Embed Size (px)
Citation preview
DOCUMENT – APRIL 2019
PRINTED 6 NOVEMBER 2019
DEPLOYING WIN32APPLICATIONS: VMWAREWORKSPACE ONEOPERATIONAL TUTORIALVMware Workspace ONE
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 2
Table of Contents
Overview
– Introduction
– Audience
Deploying a Standard MSI Application File
– Introduction
– Understanding Installation Behavior
– Getting the Uninstall Command
– Getting the Exit Code
Deploying Win32 Applications
– Deploying a Standard ZIP Application File - Example Microsoft Office Pro Plus
Reviewing Additional Application File Samples
– Introduction
– MSI Samples
– ZIP Samples
– EXE Samples
Summary and Additional Resources
– Conclusion
– Terminology Used in This Tutorial
– Additional Resources
– About the Authors
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 3
– Feedback
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 4
VMware Workspace ONE UEM Operational Tutorial:Delivering Win32 Applications
OverviewIntroductionVMware provides this operational tutorial to help you with your VMware Workspace ONE®environment. This tutorial shows you how touse Workspace ONE UEM to manage Windows 10 Applications through a series of exercises including managing Win32 apps,deploying Microsoft Office 365 ProPlus, and reviewing additional application file samples.
AudienceThis operational tutorial is intended for IT professionals and Workspace ONE administrators of existing production environments. Bothcurrent and new administrators can benefit from using this tutorial. Familiarity with networking and storage in a virtual environment isassumed, including Active Directory, identity management, and directory services. Knowledge of additional technologies such asVMware Workspace ONE® Access (formerly VMware Identity Manager) and VMware Workspace ONE® UEM is also helpful.
Deploying a Standard MSI Application FileIntroductionThis exercise introduces you to managing Win32 applications with Workspace ONE.
Understanding Installation BehaviorWhen deploying numerous apps to end-user devices, it can take some time to install all the device applications. After device on-boarding completes, apps queue up for the device to install per Windows operating system specifications, configured timeout values,and retry logic. Dependency files are installed prior to the main application.
Installation Behavior VariablesA few variables impact the way applications distributed from the Workspace ONE UEM Console install on devices.
User Type - Devices can have either admin or standard users.Privileges - Applications may allow user privileges or require administrative privileges.Context - Applications can install to the device or the user context.
The following table outlines how these variables impact installation behavior.
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 5
User Type Privileges Context Install Behavior
Admin User
AdminDevice Install without prompt
User Install with prompt
UserDevice Install without prompt
User Install with prompt
Standard User
AdminDevice Install without prompt
User Install fails
UserDevice Install without prompt
User Install fails
Getting the Uninstall CommandIn this exercise, you use command-line options to determine the uninstall command you might use when creating an uninstall script.You can then upload the script on the Files tab when deploying an app.
In a command-line session, enter setup.exe /?. If the EXE contains an underlying MSI, use the msiexec uninstall1.command: msiexec /x setup.exe.Install the app on a reference device.2.When installation completes, look at the HKEYs on the device’s listed registries.3.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\UninstallHKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UninstallHKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\
Getting the Exit CodeIn this exercise, you determine the exit codes you might use if you select Using Custom Script on the Deployment Options tab.
Use the environmental variable %errorlevel% to get exit codes. Use it in conjunction with built-in DOS commands like ECHO, IF,and SET to preserve the existing %errorlevel% value.
In a command-line session, run the install command for the Win32 application.1.Run ECHO %errorlevel%.2.If the Win32 application requires a reboot for installation, the variable returns the reboot exit code.3.
Deploying Win32 ApplicationsDeploying a Standard ZIP Application File - Example Microsoft Office Pro PlusThis exercise helps you configure and assign Microsoft Office 365 ProPlus with a configuration file for click-to-run delivery. The procedures are sequential and build upon one another, so make sure that you complete each section in order.
For more information on the Office Customization Tool, please see Overview of the Office Customization Tool
Disclaimer: This information may change over time
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 6
Pre-RequisitesBefore we can upload the files to Workspace ONE UEM, we need to ensure a few steps are taken care of
Create Configuration.xml file using the Office Customization Tool1.Create the Uninstall.xml2.Download the Office Deployment tool3.Office Customization Tool Tips4.
You must also must satisfy the following requirements:
Workspace ONE UEM Console9.2 or laterSoftware Package Deployment enabled
Windows 10 device that meets the following specifications:Enrolled in Workspace ONE UEMA virtual machine or spare Windows deviceWindows 10 with the latest updates installedWorkspace ONE Application installed on Windows 10 deviceAdministrative rights
Folder containing Office365 files with the logo saved as 0365-logo.jpg.
Create Configuration.xml file using the Office CustomizationToolCreate Configuration.xml file using the Office Customization Tool
Go to config.office.com1.
