PC Manager Meeting

1
PC Manager Meeting

• November 29th, 2006

2
Today

• Updates
• Next Meeting
• Training
• License
• Networking
• Windows Policy
• Security
• Cool Tool of the Month
• OSX Central Tools Cele Bruce

3
Next Meeting

• December 27th
• Key Management Service (Ill explain in a minute)
• New get_cert for Windows!

4
Training Update

• Understanding and Using Digital Certificates
  (PKI) Dec. 4, 2006
• Access 2003 Forms and Reports Dec. 5, 2006

5
Licensing

• EA Presentation Adam Walters
• Key server is back (sort of)!
• Vista require a Key Management Service (KMS)!
• Clients check into KMS service to
  register/reregister on a predetermined basis.
• KMS service checks into Microsoft on a
  predetermined basis
• Machines that cant check in after 30 days go to
  Reduced Functionality Mode (RFM)
• CD plans to put up the site KMS
• Testing now for Vista.. Lots of questions..
• More info as we learn it..

6
Networking

• And now for something completely different.. A
  change to the lab SSID on January 9th

7
Windows Policy Committee

• Next Meeting
• Dec 6th 130-230pm, WH5SW
• Status of Vista
• Expiring Service Accounts
• Other agenda items?

8
Security Updates

• Disk Encryption
• DOE Labs looking at laptop/pc disk encryption
• DOE has an agreement with pointsec
  (www.pointsec.com) for reduced cost
• Pointsec clients for windows and linux
• Pointsec client FIPS compliant
• Any one else looking at disk encryption?

9
Security Updates

• Entrust
• Required by DOE for Official Use Only docs
• Initial Need list under 20 people
• Requires windows os
• Outlook email client available
• User must be a US citizen.
• User must be approved by lab RA (Jack Schmidt
  schmidt_at_fnal.gov)
• Requires user and RA key to activate.

10
Cool Tool of The Month

• Userpasswords2 - Hidden Advanced User Control
  Panel!
• Lists all available users on the computer and
  provides you with some other controls
• Add / Remove / Properties
• Add will open a simple Add User wizard
• Remove will delete the selected user
• Properties will let you change their user name,
  description, or their group membership (standard
  user / restricted user / admin / etc.).
• Reset Password Ability to reset the system
  password for the local Administrator account
  among others
• The Advanced tab lets you manage stored passwords
  and .NET Passport information, and open the Local
  Users and Groups snap-in for detailed user
  account editing.
• Require users to press CtrlAltDelete checkbox

11
Cool Tool of The Month
type control userpasswords2 from the command
line or in the Run dialog box (must be admin)
12
Main Topic

• OSX Central Tools Cele Bruce

13
Background

• DOE mandate to centrally manage supported
  operating systems
• Central inventory (hardware/software) database
• Tie in to Hercules
• Central patching method. Apply patches to all
  FNAL-owned OSX systems
• Central required configurations banner, etc
• Baseline compliance (FNAL mandate)
• Needed something by Fall 2006!

14
Product(s)

• Quest Software (www.quest.com)
• Vintela Authentication Services
• Active Directory Client for OSX systems
• Vintela Management Extensions
• SMS Client for OSX systems (also available for
  linux and Solaris)

15
Vintela Authentication Services

• Active Directory Client for OSX systems
• GPO like function for OSX
• Have not yet tested.. Will require putting OSX
  systems in the Fermi domainneeds Winpol
  discussion.

16
Vintela Management Extensions

• SMS Client for OSX systems (also available for
  linux and Solaris)
• Hardware/Software Inventory
• Patch Management
• Uses existing SMS Management Console
• Uses existing SMS database and report
  infrastructure
• Testing.. Moving to production

17
Vintela Management Extensions
18
(No Transcript)
19
Vintela Management Extensions

• Issues
• Patches updated whether machine needs it or not
• Working with Quest
• Remote Tools. SMS server needs root access to
  desktops. Best way to implement?
• Custom Collections need to be built based on
  system name until OSX systems can join the domain
• How to roll it out?

20
Vintela Management Extensions

• Implementation
• Plan to move from test SMS server to production
  server in early December.
• Testers still needed!
• Presently CD, LSS, CST
• Covered under existing SMS Major Application
• Mac Users meeting to explain why coming soon!
• Dont have plans to manage OSX?
• Contact Jack Schmidt (schmidt_at_fnal.gov) or Wayne
  Baisley (baisley_at_fnal.gov)