zman - The command line interface to manage Novell ZENworks 11 products, including Asset Management, Configuration Management, Endpoint Security Management, and Full Disk Encryption.
The zman command line interface provides quick access to most ZENworks management operations. By utilizing zman commands in scripts, you can automate many ZENworks management tasks.
The following sections provide information about all of the commands provided for the ZENworks products. The commands apply to all products, with the following exceptions:
ZENworks Asset Management commands: Apply only to ZENworks Asset Management.
ZENworks Bundle commands: Apply only to ZENworks Configuration Management.
ZENworks Imaging commands: Apply only to ZENworks Configuration Management.
ZENworks Endpoint Security Management commands: Apply only to ZENworks Endpoint Security Management.
ZENworks Full Disk Encryption commands: Apply only to ZENworks Full Disk Encryption.
zman <category>-<command> [-options] [arguments]
In general, zman commands have both a short form and a long form. The long form is assembled in the form category-action. For example, the command registration-list lists all registrations in a registration folder. There are many commands, but most of them are easy to remember because they are grouped under categories (workstation, server, bundle, policy, administrator, registration, etc) and most actions (list, create, modify, delete) to perform on them are common.
The abbreviated form of each command uses one letter from each word in the long form. In this manner, admin-list is shortened to al. There are some exceptions to this rule to maintain the uniqueness of the short names. For example, bc is the short form of bundle-create, and bcp is the short form of bundle-copy.
A command takes options and arguments. Options can be specified anywhere in the command. Arguments are dependent on position.
Options are of two types: switches and flagged options. Both have a short and long form. The short form is preceded by a single hyphen and the long form is preceded by two hypens. For example, -n and --namefilter are the short and long forms of a flagged option used to filter the display of results by name for the bundle-list command.
Switch: A parameter that does not take any value. Its presence alone conveys the meaning. For example, specifying the –recursive switch in bundle-list indicates that the contents of the subfolders should also be displayed.
Flagged Option: This parameter is used to set a value for an option. The value is given followed by a space or equals sign after the short or long flag of the option.Example: zman bundle-list -namefilter "bundle*" -r
Arguments for a command are usually ordered in the same way as the command itself. For example, for server-add-bundle, the server is named first and the bundle second.
This section contains a guide to general command formatting and conventions.
Every action in zman is governed by the access limitations of the administrator. The initial Administrator account created during the initial installation has rights to all objects. Additional administrator accounts you create are granted read-only rights by default. These accounts must be explicitly granted rights to any objects they are to manage.
The zman command line interface provides help at several levels. Pipeline the help through the operating system's native more command for scrollable output.
At the highest level, lists all the categories of commands available in zman and the global options for the commands.
Example: zman
At the all category level, lists all the commands available in zman organized by categories (workstation, server, bundle, policy, etc.).
Example: zman -h
For each category, lists the commands available specific to that category.
Example: zman policy /?
At each command level, gives usage, detailed help, and examples for a particular command.
Example: zman policy-list - help
-h, and --help are the various help options available.
If no folder is specified for commands that take a folder argument, the command targets the root folder. To specify a folder path, list each folder from the root separated by a forward slash (/). For example, if you have a folder named folder1 in the root, containing a subfolder named subfolder1, you would reference this folder as folder1/subfolder1. Each specified folder must already exist.
Arguments enclosed inside parentheses ( ) are mandatory and those enclosed by square brackets [ ] are optional.
An ellipsis indicates that a command accepts multiple entries of the last argument type. The arguments must be separated by space or commas, depending on the command. For example:
zman server-add-bundle [options] (server) (bundle) [...]
The ellipsis indicates that server-add-bundle can accept multiple bundles. In the command level help, the multiple entry argument help is given as [(bundle) (bundle)... (bundle)] for more clarity.
All commands that have multiple entries of the last argument also have the -f|--folder option. This option is convenient if all the entries of the argument are under the same folder. The path of the entries are calculated relative to this folder path. For example:
zman server-add-bundle server1 bundlefolder/bundle1 bundlefolder/bundle2
can also be given as:
zman server-add-bundle server bundle1 bundle2 --folder bundlefolder
If the argument required is the path of a ZENworks object, the path must be specified relative to the root folder of that object separated by a forward slash (/), unless it is specified in the command help to enter the absolute path. For example:
zman server-add-bundle serverfolder/server bundlefolder/bundle1
where the absolute paths of the arguments are:
/devices/servers/serverfolder/server and /bundles/bundlefolder/bundle1
You can use the zman commands such as bundle-export-to-file, policy-export-to-file, and settings-export-to-file to export bundles, policies, and settings definitions respectively to a specified file in the XML format. The file is created with the specified name and file extension. If the file extension is not specified, the .xml extension is added by default. You can use these files to create bundles, policies, and settings.
You can now run zman as service. Running zman as a service enables you to execute zman commands in service mode, which reduces the execution time for the commands.
The zman service commands are grouped within the shell category and are as follows:
Starts the zman service.
Accepts the following options:
Stops the zman service.
Displays the zman service status.
To run zman commands as a service, you must do the following:
Before starting the zman service, run the zman admin-store-credential(asc) command to save the credentials. The zman service uses the saved credentials to run the zman commands in service mode.
If you choose to run any zman command that requires file paths in service mode, you must specify the complete file path instead of the relative file path. By default, the working directory is initialized to the location where the zman service is started.
The following zman commands run as separate processes even when the zman service is up and running:
These commands are used to load purchase record files and refresh the compliance engine. They apply only to ZENworks Asset Management.
Imports a contract to a file. The command queues the import task to be processed by the loader. The loader then loads the contracts from the file.
The command is asynchronous, which means that zman returns immediately and does not wait for the import to be complete. This is because the command might run for a long time. You can check the progress of the import by viewing the log file created by the command.
Accepts the following option:
Loads a purchase record file. The Purchase Record Loader looks for the purchase record file to load on the primary server in the folder ZENWORKS_HOME/temp/PurchaseRecordImport/uploaded. If you have not yet used the Purchase Record Loader from ZENworks Control Center, you need to create this folder.
This command is asynchronous, which means zman returns immediately and does not wait for the command to complete. This is because the command may run for a long time. You can check the status of this process from ZENworks Control Center.
Runs the software compliance engine to refresh the software license compliance data.
This command is asynchronous, which means zman returns immediately and does not wait for the command to complete. This is because the command may run for a long time. You can check the status of this process from ZENworks Control Center.
These commands are used to import and export audit configuration details. Audit commands begin with audit- in the long form, or with the letter a in the short form. The following commands accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Exports change and agent audit event settings to an XML file for a zone, device folder or device level.
-s, --source=<source device or device folder path>: Path of the device or device folder relative to /Devices from which settings have to be exported. If not specified, settings will be exported from the Management Zone level.
-a, --auditEventStatus=<Event status>: Event status enabled, disabled or all. Default is all.-t, --type=<Type>: The event type can be AgentEvents, ChangeEvents or all. The default value is all.-e, --effective: If specified, the effective settings will be retrieved, else only the settings defined or overridden at the source path will be retrieved.
(XML file path): The file into which the settings data will be stored in XML format. If the file does not exist a new file is created.
[settings name][...]: Names of the settings to be exported. If not specified, all settings will be exported. If specified, the effective settings will be retrieved, else, only the settings defined or overridden at the source path will be retrieved.
Imports change and agent audit event settings from an XML file, for a zone, device folder or device level.
(XML file path): XML file containing exported settings information. Use audit-settings-export-to-file (asetf) to export settings information into an XML file.[destination device or device folder path][...]: Path of the device or device folder relative to /Devices on which settings have to be set. If not specified, settings will be set at the Management Zone level.
These commands are used to create and manage administrator accounts. Administrator commands begin with admin- in the long form or the letter a in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
admin-list-roles (alr) <ZENworks administrator name> [options]
admin-rights-delete (ard) <ZENworks administrator name> [options] [object path]
admin-rights-info (ari) <ZENworks administrator name> [object path] [options]
admin-rights-set (ars) <ZENworks administrator name> [rights category] [object path] [...] [options]
Clears the ZENworks username and password stored by using the admin-store-credential command. It is always safer and is a good practice to delete the stored credentials after you are finished executing the commands.
Creates a ZENworks administrator account.
<administrator or user> - Name of the administrator or full path of a user in a user source.
Accepts the following options:
The command prompts for the password of the administrator, to avoid entering the password in clear text. If the administrator account is based on a user, it uses the same credentials defined in the user source so the command does not prompt for the password.
Deletes a ZENworks administrator account.
<ZENworks administrator name> [...] - Name of the ZENworks administrator. The wildcard * can be used in the object names if it is enclosed in quotation marks. Exercise caution while using wildcards for deleting objects.
Lists all ZENworks administrator accounts.
Accepts the following options:
Lists roles assigned to a ZENworks administrator account.
Accepts the following option:
Renames a ZENworks administrator account.
Deletes rights assigned to a ZENworks administrator account.
[object path] [...] - Full path of the ZENworks object, starting with a forward slash (/).
Accepts the following option:
Displays rights assigned to a ZENworks administrator account.
[object path] [...] - Full path of the ZENworks object, starting with a forward slash (/).
Accepts the following options:
Allows or denies rights for a ZENworks administrator account.
[rights category] - Name of the category under which the rights are grouped. To see the list of categories, run zman admin-rights-set --Help | more.
[object path] [...] - Full path of the ZENworks object, starting with forward slash (/), on which the rights should be enforced. To view the root folders of the allowed object types for which rights can be assigned within each rights category, run zman admin-rights-modify --Help | more.
