supporttbs.comsupporttbs.com/download/convergent/MyPC Manuals... · Web viewCreating a Windows Authentication Role ... it will create RegResources.xml in the location specified

SPECIAL CONFIGURATION GUIDE

© TODAY’S BUSINESS SOLUTIONS, INC. 2016

Special Configuration GuideVersion 6.1

SPECIAL CONFIGURATION GUIDE NVD13042015

2

ContentsContents .................................................................................................................................................. 2Enabling SSL in Cire and Internet Information Services (IIS) ................................................................. 3

Logging on to Cire .............................................................................................................................. 3Configuring SSL in Internet Information Services (IIS) on Windows 2012 R2 Server........................ 6Changing the Registry Key to “https”................................................................................................ 10IIS Reset in Windows 2012 R2 Server ............................................................................................. 11

Enabling NTLM Authentication in Cire and Internet Information Services (IIS) .................................... 13Logging on to Cire ............................................................................................................................ 13

Creating a Windows Authentication Role (Integrated Authentication Server). ............................ 15Configuring NTLM authentication in Internet Information Services (IIS) on a Windows 2012 R2Server ........................................................................................................................................... 17IIS Reset in Windows 2012 R2 Server ......................................................................................... 21

Installing MyPC on a US Server? ......................................................................................................... 22Post Installation Configuration in a Terminal Server / Virtual Desktop Infrastructure – One-to-ManyEnvironment (RRL Updater).................................................................................................................. 24

The Registered Resources Provider and RRL Updater ................................................................... 24Installing the Registered Resources Provider and RRL Updater ..................................................... 24

RRL Setup .................................................................................................................................... 24RRL Updater Setup ...................................................................................................................... 28Scheduling the RRL Updater........................................................................................................ 32

MyPC Server-Side Configuration in a Terminal Server / Virtual Desktop Infrastructure – One-to-ManyEnvironment .......................................................................................................................................... 33MyPC Behavior in a Terminal Server / Virtual Desktop Infrastructure – One-to-Many Environment. 35Changes in MyPC Operation in a Terminal Server / Virtual Desktop Environment .............................. 36

Terminal Server ............................................................................................................................ 36Virtual Desktop – One-to-One ...................................................................................................... 36Virtual Desktop – One-to-Many .................................................................................................... 36

Windows 7 Local Administrator Logon.................................................................................................. 37Mac Local Administrator Logon ............................................................................................................ 40

Changing MyPC Local Administrator Password (Mac)..................................................................... 44



3

Enabling SSL in Cire and Internet InformationServices (IIS)Once Cire and MyPC has successfully been installed you have the option to apply additional security settings by enabling the Secure Socket Layer (SSL) protocol. An SSL Certificate enables encryption of sensitive information during online transactions. Each SSL Certificate contains unique, authenticated information about the certificate owner. It is solely the owner’s responsibility to obtain the SSL Certificate and not the responsibility of TBS.

Please note that upon installation the option to use SLL is set to No by default. To ensure that use SSL is enabled please check the registry Use SSL is set to 1 to further configure SSL as explained in the section below.

Logging on to CireIn order to proceed from here, you’ll need to be able to log in to the Cire Owner Web Interface. TheURL will be something like:

http://m ys er ver /c ir e/o wlog in .as px

Replace myserver used in the above example with the name of your Cire Server. If you do not know these details please contact your IT Department.

Once you have successfully navigated to the Cire Owner login page it will prompt you to logon with the Owner Username and Password as shown below:

Please note that the Owner details are obtained upon installation.

A successful logon will display the Cire Owner login page.

Click on the System tab along the top of the page and click on Product Management in the left hand pane. The following screenshot will show.



4

Click on the Cire icon. The following screenshot will be shown.

Check the box Uses SSL to enable SSL, then click on the Update button.

Now click on the MyPC icon. The following dialogue will be shown.



5

Check the box Uses SSL to enable SSL, then click on the Update button.



6

Configuring SSL in Internet Information Services (IIS) onWindows 2012 R2 ServerOpen IIS Manager in Server Manager > Local Server > Tools > Internet Information Services (IIS) Manager and open the Application Pool section.

