac Management Features • If you have a single OS X image, you can hold the N key as a Mac boots to boot from it. • If you have multiple images, hold the Option key during the Mac startup. This will start the Mac in Startup Manager where you can select an image to boot from. Deploying Parallels Desktop and Virtual Machines on Macs[...]

106 Parallels Mac Management Features Parallels Desktop and a source virtual machi ne can be configured before deployment in a number of ways according to your requirements. This in cludes the general virtual machi ne configuration parameters, such as the number of CPUs, available RAM, hard disk size, etc., as well as additional configuration optio[...]

107 Parallels Mac Management Features Sending the Package to a Distribution Point To send a copy of the package to a distribution po int, right-cli ck the package of interest and click Distribute Content in the pop-up menu. Use the Distribute Content Wizard to spec ify a distribution point to which you want to send the pa ckage. Please make sure th[...]

108 Parallels Mac Management Features 1 Configure a distribution point. 2 Create a software distribution package (see below). 3 Create a program (see below). 4 Send the package to the distribution point. 5 Deploy the software. The rest of this section describes how to create a software distribution package and a program containing instructions to i[...]

109 Parallels Mac Management Features When the package is created, send it to a distri bution point and specify the deployment settings. See Software Distribution (p. 97) for details. Managing Windows Virtual Machine After you install the Configuration Manager client agent in a Windows virtual machine, the machine can be managed from the Configurat[...]

110 Parallels Mac Management Features • Connect via SSH . This option uses the Secure Shell (SSH) protocol to acc ess a shell account on a remote Mac and execute co mmands in Mac OS X. Parallels Mac Management uses third-party VNC and SSH client utilities that are installed in Windows automatically when you install the Conf iguration Manager Cons[...]

111 Parallels Mac Management Features When you select the Connect via SSH option in the Configuration Manag er console, the SSH client application starts and asks you to enter th e Mac user ID and password. If the credentials are valid, an SSH window opens where you can type and execute commands in Mac OS X. Problem Reporting and Monitoring The Par[...]

112 Parallels Mac Management Features Sending Problem Reports Usin g Windows Reporting Utility In addition to the Configuration Manager Cons ole Extension reporting feature, Parallels Mac Management provides a standalone r eporting utility for Windows, which is installed when you install the Configuration Manager Proxy or the Config uration Manager[...]

113 Parallels Mac Management Features Click Cancel to close the dialog without sending the repo rt. If the utility is run on the computer where the Configuration Manag er Proxy is installed, the report file will be forwarded to Configuration Manager Proxy, which will notify the Problem Monitor about it. You can then use the Problem Monitor to view [...]

114 Parallels Mac Management Features Starting and Stopping the Problem Monitor The monitor starts automatically after you complete the Parallels Mac Management installation. It also starts automatically when the computer is rebooted and a user logs in to Window s. If the user is not authorized to access the computer where the Configurati on Manage[...]

115 Parallels Mac Management Features Viewing the Problem Report List To view the problem report list, click the balloon to open the Problem Re ports dialog. If the balloon is not currently displayed, right-click the problem monitor icon and select Show Problem Reports from the pop-up menu (or you can simpl y click the icon). Each row in the list c[...]

116 Parallels Mac Management Features Viewing the Problem Report Activity Log The problem monitor maintains an activity log, which contains the infor mation about the operations that were performed on the reports. To view the problem report activity log, right-click the problem monitor icon in the notification area and select Problem Reports Log fr[...]

117 Parallels Mac Management Features • Status — Apple warranty status. • Expiration Date — Apple warranty expiration date. • Last Update — the date on which the warranty information was last upd ated.[...]

This chapter provides the resources to help you use the Parallels Mac Management user interface components. In This Chapter Wizard Pages ........................................................................................................... 118 Property Pages ......................................................................................[...]

119 Technical Reference SMS Provider Location Page The SMS Provider location page is used to specify the IP address or hostname of the server where the SMS Provider is installed. The page contains the following elements: Local Server Select this option if the SMS Provider is installed o n the server where you are running this wizard. Remote server [...]

120 Technical Reference Note: The Configuration Manag er Proxy service account must have read/write access to the SMS Provider. The page contains the following elements: Local System account Specifies that the predefined Local System account should be used to run the Configuration Manager Proxy service. This account Specifies a user account name. T[...]

121 Technical Reference The page has the following elements: SCCM site code Specifies the Configuration Ma nager site code. Select the site c ode that you want to use from the list. Security Settings Page The Security settings page is used to configure the Configura tion Manager Proxy role-based access control. The roles are created during the Para[...]

122 Technical Reference The roles are listed in the Roles list. You can select a role and see the d efault users and groups for it. Depending on your requirements, you can remove a de fault group and/or add a new group or a user. To remove a group, select it and click the "-" button. To add a group or a user click the "+" button[...]

123 Technical Reference Configuration Manager Proxy Communication Ports Page The Configuration Manager Proxy communicatio n ports page can be used to change the default communication ports. The page contains the following elements: Use custom ports Select this option to override the defa ult communication ports. Ports for incoming connections to SC[...]

