Many of the ZfD policies are available only if you select the Workstation Management installation option. For installation steps, see Workstation Management in Getting Started.
Creating the Policy Packages
You should create an Organizational Unit (OU) for holding the policy packages. Consider the following when determining where to place this OU:
If you have partitions in your tree
The 256-character limit in NDS for the full distinguished name
The Search policy is used to locate the policy package
To minimize tree walking, it is best to create this policy package OU at the root of the partition that contains the objects with which the policy package will be associated. In doing so, the following benefits are realized:
Tree walking is minimized with the root of the partition and the Search policy being used
Placing the OU at the partition's root maximizes the number of characters that will be available for naming plural policies
To create a policy package:
In ConsoleOne, right-click the container where you want the container for the policy packages placed > click New > click Object > click Organizational Unit > click OK.
Give the container a short name.
HINT: Because you can have both ZfD and ZfS policies in the same tree, make sure you distinguish your ZfD policies container. For example, ZfD Policies.
Right-click the policy package's container > click New > click Policy Packages.
Select one of the following policy packages:
Container Package
Server Package
Service Location Package
User Package
Workstation Package
Click Next > give the package a short name > click Next > click Create Another Policy Package (unless this is the last one being created) > click Finish.
Short package name suggestions include:
Container
Server
Location
User
Workstation
Repeat Step 4 through Step 5 for each policy package to be created.
Setting Up a Search Policy
The Search policy is required for finding other policies. You set up Search policies at a container level. Create as many Search policies as you will need to help minimize network traffic.
To create a Search policy:
In ConsoleOne, right-click the Container Package > click Properties.
Check the check box under the Enabled column for the Search policy.
This both selects and enables the policy.
Click Properties.
The Search Level tab is displayed.
Select the level to search up to:
[Root]: Search to the root of the tree.
Object Container: Search to the parent container.
Partition: Search to the partition root.
Selected Container: Search to the selected container.
If you chose Selected Container, browse to select the container.
To determine the searching limits in either direction, specify a number:
Number
Description
0
Limits the search to the selected level.
1
Limits the search to one level above the selected level.
For example, if you selected the server's parent container, this would limit the search to one level above the parent level.
-1
Limits the search to one level below the selected level.
For example, if you selected [Root], -1 would limit the search up to one level below [Root].
You can specify any number between -25 and 25.
Click the Search Order tab > specify the policy searching order.
Use the arrow keys, the Add button, and the Remove button as necessary to create your search order.
Click the Refresh Interval tab > specify the frequency for how often the policy should be refreshed.
The default is hourly. If you set both time increments to zero (0), policies will never be refreshed.
Click OK.
Click the Associations tab > Add.
Browse to select the container object for association to the Search policy.
Click OK when finished.
Setting Up the Server Package Policies
Review the following sections to help you set up the Server Package policies:
If you will be imaging workstations, configure and enable this policy. This section contains step-by-step information to set up the Imaging Server policy. For more detailed information on imaging, see Workstation Imaging. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Imaging Server policy:
In ConsoleOne, right-click the Server Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Imaging Server policy.
This both selects and enables the policy.
Click Properties.
Click the Image Selection tab > Rules.
Click Add > define the conditions under which the imaging server should lay down a particular image > click OK.
For details on how to perform this task, click Help in the New Image Selection Rule dialog box.
Repeat the previous step as needed to provide rules that will cover all the target workstations.
Click OK to save the policy.
Repeat Step 1 through Step 7 for each platform where you want to set an Imaging Server policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Server Package to associate the policy package.
Setting Up the Workstation Import Policy
You must configure and enable this policy to use the Automatic Workstation Import service. This section contains step-by-step information to set up the Workstation Import policy. For more detailed information, see Automatic Workstation Import and Removal. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Workstation Import policy:
In ConsoleOne, right-click the Server Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Workstation Import policy.
This both selects and enables the policy.
Click Properties.
The Containers tab is displayed.
Click Add > select the NDS containers where rights are needed for creating Workstation objects > click OK.
Click the Limits tab > fill in the fields:
User Login Number: If the Workstation Import policy requires user information, this number represents the number of times the user can log in before the user's Workstation object is created.
Limit Number of Workstations Imported: To help balance server workload, enable this option to limit how many workstations are imported.
Workstations Created Per Hour: Specify the limit for how many Workstation objects can be created per hour.
Click the Platforms tab > click General, Win9x, or WinNT/2000, as applicable.
The Location page is displayed.
Fill in the fields:
Allow Importing of Workstations: Enable this option to allow registered workstations to be imported.
Create Workstation Objects In: Select an option from the drop-down list:
Selected Container: The Workstation object will be created in the container specified in the Path field. This is an absolute NDS path.
Server Container: The Workstation object will be created in the same container as the server running the import service. You can specify a relative path from the server container.
User Container: The Workstation object will be created in the container where the User object resides for the logged-in user. You can specify a relative path from the user container.
Associated Object's Container: The Workstation object will be created in the container that is associated with the Workstation Import policy. You can specify a relative path from the associated container.
Path: If you are using a relative path, enter a string. The number of periods you end the path with determines the number of relative levels. If you are using an absolute path, select the container.
Click the Naming page > fill in the fields:
Workstation Name: Displays the workstation naming convention currently defined in the Add Name Fields and Place Them in Order field. Whenever there is a potential name conflict (such as two Workstation objects in the same container named after the User object), the system will append a 3-digit number on the end of the name that you enter here.