Accepts the following options:
Stores the ZENworks username and password for use with every command so credentials need not be entered for every command. The credentials are stored on the home directory of the logged-in user and are used only for that logged-in user. In Linux, ensure that the user has a home directory. If you share the same machine login with other ZENworks administrators, you must clear your credentials by using the admin-clear-credential command after you are finished executing commands.
The batch command is a utility command used to execute a list of zman commands from a text file. The commands are executed faster because logging into ZENworks is done only once and not for every command. Batch commands begin with batch- in the long form, or with the letter b in the short form.
This command accepts the option flags listed in the Global Options section. In addition, it accepts individual options as listed with the command.
Executes zman commands from text files in a batch (not to be confused with Windows batch files).
(file path) [...] - The path of the text files containing zman commands to be executed. Lines starting with #, rem, REM, ; and // are considered as comments, and are not processed. For a sample file, refer to BatchExecuteCommands.txt located in /opt/novell/zenworks/share/zman/samples/batch on a Linux server or Installation_path:\Novell\Zenworks\share\zman\samples\batch on a Windows server.
Accepts the following option:
Examples:
To execute zman commands in multiple files:
zman bex c:\filetxt c:\filetxt
The files are executed in the order of input.
To execute zman commands in multiple files but exit when a command fails:
zman bex /home/user1/file1 /home/user1/file2 -e
The files are executed in the order of input.
These commands are used to create, modify and manage bundles. Bundle commands begin with bundle- in the long form, or with the letter b in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command. These commands apply only to ZENworks Configuration Management.
bundle-add-actions (baa) (bundle path) (action XML file) [...] [options]
bundle-copy (bcp) (bundle path) (bundle name) [parent folder] [options]
bundle-create (bc) (bundle name) (bundle XML file) [parent folder] [options]
bundle-delete-version (bdv) (bundle path) [bundle version number] [options]
bundle-folder-create (bfc) (folder name) [parent folder] [options]
bundle-group-add (bga) (bundle group path) (bundle path) [...] [options]
bundle-group-create (bgc) (group name) [parent folder] [options]
bundle-group-remove (bgr) (bundle group path) (bundle path) [...] [options]
bundle-list-assignments (blas) (bundle or bundle group) [options]
bundle-move (bmv) (bundle object path) [destination folder path]
bundle-remove-actions (bra) (bundle path) (action set type) [action's positions] [...]
bundle-rename (br) (bundle object path) (new name) [options]
bundle-reorder-actions (broa) (bundle path) (action set type) (current position) (new position)
bundle-sandbox-create (bsc) (bundle path) [version of the bundle] [options]
bundle-sandbox-publish-to-newbundle (bsptn) (bundle path) (bundle name) [parent folder] [options]
bundle-view-advanced-deployment-status (bvads) (bundle path) [options]
bundle-appdata-calculation (bac) (bundle path or bundle GUID) [...]
Adds actions to a bundle.
(action XML file) [...] - The XML files that contain information for actions to be added. The actions are grouped under one of these action sets: Distribution, Install, Launch, Verify, Uninstall, Terminate. The XML file contains an ActionSet element that contains information of actions to be added for an action set. Multiple XML files can be given as input to add actions to different action sets of the bundle. The XML files can be created by exporting actions of an existing bundle using the bundle-export-actions command.
Accepts the following option:
NOTE:If you choose the action set type as Uninstall, the following options are not supported for Linux bundles and Linux Patch bundles: DaysBeforeUninstallWhenNotUsed, DisplayUninstallMessage, IgnoreUninstallAfterUnassociation, IgnoreChainedDependencies, and AllowToCancelUninstall.
Assigns a bundle or bundle group to one or more device or user objects.
(device or user type) - Valid values are device, server, workstation, and user.
(device or user object path) [...] - The path of the device or user objects relative to the root folder of the device or user type specified.
Accepts the following options:
Copies a bundle.
Accepts the following options:
Creates a new bundle.
(bundle XML file) - XML file containing exported bundle information. Use bundle-export-to-file (betf) to export a existing bundle's information into an XML file. If you want to reuse files, template XML files can be created from bundles that were created through ZENworks Control Center. For a sample XML file, refer to WindowsMSIBundle.xml located in /opt/novell/zenworks/share/zman/samples/bundles on a Linux server or Installation_directory:\Novell\Zenworks\share\zman\samples\bundles on a Windows server.
Accepts the following options:
NOTE:If you choose the action set type as Uninstall, the following options are not supported for Linux bundles and Linux Patch bundles: DaysBeforeUninstallWhenNotUsed, DisplayUninstallMessage, IgnoreUninstallAfterUnassociation, IgnoreChainedDependencies, and AllowToCancelUninstall.
Deletes one or more bundle objects.
(bundle object path) [...] - The path of the bundle objects (bundle, bundle folder or bundle group) relative to /Bundles. The wildcard * can be used in the object names if it is enclosed in quotation marks. Exercise caution while using wildcards for deleting objects.
Accepts the following options:
Deletes one or more versions of the bundle.
[bundle version number] [...] - Version of the bundle to delete.
Accepts the following option:
Examples:
To delete the version 5 of the bundle, zenbundle:
zman bdv zenbundle 5
To delete all the versions of the bundle, zenbundle:
zman bdv zenbundle -a
To delete all the versions of the bundle, zenbundle, that are older than the version 3:
zman bdv zenbundle version -p 3
Disables bundles.
Accepts the following option:
Enables bundles.
Accepts the following option:
Exports the actions added to a bundle's action set to a file. The file can be used as input to the bundle-add-actions command.
(action set type) - The type of the action set. If this option is specified, the actions for only this action set are listed. Valid values are Install, Launch, Verify, Uninstall, Terminate, and Preboot.
NOTE:The Terminate action set is not supported for Linux bundles and Linux Patch bundles.
[action's positions] [...] - A comma-separated list of position of actions in the action set. The first action is at position 1. Use the bundle-list-actions command to see the position of a particular action in an action set. This is optional, but if it is not specified, all the actions in the specified action set are exported.
Exports a bundle's information (in XML format) to a file. The XML file is to be used as input for creating bundles.
(XML file path) - The complete path of the XML file to which the bundle’s information is to be exported.
[version of the bundle] - Version of the bundle to be exported. If it not specified, the published version of the bundle is considered. To export a sandbox version of the bundle, specify sandbox.
[-c|--export-content] - Exports the content of the bundle to a sub directory within the directory containing the XML file to which the bundle’s information is exported. If the option is not specified, the bundle content is not exported.
Examples:
To export the sandbox version of a bundle named zenbundle to an xml file named bundle.xml:
zman betf bundlefolder/zenbundle C:\bundles\bundle.xml sandbox
To export the version 3 of a bundle named zenbundle to an xml file named bundle.xml:
zman betf bundlefolder/zenbundle C:\bundles\bundle.xml 3
To export the version 5 of a bundle named zenbundle to an xml file named bundle.xml and export the bundle’s content to the C:\bundles\bundle_content directory:
zman betf bundlefolder/zenbundle C:\bundles\bundle.xml 5 -c
Creates a new folder for containing bundles.
Accepts the following option:
Adds bundles to a bundle group.
Accepts the following option:
Creates a bundle group and adds members to it.
Accepts the following options:
Lists members of a bundle group.
Accepts the following option:
Removes bundles from a bundle group.
Accepts the following option:
Increments the version of bundles. This command is applicable for versions prior to ZENworks 11SP1. In ZENworks 11 SP1or higher, this command is replaced by the bundle-sandbox-publish (bsp) command
Accepts the following option:
Lists bundles objects.
Accepts the following options:
Lists actions added to a bundle.
[action set type] - The type of the action set. If this option is specified, the actions for only this action set are listed. Valid values are Install, Launch, Verify, Uninstall, Terminate, and Preboot.
NOTE:The Terminate action set is not supported for Linux bundles and Linux Patch bundles.
Lists the device and user assignments for a bundle.
Accepts the following options:
-t, --typefilter=[assignment type] - Filters on the assignment type. Valid values are device and user.
-s, --scrollsize=[scrollsize] - Number of results to be displayed at a time.
Lists the bundle groups of which the given bundle is a member.
Accepts the following options:
-s, --scrollsize=[scrollsize] - Number of results to be displayed at a time.
Examples:
To list all the bundle groups that bundle1 belongs to with five results displayed at a time:
zman blg bundlefolder/bundle1 -s 5
Lists all the versions of the bundle.
Examples:
To list all the versions of the bundle, zenbundle:
zman blv zenbundle
Moves a bundle object to a different folder.
Removes actions from a bundle.
(action set type) - The type of the action set that contains the action. Valid values are Install, Launch, Verify, Uninstall, Terminate, and Preboot.
NOTE:The Terminate action set is not supported for Linux bundles and Linux Patch bundles.
[action's positions] [...] - A comma-separated list of position of actions in the action set. The first action is at position 1. Use the bundle-list-actions command to see the position of a particular action in an action set. This is optional, but if it is not specified, all the actions in the specified action set are removed.
Renames a bundle object.
Reorders actions in the action set of a bundle.
(action set type) - The type of the action set that contains the action. Valid values are Install, Launch, Verify, Uninstall, Terminate, and Preboot.
NOTE:The Terminate action set is not supported for Linux bundles and Linux Patch bundles.
Creates a sandbox from an existing version of a bundle
[version of the bundle] - Specify the version of the bundle to be used for creating the sandbox.
Accepts the following option:
Example:
To create a sandbox from the version 2 of a bundle, zenbundle:
zman bsc zenbundle 2
Publishes a sandbox to create a published version.
Accepts the following option:
Examples:
To publish the sandbox version of a bundle, zenbundle:
zman bsp zenbundle
To publish the sandbox version of a bundle named zenbundle1 along with all its dependent bundles:
zman bsp zenbundle1 -f -c
Publishes a sandbox to a new bundle.