In Windows 2008 R2 use Start > Administrative Tools > Internet Information Services (IIS) Manager.

Internet Information Services (IIS) will open. Expand the local server and then expand the Web Sitesfolder. You will see the Default Web Site option within the list.



7

Right click on Default Web Sites and select Edit Bindings.



8

Type Select https from the from down menu

Port Check the port is set to 443

SSL Certificate Select your SSL Certificate from the drop down menu. In this example we used a self-assigned certificate for demonstration purposes.

Click OK to continue.



9

Click Close to continue.

Next we have to apply the SSL settings on Cire and MyPC website. Click on Cire and select SSL Settings from the right hand menu.

Select Require SSL and click on Apply.

Please note that the same steps as above should be followed to enable SSL for MyPC.



1

Changing the Registry Key to “https”Next you need to set the CireServer located in the registry to https.

To do this open the registry editor via Run > Type Regedit in the Search Field and locateHKEY_LOCAL_MACHINE\SOFTWARE\TBS\MyPC 3\MyPC Server in the left hand pane.



1

IIS Reset in Windows 2012 R2 ServerClick on the Windows button and select Run.

Type cmd in the field provided and click OK.

The Command Prompt window will open as shown below. Type iisreset and click Enter.

After a few seconds the message Internet services successfully restarted will show.

Once you attempt to access the web page via the standard URL ht t p: / / m y s e r v er/ cir e/ o w l o g i n. a s px you will be presented with the following screen.



1

In order to view the Cire Login page please use https e.g. ht t p s :// m y s er v er/ c i r e /o w l o g i n. a s px as shown in the screenshot below.



1

Enabling NTLM Authentication in Cire andInternet Information Services (IIS)Once Cire has successfully been installed you have the option to enable NTLM (NT LAN Manager). NTLM is an authentication protocol used in various Microsoft network protocol implementations. Originally used for authentication, NTLM is also used as an integrated single sign-on mechanism.

Logging on to CireIn order to proceed from here, you’ll need to be able to log in to the Cire Owner Web Interface. TheURL will be something like:

http://m ys er ver /c ir e/o wl og in .aspx

Replace myserver used in the above example with the name of your Cire Server. If you do not know these details please contact your IT Department.

Once you have successfully navigated to the Cire Owner login page it will prompt you to logon with the Owner Username and Password as shown below:

Please note that the Owner details are obtained upon installation.

A successful logon will display the Cire Owner login page.

Click on the System tab along the top of the page and select Login Management in the left hand pane. The following screenshot will show.



1

In the Authentication Methods section click on NTLM radio button.

Click on the Update button to continue.



1

Creating a Windows Authentication Role (Integrated AuthenticationServer).Before continuing to configure NTLM authentication in IIS please ensure that the WindowsAuthentication role is created.

Please note that this role may already be created in your environment. If so, please click on the link C o n f ig u r ing NT L M in IIS to continue to the next section.

On the server click on the Server Manager.

Click on Add roles and features. Select the Web Server (IIS) and search for Security (Installed). Select the option Windows Authentication by ticking the box as shown in the screen shot below.



1

Click Next and Install when prompted.



1

Configuring NTLM authentication in Internet Information Services (IIS)on a Windows 2012 R2 ServerOpen IIS Manager in Server Manager > Local Server > Tools > Internet Information Services (IIS) Manager and open the Application Pool section.

In Windows 2008 R2 use Start > Administrative Tools > Internet Information Services (IIS) Manager.

Internet Information Services (IIS) will open.



1

Expand the local server and then expand the Sites. You will see the Default Web Site option within the list.

Click on Cire and select Authentication in the right hand menu.

The following window will show.

You will see that Anonymous Authentication is enabled by default. In the Actions window in the right hand pane please click on Disable.



1

Next you need to Enable Windows Authentication.

Next click on Cire and select Content View (right click on Cire and select from there) which enables you to view all the files in the Cire web site.

In the right hand pane right click on Service.asmx and then select Switch to Features View. You will notice that the Services.asmx is now located in the left hand pane.