Add Name Fields and Place Them in Order: You must have at least one option in this list. By default, there is one of two option pairs in the list, either Computer + Network Address or User + Network Address. Click Add to select from the following list of name fields:
<User Defined>
CPU
OS
Computer
DNS
Server
Container
Network Address
User
Click the Groups page > click Add > browse for the workstation groups you want this Workstation object to belong to when it is imported.
Click OK to save the policy.
Repeat Step 1 through Step 10 for each platform where you want to set a Workstation Import policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Server Package to associate the policy package.
Setting Up the Workstation Removal Policy
If you want Workstation objects to be automatically removed after they have not been used for a specified period of time, configure and enable this policy. This section contains step-by-step information to set up the Workstation Removal policy. For more detailed information on workstation removal, see Automatic Workstation Import and Removal. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Workstation Removal policy:
In ConsoleOne, right-click the Server Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Workstation Removal policy.
This both selects and enables the policy.
Click Properties.
The Containers tab is displayed.
Click Add > select the containers where workstations to be removed reside.
To specify how long a Workstation object should remain in the tree without registering, click the Limits tab > specify the number of days.
To schedule when Workstation objects should be removed, click the Schedule tab > fill in the fields:
Year: Year to begin schedule.
Date: Day of month to begin schedule.
Start Time: Beginning time for the window when policy can run.
Duration: Length of the time window.
Repeat Interval In Days: Beginning from the starting date, Workstation object removal is performed at this interval.
Limit Number of Workstations Removed: To help balance server workload, enable this option to limit how many workstations are removed in a session.
Workstations Removed Per Session: A number to set the limit for how many Workstation objects can be removed per hour.
Click OK to save the policy.
Repeat Step 1 through Step 7 for each platform where you want to set a Workstation Removal policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Server Package to associate the policy package.
Setting Up the Inventory Roll-Up Policy
If you want to track workstation inventory information, configure and enable this policy. This section contains step-by-step information to set up the Inventory Roll-Up policy. For more detailed information on Inventory, see Workstation Inventory. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Inventory Roll-Up policy:
In ConsoleOne, right-click the Server Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Inventory Roll-Up policy.
Repeat Step 1 through Step 6 for each platform where you want to set an Inventory Roll-Up policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Server Package to associate the policy package.
Associating the Server Package
The policies you configured and enabled will not be in effect until you associate their policy package with a container object.
To associate the Server Package:
In ConsoleOne, right-click the Server Package > click Properties.
Click the Associations tab > Add.
Browse for the container for associating the package > click OK.
Setting Up the Service Location Package Policies
Do the following to set up the Service Location Package policies:
If you want e-mail notifications, you should configure and enable this policy. For more information, see SMTP Host. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the SMTP Host policy:
In ConsoleOne, right-click the Service Location Package > click Properties.
The General tab is displayed.
Check the check box under the Enabled column for the SMTP Host policy.
This both selects and enables the policy.
Click Properties > enter the SMTP Host name > click OK.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Service Location Package to associate the policy package.
Setting Up the SNMP Trap Targets Policy
If you are using SNMP, you should configure and enable this policy. For more information, see SNMP Trap Targets. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the SNMP Trap Targets policy:
In ConsoleOne, right-click the Service Location Package > click Properties.
The General tab is displayed.
Check the check box under the Enabled column for the SNMP Trap Targets policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Service Location Package to associate the policy package.
Setting Up the ZENworks Database Policy
This policy identifies the location of the ZENworks Database object. If you selected to install the ZENworks database, you should configure and enable this policy.
Configuring the ZENworks Database Object for Oracle
To create and configure the ZENworks Database object:
In ConsoleOne, right-click the container where the Database object is to be created > click New > click Object > click ZENworks Database > click OK.
HINT: While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
Enter a name for the Database object > click Define Additional Properties > click OK.
The ZENworks Database tab should be displayed.
Select the DN of the server where the database files will be stored.
(Optional) Enter the IP address of the server.
Fill in the applicable fields, keeping the user name and password pairs together:
Database (Read-Write) User Name: Secures read and write access to the database file.
Database (Read-Write) Password: Secures read and write access to the database file.
Database (Read Only) User Name: Secures only read access to the database file.
Database (Read Only) Password: Secures only read access to the database file.
Database (Write Only) User Name: Secures only write access to the database file.
Database (Write Only) Password: Secures only write access to the database file.
To specify the JDBC driver type, click the JDBC Driver Information tab > click the Populate Fields With Default Values For An Oracle Database radio button > click Populate Now.
To change any default JDBC driver type information, edit the fields:
Driver
Protocol
SubProtocol
SubName
Port
If you will use an ODBC driver for the database file, click the ODBC Driver Information tab > fill in the fields:
In ConsoleOne, right-click the Service Location Package > click Properties.
The General tab is displayed.
HINT: While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
Check the check box under the Enabled column for the ZENworks Database policy.
This both selects and enables the policy.
Click Properties.
The ZfD Database tab is displayed.
Select the database DN > click OK.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Service Location Package to associate the policy package.
Associating the Service Location Package
The policies you configured and enabled will not be in effect until you associate their policy package with a container object.
To associate the Service Location Package:
In ConsoleOne, right-click the Service Location Package > click Properties.
Click the Associations tab > Add.
Browse for the container for associating the package > click OK.