124 Technical Reference Parallels NetBoot Server Configuration Wizard SMS Provider Location Page The SMS Provider location page is used to specify the IP address or hostname of the server where the SMS Provider is installed. The page contains the following elements: Local Server Select this option if the SMS Provider is installed o n the server whe[...]

125 Technical Reference Note: The account must have read/w rite access to the SMS Provider. The page contains the following elements: Local System account Specifies that the predefined Local System account should be used to run the Configuration Manager Proxy service. This account Specifies a user account name. This can be a local or a domain user [...]

126 Technical Reference NetBoot Image Path Page The NetBoot image path page is used to specify a folder where the NetBoot server will store .dmg images. The page contains the following elements: Path Specifies the image path.[...]

127 Technical Reference Enable Unknown Macs Support Page The Enable unknown macs support page allows you to specify whether the NetBoot s erver is allowed to work with Macs not assigned to the SC CM site. A Mac assigne d to the site can be fully managed via SCCM. An unknown Mac is recognized on the network, but has not joined the SCC M site and the[...]

128 Technical Reference Software Distribution Wizards Create Package and Program Wizard The Create Package and Program Wizard is used to create a software di stribution package and a program. Please note that some o ptions that can be set using the wizard are not used and will be ignored. The following describes which options are supported and whic[...]

129 Technical Reference All other fields on the Requirements page are ignored. The Summary , Progress , and Completion pages don't have user editable fields. Property Pages Parallels Discovery Properties The Parallels Discovery Properties dialog displays information about discovery and provides controls to modify discovery properties. The disc[...]

130 Technical Reference The General tab contains the following elements. Enable network discovery Enables or disables network discovery. Nmap scan settings: Specify the TCP ports to scan Specifies the ports to scan. You can e nter multiple ports separated by a comma, space, or semicolon. Nmap scan settings: Nmap timing policy Specifies the Nmap tim[...]

131 Technical Reference Client Push Installation Accounts list Contains the names of user accounts that di scovery will use to log in to remote Mac computers. The following options are available to manage user accounts: • New icon: Opens the Mac OS X User dialog to add a Mac account. • Delete icon: Deletes the selected account from the list. ?[...]

132 Technical Reference The following options are available for managing the sub nets searched during a Network Discovery run: • New icon: Opens the New Subnet Properties dialog to add subnet information to the discovery polling list and to initially enable the specific subnet search. Note: Specifying a subnet does not guar antee that it will be [...]

133 Technical Reference Allows to specify a filter for the Boundaries to search lists. You can type any part of the text that might appear in the boundary's name, type, or description. Check All Selects all boundaries in the list. Uncheck All Clears all boundaries in the list. Parallels Discovery Properties: Schedule Tab Use the Schedule tab o[...]

134 Technical Reference The following options are available to manage Network Discovery schedules: • New icon: Opens the Custom Schedule dialog to add a new schedule to the schedule list. This schedule may be for a one-time only run, or be a recurring schedul e. • Properties icon: Opens the Custom Schedule dialog to modify a selected schedule f[...]

135 Technical Reference OK button Saves the configuration item. Cancel Closes the dialog without saving the configuration item. Help Displays this help topic. Mac OS X Configuration Profile (from file) Dialog Use this dialog to create a Mac OS X configuratio n item from an existing Mac OS X Configuratio n Profile file. Mac computers will be evaluat[...]

136 Technical Reference Select this option if you want to install the conf iguration profile using the current user's s ecurity context. Note that the System Policy Control payload (designa ted by specifying com.apple.systempolicy.control as the PayloadType) must only exist in a devi ce profile. If the payload is present in a user profile , an[...]

137 Technical Reference The dialog contains the following elements: Name Specifies the configuration item name. Description Specifies the configuration item description. Key type: Personal If this option is selected, a personal key will be used to encrypt each Mac. Key type: Institutional If this option is selected, an institutio nal key will be us[...]

138 Technical Reference Parallels Desktop Configuration Profile Dialog Use this dialog to create a Parallels Desktop configuration profile. Parallels Desktop on Mac computers will be evaluated for compliance using the configuration that you specify here. The configuration options in the dialog are grou ped by functionality. To make modifications: 1[...]

139 Technical Reference License Specifies Parallels Desktop license information. USB Specifies USB settings. Updates Specifies Parallels Desktop automati c update options. Network Specify networking settings. Miscellaneous Specifies miscellaneous configuratio n options. OK button Saves the configuration item. Cancel button Cancels the changes and c[...]

140 Technical Reference Virtual Machine Configuration Profile Dialog Use this dialog to create a configuration item co nt aining Parallels virtual machine configuration settings. Virtual machines on client Macs will be evaluated against the configuration settings that you specify here. The configurations option s in the dialog are grouped by functi[...]