2

Click on Authentication, the following window will show.

Ensure that Anonymous Authentication is Enabled and Windows Authentication is Disabled.

Please note that the configuration should also be checked for the remaining MyPC web site. To do so, repeat the steps in this section above selecting the relevant web site when required.



2

IIS Reset in Windows 2012 R2 ServerClick on the Windows button and select Run.

Type cmd in the field provided and click OK.

The Command Prompt window will open as shown below. Type iisreset and click Enter.

After a few seconds the message Internet services successfully restarted will show.



2

Installing MyPC on a US Server?The MyPC web inteface fully supports US date format. In order to show the dates in US format you need to make a registry change.

To do this open the registry editor via Run > Type Regedit in the Search Field and locateHKEY_LOCAL_MACHINE\SOFTWARE\TBS in the left hand pane.

Right click on MyPC 3 and create a new key MyPC Web. Next right click on the newly created key and select new String.

In the field provided type UseAmericanTimes.The value must be set to 1.Set the value to 0 which will set the MyPC web interface back to the default time.



2

The changes will only take effect once you do an IIS Reset and restart the MyPC Server Service.



2

Post Installation Configuration in a Terminal Server / Virtual Desktop Infrastructure – One- to-Many Environment (RRL Updater)To ensure the correct operation of the MyPC Terminal Services / Virtual Desktop Infrastructure– One-to-Many Client in environments where both MyPC-controlled and non-controlled devices access the same Terminal Server / virtualized desktops it is absolutely essential that these instructions are followed.

Please note that when installing the RRL Updater application on a Windows 2008 or 2012MyPC server IIS 6 management compatibility must be installed in order to allow the application to run the installer.

Please note if installing on a 64-bit server you need to merge the Wow6432Node registry key to HKEY_LOCAL_MACHINE\SOFTWARE\TBS.

The Registered Resources Provider and RRL UpdaterIn some environments the Terminal Servers / virtualized desktops that will have the MyPC Client installed will be accessed by both devices that are managed by MyPC and others that are not. When a device connects that is not defined within MyPC Web Admin users will not be presented with the MyPC Status Screen (where available) nor will they be controlled by MyPC. The MyPC Terminal Services / Virtual Desktop Infrastructure – One-to-Many Client also features a client-side list ofNetBIOS names of devices that are managed by MyPC that is referred to when client devices connect to reduce load on the MyPC Server and if communication goes down between the MyPC Terminal Services client and the MyPC Server. This file is known as the Registered Resources file (RegResources.xml). During periods of No Communication only connecting devices found in RegResources.xml will be subject to the limited control of the MyPC Terminal Server / Virtual Desktop Infrastructure – One-to-Many Client in its offline mode. To achieve this the MyPC Client fetches the RegResource.xml file from the MyPC Server at start-up. A Server-side tool, the RRL Updater, maintains this list for deployment to MyPC Clients and should be configured to run periodically via the Window’s task scheduler, Scheduled Tasks.

Installing the Registered Resources Provider and RRL Updater

RRL SetupFirst begin by installing RRL Setup by double-clicking RRL Setup.msi which is located in the RRL Updater folder of the MyPC CD-ROM. The following opening dialogue will be displayed:

Please note that when installing the Registered Resources Provider (RRLsetup.msi) the path must exist or be created prior to entering the details in the installer.



2

Click Next to continue.

In the subsequent screen the path should be specified where the registered resources file will reside, this can be any place of your choice.

Please note that the “\” (back slash) has to be specified at the end of the path name e.g. C:\Program Files\Registered Resources|



2


Upon pressing Next RRL Setup is ready to be installed.



2

If anything is incorrect, please use the Back button to return to the appropriate dialog and make any necessary changes. Click Next to begin the installation.

On successful completion of the installation the following final screen is shown.



2

Click Close. The RRL Setup has now been installed. Now proceed to install and schedule the RRL Updater.

RRL Updater SetupOnce the RRL Setup has successfully been installed you can commence the installation of the RRL Updater Setup by double-clicking RRLUpdaterSetup.msi which is located in the RRL Updater folder ofthe MyPC CD-ROM. The following opening dialog will be displayed:



2


A dialog will then be shown asking you to select the drive and path where RRL Updater Setup will be installed.