Setting Up the User Package Policies
Review the following sections for information to help you set up the User Package policies:
For the Windows 95/98 and Windows NT/2000 platforms, sets defaults for users' desktops. This section contains step-by-step information to set up the Desktop Preferences policy. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Desktop Preferences policy:
In ConsoleOne, right-click the User Package > click Properties > click the appropriate platform page.
Check the check box under the Enabled column for the Desktop Preferences policy.
This both selects and enables the policy.
Click Properties.
The Roaming Profiles tab is displayed.
To enable roaming profiles, check the Roaming Profiles box > set the desired parameters in the following fields:
Override Terminal Server Profile: Stores the roaming profile on the network in the user's home directory.
Store User Profile in User's Home Directory: Stores the roaming profile on the network in the user's home directory. This allows the user to utilize the same desktop environment on all workstations throughout the network.
Find Profile in a NetWare File System Directory: The mandatory profile is found in a specific directory on a NetWare server. A mandatory profile requires all users to utilize the same desktop environment on all workstations throughout the network.
Path: Specify the user's home directory.
Click the Settings tab > click an icon to display a dialog box that shows the options available for each feature.
This page displays icons matching the equivalent desktop features in Windows 95/98 or Windows NT/2000.
See your Microsoft Windows documentation for help on these features and their options.
Click OK to save the policy.
Repeat Step 1 through Step 6 for each platform where you want to set desktop preferences.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the User Package to associate the policy package.
Setting Up the Dynamic Local User Policy
For Windows NT/2000, lets you configure users created on Windows NT/2000 workstation after they have authenticated to NDS. This section contains step-by-step information to set up the Dynamic Local User policy. For more detailed information, see Dynamic Local User. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Dynamic Local User policy:
In ConsoleOne, right-click the User Package > click Properties > click the Windows NT-2000 platform page.
Check the check box under the Enabled column for the Dynamic Local User policy.
This both selects and enables the policy.
Click Properties.
The Dynamic Local User tab is displayed.
Fill in the following fields:
Enable Dynamic Local User: Enables creation of a User object that resides either temporarily or permanently in the workstation's Security Access Manager (SAM) database.
Manage Existing NT Account (If Any): Allows management through the existing NT account.
Use NetWare Credentials: Enables logging in through the user's NetWare credentials instead of NT credentials.
Volatile User (Remove NT User After Logout): Specifies the use of a volatile user account for NT login.
NT User Name: The NT user name. The NT user name (not including the context) must contain fewer than 20 characters for a dynamic local user to log in.
A user that is manually created via User Manager can`t have a longer name.
Full Name: The user's full name.
Description: Enter any additional information that helps you to further identify this user account.
Member Of: Lists the groups where this user has membership.
Not Member Of: Lists available groups where this user has not been assigned as a member.
Custom: Opens the Custom Groups page, where you can add a new custom group, delete an existing custom group, and view or modify properties of an existing custom group.
Click OK to save the policy.
Repeat Step 1 through Step 5 for each platform where you want to set a Dynamic Local User policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the User Package to associate the policy package.
Setting Up the Help Desk Policy
Sets the choices viewed in the Help Desk user interface. This policy is available on each of the platform pages. This section contains step-by-step information to set up the Help Desk policy. For more detailed information, see Help Desk. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Help Desk policy:
In ConsoleOne, right-click the User Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Help Desk policy.
This both selects and enables the policy.
Click Properties.
The Configuration tab is displayed.
To enable the Help Requester, fill in the fields:
Allow User to Launch the Help Requester: Users can run the Help Requester only if this option is checked.
Allow User to Send Trouble Tickets from the Help Requester: Disables the Mail For Help option in the user's Help Requester interface.
Trouble Ticket Delivery Mode: To specify e-mail delivery of help requests, select either GroupWise 5.0 or MAPI.
Trouble Ticket Subject Lines: Create a list of possible categories for help requests.
To configure what choices should be available to users, click the Configure Trouble Ticket tab > fill in the fields:
User Information: Check the box for each of the following user information items that you want to be available for sending with the trouble ticket:
User Context
User Tree
User Location
User Phone
Workstation Information: Check the box for each of the following workstation information items that you want to be available for sending with the trouble ticket:
Workstation ID
Workstation Tree
Workstation Inventory
Click the Information tab > fill in the fields:
Contact Name: The primary contact for help requests.
E-mail Address: The primary contact's e-mail address.
Telephone Number: The primary contact's telephone number.
Click OK to save the policy.
Repeat Step 1 through Step 7 for each platform where you want to set a Help Desk policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the User Package to associate the policy package.
Setting Up the NT User Printer Policy
For Windows NT/2000, sets parameters for printer drivers. This section contains step-by-step information to set up the NT User Printer policy. For more detailed information, see User Printer. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the NT User Printer policy:
In ConsoleOne, right-click the User Package > click Properties > click the Windows NT/2000 platform page.
Check the check box under the Enabled column for the NT User Printer policy.
This both selects and enables the policy.
Click Properties.
The Printer Entries tab is displayed.
To set printer configurations for users, fill in the fields:
Installed NetWare Printers: List of currently defined printers.
Toggle Default: Makes the selected printer the default.
New Driver: Opens the Driver dialog box, where you can assign a print driver.
NetWare Settings: Opens the Advanced Workstation Printer Options dialog box, where you can define various settings:
Output Settings: Sets the following: number of copies, form feed, spaces for tabs, and number of spaces for tabs.
Banner Settings: Sets the following: enable banners, first banner name, and second banner name.
Other Settings: Sets the following: hold print jobs, keep print job in queue, and notify when print job is done.
Click OK to save the policy.