Accepts the following option:
Examples:
To publish the sandbox version of a bundle named zenbundle1 as a new bundle named zenbundle2:
zman bsptn zenbundle1 zenbundle2 /Bundles/Folder1
To publish the sandbox version of a bundle named zenbundle1 as a new bundle named zenbundle2 and publish the dependent bundles of zenbundle1 as new bundles:
zman bsptn zenbundle1 zenbundle2 /Bundles/Folder1 depsToNewFolder=/Bundles/Folder2
Deletes the sandbox and reverts to the latest version of the bundle.
Example:
To delete the sandbox of a bundle, zenbundle and revert to the latest version of the bundle:
zman bsr zenbundle
Unassigns a bundle or bundle group from one or more device or user objects.
(device or user type) - Valid values are device, server, workstation, and user.
(device or user object path) [...] - The path of the device or user objects relative to the root folder of the device or user type specified.
Accepts the following option:
Updates the assignment between a bundle or bundle group and device or user objects.
(device or user type) - Valid values are device, server, workstation, and user.
(device or user object path) [...] - The path of the device or user objects relative to the root folder of the device or user type specified.
Accepts the following options:
Displays advanced deployment status of a bundle.
Accepts the following options:
Displays the deployment schedules for a bundle assigned to a device or user object.
(device or user type) - Valid values are device, server, workstation, and user.
(device or user object path) [...] - The path of the device or user objects relative to which the bundle group is assigned.
Displays a summary of the deployment status of a bundle.
Creates an XML file to export package metadata. Use the baa command to add the exported content to the server.
Accepts the following option:
Queues a loader action that will calculate and cache application data for bundles, and waits until the action is fully executed. The cached data will be used to prepare web service responses and enhance performance.
NOTE:The zman bac command is applicable only for Patch Policies within ZENworks Patch Management.
These commands are used to set and modify bundle settings. Settings commands begin with settings- in the long form, or with the letter s in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Copies settings.
(source bundle or bundle folder path) - The path of the bundle or bundle folder relative to /Bundles from which settings have to be copied.
(destination bundle or bundle folder path) [...] - The path of the bundles or bundle folders relative to /Bundles to which settings must be copied.
Accepts the following option:
Exports settings data (in XML format) to a file. The XML file is to be used as input for creating or modifying settings.
(XML file path) - The file into which the settings data is stored in XML format. If the file does not exist, a new file is created.
[settings name] [...] - Names of the settings to be exported. If this option is not specified, all settings are exported.
Accepts the following options:
Reverts the settings to that of the parent folder.
(source bundle or bundle folder path) - The path of the bundle or bundle folder relative to /Bundles, whose settings must be reverted.
Sets settings at various levels.
(XML file path) - XML file containing exported settings information. Use settings-export-to-file (setf) to export settings information into a XML file.Accepts the following options:
[settings name] [...] - Names of the settings to be exported. If this option is not specified, all settings are exported.
These commands are used to manage the certificate authority role of ZENworks servers. Certificate authority commands begin with certificate-authority- in the long form, or with the letters ca in the short form.
Exports the key-pair credentials of the zone certificate authority to a file, and optionally disables the Certificate Authority role of the local server.
Accepts the following option:
Imports the key-pair credentials of the zone certificate authority from a file and enables the Certificate Authority role on the local server.
Disables the Certificate Authority role on the local server.
Enables the Certificate Authority role on the local server.
These commands are used to manage the credentials needed for certain ZENworks actions and tasks that require authentication to resources. Credential commands begin with credentials- in the long form, or with the letters cr in the short form.
Creates credentials.
Accepts the following options:
Deletes credentials.
Creates a new folder for containing credentials.
Accepts the following option:
Lists credentials.
Moves a credential.
Renames credentials.
Creates credentials.
Accepts the following options:
These commands are used to manage the embedded Sybase SQL Anywhere database. Database commands begin with database- in the long form, or with the letter d in the short form.
NOTE:These commands cannot be used to manage an external Sybase SQL Anywhere database.
Retrieves the credentials used to connect to the Audit Embedded Sybase SQL Anywhere database.
Backs up the embedded Sybase SQL Anywhere database and also allows you to schedule the backup operation.
(backup directory) - The local directory on the database server or the network location where the database files are backed up. Ensure that the parent directory already exists and has sufficient disk space. Any existing database files in the directory are overwritten.
[schedule SQL file] - File that contains the schedule for backing up the database. The SQL file can contain CREATE EVENT, ALTER EVENT, or DROP EVENT SQL statements. For sample SQL files, refer to the files located in /opt/novell/zenworks/share/zman/samples/database on a Linux server or Installation_directory:\Novell\Zenworks\share\zman\samples\database on a Windows server. If you do not specify a schedule file, the database is backed up immediately. For more information on defining schedules, refer to the SQL Anywhere documentation at http://infocenter.sybase.com/help/index.jsp?topic=/com.sybase.dbdaen10/html/title.htm.
Accepts the following option:
Retrieves the credentials used to connect to the embedded Sybase SQL Anywhere database.
These commands are used to perform deployment tasks. Deployment commands begin with deployment- in the long form, or with the letters dp in the short form.
Aborts the deployment task.
Creates a deployment task to deploy the ZENworks Adaptive Agent to devices by using the IP address or DNS name.
(user credential file) - The path of the file containing the credentials to connect to the device. Each line in the file should have a username and password separated by a space. For example, administrator password.
Accepts the following options:
Deletes the deployment task.
Lists the deployment tasks and the status.
Accepts the following options:
Schedules the specified deployment task to run immediately. The task should have the credentials saved in the data store.
These commands are used to view device discovery-related information. Discovery commands begin with discovery- in the long form, or with the letter d in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Lists the discovered devices.
Accepts the following options:
Lists the discovery tasks and the status.
Accepts the following options:
Executes the specified discovery task immediately.
These commands are used to view dynamic groups, group members, and to refresh a group. Dynamic group commands begin with dynamic-group- in the long form, or with the letters dg in the short form.
Lists the dynamic groups.
Accepts the following options:
Lists the members of the specified dynamic group.
Accepts the following options:
Refreshes the specified dynamic group.
Accepts the following options:
Lists the filters for the specified dynamic group.
(path of the dynamic group folder) - Path of the dynamic group. You can either specify the complete path or the relative path of the root folder
These commands are used to import and export security policies and to export a Management Zone’s security policy encryption key (KMK). They apply only to ZENworks Endpoint Security Management.
All of the commands below accept the option flags listed in the Global Options section, with the exception that the esmpolicy-export-to-file and esmpolicy-import commands cannot be run remotely and therefore do not accept the --host option.
Exports a security policy's information to an encrypted XML policy file. The XML policy file can be used to import the policy to the same Management Zone or a different Management Zone.
NOTE: To import a policy, you must also supply the zone’s security policy encryption key (KMK) so that the encrypted XML policy file can be decrypted. Use the esmpolicy-export-kmk-to-file command to create the key file.
(policy path) - The path (including the filename) of the policy object relative to the Policies root folder. For example, FWpolicy1 or ESMpolicies/DEpolicy4.
(XML policy file path) - The path (including the filename) where you want to save the XML policy file. If you specify a filename only, the file is saved to the current directory. For example, firewallpolicy.xml or c:\firewallpolicy.xml.
Examples:
zman epetf FWPolicy1 c:\FWpolicy1.xml
zman epetf ESMpolicies/DEpolicy4 DEpolicy4.xml
Exports the Management Zone’s security policy encryption key (KMK) to a file. The key file is required to decrypt an XML policy file (that was exported from a policy in the zone) when importing the policy with the esmpolicy-import command.
(policy encryption key file path) - The path (including filename) where you want to save the security policy encryption key (KMK) file. If you specify a filename only, the file is saved to the current directory. Use any supported filename for the file. The extension is not important; you can use any extension or no extension. For example, KMK.txt, key.xml, KMK, and decryption.file are all valid filenames.
Examples:
zman epektf c:\key.txt
zman epektf EncryptionKey.xml
Imports a security policy from an encrypted XML file created by the esmpolicy-export-to-file command.
(policy name) - The name to assign to the policy object.
(policy encryption key file path) - The full path (including filename) of the security policy encryption key (KMK) file for the Management Zone from which the policy was exported. This file is required to decrypt the encrypted XML file. If the key file is in the current directory, specify the filename only.
(XML policy file path) - The full path (including filename) of the encrypted XML policy file. If the file is in the current directory, specify the filename only.
[parent folder] - The Policies folder in which to create the policy object. If you want to create the object in the root folder, ignore this option.
Examples:
zman epi FWPolicy c:\key.txt c:\FWpolicy.xml
zman epi DEPolicy key.txt encryptionpolicy.xml esmpolicies/encryption
Purges effective policy report records from the ZENworks database. The following options can be used to target report records for specific devices or for specific time periods.
[(device path) (device path) ... (device path)]: To purge the effective policy report records for specific devices, specify the full path for each device. Ignore this option to purge reports for all devices.
[-b|--begin-date=yyyy-MM-dd HH:mm:ss]: To purge effective policy report records starting with a specific date, specify the begin date. All records with a timestamp on or after the begin date are purged. Use this option with the end-date option to designate a specific time period.
[-e|--end-date=yyyy=MM-dd HH:mm:ss]: To purge effective policy report records up to a specific date, specify the end date. All records with a timestamp on or before the end date are purged. Use this option with the begin-date option to designate a specific time period.
[-u|--unregisteredDevices]: Purge effective policy report records for devices that are no longer registered in the zone but that still have report data in the ZENworks database.
Examples:
zman epep /Devices/Workstations/device1
zman epep /Devices/Workstations/device1 -b "2010-10-10 10:10:10" -e "2010-12-31 24:00:00"
zman epep -u
These commands apply only to ZENworks 11 Full Disk Encryption. In addition to the parameters listed below, the commands accept the option flags listed in the Global Options section.