3


Upon pressing Next the RRL Updater Setup is ready to install.



3

If anything is incorrect, please use the Back button to return to the appropriate dialog and make any necessary changes. Click Next to begin the installation.

On successful completion of the installation the following final screen is shown.

Click Close. The RRL Updater Setup has now been installed.

Run RRLUpdater.exe from the targeted path; it will create RegResources.xml in the location specified in the Web service installer.

All the Terminal Services and Virtual Desktop Infrastructure - One-to-Many Clients should now be able to access the RegResources.xml via the newly created RRL web application; furthermore, they will store it locally, providing a fail-safe mechanism if the server was to become unavailable.



3

Scheduling the RRL Updater To ensure that the RegResources.xml is regularly updated you will need to schedule the

RRLUpdater using Windows Scheduled Tasks. Browse to Scheduled Tasks via the Start Menu at Programs Accessories System

Tools Scheduled Tasks. Double click Add Scheduled Task and click Next. Browse to RRLUpdater.exe at C:\Program Files\TBS\RRL UpdaterSetup\. Configure the task to be performed at the interval and time required (this can be relatively

infrequent if you do not plan to frequently add or remove devices from the control of MyPC). Configure the task to be executed by a user account with local administrative permissions. Run the scheduled task by right clicking it and selecting Run to test that it has been

successfully configured.



3

MyPC Server-Side Configuration in a Terminal Server / Virtual Desktop Infrastructure – One-to-Many EnvironmentFor instructions on installing MyPC’s server-side components please refer to the MyPC Server and Web Installation within this guide. This manual solely details specific configuration options required to make MyPC operational in a Terminal Server environment.

Start a web browser and navigate to the MyPC web interface and logon as a Technical Administrator(TA).

Access MyPC Web Admin by clicking on the icon. Once inside Web Admin navigate to Sites and Locations. If you need to create Sites, Locations and or Location Policies please refer to the MyPC 4 Reference Guide for further instructions.

Click on the Location in which you intend to create a thin-client device that will access a TerminalServer / virtualized desktops controlled by the MyPC Terminal Server / Virtual Desktop Infrastructure– One-to-Many Client.

Click Add New and the following window will appear.



3

Enter the Name of the thin-client device this will be shown on the MyPC Status Screen (where available) before users logon and will be used to identify the device on the MyPC Booking Screen. Next enter the NetBIOS name of the device and select a resource type. Click Save to complete the process.

The Web Admin screen will now refresh to display your newly defined thin-client device.

Please note that thin-client devices will only turn blue in Web Admin to indicate communication when the terminal is displaying the MyPC Status Screen or Windows logon screen or if a user is in the process of logging on. Once the user has logged on the device will appear as in use and a red MyPC wee man will appear next to the monitor icon as shown in the previous screenshot. Terminal Server / virtualized desktop sessions will appear as in use on the MyPC Booking Screen as per the normal operation of MyPC.

For more information concerning the behavior of the MyPC Terminal Services Client please refer to the M y P C B e h a v i o r i n a T er m i n a l S e r v er / Vi r t u a l De sk top I n f r a s tru c ture – O ne - t o - M a n y E n v i r o n m e n t section of this manual.



3

MyPC Behavior in a Terminal Server / Virtual Desktop Infrastructure – One-to-Many EnvironmentThe MyPC Terminal Server / Virtual Desktop Infrastructure – One-to-Many Client provides MyPC functionality in environments where users access their desktop by connecting from thin-client devices to Windows-based Terminal Servers, including those that run Citrix XenApp, Presentation Server or Metaframe or virtualized Windows XP, Windows Vista or Windows 7 desktops running on solutions such as VMware. Please note that the MyPC Terminal Services / Virtual Desktop Infrastructure –One-to-Many Client provides the majority of the MyPC Classic Client’s functionality for ActiveDirectory and Novell eDirectory environments only. There is no MyPC Terminal Services / Virtual Desktop Infrastructure Client available for Public Library environments (where end-user authentication is performed against a flat file, library management system or LDAP); however the Library Fines and Overdue Items module is available.

