Managing Computer Labs with ZENworks for Desktops

1. Managing Computer Labs with ZENworks for Desktops Kristi Wall University of Georgia kew@uga.edu

2. What is ZENworks for Desktops? • ZENworks for Desktops is Novell’s full featured desktop management system • Directory enabled desktop management system – utilizes Novell’s eDirectory • Offers both desktop management and application management capabilities

3. What does ZENworks for Desktops give me? • Workstation Imaging – image one or many workstations at a time • Application management, distribution and repair – on and off the network • Desktop Management Policies – secure workstations, manage user’s experiences and remotely manage users and workstations • Inventory – collect software and hardware info

4. What do I need to run ZFD? • Runs on either NetWare or Windows • eDirectory is required • Current version (ZFD 4) does not require the traditional Novell client • Modular agents necessary to provide various ZFD functions • ZFD functions outside a firewall

5. Our Focus Today… • Lab deployment and maintenance strategies • Locking down workstations with desktop policies – how do you handle exceptions? • Restricting applications • Directory design considerations • UGA’s MyID lab authentication

6. Interesting Imaging Aspects • ZFD imaging is based on a Linux kernel • Three ways to initiate an imaging session • Linux partition on the workstation, Imaging media (CD or diskettes), PXE (Preboot Services) • File level imaging solution – take advantage of add on imaging • ZENworks Image Safe Data – safely store workstation specific information

7. New Lab Deployment • Multicast from workstation or server • New machines dynamically retrieve IP, Windows Networking and DNS info • Image selection can be based on hardware rules you define • Use add on images for machines with different software requirements

8. Lab Upgrades or Maintenance • Flag machine(s) for automatic imaging operations when necessary • After an image is restored the Image Safe Data overwrites values stored in the image • Netbios Name • IP information (DHCP or static) • Workgroup membership • eDirectory workstation object information, if any • Randomizes the SID • Scheduled Wake-on-LAN services

9. Using ZFD for Workstation Security • Control user authentication and access • Use ZFD policies to control what user’s can do • Policies applied to workstations will apply to all users who use that workstation • Policies applied to users will apply wherever that user logs in • Using workstation and user policies give a combined security effect

10. User Authentication and Access • How do user’s authenticate? • Don’t use single account for lab logins • Dynamic Local User policy for NT/2K/XP • Designate local group membership • Can be tied to specific workstations • Volatile or nonvolatile local user accounts • Use NTFS, if possible, to enhance ZFD’s security policies • Change default group security settings!

11. What rights do users need? • For Application Launcher to work properly, the logged-in user requires the following rights: • Full Control access to the NAL cache directory (typically, C:\NALCACHE). • Full Control access to the user's TEMP directory (typically, C:\DOCUMENTS AND SETTINGS\username\LOCAL SETTINGS\TEMP). • Read\Write rights to the HKEY_CURRENT_USER\ Software\NetWare\NAL\.1.0 registry key. • Read rights to the HKEY_LOCAL_MACHINE\Software\NetWare\NAL\1.0 registry key • Read rights to the HKEY_LOCAL_MACHINE\Software\Novell\ZENworks registry key. • In addition, the System user requires full access to all areas of the workstation. By default, this access is granted to the System user as a member of the Administrators group. Do not limit the default rights given to the Administrators group.

12. ZFD Desktop Management Policies • Extensible Policies still available – POLEDIT anyone? • Win98/NT/2K/XP • Import custom ADM files • Group Policies provide more control • Win2K/XP • Same as Group Policies in AD • Settings stored in eDirectory and applied when necessary

13. Interesting GP Aspects • By default User based group policies don’t remain in effect after a user logs out. • User, Computer and Security group policy settings can be applied to a user or workstation. • Policy’s can be scheduled to be applied at a certain time (event or time) • Workstation group policies have loopback support • Replace mode (don’t apply user’s settings) • Merge mode (apply workstation’s settings last – last policy applied wins)

14. Common Group Policy Settings for Labs • Configure Windows Components • Internet Explorer • NetMeeting • Task Scheduler • Windows Installer • Remove Options from Windows Explorer • Control Desktop environment • Remove access to Control Panels • Remove System Settings and Apps

15. Locking down Windows Explorer • Remove dangerous options from Explorer • Map/Disconnect Network Drive • Folder Options from Tools Menu (view file types, active desktop) • Context Menus (shortcut menus when you right click an item) • Hardware tab • Search button • Request alternate credentials for installs

16. Controlling Drive Access • Prevent or hide access to drives • Designate which drives are available (or not) to users. • Can prevent access completely • Causes some warnings when opening Explorer and dialog boxes within applications • Recommended: Hide drives and handle security through NTFS file rights

17. Controlling the Desktop • Start Menu and Taskbar control • Remove Settings (no control panel, printer) • Remove Run from Start Menu • Desktop control • Hide Icons on Desktop (all or some) • Control Active Desktop (enable, disable, prohibit changes)

18. Control System Settings & Apps • Don’t display Welcome screen at logon • Disable REGEDIT • Disable Command Prompt • Allow command prompt script processing? • Run or don’t run specified Windows apps or • prevents users from running programs that are started by the Windows Explorer process • Consider Rogue Process Management • Disable Autoplay

19. What about Admin access? • If you use extensible policies • FIRST create a reversed policy that reverses the policies you will create for regular users. • Associate that to YOU and other admins • If you use group policies • Create a reversal gp for yourself (just in case) • Be careful with Workstation Loopback Support • Arrange search policy to always find and apply user’s policies last

20. Restricting Applications • Novell Application Launcher (NAL) can be run as the shell for more security • Rogue Process Management • Application Launcher watches processes run on the workstation • Terminates and/or ignores processes not launched through Application Launcher • Can log rouge processes too • Allows exceptions

21. eDirectory Design Guidelines • Tree wide ZFD policies can be provided by one server. • You may want more ZFD servers depending on your network design. • Policies applied to different areas of the tree can be located together. • The search policy checks to find associations of policies and applications, not the objects themselves.

22. UGA’s MyID lab authentication • EITS run labs authenticate to UGA’s central MyID service • Windows 2000 lab utilizing Dynamic Local User policy • DLU is only user policy applied to MyIDs • Only allowed DLU access to specified workstations in tree

23. Limitations & Problems • Don’t allow additional user policies • Recommend using Group Policies applied to workstation objects • Remember group policies containing user settings can be applied to workstations • Search policy only searches for policies and applications applied to the MyID container (only central EITS settings) • Departmental applications associated to lab workstation objects

24. Possible Futures • Extend MyID information to contain departmental and possibly class information • Synchronize MyID data to hierarchical eDirectory tree • Allow department policy and application associated to MyIDs – merge two tree ZFD settings on user login • Applications and policies can be applied to users with appropriate departmental affiliation and class load

25. ZFD Resources • This presentation will be posted off the UGA ZENworks web pages www.eits.uga.edu/lans/novell/zenworks • Official ZFD documentation www.novell.com/lg/zdpr/index • ZFD Coolsolutions www.novell.com/coolsolutions/zenworks • ZEN Email List ZEN@listserv.uga.edu