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 7
Click Create under Create a new configuration2.
Configure the Office deployment settings1.Export the XML2.
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 8
Select file format - Keep Current Settings1.Click OK2.Read and Accept the license agreement3.Ensure file name is configuration.xml4.
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 9
Create the Uninstall.xmlRecommended :
If you want to have an uninstall command in the Workspace ONE UEM console, create a uninstall.xml file. Paste the following text inthe uninstall XML file.
Copy and paste the below into notepad and name the file uninstall.xml
<Configuration><Remove><Product ID=”O365ProPlusRetail”><Language ID=”en-us”/></Product></Remove><Display Level=”None” AcceptEULA=”TRUE”/></Configuration>
Download the Office Deployment toolDownload the Office Deployment Tool 1.Run the exe file2.Export the files to a location for later3.
Office Customization Tool TipsUsing the Office Customization Tool, you can customize your installation of Office to meet the organizations needs.
You can select configurations such as:
Select which Office Edition to installConfigure Specific Office Applications to install
E.g. Outlook, Word, Excel, PowerPoint, TeamsConfigure how Office receives UpdatesConfigure Languages and more
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 10
For more information on the Office Customization Tool, please see Overview of the Office Customization Tool
Create Office Zip package
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 11
Select Configuration.xml , uninstall.xml and setup.exe1.Sent files to ZIP folder. 2.Name the file. E.g Office3.
Upload Office Zip in Workspace ONE UEM consoleAfter uploading Office 365 ProPlus to the Workspace ONE UEM Console, set its configurations, assign it to groups, and deploy it todevices.
Upload Application into Workspace ONE UEM
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 12
In the left hand side of the Workspace ONE UEM console, select Apps and Books.1.Select Internal Application.2.Select Add Application and Upload.3.Browse for the Office.zip file and click Save.4.Select No for Is this a dependency app?.5.Select Continue.6.
Configure the Details Tab
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 13
Ensure the Details tab is selected.1.Enter Office 365 Pro Plus for the Name.2.Select 64-bit for the Supported Processor Architecture. Verify which processor architecture is relevant for your device.3.
Note: When uploading MSI files all possible fields are automatically pre-populated with all of the metadata, however for ZIP packages you will have to generate a Name as well as some of the Deployment options.
Configure the Files Tab
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 14
Navigate to the Files tab.1.Scroll down to find the App Uninstall Process section.2.Select Input for the Custom Script Type.3.Enter setup.exe /CONFIGURE uninstall.xml in the Uninstall Command text box.4.
Configure the Deployment Options TabDefine When to Install
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 15
Configure details about what requirements must be met in order to install the application.
Select the Deployment Options tab1.Look for the When to Install Section2.Enter 3 for the Disk Space Required which specifies the amount of disk space the device must have available to install the3.application.Select GB for the Units of the Disk Space Required.4.Enter 50 for the Device Power Required which specifies the battery power, in percentage, that the device must have to install5.the application.Enter 500 for the RAM Required which specifies the amount of RAM the device must have to install the application.6.Enter MB for the Units of the RAM Required.7.
Define How to Install
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 16
Scroll down to find the How To Install section.1.Leave Install Context to Device2.Enter setup.exe /configure configuration.xml for the Install Command.3.Leave Admin Privileges as Yes4.Change Device Restart to specified settings. In this example we are using Restart If Required5.Enter 3 for the Retry Count, which specifies the number of times the system attempts to install the application after an6.unsuccessful attempt.Enter 5 for the Retry Interval, which specifies the time (in minutes) the system waits when it tries to install the application7.after an unsuccessful attempt.Enter 60 for the Install Timeout, which specifies the time (in minutes) the system allows the installation process to run8.without success.Enter 1614 for the Installer Reboot Exit Code, which specifies the code the installer outputs to identify a reboot action.9.Enter 0 for the Installer Success Exit Code, which specifies the code the installer outputs to identify a successful installation.10.
Define When To Call Install Complete
Scroll down to find the When To Call Install Complete section1.Select Defining Criteria for Identity Application By2.
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 17
Select Add3.
In the Criteria Type drop-down , select File Exists1.Enter the Path C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE2.
Note: There are multiple Criteria Types to choose from, allowing you to be flexible in determining if your deployment was successful. You can also add multiple Criteria configurations and link them together logically to cover complex deployments.
Add the Application Icon
Select the Images tab.1.Select the Icon tab.2.Click the area labeled Click or drag files here3.Navigate to the folder containing the Office365 files and Select the file4.Your icon should be uploaded as below5.
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 18
Set Terms of Use
Select the Terms of Use tab.1.If you decide to have a Terms of Use that your users must accept before installing applications, you can configure that here.2. For this exercise, select None.Click Save & Assign.3.
Assign & Publish
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 19
Click Assignments1.Click Add Assignment2.