141 Technical Reference Resources Specifies the CPU, RAM, video me mory, and boot settings. Startup / Shutdown Specifies virtual machine startup and shutdown settings. Optimization Specifies performance, power, and fr ee space optimization settings. Security Specifies virtual machine security settings, including password-protecting virtual machine [...]

142 Technical Reference New Subnet Assignment Dialog Use this dialog to specify a subnet to be searched by Network Discovery. The dialog contains the following elements: Subnet A subnet number in IP format (f or example, 131.24.10.0) to be searched by Network Discovery. Mask The subnet mask for the subnet nu mber (for example, 255.255.255.0). Enabl[...]

143 Technical Reference Custom Schedule Dialog Use this dialog to schedule the start, recurrence pattern, and duration of an operation. The dialog contains the following elements: Time Specifies the Start date and time or Duration of the operation. Recurrence Pattern Specifies how often this operation recurs. The following options are available for[...]

144 Technical Reference Days: Values from 1 to 31 days, inclusive. Max OS X User Account Dialog Use this dialog to specify a Mac OS X user account that Network Discovery should use to connect to remote Mac computers. The user a ccount mu st have administrative rights on the Mac. The dialog contains the following elements: User Name Specifies the Ma[...]

145 Technical Reference Click the Send Report button to collect the report data and send it to Parallels Support. A progress bar will be displayed informing you of the data collection progress. Close button Click the Close button to close the dia log. Send Problem Report Dialog Use this dialog to send a problem report to Parallels Support. The dial[...]

146 Technical Reference • Description — specifies whether the report was generated a utomatically or manually by a user. Send Report button Sends the selected problem report to Parallels Support and removes the report from the list. The report is also deleted from the server on which it resides. Delete button Removes the reports from the list a[...]

In This Chapter Ports Used by Parallels Mac Management ............................................................... 147 Log Files in Parallels Mac Management for Microsoft SCCM .................................... 148 Changing Log File Rotati on Limits ............................................................................ 151 Parallels Mac[...]

148 Appendices Mac client 8000 Mac Required Required for Parallels Mac Client to accept incoming connection from Parallels Configuration Manager Proxy . In addition, RPC ports need to be open in order to allow WMI/RPC traffic to pass through. RPC ports can be opened by enabling a Group Policy firewall exception . Open the Group Policy Object Editor[...]

149 Appendices pma_isv_proxy_service.log This is the ma in SCCM Proxy log file. It is updated as needed while the SCCM Proxy service is running. It contains i nformation related to the SCCM Proxy operations su ch as starting/stopping the service, reading various system properties, starting or stopping M ac management utilities and others. pma_disco[...]

150 Appendices The following table describes the Site Server log files which are located in the <SCCM_InstallationPath>LOGS folder. The files may contain informa tion about the SCCM Proxy component. Log file Log file description Colleval.log Records activities when collections are created, changed, and deleted by the Collection Evaluator. Da[...]

151 Appendices MP_Status.log Converts XML.svf status message f iles from clients and copies them to the site server. The following table describes the Admin UI log files, which are located in the <SCCM_InstallationPath>AdminUIAdminUILog directory. The files may contain information about the Configuratio n Manager Console Extension compo nen[...]

152 Appendices pma_discovery Windows %Windir%Logspma_discovery.log pma_problem_monitor Windows %Win dir%Logspma_problem_monitor.log pma_report_tool Windows Mac OS X %Windir%Logspma_report_tool.log /Users/<user_name>/Library/Logs pma_agent Mac OS X /Library/Logs/pma_agent.log pma_agent_ui Mac OS X /Lib rary/Logs/p ma_agent_ui.log A log f[...]

153 Appendices • To set the maximum number of files in a rotation set, modi fy the value of the “MaxNumberOfSavedLogs” parameter. On Mac OS X computers, the log rota tion limits are stored in the /Library/Preferences/com.parallels.pma.agent.plist file. To modify the limits: • Open the com.parallels.pma.agent.plist file in a text editor. •[...]

Index A About Parallels Mac Management for Microsoft SCCM 2012 - 7 About This Guide - 7 Appendices - 148 Application Management - 89 C Certificate Authority and PKI Integration Overview - 20 Changing Log File Rotation Limits - 152 Checking Installation Requirements - 10 Checking User Rights Requirements - 14 Choosing Installation Type - 89 Configur[...]

Index Exporting Client Certificate for Distribution Point - 26 F FileVault 2 Configuration Item Dialog - 137 FileVault 2 Encryption with Institutional Recovery Key - 68 FileVault 2 Encryption with Personal Recovery Key - 74 H Hardware and Software Inventory - 58 I Initiating Policy Retrieval - 53 Installing Active Directory Certificate Services Rol[...]

Index Sending Package to Distribution Point - 101 Sending Problem Reports from Mac Client - 114 Sending Problem Reports From Mac Client - 55 Sending Problem Reports Using Configuration Manager Console - 112 Sending Problem Reports Using Windows Reporting Utility - 113 SMS Provider Location Page - 120, 125 Software Distribution - 98 Software Distrib[...]