Repeat Step 1 through Step 5 for each platform where you want to set an NT User Printer policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the User Package to associate the policy package.
Setting Up the Remote Control Policy
Sets parameters for remote management sessions. This policy is available on each of the platform pages. This section contains step-by-step information to set up the Remote Control policy. For more detailed information, see Remote Management. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Remote Control policy:
In ConsoleOne, right-click the User Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Remote Control policy.
This both selects and enables the policy.
Click Properties.
The Remote Management tab is displayed.
On the General page, fill in the fields:
Enable Chat: Allows the administrator to chat with the user logged in to the managed workstation.
Enable Diagnostics: Allows the administrator to diagnose the managed workstation.
Remote Control/View Startup Timeout for Console User __ Minutes: The maximum duration of time to wait for connecting with the managed workstation to start a Remote Control or a Remote View session. The default timeout value is 5 minutes. The range is 1 to 30 minutes.
Click the Control page > fill in the fields:
Enable Remote Control: Allows the administrator to remotely control the managed workstation.
Prompt User for Permission to Remote Control: Click this option if you want the administrator to seek permission from the user at the managed workstation before initiating a remote control session.
Give User Audible Signal When Remote Controlled: Click this option if you want the management console to send an audible signal to the managed workstation every time the administrator remotely controls the managed workstation.
Every __ Seconds: The time interval for the management console to periodically send the audible signal to the managed workstation.
Give User Visible Signal When Remote Controlled: Click this option if you want the management console to send a visible signal to the managed workstation every time the administrator remotely controls the managed workstation.
Display Name of Initiator Every __ Seconds: The time interval for the management console to periodically send the visible signal to the managed workstation.
Allow Blanking User's Screen: Allows the administrator to blank the screen of the managed workstation during a remote control session.
Allow Locking User's Keyboard and Mouse: Allows the administrator to lock the keyboard and mouse controls of the managed workstation during a remote control session.
Click the View page > fill in the fields:
Enable Remote View: Allows the administrator to remotely view the desktop of the managed workstation.
Prompt User for Permission to Remote View: Click this option if you want the administrator to seek permission from the user at the managed workstation before initiating a remote view session with the managed workstation.
Give User Audible Signal When Remote Viewed: Click this option if you want the management console to send an audible signal to the managed workstation every time the administrator remotely views the managed workstation.
Every __ Seconds: Specify the time interval for the management console to periodically send the audible signal to the managed workstation.
Give User Visible Signal When Remote Viewed: Click this option if you want the management console to send a visible signal to the managed workstation every time the administrator remotely views the managed workstation.
Display Name of Initiator Every __ Seconds: Specify the time interval for the management console to periodically send the visible signal to the managed workstation.
Click the File Transfer page > fill in the fields:
Enable File Transfer: Choose to allow the administrator to transfer files between the management console and the managed workstation.
Prompt User for Permission to Transfer Files: Click this option if you want the administrator to seek permission from the user at the managed workstation before transferring files between the management console and the managed workstation.
Click the Remote Execute page > fill in the fields:
Enable Remote Execute: Choose to allow the administrator to execute applications or files on the managed workstation.
Prompt User for Permission to Remote Execute: Click this option if you want the administrator to seek permission from the user at the managed workstation before running applications or files at the managed workstation.
Click OK to save the policy.
Repeat Step 1 through Step 9 for each platform where you want to set a Remote Control policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the User Package to associate the policy package.
Setting Up the Scheduled Action Policy
Sets up schedules for specific actions. This is a plural policy, meaning it can be added many times to the policy package. It is available for each of the platform pages. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Scheduled Action policy:
In ConsoleOne, right-click the User Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Scheduled Action policy.
This both selects and enables the policy.
Click Properties.
The Actions tab is displayed.
Fill in the fields:
Name: The name that was entered in the Name field on the Item Properties tab when the action item was added.
Working Directory: Generally, this is the path where the executable file for this action is located. It can be a different path if the program requires it.
Parameters: The parameters to pass to the action item. For more information, see the documentation associated with the executable file specified in the Working Directory field.
Priority: The importance assigned to this action in relation to the user's access to the workstation.
Terminate Time: The length of time this action can run before the system stops it. The assumption is that if it takes longer than a specified time to run, there might be a problem associated with running this action and the action should be terminated. The length of time was specified under the Terminate Item If Still Running After check box on the Action Items tab when you added this action.
Run Items in Order Listed: The items will run in the order they display in the list. You can reorder the list with the up/down arrows.
Click the Policy Schedule Tab > select a schedule type:
Package Schedule
Event
Daily
Weekly
Monthly
Yearly
Click OK to save the policy.
Repeat Step 1 through Step 6 for each platform where you want to set a Scheduled Action policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the User Package to associate the policy package.
Setting Up the User Extensible Policy
Sets user-defined policies (from .ADM files) for user objects. This policy is found only on the WinNT-2000 and Win95-98 pages. This section contains step-by-step information to set up the User Extensible policy. For more detailed information, see User Extensible. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the User Extensible policy:
In ConsoleOne, right-click the User Package > click Properties > click the appropriate platform page.
Check the check box under the Enabled column for the User Extensible policy.
This both selects and enables the policy.
Click Properties.
The User Extensible Policies tab is displayed.
Click Add > browse for a .ADM file.
To edit the properties of a policy, click the policy in the ADM Files box > browse and edit the policy settings in the Policies box.
Click the plus signs to expand the attributes.