Select Add Assignment to add the assignment group. 1.Select the Select Assignment Groups search box and select All Devices.1.Select On-Demand for the App Delivery Method.2.Select Show for Display in App Catalog.3.
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 20
Select Enabled for Make App MDM Managed if User Installed..4.Select Add.5.
Click Save and Publish.2.
Confirm the Application Appears in the List View
In the Internal Applications List View, confirm that the Office 365 Pro Plus application is displayed.
You have successfully added the Office 365 ProPlus app to Workspace ONE UEM for deployment.
SummaryYou can deploy Office 365 ProPlus with Workspace ONE UEM using software distribution.
The following use case explains deploying Office 365 ProPlus as a light office install using software distribution. The use case coversprerequisites such as using the Office Customization Tool to ensure only Outlook, Work, Excel, PowerPoint, and Teams are installed;Creating a Office.zip file for scripted install; and then uploading and configuring the deployment settings with Workspace ONE UEM
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 21
The VMware Workspace ONE application life cycle flow, also known as software distribution, exists for all internal applications. Usesoftware distribution to deliver Win32 applications, track installation statuses, keep application versions current, and delete oldapplications.
Note: VMware software distribution supports MSI, EXE and ZIP files. The required application details vary by application and file type.For more information, see Additional Application Samples. To address scripting needs, use product provisioning.
Reviewing Additional Application File SamplesIntroductionWorkspace ONE UEM supports the upload and deployment of MSIs, EXEs, and packaged apps. In this exercise, review additionalexamples of the supported application types, and their required Workspace ONE UEM configurations.
Refer to the article Software Distribution: Tips and Troubleshooting for a list of validated use cases as well as instructions on retrievingrequired application information.
MSI SamplesMSI application delivery is a highly automated procedure that's ideal for remote and enterprise worker devices. In this section, reviewthe 7-Zip and Global Protect MSI application samples.
7-Zip
Install Command msiexec /i "7z1700-x64.msi" /qn
Uninstall Command Use default setting
Install Context Device
Admin Privileges No
Success Code 0
Reboot Code 1614
When to Call Install Complete Use default setting
Global Protect
Install Command msiexec /i "GlobalProtect64.msi" /qn
Uninstall Commandmsiexec /x {9F062897-EF0D-405E-AF59-AED495611981} /qn
Install Context Device
Admin Privileges No
Success Code 0
Reboot Code
When to Call Install Complete Value Type String
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 22
ZIP SamplesIn this section, review the PocketOE.zip and the GPO Migration Tool application samples. The PocketOE.zip shows an MSI deployedas a zip, and the GPO Migration Tool shows a zip with a PowerShell script used for installation detection.
PocketOE.zip
Install Command msiexec /i "PocketOE.msi" /quiet
Uninstall Command msiexec /x "PocketOE.msi" /quiet
Install Context Device
Admin Privileges Yes
Success Code 0
When to Call Install CompleteType: App ExistsAppID: {AF90D5E8-5F3E-4DD3-A57D-3EFE740F204D}
GPO Migration Tool
Install Commandpowershell -executionpolicy bypass -FileDeployPackage.ps1
Uninstall Command LGPO.exe
Install Context Device
Admin Privileges Yes
Success Code 0
When to Call Install Complete
Upload the Custom PowerShell Script File:LGPOConfirmPackageInstall.ps1Run Command: powershell –executionpolicybypass –File LGPOConfirmPackageInstall.ps1
EXE SamplesIn this section, review the Firefox .EXE application samples.
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 23
Firefox
Install Command Firefox Setup 56.0.2 -ms
Uninstall Command%ProgramFiles%\MozillaFirefox\uninstall\helper.exe /S
Install Context Device
Admin Privileges Yes
Success Code 1
Reboot Code 0
When to Call Install CompleteRegistry path:HKLM\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB
Summary and Additional ResourcesConclusionThis tutorial shows you how to use Workspace ONE UEM to manage Windows 10 updates through a series of exercises.
Terminology Used in This TutorialThe following terms are used in this tutorial:
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 24
Term Description
adaptive access The ability to control access and authentication methods to sensitive apps based on a device’s managed status.
additive Includes only changes developed after the latest version of the application or the last additive patch.
app dependencies Applications required by the environment and devices to run the Win32 application.
app patches Files that apply additive or cumulative fixes, updates, or new features to applications.
app transforms Files that control application installation and can add or prevent components, configurations, and processes during the process.
app uninstall process Scripts that instruct the system to uninstall an application under specific circumstances.
application store A user interface (UI) framework that provides access to a self-service catalog, public examples of which include the Apple App Store, the Google Play Store, and theMicrosoft Store.
auto-enrollment Auto-enrollment simplifies the enrollment process by automatically enrolling registered devices following the Out-of-Box-Experience.