Purges emergency recovery information (ERI) records from the ZENworks database. The following options can be used to target records for specific devices or for specific time periods.
[(device path) (device path) ... (device path)]: To purge the ERI records for specific devices, specify the full path for each device. Ignore this option to purge reports for all devices.
[-b|--begin-date=yyyy-MM-dd HH:mm:ss]: To purge ERI records starting with a specific date, specify the begin date. All records with a timestamp on or after the begin date are purged. Use this option with the end-date option to designate a specific time period.
[-e|--end-date=yyyy=MM-dd HH:mm:ss]: To purge ERI records up to a specific date, specify the end date. All records with a timestamp on or before the end date are purged. Use this option with the begin-date option to designate a specific time period.
[-u|--unregisteredDevices]: Purge ERI records for devices that are no longer registered in the zone but that still have report data in the ZENworks database.
Examples:
zman fpe /Devices/Workstations/device1
zman fpe /Devices/Workstations/device1 -b "2010-10-10 10:10:10" -e "2010-12-31 24:00:00"
zman fpe -u
Exports a full disk encryption policy's information to an encrypted XML policy file. The XML policy file can be used to import the policy to the same Management Zone or a different Management Zone.
NOTE: To import a policy, you must also supply the zone’s full disk encryption policy encryption key (KMK) so that the encrypted XML policy file can be decrypted. Use the fdepolicy-export-kmk-to-file command to create the key file.
(policy path) - The path (including the filename) of the policy object relative to the Policies root folder. For example, FDEpolicies/FDEpolicy4.
(XML policy file path) - The path (including the filename) where you want to save the XML policy file. If you specify a filename only, the file is saved to the current directory. For example, FDEpolicy.xml.
Example:
zman fpetf FDEPolicy1 c:\FDEpolicy1.xml
Imports a full disk encryption policy from an encrypted XML file created by the fdepolicy-export-to-file command.
(policy name) - The name to assign to the policy object.
(policy encryption key file path) - The full path (including filename) of the full disk encryption policy encryption key (KMK) file for the Management Zone from which the policy was exported. This file is required to decrypt the encrypted XML file. If the key file is in the current directory, specify the filename only.
(XML policy file path) - The full path (including filename) of the encrypted XML policy file. If the file is in the current directory, specify the filename only.
[parent folder] - The Policies folder in which to create the policy object. If you want to create the object in the root folder, ignore this option.
Example:
zman fpi FDEPolicy c:\key.txt c:\FDEpolicy.xml
Exports the Management Zone’s full disk encryption policy encryption key (KMK) to a file. The key file is required to decrypt an XML policy file (that was exported from a policy in the zone) when importing the policy with the fdepolicy-import command.
(policy encryption key file path) - The path (including filename) where you want to save the full disk encryption policy encryption key (KMK) file. If you specify a filename only, the file is saved to the current directory. Use any supported filename for the file. The extension is not important; you can use any extension or no extension. For example, KMK.txt, key.xml, KMK, and decryption.file are all valid filenames.
Examples:
zman fpektf c:\key.txt
zman fpektf EncryptionKey.xml
This command is used to view the list of devices that have unacknowledged warnings or errors. The Hotlist command begin with hotlist- in the long form, or with the letter hl in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Lists devices that have unacknowledged warnings or errors.
Accepts the following options:
These commands are used to perform Preprovisioning, Provisioning, and Management operations on the Intel AMT devices. The Intel AMT commands begin with iamt- in the long form, or with the letter i in the short form.
The supported iAMT versions in ZENworks are 3, 4, 5, and 6.
Prints the ZENworks Root Certificate hash.
Creates or imports the Intel AMT Provisioning or Management Certificate in the .DER format on every Primary Server that is used as an iAMT Provisioning or Management Server.
Accepts the following options if you are importing an external certificate:
For example, to import an external certificate, run the following command:
iamt-create-mgmtcert (icmc) [-p|--certpath=Intel AMT Provisioning/Management Certificate_path_in_.DER format]
Creates the Certificate Request for the Intel AMT Provisioning / Management Server or the AMT device in an External CA environment.
Accepts the following options:
Clears the Intel AMT Provisioning / Management Certificate.
Imports the External CA or its subordinate CA on the server.
Accepts the following options if you are importing an External CA or its subordinate CA:
These commands are used to perform Imaging operations. Imaging commands begin with imaging- in the long form, or with the letter i in the short form.
Accepts the following options:
For example, to apply the assigned Imaging bundle to a server with the name server1, run the following command:
zman iaaib server server1
If the device object is located within a folder, use the following command:
iaaib (Device type) (folder/path of device)/(Device name)
where folder/path of device is the relative path of the device within the Workstation or Server folder.
These commands are used to initiate scans and send an inventory data collection form to the managed devices. Inventory commands begin with inventory- in the long form, or with the letter i in the short form.
Sends the inventory data collection form to one or more devices.
Accepts the following option:
Initiates an inventory scan of one or more devices.
Accepts the following option:
Imports the administrator-defined local products and product fingerprints. Only administrators with CDLP rights can import the local products.
To import product data:
zman iilp {pathname} [-U (Administrator)] [-P (password)].
Example:
To import administrator-defined local products to ZENworks Configuration Management from a file in ./output/lpimports.txt:
zman iilp ./output/lpimports.txt -U Administrator -P novell.
Exports the administrator-defined local products and product fingerprints. Only administrators with CDLP rights can export the local products.
To export product data:
zman ielp {pathname} [-U (Administrator)] [-P (password)].
Example:
To export all administrator-defined local products from ZENworks Configuration Management to a file in ./output/lpexports.txt:
zman ielp ./output/lpexports.txt -U Administrator -P novell.
These commands are used to activate your ZENworks server or to display licensing information. License commands begin with license- in the long form, or with the letter l in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Activates the ZENworks products (Asset Inventory for Unix/Linux, ZENworks Configuration Management, ZENworks Asset Management, ZENworks Full Disk Encryption, ZENworks Endpoint Security Management) or the ZENworks Suite.
Deactivates the ZENworks products. Only the product name is needed as an argument.
Displays the licensing information.
Forces the system to refresh the stored license cache, which is normally updated once per day. Use this command to update the cache at any time, such as when an evaluation license might expire and the cache doesn’t yet reflect that.
Lists the current license states of all known ZENworks Configuration Management components and DataModel plug-ins (two separate lists).
These commands are used to view and manage locations. A location consists of one or more network environments. When the ZENworks Adaptive Agent determines that its current environment matches a network environment associated with a location, the agent enforces any security policies and closest server rules assigned to the location.
Location commands begin with location- in the long form, or with the letter l in the short form. All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
location-create (lc) (location name) [-d|--desc=<description>] [network environment name] [...]
location-delete-all-network-assignments (ldana) (location name)
location-delete-network-assignments (ldna) (location name) [network environment name] [...]
location-list-relationships (llrel) (location name) [-c count]
location-network-assign (lna) (location name) (network environment name) [...]
Configures the audit data upload for a specified location.
(location name) - The name of the location.
(state) - Select the state:
1 to enable devices in the associated location to upload audit event data to any Satellite Server (Collection role) or Primary Server.
2 to disable devices in the associated location from uploading audit event data to any Satellite Server (Collection role) or Primary Server.
Creates a location and (optionally) assigns network environments to the location.
(location name) - The name you want assigned to the new location.
-d, --desc=<description> - A description for the location.
[network environment name] - The name of an existing network environment that you want to assign to the location. You can add multiple network environments. Adding network environments during creation of a location is optional. You can use the location-nwenv-assign command to add network environments after creation.
Deletes locations.
(location name) - The name of the location you want to delete. You can specify one or more location names.
Removes all network environments from a location.
(location name) - The name of the location from which you want to remove all assigned network environments.
Removes specific network environments from a location.
(location name) - The name of the location from which you want to remove network environments.
[network environment name] - The name of the network environment that you want to remove. You can remove multiple network environments.
Lists locations.
Accepts the following options:
Lists the network environments assigned to a location.
(location name) - The name of the location whose network environments you want to view.
Accepts the following options:
Lists the ZENworks objects such as policies and bundles that are associated with the specified location.
(location name) - The name of the location whose ZENworks objects you want to view.
Accepts the following option:
Adds network environments to a location.
(location name) - The name of the location to which you want to assign network environments.
[network environment name] - The name of an existing network environment that you want to add to the location. You can add multiple network environments.
Renames a location.
(old name) - The name of the location that you want to rename.
(new name) - The new name for the location.
Requests the server to recompute the location configuration response so that the requesting devices can obtain the latest changes.
[Device Folder or Device Object Path][...]: Specify the path of a device folder or device object.
-f, --forceRecompute: Force recompute all the location configuration responses.
Sets the bandwidth throttle rate to be used for distributing content to devices identified with the specified location. To maximize performance of your ZENworks Servers and network system, high bandwidth environments can use one set of throttle rates and low bandwidth environments can use a different set of throttle rates. The throttle rate can be overridden in a bundle so that high-priority patch and bundle content can be deployed quickly.
(location name) - The name of the location for which you want to define the bandwidth throttle rate.
(throttle rate) - The maximum bandwidth rate in kilobits per second (kbps).
Sets the bandwidth throttle rate to be used for distributing content to devices identified with the Unknown location.
(throttle rate) - The maximum bandwidth rate in kilobits per second (kbps).
These commands are used to copy, export, and import Closest Server rules. Location commands begin with location- in the long form, or with the letter loc in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
The Location Rules commands are applicable only for the ZENworks Configuration Management 10.2.x/10.3.x zone. The commands are no longer valid after you baseline your zone to ZENworks 11 SP3. To configure locations in ZENworks, you must use the commands listed in the Location category.