When users connect to Terminal Servers / desktops running the MyPC Terminal Server / Virtual Desktop Infrastructure – One-to-Many Client the NetBIOS name of the connecting device is queried. If MyPC finds that the device is defined within MyPC Web Admin the user will be presented with the MyPC Status Screen (where available) indicating whether the terminal is reserved, available orsubject to any other state such as closed or book with staff. Users then click the screen to logon and are presented with the standard Windows / Novell logon screen where they are then required to logon. After logon they are provided access to their desktop with their session controlled by MyPC. Users receive all warning messages as per the usual operation of MyPC, they can check their time remaining using the yellow MyPC system tray clock and are logged off when their sessions come to an end. The key differences between the Terminal Server and the Classic Client is that it is not possible to shut down or reboot Terminal Servers running the MyPC Terminal Services Client via theMyPC Booking Screen or Admin Interface (for obvious reasons). It is possible to do so when using theVirtual Desktop Infrastructure – One-to-Many Client. In addition iSPY is not available on either platform as the underlying VNC technology is not compatible with these environments.

Please note that iSPY is not available for the MyPC Terminal Server / Virtual DesktopInfrastructure – One-to-Many Client.

In some environments the Terminal Servers / virtualized desktops that will have the MyPC Client installed will be accessed by both devices that are managed by MyPC and others that are not. When a device connects that is not defined within MyPC Web Admin users will not be presented with the MyPC Status Screen (where available) nor will they be controlled by MyPC. The MyPC Terminal Services / Virtual Desktop Infrastructure – One-to-Many Client also features a client-side list ofNetBIOS names of devices that are managed by MyPC that is referred to when client devices connect to reduce load on the MyPC Server and if communication goes down between the MyPC Terminal Services Client and the MyPC Server. This file is known as the Registered Resources file (RegResources.xml). During periods of No Communication only connecting devices found in RegResources.xml will be subject to the limited control of the MyPC Terminal Server / Virtual Desktop Infrastructure – One-to-Many Client in its offline mode. To achieve this the MyPC Client fetches the RegResource.xml file from the MyPC Server at start-up. A Server-side tool, the RRL Updater, maintains this list for deployment to MyPC Clients and should be configured to run periodically via the Window’s task scheduler, Scheduled Tasks. For further information regarding the configuration of this functionality please refer to the section entitled P o s t I n s ta l l a t i on Con f i g urat i on i n a T e r m i n a l S e r v er / Vir tu al Des k top Inf r as truc t ure – O ne- t o- Man y En vir on m ent in this manual.



3

Changes in MyPC Operation in a TerminalServer / Virtual Desktop EnvironmentCurrently the MyPC Terminal Services Client does not support multiple concurrent logins by the same user even if the user has been defined as a guest within MyPC. Whenever a user tries to logon to two Terminal Service sessions simultaneously both sessions will be closed automatically. This restriction does not apply to Virtual Desktop – One-to-One and One-to-Many environments In addition please note that the MyPC Terminal Server and Virtual Desktop – One-to-One and One-to-Many Clients do not allow more than one connection from the same device.

Please note that the MyPC Booking screen will offer the following options even when administrators (NTAs and TAs) are controlling devices that utilize the MyPC Terminal Services Client / Virtual Desktop – One-to-One and One-to-Many Clients however they will behave as follows:

Terminal ServerShutdown – logs off the user from their Terminal Server session. Reboot – logs off the user from their Terminal Server session. iSPY – will not successfully launch an iSPY / VNC session. Logoff and Send Message work as to be expected.Wake-On-LAN – it is not possible to wake a Terminal Server or a thin-client device.Faulty / Working, Logoff and Send Message work as to be expected.

Virtual Desktop – One-to-One Shutdown – Shuts down the virtual desktop. Reboot – Reboots down the virtual desktop.iSPY – will successfully launch an iSPY / VNC session where installed.Logoff and Send Message work as to be expected.Wake-On-LAN – it is not possible to wake a virtualized desktop or a thin-client device.Faulty / Working, Logoff and Send Message work as to be expected.