The check box states are as follows:
Check Box
State
Description
Enabled
Attribute is enabled in the client. Any values you enter for it are applied.
Disabled
Attribute is disabled in the client.
or
Ignored
Attribute is ignored (not changed in the client). If the attribute is already enabled in the client, it remains enabled. If it is already disabled in the client, it remains disabled.
Repeat Step 4 and Step 5 for each extensible policy to be added.
Click the Policy Schedule tab > select a schedule type:
Package Schedule
Event
Daily
Weekly
Monthly
Yearly
Click OK to save the policy.
Repeat Step 1 through Step 8 for each platform where you want to set a User Extensible policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the User Package to associate the policy package.
Setting Up the User System Policy
This ZENworks 2 functionality is now a part of ZfD Extensible policies.
For Windows NT, use the COMMON.ADM, WINNT.ADM, and ZAKWINNT.ADM files in Extensible policies.
For Windows 95/98, use the ADMIN.ADM file in Extensible policies.
If this policy has been migrated from ZENworks 2, the functionality is enabled in ZfD but you cannot edit or modify the policy. If you want to change these settings, you must create a new User Package in ZfD and enable Extensible policies.
Setting Up the Windows 2000 Group Policy
Only for Windows 2000, this policy is an extension of extensible policies for Windows 2000 and Active Directory. This section contains step-by-step information to set up the Windows 2000 policy. For more detailed information, see Windows 2000 Group. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Windows 2000 Group policy:
In ConsoleOne, right-click the User Package > click Properties > click the Windows NT/2000 platform page.
Check the check box under the Enabled column for the Windows 2000 Group policy.
This both selects and enables the policy.
Click Properties.
The Windows 2000 Group Policies tab is displayed.
Browse for an NDS policy directory > click Edit.
This launches the Microsoft Management Console editor, where you can edit a User Package policy or a Workstation Package policy. For more information, click Help in the dialog boxes.
Click the Workstation Manager Policies tab > click Active Directory Group Policy Import > fill in the fields:
Active Directory Policy Path: Specify the UNC path where group policies created by Active Directory exist that you want to migrate to NDS. You must know or browse for the Unique Name of the directory from where you will import the Active Directory group policy.
NDS Policy Directory: Enter or browse for a target UNC path location on the NetWare server for migrating the Windows 2000 group policies into NDS from the location specified in the Active Directory Policy Path field. The User and Workstation objects must have Read and File Scan rights to this location.
IMPORTANT: You should use UNC paths rather than mapped drives for Windows 2000 Group policies. For more information, see Windows 2000 Group.
If you enter information into the fields, click Import Files.
This copies the Active Directory group policy to the directory specified in the NDS Policy Directory field. If the specified directory does not exist, it will be automatically created.
WARNING: Make sure you have selected the correct directory path in the NDS Policy Directory field because you could destroy data. All of the files in the selected directory and any of its subdirectories will be deleted before the Active Directory group policy is copied to it.
Click the Policy Schedule tab > select a schedule type:
Package Schedule
Event
Daily
Weekly
Monthly
Yearly
You can click Advanced Settings to set additional settings such as Completion, Fault, Impersonation, Priority, and Time Limit. For detailed information on each of these settings, click the Help button on each tab.
IMPORTANT: The default Impersonation setting is Interactive User. If you change this setting the policy will not function properly.
Click OK to save the policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the User Package to associate the policy package.
Setting Up the Windows Terminal Server Policy
Only for Windows 2000, this policy sets parameters for Citrix and Microsoft Terminal Server users. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Windows Terminal Server policy:
In ConsoleOne, right-click the User Package > click Properties > click the appropriate platform page.
Check the check box under the Enabled column for the Windows Terminal Server policy.
This both selects and enables the policy.
Click Properties.
The Terminal Configuration Connection tab is displayed.
Fill in the fields:
Allow Logon to Terminal Server: Lets the user log on to the Terminal Server.
Broken or Timed-out Connections: Specifies settings for when a session limit is reached or connection is broken. Click Disconnect to disconnect the user from the session, allowing the session to be reconnected. Click End to end the session.
Reconnect From: Reconnects disconnected sessions from any client (lets the user reconnect to a disconnected session from any computer) or from the previous client (lets the user reconnect to a disconnected session only from the client computer where the session originated).
Timeout Settings (in minutes): Sets timeout options for disconnected, active, and idle sessions.
Connection: Specify the amount of time a user's session can remain active on the server. When the time limit is reached, the user is either disconnected from the session or the session ends.
Disconnection: Specify the amount of time that a disconnected session remains on the server. When the time limit is reached, the disconnected session ends.
Idle: Specify the amount of time that an idle session (a session without client activity) remains on the server. When the time limit is reached, the user is either disconnected from the session or the session ends.
Shadowing: Session shadowing lets you monitor the display of another active session, see what users are doing, and interact with a user's session using the keyboard and mouse. You can shadow active sessions on the same server or on other Citrix servers.
Enabled: Specifies that sessions on the connection can be shadowed.
Allow Input: Allows the shadower to input keyboard and mouse actions to the shadowed session.
Notify Client: Specifies that the shadowed user gets a message asking if it is permissible for the shadowing to occur.
Modem Callback: Use this option to configure asynchronous ICS connections to hang up and dial a preset or user-specified number after a user logs on to the Citrix server.
Enabled: Enables modem callback.
Phone Number: Enter the callback phone number.
Roving Phone Number: Prompts users to enter a callback number when they start an async session. You can use this option to centralize telephone charges.