Imports Closest Server rules data (in XML format) from a file. If the devices or folders specified in the XML file no longer exist, they are skipped.
(source device or device folder path) - Path of the device or device folder starting with /Devices from which Closest Server rules are to be copied.
(destination device or device folder path) - Paths of one or more devices or device folders starting with /Devices to which Closest Server rules are to be applied. If the destination does not exist, or does not appear in the XML file, it will be skipped.
Accepts the following options:
Examples:
To copy the rules from /Devices/Workstations/Folder1 to /Devices/Workstations/Folder2 and /Devices/Workstations/MyComputer:
zman loccp /Devices/Workstations/Folder1 /Devices/Workstations/Folder2 /Devices/Workstations/MyComputer
To copy the rules from /Devices/Workstations/Folder1 to /Devices/Workstations/Folder2 overwriting existing values:
zman loccp -o /Devices/Workstations/Folder1 /Devices/Workstations/Folder2
Exports Closest Server rules data (in XML format) to a file. The XML file can be used as input for creating or appending to the Closest Server rules.
(XML file path) - The file into which the rules data will be stored in XML format. The file is created if it does not exist.
Accepts the following option:
Examples:
To export the Closest Server rules for folder /Devices/Servers to C:\rules.xml:
zman loctf -s /Devices/Servers C:\rules.xml
To export all Closest Server rules to C:\rules.xml:
zman loctf C:\rules.xml
Imports Closest Server rules data (in XML format) from a file. If the devices or folders specified in the XML file no longer exist, they are skipped.
(XML file path) - XML file containing exported rules information. Use location-export-rules-to-file (loctf) to export settings information into an XML file.
[destination device or device folder path][...] - Paths of one or more devices or device folders starting with /Devices to which Closest Server rules are to be applied. If the destination does not exist, or does not appear in the XML file, it will be skipped.
Accepts the following options:
Examples:
To import Closest Server rules from C:\rules.xml:
zman locff C:\rules.xml
To import Closest Server rules from C:\rules.xml and quit on error:
zman locff -q C:\rules.xml
To import Closest Server rules from C:\rules.xml overwriting existing values:
zman locff -o C:\rules.xml
These commands are used to view and manage messages. Message commands begin with message- in the long form, or with the letter m in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Acknowledges messages associated with a ZENworks managed device, bundle, or policy.
[object path] - Full path of the object that has messages associated with it. The object can be a server, workstation, bundle, or policy.
Accepts the following options:
Deletes messages associated with a ZENworks managed device.
[object path] - Full path of the object that has messages associated with it. The object can be a server, workstation, bundle, or policy.
Accepts the following options:
Lists messages associated with a ZENworks managed device, bundle, or policy.
These commands are used to view and manage network environments. Network environments consist of services (gateways, DNS servers, DHCP servers, and so forth) that identify the environment.
Network environments are the building blocks for locations. When the ZENworks Adaptive Agent determines that its current environment matches a network environment assigned to a location, the agent enforces any security policies and closest server rules assigned to the location.
Network environment commands begin with network-environment- in the long form, or with the letters ne in the short form. All of the commands below accept the flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
network-environment-audit-upload (neau) (network environment name) (state)
network-environment-delete (ned) (network environment name) [...]
network-environment-export-to-file (neetf) (network environment name) (XML file path)
network-environment-list-relationships (nelr) (network environment name) [-cr count]
network-environment-throttle (net) (network environment name) (throttle rate)
Configures the audit data upload setting for a specified network environment.
(network environment name) - The name of the network environment.
(state) - Select the state:
0 to revert to the audit data upload settings configured for the location associated with the device.
1 to enable devices in the associated network environment to upload audit event data to any Satellite Server (Collection role) or Primary Server.
2 to disable devices in the associated network environment, from uploading audit event data to any Satellite Server (Collection role) or Primary Server.
Creates a network environment from the information contained in the specified XML file.
(network environment name) - The name you want assigned to the new network environment.
-d, --desc=<description> - A description for the network environment.
[network environment XML file] - The pathname of the XML file containing the information needed to create the network environment. If you don’t already have an XML file, use the network-environment-export-to-file command to export the information for an existing network environment. You can then use the XML file as a template for creating new network environment files.
Deletes a network environment.
(network environment name) - The name of the network environment you want to delete. You can specify one or more names.
Exports a network environment’s information to an XML-formatted file.
The network-environment-create command requires network environment information to be input through an XML-formatted file. You can use this file as a template, modifying it as necessary to include the information you want used when creating a new network environment.
(network environment name] - The name of the network environment whose information you want to export to the file.
(XML file path) - The file path and name for the export file.
Lists network environments.
Accepts the following options:
Lists the ZENworks objects such as policies and bundles that are associated with the specified network environment.
(network environment name) - The name of the network environment whose ZENworks objects you want to view.
Accepts the following option:
Renames a network environment.
(old name) - The name of the network environment that you want to rename.
(new name) - The new name for the network environment.
Sets the bandwidth throttle rate for distributing content to devices located in a specific network environment. To maximize performance of your ZENworks Servers and network system, high bandwidth environments can use one set of throttle rates and low bandwidth environments can use a different set of throttle rates. The throttle rate can be overridden in a bundle so that high-priority patch and bundle content can be deployed quickly.
(network environment name) - The name of the network environment for which you want to define the bandwidth throttle rate.
(throttle rate) - The maximum bandwidth rate in kilobits per second (kbps).
This command is used to register the Primary Server to the Novell Customer Center.
The Novell Customer Center Registration command begins with ncc-register in the long form, or with nccreg in the short form. This command accepts the flags listed in the Global Options section. In addition, it accepts individual options as listed with the command.
Registers the Primary Server to the Novell Customer Center.
(abc@xyz.com) - The Email address to register the Primary Server to the Novell Customer Center Server.
(registration-key) - The Registration key to register the Primary Server to the Novell Customer Center Server.
[Primary Server path] - The path of the Primary Server to register to the Novell Customer Center Server.
-i, --nccConfigXML= ncc-config.xml - The XML file that contains registration information such as the product, version, architecture, and release.
-r, --reRegister - Reregister the Primary Server to the Novell Customer Center Server.
Examples:
To register the Local Primary Server to the Novell Customer Center Server, run the following command:
zman nccreg email reg-key
To register a specific Primary Server to the Novell Customer Center Server, run the following command:
zman nccreg email reg-key server_path
To reregister the Local Primary Server to the Novell Customer Center Server, run the following command:
zman nccreg email reg-key -r
To reregister a specific Primary Server to the Novell Customer Center Server, run the following command:
zman nccreg email reg-key server_path -r
These are utility or convenience commands to operate on ZENworks objects. Object commands begin with object- in the long form, or with the letter o in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Gets the GUID of a ZENworks object.
(object path) - Full path of the ZENworks object, starting with a forward slash (/).
Gets the name of a ZENworks object.
(ZENworks GUID) - The ZENworks GUID of the object, consisting of 32 characters.
Gets the path of a ZENworks object, given the GUID.
(ZENworks GUID) - The ZENworks GUID of the object, consisting of 32 characters.
These commands are used to manage content on the Primary Server. Primary Server commands begin with primary-server-.
Replicates the content for the specified bundle or policy on the Primary Server.
Examples:
To replicate the content of a bundle to the current server: zman psrc /Bundle/bundle1
To replicate the content of a policy to the current server: zman psrc /Policy/policy1
Cleans up the content for the specified bundle/policy on the Primary Server.
Examples:
To clean up the content of a bundle from the current server: zman pscc /Bundle/bundle1
To clean up the content of a policy from the current server: zman psrc /Policy/policy1
These commands are used to create, modify and manage policies. Policy commands begin with policy- in the long form, or with the letter p in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
policy-create (pc) (policy name) (policy XML file) [parent folder] [options]
policy-copy (pcp) (policy path) (policy name) [parent folder] [options]
policy-delete-version (pdv) (policy path) [version of the policy to be deleted] [options]
policy-folder-create (pfc) (folder name) [parent folder] [options]
policy-group-add (pga) (policy group path) (policy path) [...] [options]
policy-group-create (pgc) (group name) [parent folder] [options]
policy-group-remove (pgr) (policy group path) (policy path) [...] [options]
policy-list-assignments (plas) (policy or policy group) [options]
policy-move (pmv) (policy object path) [destination folder path]
policy-sandbox-create (psc) (policy path) [version of the policy] [options]
policy-sandbox-publish-to-newpolicy (psptn) (policy path) (policy name) [parent folder] [options]
policy-rename (pr) (policy object path) (new name) [options]
policy-view-advanced-deployment-status (pvads) (policy path) [options]
Assigns a policy or policy group to one or more device or user objects.
(device or user type) - Valid values are device, server, workstation, and user.
(device or user object path) [...] - The path of the device or user objects relative to the root folder of the device or user type specified.
Accepts the following options:
Creates a policy.
(policy XML file) - XML file containing exported policy information. Use policy-export-to-file (petf) to export a policy's information into a XML file. If you want to reuse files, template XML files can be created from policies created through ZENworks Control Center.
Accepts the following options:
Copies a policy.
Accepts the following option:
Deletes one or more policy objects.
(policy object path) [...] - The path of the policy objects (policy, policy folder or policy group) relative to /Policies. The wildcard * can be used in the object names if it is enclosed in quotations. Exercise caution while using wildcards for deleting objects.
Accepts the following options:
Disables policies.
Accepts the following option:
Deletes one or more versions of the policy.
Examples:
To delete the version 3 of the policy, zenpolicy:
zman pdv zenpolicy 3
To delete all the versions of the policy, zenpolicy:
zman pdv zenpolicy -a
To delete all the versions of the policy, zenpolicy, that are older than the specified version:
zman pdv zenpolicy version -p
Enables policies.