Virtual Desktop – One-to-Many Shutdown – Shuts down the virtual desktop. Reboot – Reboots down the virtual desktop.iSPY – will not successfully launch an iSPY / VNC session.Logoff and Send Message work as to be expected.Wake-On-LAN – it is not possible to wake a virtualized desktop or a thin-client device.Faulty / Working, Logoff and Send Message work as to be expected.

Please note that in Terminal Server / Virtual Desktop – One-to-Many environments thin-client devices will only turn blue in Web Admin to indicate communication when the terminal is displaying the MyPC “Status Screen” (where available) or if a user is in the process of logging on. Once the user has logged on the device will appear as in use and a red MyPC “wee man” will appear next to the monitor icon. Terminal Server and virtual desktop sessions will appear as in use on the MyPC Booking Screen as per the normal operation of MyPC. Please note that this is not the case when using the Virtual Desktop – One-to-One Client which will behave asper MyPC Classic as long as the virtual desktops are up and running.



3

Windows 7 Local Administrator LogonIn this section we explain the steps required to logon on as a Local Administrator on a MyPC Client PC (Windows 7). It is only required to logon to a MyPC Client as a Local Administrator in situations where you wish to logon as a Local Administrator on the PC or you wish to be free of MyPC’s control and your account has not been configured in MyPC Web Admin to be a TA or NTA.

Please note that for organizations that uses client versions prior to MyPC 5.0 should contactTBS Support.

The MyPC Client logon screen will appear as follows before logon.

Click on the Switch User button. The subsequent screen will show.



3

Users of MyPC for Windows, Novell or RM networks should logon either locally e.g. Win7PC21\administrator. The resulting session will be free of MyPC’s control.

Users of MyPC in Public Library environments should logon using accounts that is resident on the local machine using the following format:

For local accounts e.g. Win7PC21\administrator. The resulting session will be free of MyPC’s control.



3

Click the button to continue. The subsequent screen shows the user has successfully been logged on locally.



4

Mac Local Administrator LogonPlease note that the Mac client does not support the MyPC 5.0 Charging module.

In this section we explain the steps required to logon on as a Local Administrator on a MyPC Mac Client. It is only required to logon to a MyPC Mac Client as a Local Administrator in situations where you wish to logon as a Local Administrator on the Mac Client and bypass MyPC.


Click the left mouse button FIVE times within the grey area where the username and password fields are shown when MyPC is displaying its status screen (Available, Reserved, etc.). This will invoke the local administrator password entry box as shown below.



4

You can continue to logon by entering the MyPC Local Administrator password in the LocalAdministrator password field and click OK, which will prompt a confirmation dialogue as shown below.



4

Please note that the MyPC Local Administrator password is set during the time of MyPC Client installation. Please contact ITS Technical Support if you do not remember the Local Administrator password.

Local Administrator mode will now be active. Click OK on the MyPC Local Administrator mode confirmation dialog and you will be taken back to the MyPC Client status screen as shown below.



4

Enter the required Username and Password as prompted on the MyPC Client status screen as shown above. After logon you will not be subject to the control of MyPC.



4

Changing MyPC Local Administrator Password (Mac)To change the MyPC Local Administrator Password on computers running Mac OS 10.4 please follow the steps outlined in this chapter.


As previously mentioned click the left mouse button FIVE times within the grey area where the username and password fields are shown when MyPC is displaying its status screen (Available, Reserved, etc.). This will invoke the local administrator password entry box as shown below.



4

It is possible to change the password once the Local Admin dialogue has been accessed and the old password has been entered. Click Set new password to change the local administrator password.



4

Enter the current password in the first field and the new password in the following two fields as shown above and click OK.



4

If successful a confirmation window will be shown as below.

Click OK to return to the main status screen.If you have any comments about this manual or any aspect of MyPC please e-mail your suggestions to the MyPC team at my p c@itsl t duk .c o m .


Documents

supporttbs.comsupporttbs.com/download/convergent/MyPC Manuals... · Web viewCreating a Windows Authentication Role ... it will create RegResources.xml in the location specified