Click the Terminal Configuration tab > click Login > fill in the fields:
Initial Program: Use the following settings to configure an initial program for the connection.
Command Line: Enter the path and filename of the program that you want to start when the user logs on to the Terminal Server.
Working Directory: Specifies the working directory path for the program.
Inherit Client Configuration: If this option is checked, the client settings in User Manager are used.
Client Devices: Controls client device mappings. The Client Devices options control whether drives and printers are mapped to client drives and printers. If these options are cleared, the devices are still available but must be manually mapped to drive letters and port names.
Connect Client Drives at Logon: Automatically maps the client computer's drives at logon.
Connect Client Printers at Logon: Automatically maps the client computer's printers at logon. This applies only to Windows clients and maps only printers already configured in Print Manager on the client computer. DOS printers must be manually mapped.
Default to Main Client Printer: Configures the user's default client printer as the default printer for the ICA session.
Terminal Server Home Directory: Specify the user's Terminal Server home directory.
Local Path: Sets the Terminal Server home directory to the local path you specify.
Connect: Sets the Terminal Server home directory to the drive you specify. Choose a driver from the drop-down list, then enter a path.
Terminal Server Profile Path: Specify the user's Terminal Server profile path.
Click OK to save the policy.
Repeat Step 1 through Step 6 for each platform where you want to set a Windows Terminal Server policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the User Package to associate the policy package.
Associating the User Package
The policies you configured and enabled will not be in effect until you associate their policy package with a container object.
To associate the User Package:
In ConsoleOne, right-click the User Package > click Properties.
Click the Associations tab > Add.
Browse for the container for associating the package > click OK.
Setting Up the Workstation Package Policies
Review the following section for more information to help you set up the Workstation Package policies:
Sets configuration parameters for workstations. This policy is found only on the WinNT-2000 and Win95-98 pages. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Client Configuration policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the appropriate platform page.
Check the check box under the Enabled column for the Client Configuration policy.
This both selects and enables the policy.
Click Properties.
The Novell Client Configuration Client tab is displayed.
Click Help in this dialog box for instructions on how to configure the policy.
When you have finished configuring the policy, click OK.
Repeat Step 1 through Step 5 for each platform where you want to set a Client Configuration policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Setting Up the Computer Extensible Policy
Sets user-defined policies (from .ADM files) for Workstation objects. This policy is found only on the WinNT/2000 and Win95/98 pages.
To create the Computer Extensible policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the appropriate platform page.
Check the check box under the Enabled column for the Computer Extensible policy.
This both selects and enables the policy.
Click Properties.
The Computer Extensible Policies tab is displayed.
Click Add > browse for a .ADM file.
To edit the properties of a policy, click the policy in the ADM Files box > browse and edit the policy settings in the Policies box.
Click the plus signs to expand the attributes.
The check box states are as follows:
Check Box
State
Description
Enabled
Attribute is enabled in the client. Any values you enter for it are applied.
Disabled
Attribute is disabled in the client.
or
Ignored
Attribute is ignored (not changed in the client). If the attribute is already enabled in the client, it remains enabled. If it is already disabled in the client, it remains disabled.
Repeat Step 4 and Step 5 for each extensible policy to be added.
Click the Policy Schedule tab > select a schedule type:
Package Schedule
Event
Daily
Weekly
Monthly
Yearly
Click OK to save the policy.
Repeat Step 1 through Step 8 for each platform where you want to set a Computer Extensible policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Setting Up the Computer Printer Policy
Sets workstation parameters for printing. This policy is found only on the WinNT/2000 and Win95/98 pages. This section contains step-by-step information to set up the Computer Printer policy. For more detailed information, see Computer Printer. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Computer Printer policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the appropriate platform page.
Check the check box under the Enabled column for the Computer Printer policy.
This both selects and enables the policy.
Click Properties.
The Printer Entries tab is displayed.
To set printer configurations for users, fill in the fields:
Installed NetWare Printers: List of currently defined printers.
Toggle Default: Makes the selected printer the default.
New Driver: Opens the Driver dialog box, where you can assign a print driver.
NetWare Settings: Opens the Advanced Workstation Printer Options dialog box, where you can define various settings:
Output Settings: Sets the following: number of copies, form feed, spaces for tabs, and number of spaces for tabs.
Banner Settings: Sets the following: enable banners, first banner name, and second banner name.
Other Settings: Sets the following: hold print jobs, keep print job in queue, and notify when print job is done.
Click OK to save the policy.
Repeat Step 1 through Step 8 for each platform where you want to set a Computer Printer policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Setting Up the Computer System Policy
This ZENworks 2 functionality is now a part of ZfD Extensible policies.
For Windows NT, use the COMMON.ADM, WINNT.ADM, and ZAKWINNT.ADM files in Extensible policies.
For Windows 95/98, use the ADMIN.ADM file in Extensible policies.
If this policy has been migrated from ZENworks 2, the functionality is enabled in ZfD but you cannot edit or modify the policy. If you want to change these settings, you must create a new User Package in ZfD and enable Extensible policies.
Setting Up the RAS Configuration Policy
Sets dial-up networking parameters. This policy is found only on the WinNT-2000 and Win95-98 pages. This section contains step-by-step information to set up the RAS Configuration policy. For more detailed information, see RAS Configuration. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the RAS Configuration policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the appropriate platform page.
Check the check box under the Enabled column for the RAS Configuration policy.
This both selects and enables the policy.