Accepts the following option:
Exports a policy's information (in XML format) to a file. The XML file is to be used as input for creating policies.
(XML file path) - The complete path of the XML file to which the policy information is to be exported.
[Version of the policy] - Version of the policy to be exported. If the version is not specified, the published version of the policy is exported. To export a sandbox version of the policy, specify sandbox.
[-c|--export-content] - Exports the content of the policy to a subdirectory within the directory containing the XML file to which the policy’s information is exported. If the option is not specified, the policy content is not exported.
Examples:
To export the sandbox version of a policy named zenpolicy to an XML file named policy.xml:
zman petf policyfolder/zenpolicy C:\policies\policy.xml sandbox
To export version 3 of a policy named zenpolicy to an XML file named policy.xml:
zman petf policyfolder/zenpolicy C:\policies\policy.xml 3
To export version 5 of a policy named zenpolicy to an XML file named policy.xml and export the policy’s content to the C:\policies\policy_content directory:
zman petf policyfolder/zenpolicy C:\policies\policy.xml 5 -c
Creates a new folder for containing policies.
Accepts the following option:
Adds policies to a policy group.
Accepts the following option:
Creates a policy group and adds members to it.
Accepts the following options:
Lists members of a policy group.
Accepts the following option:
Removes policies from a policy group.
Accepts the following option:
Lists policy objects.
Accepts the following options:
Lists the device and user assignments for a policy.
Accepts the following options:
Lists groups where the given policy is a member.
Accepts the following option:
Lists all the versions of the policy.
Examples:
To list all the versions of the policy, zenpolicy:
zman plv zenpolicy
Moves a policy object to a different folder.
Create a sandbox from an existing version of a policy
[version of the policy] - Specify the version of the policy to be used for creating the sandbox.
Accepts the following option:
Example:
To create a sandbox from the version 2 of a policy, zenpolicy:
zman psc zenpolicy 2
Publish a sandbox to create a published version of the policy.
Example:
To publish the sandbox of a policy, zenpolicy
zman psp zenpolicy
Publishes sandbox version of a policy to a new policy.
(policy path) - The path of the policy object relative to the policies root folder, /Policies.
(policy name) - Name of the new policy to be created.
[parent folder] - Folder in which the new policy is to be created. If not specified, the policy is created in the root folder.
Accepts the following options:
Example:
To publish the sandbox version of a policy to a new policy.
zman psptn policy1 policy2 /Policies/Folder1
Deletes the sandbox and reverts to the latest published version of the policy.
Example:
To delete the sandbox and revert to the latest published version of the policy:
zman psr zenpolicy
Renames a policy object.
Unassigns a policy or policy group from one or more device or user objects.
(device or user type) - Valid values are device, server, workstation, and user.
(device or user object path) [...] - The path of the device or user objects relative to the root folder of the device or user type specified.
Accepts the following option:
Displays the advanced deployment status of a policy.
Accepts the following options:
Displays a summary of the deployment status of a policy.
These commands are used to set and modify policy settings. Settings commands begin with settings- in the long form, or with the letter s in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Copies settings.
(source policy or policy folder path) - The path of the policy or policy folder relative to /Policies from which settings have to be copied.
(destination policy or policy folder path) [...] - The path of the policies or policy folders relative to /Policies to which settings must be copied.
Accepts the following option:
Exports settings data (in XML format) to a file. The XML file is to be used as input for creating or modifying settings.
(XML file path) - The file into which the settings data is stored in XML format. If the file does not exist, a new file is created.
[settings name] [...] - Names of the settings to be exported. If this option is not specified, all settings are exported.
Accepts the following options:
Reverts the settings to that of the parent folder.
(source policy or policy folder path) - The path of the policy or policy folder relative to /Policies, whose settings must be reverted.
Sets settings at various levels.
(XML file path) - XML file containing exported settings information. Use settings-export-to-file (setf) to export settings information into a XML file.Accepts the following options:
[settings name] [...] - Names of the settings to be exported. If this option is not specified, all settings are exported.
These commands are used to list and run saved searches. Query commands begin with query- in the long form, or with the letter q in the short form.
Lists the saved searches.
Accepts the following option:
Runs a saved search.
Accepts the following options:
These commands are used when you need to make modifications to the queue. The queue processes asynchronous events such as client refreshes and content cleanup, and does not need to be modified under most circumstances. Queue commands begin with queue- in the long form, or with the letter q in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Flushes the queue by removing the queue entries.
(queue status) [...] - Filters on the status of the queue entries. Valid values are N, I, C, S, and F (New, In Progress, Cancelled, Success, and Failed).
Lists queue entries.
[server path] - The path of a server relative to /Devices/Servers. Lists only the queue entries belonging to the specified server.
Accepts the following options:
Resets the queue, and sets the status of failed queue entries to New.
[server path] - The path of a server relative to /Devices/Servers. Resets only the queue entries belonging to the specified server.
These commands allow you to create and alter registrations. They require a device type to be specified. It determines the type of device folder and device group the registration key is associated with and therefore the type of the registering devices. Registration commands begin with registration- in the long form, or with the letter r in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
registration-create-key (rck) (device type) (registration key) [registration folder path] [options]
registration-delete (rd) (registration object path) [...] [options]
registration-folder-create (rfc) (folder name) [parent folder] [options]
registration-list-device-groups (rldg) (registration key)(rd)
registration-move (rmv) (registration object path) [destination folder path]
registration-rename (rr) (registration object path) (new name)
registration-update-key (ruk) (device type) (registration key) [options]
registration-import-devices (rid) (CSV file path) (registration key)
Adds membership in the specified device groups for devices registering with the given key.
(device type) - Type of the registering device. Valid values are server and workstation.
Accepts the following option:
Creates a new registration key.
(device type) - Type of the registering device. Valid values are server and workstation.
Accepts the following options:
Copies a registration key.
(registration key) - Name of the registration key.
(new name) - Name for the copied registration key.
Deletes registration objects.
(registration object path) [...] - The path of the registration objects (registration key or folder) relative to /Keys. The wildcard * can be used in the object names if it is enclosed in quotations. Exercise caution while using wildcards for deleting objects.
Accepts the following options:
Creates a new registration folder.
Accepts the following option:
Displays detailed information about a registration key.
Lists all registration objects.
Accepts the following options:
Lists the device groups associated with a registration key.
Moves a registration object to a different registration folder.
Removes the association of device groups to a registration key.
(device type) - Type of the registering device. Valid values are server and workstation.
Accepts the following option:
Renames a registration object.
Updates a registration key.
Accepts the following options:
Imports the devices from the CSV file, which is used to specify the device information.
(CSV file path) - The name of the CSV file with the path. Each entry in the file contains details for a workstation or a server.
For a workstation, or a server, the format of the file entry is version, host name, serial number, and macAddress.
For a workstation, or a server, the version is WS_1.0.
The values for version and host name are mandatory, and the values for serial number and macAddress are optional.
(registration key) - Name of the registration key.
NOTE:Ensure that the file is in UTF-8 format.
For example:
To register the devices in the CSV devicesInfo file by using the registration key regkey, run the zman rid c:\devicesInfo.csv regkey command.
These commands are used to create and manage roles for rights-based management of administrator accounts. Role commands begin with role- in the long form or the letters rl in the short form.
Assigns a role to one or more ZENworks administrators and associates the rights categories in a role to different object contexts.
[rights category] - Name of the category within which the rights are grouped. To see the list of categories, run zman role-rights-add-admins --Help | more.
[object path] [...] - Full path of the ZENworks object starting with a slash (/) on which the rights grouped in a rights category should be enforced. To view the root folders of the object types that can be associated with a rights category, run zman role-add-admins --Help | more.
Accepts the following options:
Creates a ZENworks administrator role.
Renames a ZENworks administrator role.
(role name) [...] - Name of the roles. The wildcard * can be used in the object names if it is enclosed in quotation marks. Exercise caution when using wildcards to delete objects.
Lists all ZENworks administrator roles.
Accepts the following options:
Lists the ZENworks administrators with the specified role, and the contexts associated with the rights categories of that role.
Removes assignment of a role from one or more ZENworks administrators or removes the association of rights categories to object contexts.
[rights category] - Name of the category within which the rights are grouped. To see the list of categories, run zman role-rights-add-admins --Help | more.
[object path] [...] - Full path of the ZENworks object starting with / on which the rights grouped in a rights category should be enforced. To view the root folders of the object types that can be associated with a rights category, run zman role-add-admins --Help | more.
Accepts the following option:
Renames a ZENworks administrator role.
Deletes rights assigned to a ZENworks administrator role.
[rights category] - Name of the category within which the rights are grouped. To see the list of categories, run zman role-rights-set --Help | more.
Displays rights assigned to a ZENworks administrator role.
Accepts the following options:
Allows or denies rights for a ZENworks administrator role.
[rights category] - Name of the category within which the rights are grouped. To see the list of categories, run zman role-rights-set --Help | more.
Accepts the following options:
These commands are used to create and modify registration rule sets. Rule sets are applied to new devices registering to the ZENworks server that do not present a registration key. The commands require a device type to be specified, then the command determines the type of device folder and device group the rule set is associated with, and therefore determines the type of the registering devices. Rule set commands begin with ruleset- in the long form, or with the letter rs in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
ruleset-add-rule (rsar) (rule set name or position) (add mode) (rule group position) (rules file)
ruleset-create (rsc) (device type) (rule set name) (rules file) [position] [options]
ruleset-copy (rscp) (rule set name or position) (new name) [position]
ruleset-export-rules-to-file (rsertf) (rule set name or position) (XML file path)
ruleset-list-device-groups (rsldg) (rule set name or position)
ruleset-move (rsmv) (rule set name or position) (new position)
ruleset-remove-rule (rsrr) (rule set name or position) (rule positions) [...]
ruleset-update (rsu) (device type) (rule set name or position) [options]
Adds membership in the specified device groups for devices imported by using the specified rule set.