BitLocker Full disk encryption available for Windows, focused on addressing data leakage or data theft scenarios from stolen, lost, or incorrectly decommissioned devices.
bring your own device (BYOD) The process of providing secure access to corporate data, apps, and content on an employee-owned device without invading employee privacy to their personal data,apps, or content.
business mobility The concept of being able to provide secure access to your business services, infrastructure, and content to enable your workforce to work remotely.
catalog A user interface (UI) that displays a personalized set of virtual desktops and applications to users and administrators. These resources are available to be launched uponselection.
cloud Asset of securely accessed, network-based services and applications. A cloud can also host data storage. Clouds can be private or public, as well as hybrid, which is bothprivate and public.
conditional access To provision access to a resource or service, based on user entitlements or roles.
container The separation of corporate and personal data on employee-owned devices, allowing IT administrators to manage corporate applications and profiles without invadingemployee privacy or personal apps and content.
cumulative Includes the entire application, including any changes since the latest version of the application, or the last patches.
data leakage protection Software-controlled policies that determine how and where data can be transferred or shared to.
device enrollment The process of installing the mobile device management agent on an authorized device. This allows access to VMware products with application stores, such as VMwareWorkspace ONE Access (formerly VMware Identity Manager).
Device Health Attestation Module that gathers device health measurements and reports these measurements to the Health Attestation Service for evaluation.
enrollment The process of allowing your device to be managed by the software-defined policies of the chosen enterprise mobility management provider.
enterprise mobility management The concept of using software and policies to both secure and provide access controls for mobile devices.
files and actions The combination of the files delivered to a device and the actions that file performs on the device. Files and actions cannot be assigned directly to a device. Instead, assignfiles and actions to a product, which then provisions to devices.
Health Attestation Services Cloud service that evaluates health measurements from the device to determine the health state.
identity-as-a-service Identity and access management services through the cloud to provide SSO identity federation and user-access provisioning.
identity provider (IdP) A mechanism used in a single-sign-on (SSO) framework to automatically grant the user access to a resource based on their authentication to a different resource.
mobile application management The concept of managing access, deployment, and restrictions of mobile applications using software and services.
mobile device management(MDM) agent
The concept of managing mobile devices using software installed on an authorized device to monitor, manage, and secure end-user access to enterprise resources.
multi-factor authentication Access control process that requires users to authenticate using more than one method of authentication by providing something the user knows (a password) andsomething the user has, such as a hardware token, smartcard, or phone, or something the user is, such as a fingerprint or retina.
one-touch login A mechanism that provides single sign-on (SSO) from an authorized device to enterprise resources.
per-app VPN Policies that allow individual apps to access VPN configurations without granting device-wide access to the VPN connection.
public app stores Portals where users can access and obtain publically published applications, such as the iOS App Store and Google Play Store.
service provider (SP) A host that offers resources, tools, and applications to users and devices.
smart groups Groups that control which devices get which product, based on how the group is created.
step-up authentication Restricting applications or services to require a stronger authentication method, depending on the sensitivity or severity of the resource.
unified endpoint management A single platform that allows organizations to manage and secure every endpoint, any app, and content across deployment use cases.
virtual desktop The user interface of a virtual machine that is made available to an end user.
virtual machine A software-based computer, running an operating system or application environment, that is located in the data center and backed by the resources of a physical computer.
Windows Information Protection Formerly Enterprise Data Protection (EDP), a Windows solution to assist in preventing data leakage without impeding the user experience.
For more information, see the VMware My Workspace ONE Glossary or the VMware Technical Publications Glossary.
DEPLOYING WIN32 APPLICATIONS: VMWARE WORKSPACE ONE OPERATIONAL TUTORIAL
DOCUMENT | 25
Additional ResourcesFor more information about Workspace ONE, explore the VMware Workspace ONE Activity Path. The activity path provides step-by-step guidance to help you level-up in your Workspace ONE knowledge. You will find everything from beginner to advanced curatedassets in the form of articles, videos, and labs.
Additionally, you can check out the VMware Workspace ONE and VMware Horizon Reference Architecture which provides aframework and guidance for architecting an integrated digital workspace using VMware Workspace ONE and VMware Horizon.
About the AuthorsThis tutorial was written by:
Josué Negrón, EUC Staff Architect Darren Weatherly, Senior Technical Marketing Architect Hannah Jernigan, Technical Writer, End-User-Computing Technical Marketing
FeedbackYour feedback is valuable.
To comment on this tutorial, contact VMware End-User-Computing Technical Marketing [email protected].
VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001
www.vmware.com
Copyright © 2019 VMware, Inc. All rights reserved. This product is protected by U.S. and international
copyright and intellectual property laws. VMware products are covered by one or more patents listed at
http://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. in
the United States and/or other jurisdictions. All other marks and names mentioned herein may be
trademarks of their respective companies.