Click Properties.
The RAS Phonebook Entries tab is displayed.
Click Help for information on filling in the fields for this tab.
Click the Policy Schedule Tab > select a schedule type:
Package Schedule
Event
Daily
Weekly
Monthly
Yearly
Click OK to save the policy.
Repeat Step 1 through Step 6 for each platform where you want to set a RAS Configuration policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Setting Up the Remote Control Policy
Sets parameters for managing remote user functions. This policy is found on each of the pages. This section contains step-by-step information to set up the Remote Control policy. For more detailed information, see Remote Management. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Remote Control policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Remote Control policy.
This both selects and enables the policy.
Click Properties.
The Remote Management tab is displayed.
On the General page, fill in the fields:
Enable Chat: Allows the administrator to chat with the user logged in to the managed workstation.
Enable Diagnostics: Allows the administrator to diagnose the managed workstation.
Display Remote Management Agent Icon to Users: Click this option if you want to display the Remote Management Agent icon in the task bar of the Windows 95, Windows 98, Windows NT, or Windows 2000 managed workstation on which the Remote Management Agent is installed and running.
Default protocol to use for Remote Control and Remote View: Select the preferred protocol to use for communication between the managed workstation and the management console during Remote Control and Remote View sessions.
Click the Control page > fill in the fields:
Enable Remote Control: Allows the administrator to remotely control the managed workstation.
Prompt User for Permission to Remote Control: Click this option if you want the administrator to seek permission from the user at the managed workstation before initiating a remote control session.
Give User Audible Signal When Remote Controlled: Click this option if you want the management console to send an audible signal to the managed workstation every time the administrator remotely controls the managed workstation.
Every __ Seconds: The time interval for the management console to periodically send the audible signal to the managed workstation.
Give User Visible Signal When Remote Controlled: Click this option if you want the management console to send a visible signal to the managed workstation every time the administrator remotely controls the managed workstation.
Display Name of Initiator Every __ Seconds: The time interval for the management console to periodically send the visible signal to the managed workstation.
Allow Blanking User's Screen: Allows the administrator to blank the screen of the managed workstation during a remote control session.
Allow Locking User's Keyboard and Mouse: Allows the administrator to lock the keyboard and mouse controls of the managed workstation during a remote control session.
Click the View page > fill in the fields:
Enable Remote View: Allows the administrator to remotely view the desktop of the managed workstation.
Prompt User for Permission to Remote View: Click this option if you want the administrator to seek permission from the user at the managed workstation before initiating a remote view session with the managed workstation.
Give User Audible Signal When Remote Viewed: Click this option if you want the management console to send an audible signal to the managed workstation every time the administrator remotely views the managed workstation.
Every __ Seconds: Specify the time interval for the management console to periodically send the audible signal to the managed workstation.
Give User Visible Signal When Remote Viewed: Click this option if you want the management console to send a visible signal to the managed workstation every time the administrator remotely views the managed workstation.
Display Name of Initiator Every __ Seconds: Specify the time interval for the management console to periodically send the visible signal to the managed workstation.
Click the File Transfer page > fill in the fields:
Enable File Transfer: Choose to allow the administrator to transfer files between the management console and the managed workstation.
Prompt User for Permission to Transfer Files: Click this option if you want the administrator to seek permission from the user at the managed workstation before transferring files between the management console and the managed workstation.
Click the Remote Execute page > fill in the fields:
Enable Remote Execute: Choose to allow the administrator to execute applications or files on the managed workstation.
Prompt User for Permission to Remote Execute: Click this option if you want the administrator to seek permission from the user at the managed workstation before running applications or files at the managed workstation.
Click OK to save the policy.
Repeat Step 1 through Step 9 for each platform where you want to set a Remote Control policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Setting Up the Scheduled Action Policy
Sets up schedules for specific actions. This plural policy can be added multiple times to each of the platform pages. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Scheduled Action policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Scheduled Action policy.
This both selects and enables the policy.
Click Properties.
The Actions tab is displayed.
Fill in the fields:
Name: The name that was entered in the Name field on the Item Properties tab when the action item was added.
Working Directory: Generally, this is the path where the executable file for this action is located. It can be a different path if the program requires it.
Parameters: The parameters to pass to the action item. For more information, see the documentation associated with the executable file specified in the Working Directory field.
Priority: The importance assigned to this action in relation to the user's access to the workstation.
Terminate Time: The length of time this action can run before the system stops it. The assumption is that if it takes longer than a specified time to run, there might be a problem associated with running this action and the action should be terminated. The length of time was specified under the Terminate Item If Still Running After check box on the Action Items tab when you added this action.
Run Items in Order Listed: The items will run in the order they display in the list. You can reorder the list with the up/down arrows.
Click the Policy Schedule Tab > select a schedule type:
Package Schedule
Event
Daily
Weekly
Monthly
Yearly
Click OK to save the policy.
Repeat Step 1 through Step 6 for each platform where you want to set a Scheduled Action policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Setting Up the Windows 2000 Group Policy
Only for Windows 2000, this policy is an extension of extensible policies for Windows 2000 and Active Directory. This section contains step-by-step information to set up the Windows 2000 Group policy. For more detailed information, see Windows 2000 Group. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Windows 2000 Group policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the Windows NT/2000 platform page.
Check the check box under the Enabled column for the Windows 2000 Group policy.
This both selects and enables the policy.
Click Properties.
The Windows 2000 Group Policies tab is displayed.