(device type) - Type of the registering device. Valid values are server and workstation.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
(device group path) - Specify the device group path relative to the root folder of the device type.
Accepts the following option:
Adds rules or rule groups to a rule set.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
(add mode) - Specify the mode of addition, whether rules or rule groups are being added. Valid values are rule and rulegroup. If mode is rule, all rules across rule groups in the input file will be picked and added.
(rules group position) - Specify the position of the rule group. If you are adding rule groups, this refers to the position the new groups must be inserted at. If you are adding rules, it refers to the position in the rule group where the new rule needs to be added. To point to the last rule group, specify last. To add rules in a new rule group or to add rule groups at the end of the list, specify makenew. The first rule group is at position 1.
(rules file) - The path of the XML file containing the information of rules or rule groups to be added to the rule set. The XML file can be created by exporting rules of an existing rule set using ruleset-export-rules-to-file command. The conjunction specified in the XML file is immaterial. Alternately, to add only rules, the older format can still be used.
For the file format, refer to AddRulesToRuleSet.txt located in /opt/novell/zenworks/share/zman/samples/rulesets on a Linux Server or <Installation directory>:\Novell\Zenworks\share\zman\samples\rulesets on a Windows Server.
For example:
To add rule groups at position 4 in a rule set:
zman rsar ruleset2 rulegroup 4 C:\RuleGroups.xml
To add rules to the third rule group of a rule set:
zman rsar ruleset2 rule 3 C:\Rules.xml
To add rules to the last rule group of a rule set:
zman rsar ruleset2 rule last C:\Rules.xml
To add rules as a new rule group in a rule set:
zman rsar ruleset2 rule makenew C:\Rules.xml
Creates a new rule set to apply when registering a device without a registration key.
(device type) - Type of the registering device. Valid values are server and workstation.
(rule set name) - Specify the name of the rule set.
(rules file) - The path of the XML file containing the information of rules or rule groups for the new rule set. The XML file can be created by exporting rules of an existing rule set by using the ruleset-export-rules-to-file command. Alternately, to add only rules (conjunction being AND), the older format can still be used.
For a sample of the file format, see the AddRulesToRuleSet.txt file located in /opt/novell/zenworks/share/zman/samples/rulesets on a Linux server or Installation_directory:\Novell\Zenworks\share\zman\samples\ rulesets on a Windows server.
(position) - Position of the rule set among the rule sets. The first rule set is at position 1.
Accepts the following options:
For example:
To create a rule set for registering servers:
zman rsc server ruleset1 C:\RuleSet1.xml --devicefolder serverfolder --desc "rule to import servers" --site "Building A" --dept Finance --loc Brazil
Any registering device that evaluates to true for the rules defined in this rule set is placed in the /Devices/Servers/serverfolder folder with the given site, department, and location values.
To create a rule set for registering workstations that might become members of some workstation groups:
zman rsc workstation ruleset3 --devicegroup wsgroup,wsgroup1,wsfolder/wsgroup2
The association of device groups to a rule set can also be done after the rule set creation by using the ruleset-add-device-group command.
Copies a ruleset.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
(new name) - New name to be given to the copied ruleset.
(position) - Position of the rule set among the rule sets. The first rule set is at position 1.
For example:
To copy a rule set to the first position:
zman rscp ruleset3 newruleset 1 Note: If the new position specified is 0 or greater than the number of rule sets, the rule set is copied to the beginning or the end of the list, respectively.
Exports the rules of a rule set to a file.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
(XML file path) - Specify the file in which the rules will be stored in XML format.
For example:
To export rules from a rule set:
zman rsertf ruleset1 C:\ExportedRuleSet.xml
Deletes a rule set.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
Displays detailed information about a rule set.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
For example:
To display details about the ruleset MyRegRule:
zman rsi MyRegRule
Lists all rule sets.
Lists the device groups associated with a rule set.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
Changes the position of a rule set.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
(new position) - Specify the new position to which the rule set needs to be moved.
For example:
zman rsmv ruleset3 1
Note: If the new position specified is 0 or greater than the number of rule sets, the rule set is moved to the beginning or the end of the list, respectively.
Removes the association of device groups to a rule set.
(device type) - Type of the registering device. Valid values are server and workstation.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
(device group path) - Path of the device groups relative to the root folder of the device type specified.
Accepts the following option:
Removes rules or rule groups from a rule set.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
(rule positions) - Specify the positions of the rules to be removed. The first rule group is denoted as G1 and the first two rules in G1 are denoted as G1:1,2. The position can be either a group or specific rules within a group.
For example:
To remove the second rule group of a rule set:
zman rsrr ruleset2 G2
To remove specific rule groups and specific rules from different rule groups:
zman rsrr ruleset2 G1:3 G2:2,5,6 G3 G6:4,9 G8
Renames a rule set.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
(new name) - Specify the new name to be given to the rule set.
Updates a rule set.
(device type) - Type of the registering device. Valid values are server and workstation.
(rule set name or position) - Specify the name of the rule set or its position within the rule sets. The first rule set is at position 1.
Accepts the following options:
For example:
To update a rule set that registers servers:
zman rsu server ruleset1 --devicefolder serverfolder1 --desc "rule to import servers" --site "Building B" --dept Transport --loc Brazil
To modify server groups in which the imported server should become a member use, ruleset-add-device-group and ruleset-remove-device-group commands.
To update the device folder from a workstation folder to a server root folder:
zman rsu server ruleset2
This command changes the folder to which the registering device needs to be placed; from /Devices/Workstations to /Devices/Servers.
These commands are used to view, create, and remove Satellites. Satellite commands begin with satellite-server- .
satellite-server-delete (ssd) (Path to Device) [(role),(role),...(role)][-f|--force]
satellite-server-edit-imagingrole (sseimg) (path to device) (action on proxydhcp service)
satellite-server-export-content (ssec) (path to device) (export directory) [options]
satellite-server-list-authentication-settings (sslas) (path to device)
satellite-server-list-content-replication-settings (sslcrs) (path to device)
satellite-server-remove-content-replication-setting (ssrcrs) (path to device) (content type)
satellite-server-remove-imagingrole (ssrimg) (path to device) [-r|--removeImageFiles]
Add a content type replication schedule and throttle setting to the Satellite device.
Promotes a managed device to a Satellite Server with the Imaging server role. If the managed device is already functioning as a Satellite Server, this command adds the Imaging server role.
Accepts the following options:
NOTE:Before promoting a managed device as Satellite, ensure that the ZENworks version installed on the managed device is same as that of the Primary Server. Additionally, you cannot promote the following devices as a Satellite:
A managed device that has a previous version of ZENworks Adaptive Agent installed.
A ZENworks test device.
Allows you to configure a Satellite role.
Accepts the following options:
NOTE:Before promoting a managed device as Satellite, ensure that the ZENworks version installed on the managed device is same as that of the Primary Server. Additionally, you cannot promote the following devices as a Satellite:
A managed device that has a previous version of ZENworks Adaptive Agent installed.
A ZENworks test device.
A non-root user can successfully execute this command (zman ssc) on a Linux Primary Server only if the user has been added to the ZENworks user group. To add the non-root user to the ZENworks user group, use the usermod -A non-root_username command.
Updates the JoinProxy settings on a Satellite Server. You can promote only a Windows or a Linux managed device to the JoinProxy Satellite role. The Primary Servers have the JoinProxy role by default.
Accepts the following options:
NOTE:If you do not use the ssujs command, the JoinProxy Satellite Server will be configured with the following default values:
Port: 7019
max Connections: 100
connection Check Interval: 1 min
Allows you to delete Satellite roles from the device. If all roles are removed, the device will be automatically delisted from the Server Hierarchy listing in ZENworks Control Center.
If your Management Zone consists of ZENworks Primary Server and ZENworks Configuration Management Satellites, you cannot remove individual roles from the Satellites. You can only demote the Satellite to a managed device. You can delete a Satellite that has any version of the ZENworks Adaptive Agent installed.
Accepts the following options:
[-f|--force] - Forces the demotion of a Satellite Server to a managed device while removing all of the specified, existing roles. Use this option only when a Satellite Server is permanently offline and cannot communicate with the ZENworks server.
Configures the user source connections used by a Satellite with the Authentication role. Execute this command multiple times to configure connections for multiple user sources on the same Satellite, specifying a different user source each time. Execute this command with no connections to remove the specified user source from the authentication role of the Satellite.
Accepts the following options:
Starts or stops the Proxy DHCP service of the Imaging Satellite.
Exports content files from the content repository for manual import into the Satellite device’s content repository. To import the content into the content repository on a managed device, use the zac cdp-import-content (cic) command.
Accepts the following options:
Export the content type replication schedule from the Satellite device to a file.
Lists the authentication role settings on a Satellite device.
Lists the Satellites with the Imaging role.
Lists the content replication schedule and throttle settings on the Satellite by content type.
Lists previously defined Satellite roles.
Accepts the following option:
Lists the Satellites and their roles.
Remove a content type replication schedule and throttle setting from the Satellite device.
Removes the Satellite Imaging server role from the managed device.
If your Management Zone consists of ZENworks Primary Server and ZENworks Configuration Management Satellites, you cannot remove individual roles from the Satellites. You can only demote the Satellite to a managed device. You can delete a Satellite that has any version of the ZENworks Adaptive Agent installed.
Updates a content type replication schedule and throttle setting to the Satellite device.