Browse for an NDS Policy Directory > click Edit.
This launches the Microsoft Management Console editor, where you can edit a User Package policy or a Workstation Package policy. For more information, click Help in the dialog boxes.
Click the Workstation Manager Policies tab > click Active Directory Group Policy Import > fill in the fields:
Active Directory Policy Path: Specify the UNC path where group policies created by Active Directory exist that you want to migrate to NDS. You must know or browse for the Unique Name of the directory from where you will import the Active Directory group policy.
NDS Policy Directory: Enter or browse for a target UNC path location on the NetWare server for migrating the Windows 2000 group policies into NDS from the location specified in the Active Directory Policy Path field. The User and Workstation objects must have Read and File Scan rights to this location.
IMPORTANT: You should use UNC paths rather than mapped drives for Windows 2000 Group policies. For more information, see Windows 2000 Group.
If you enter information into the fields, click Import Files.
This copies the Active Directory group policy to the directory specified in the NDS Policy Directory field. If the specified directory does not exist, it will be automatically created.
WARNING: Make sure you have selected the correct directory path in the NDS Policy Directory field because you could destroy data. All of the files in the selected directory and any of its subdirectories will be deleted before the Active Directory group policy is copied to it.
Click the Policy Schedule tab > select a schedule type:
Package Schedule
Event
Daily
Weekly
Monthly
Yearly
You can click Advanced Settings to set additional settings such as Completion, Fault, Impersonation, Priority, and Time Limit. For detailed information on each of these settings, click the Help button on each tab.
IMPORTANT: The default Impersonation setting is System. If you change this setting the policy will not function properly.
Click OK to save the policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Setting Up the Workstation Imaging Policy
Sets the parameters for imaging workstations. This policy is found on each of the platform pages. This section contains step-by-step information to set up the Workstation Imaging policy. For more detailed information, see Workstation Imaging. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Workstation Imaging policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the appropriate platform page.
Policies set on a specific platform will override policies set on the General tab.
Check the check box under the Enabled column for the Workstation Imaging policy.
This both selects and enables the policy.
Click Properties.
The Image Selection Rules tab is displayed.
Click Add > define the conditions under which the imaging server should lay down a particular image > click OK.
For details on how to perform this task, click Help in the New Image Selection Rule dialog box.
Repeat the previous step as needed to provide rules that will cover all the target workstations.
Click OK to save the policy.
Repeat Step 1 through Step 6 for each platform where you want to set a Workstation Imaging policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Setting Up the Workstation Inventory Policy
Sets what hardware and software inventory data you want to view for each workstation.This policy is found only on the WinNT-2000 and Win95-98 pages. This section contains step-by-step information to set up the Workstation Inventory policy. For more detailed information, see Workstation Inventory. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the Workstation Inventory policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the appropriate platform page.
Check the check box under the Enabled column for the Workstation Inventory policy.
This both selects and enables the policy.
Click Properties.
The Workstation Inventory Policy tab is displayed. Use this tab to:
Specify the DN name of the Inventory server
Enable or disable software scanning of workstations associated with this Inventory Policy
Fill in the fields:
Inventory Service: Specify the DN of the Inventory server. An Inventory server has a list of workstations attached to it.
Software Scanning:
Enable Software Scan: Click this option to specify software scanning for the workstations associated with the Inventory Policy. The Scan programs collect software information for the workstation only if this option is enabled.
Custom Scan Editor: Click this option to customize the list of software applications to scan for at the workstations associated with the Inventory Policy. Use the Custom Scan Editor to maintain the list of software applications that you want to scan for at the workstations.
Click the Policy Schedule tab > select a schedule type:
Package Schedule
Event
Daily
Weekly
Monthly
Yearly
Click OK to save the policy.
Repeat Step 1 through Step 6 for each platform where you want to set a Workstation Inventory policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Setting Up the WS Restrict Login Policy
Sets parameters to restrict logging in by a workstation. This policy is found only on the WinNT-2000 and Win95-98 pages. While performing the following steps, you can get detailed information about each dialog box by clicking the Help button.
To create the WS Restrict Login policy:
In ConsoleOne, right-click the Workstation Package > click Properties > click the appropriate platform page.
Check the check box under the Enabled column for the WS Restrict Login policy.
This both selects and enables the policy.
Click Properties.
The Restrict Login tab is displayed.
Use the Add and Delete buttons to add users to either list.
The Excluded Users list contains the users that you want to exclude Dynamic Local User (DLU) access to. Users listed in this box cannot use DLU access. You can make exceptions for individual users by listing them in the Included Users list. This will allow DLU access to those users only, while excluding DLU access to the remaining users in the container.
The Included Users lists contains the users that you want to allow DLU access to. Users listed in this box can use DLU access. You can make exceptions for individual users by listing them in the Excluded User list. This will exclude DLU access to those users only, while allowing DLU access to the remaining users in the container.
Click the Restrict Login tab > click Inclusions > click Add > browse for NDS objects for which you want to specifically allow login.
Click OK to save the policy.
Repeat Step 1 through Step 6 for each platform where you want to set a WS Restrict Login policy.
When you have finished configuring all of the policies for this package, continue with the steps under Associating the Workstation Package to associate the policy package.
Associating the Workstation Package
The policies you configured and enabled will not be in effect until you associate their policy package with a container object.
To associate the Workstation Package:
In ConsoleOne, right-click the Workstation Package > click Properties.
Click the Associations tab > Add.
Browse for the container for associating the package > click OK.
or 