Accepts the following option:
These commands are used to manage servers. Server commands begin with the word server- in the long form, or with the letter s in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
server-add-bundle (sab) (server object path) (bundle or bundle group) [...] [options]
server-add-certificate (sacert) (server object path) (certificate file path)
server-add-policy (sap) (server object path) (policy or policy group) [...] [options]
server-folder-create (sfc) [folder name] [parent folder] [options]
server-group-add (sga) (server group path) [server path] [...] [options]
server-group-create (sgc) [group name] [parent folder] [options]
server-group-remove (sgr) (server group path) [server path] [...] [options]
server-move (smv) (server object path) [destination folder path]
server-remove-bundle (srb) (server object path) (bundle or bundle group) [...] [options]
server-remove-policy (srp) (server object path) (policy or policy group) [...] [options]
server-reorder-bundles (srob) (server object path) (current position) (new position)
server-reorder-policies (srop) (server object path) (current position) (new position)
server-view-all-bundles-status (svabs) (server path) [options]
server-view-all-policies-status (svaps) (server path) [options]
Assigns bundles to a server object.
Accepts the following options:
Adds a second valid certificate for a server in preparation for replacing a certificate that is about to expire
(server object path) - The path of the server objects (server, server folder or server group) relative to /Devices/Servers.
(certificate file path)- Path of the DER format certificate file.
Assigns policies to a server object.
Accepts the following options:
Deletes one or more server objects.
(server object path) [...] - The path of the server objects (server, server folder or server group) relative to /Devices/Servers. The wildcard * can be used in the object names if it is enclosed in quotation marks. Exercise caution while using wildcards for deleting objects.
Accepts the following options:
Creates a new folder for containing servers.
Accepts the following option:
Adds servers to a server group.
Accepts the following option:
Creates a server group and adds members to it.
Accepts the following options:
Lists members of a server group or a dynamic server group.
Accepts the following option:
Removes servers from a server group.
Accepts the following option:
Lists detailed information about a server.
Lists server objects.
Accepts the following options:
Lists bundles assigned to a server object.
Accepts the following options:
Lists groups of which the given server is a member.
Accepts the following option:
Lists policies assigned to a server object.
Accepts the following options:
Moves a server object to a different folder.
Refreshes the ZENworks Adaptive Agent in the servers.
Accepts the following option:
-f, --folder=[server folder] - The path of a server folder relative to /Devices/Servers. If this option is specified, the path of the server objects is determined relative to this folder. This can be used to specify multiple server objects under the same folder.
--server=<server/server folder/server group object path>[...] - The path of Primary Server objects (server, server folder or server group) relative to /Devices/Servers to send Quick Task notifications.
--notify=<minutes> - Time in minutes to notify all devices.
--expire=<minutes> - Time in minutes for expiry after creation of the quick task. Specify 0 to expire immediately.
--currentserver - Add quick task to the current Primary Server.
--anyserver - Add quick task in any of the Primary Servers.
--expirenever - The quick task never expires in the Primary Server.
Removes bundles assigned to a server object.
Accepts the following option:
Removes policies assigned to a server object.
Accepts the following option:
Renames a server object.
Changes the order of bundles assigned to a server. Use the server-list-bundles command to get the order of assigned bundles.
Changes the order of policies assigned to a server. Use the server-list-policies command to get the order of assigned policies.
Retires the selected server from your ZENworks system at its next refresh. Retiring a device is different from deleting a device. When you retire a device, its GUID is retained (as opposed to when you delete a device, which also deletes its GUID). As a result, all inventory information is retained and is accessible, but all policy and bundle assignments are removed. If you reactivate the device in the future, its assignments are restored.
Accepts the following option:
Sets a server as a test device.
Examples
To set server1 as a test device:
zman ssat server1
Sets a server as a non-test device.
Examples
To set server1 as a non-test device:
zman ssan server1
Displays statistics of ZENworks server usage.
Reactivates the selected server at its next refresh and reapplies all policy and bundle assignments that the device previously had.
Accepts the following option:
Displays the advanced deployment status of bundles assigned to a server.
Accepts the following options:
Accepts the following options:
Examples
To view the deployment status of bundles assigned to server1:
zman svabs server1
To view the deployment status of bundles assigned to server1 having bundle deployment status as success or pending:
zman svabs server1 --statusfilter S,P
Displays the advanced deployment status of policies assigned to a server.
Accepts the following options:
Wakes up a server using Wake-On-LAN.
Accepts the following options:
These commands are used to set and modify settings. Settings commands begin with settings- in the long form, or with the letter s in the short form.
The Settings commands do not apply to ZENworks Endpoint Security Management settings (Zone Policy settings and Date Encryption Key settings).
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
Copies settings.
(source device or device folder path) - The path of the device or device folder relative to /Devices from which settings have to be copied.
(destination device or device folder path) [...] - The path of the devices or device folders relative to /Devices to which settings must be copied.
Accepts the following option:
Exports settings data (in XML format) to a file. The XML file is to be used as input for creating or modifying settings.
(XML file path) - The file into which the settings data is stored in XML format. If the file does not exist, a new file is created.
[settings name] [...] - Names of the settings to be exported. If this option is not specified, all settings are exported.
Accepts the following options:
Reverts the settings to that of the parent folder.
(source device or device folder path) - The path of the device or device folder relative to /Devices, whose settings must be reverted.
Sets settings at various levels.
(XML file path) - XML file containing exported settings information. Use settings-export-to-file (setf) to export settings information into a XML file.Accepts the following options:
[settings name] [...] - Names of the settings to be exported. If this option is not specified, all settings are exported.
These commands are used to create, modify, and manage subscriptions. Subscription commands begin with subscription- in the long form, or with the letters sr in the short form.
This command accepts the option flags listed in the Global Options section. In addition, it accepts individual options, as listed with the command.
subscription-create (src) (subscription name) (subscription XML file) [parent folder] [options]
subscription-folder-create (srfc) (folder name) [parent folder] [options]
subscription-move (srmv) (subscription object path) [destination folder path]
subscription-replicate (srr) (subscription-name) [destination folder path] [options]
subscription-export (sre) (subscription-name) (subscription-data.xml)
subscription-delete (srd) (Subscription object) […] [options]
subscription-modify (srm) (subscription-name) (subscription-data.xml) [parent folder] [options]
subscription-channel-list (srcl) (subscription-name) (repo entity type) [options]
subscription-copy (srcp) (subscription path) (subscription-name) [parent folder] [options]
subscription-rename (srrn) (subscription object path) (new name)
subscription-proxy-password (srpp) [Subscription Proxy Password]
Creates a new subscription.
(subscription XML file) - XML file containing exported subscription information. Use subscription-export (sre) to export an existing subscription's information into an XML file. If you want to reuse files, template XML files can be created from subscriptions that were created through ZENworks Control Center. For a sample XML file, refer to nu.xml located in
/opt/novell/zenworks/share/zman/samples/subscriptions on a Linux server.
Accepts the following options:
Creates a new subscription folder.
Accepts the following option:
Moves a subscription object to a different folder.
Begins a subscription replication.
Accepts the following options:
Exports subscription information (in XML format) to a file. The XML file is to be used as input for creating subscriptions.
Deletes one or more subscription objects. The subscriptions that are in InProgress, Suspended, and Assigned status cannot be deleted.
Accepts the following options:
Lists subscription objects.
Accepts the following options:
Exports or modifies an existing subscription.
Accepts the following options:
Returns the subscription’s status.
Accepts the following options:
NOTE:The Suspend and Cancel tasks are not supported while performing a dry run.
Lists data such as bundles, catalogs, and packages.
Accepts the following options:
Copies a subscription.
Accepts the following option:
Renames a subscription.
For example, to rename a subscription SLES10Update to SLED10Update, run the command as follows:
zman srrn /Subscription/SLES10Update /Subscription/SLED10Update
Configures the proxy password to be used by any subscription during replication.In this command, the proxy password argument is optional. If you do not enter the proxy password argument, the command prompts you to enter the password.
These commands are used to manage System Updates and Product Recognition Updates (PRUs) to ZENworks. These commands begin with system-update in the long form, or with the letters su in the short form.
system-update-delete-update (sudu) (system update or PRU name) [options]
system-update-cancel-download (sucd) (system update or PRU name)
system-update-assign (sua) (system update name) [device path] [...] [option]
system-update-import (sui) (path to update) [system update or PRU name] [-b, --checkbaseline]
system-update-activate-entitlement (suae) (mail ID) (activation code)
system-update-patch-file (supf) (system update name) (path to patch)
Downloads the latest system updates or PRU.
(system update or PRU name) - System update or PRU name or UID.
Displays a list of all available updates or PRUs ed on the update server or in an update file.
Accepts the following options:
Displays the status of the specified system update or PRU.
(system update or PRU name) - System update or PRU name or UID.
Deletes a specified system update or PRU from the zone.
(system update or PRU name) - System update or PRU name or UID.
Accepts the following option:
Cancels the download of the system update or PRU.
(system update or PRU name) - System update or PRU name or UID.
Assigns the authorized system update to devices.
(system update name) - System update name or UID.
[device path] [...] - The path of the device relative to /Devices.
Accepts the following option:
Lists all updates assigned to the specified device or group.
(device path) - The path of the device relative to /Devices.
Authorizes an update or PRU.
(system update or PRU name) - System update or PRU name or UID.
Schedules an attempt to set the specified update as the baseline update.
(system update name) - System update name or UID.
Imports a system update or PRU from a ZIP file or directory into the Zone. After the update or PRU is in the ZENworks system, it can be managed the same way that online updates or PRUs are managed.
(path to update) - The full path to the update or PRU ZIP file or directory.
(system update or PRU name) - System update or PRU name or UID.
(-b, --checkbaseline) - Check for and if applicable, baseline the update. The default is to not baseline the update.
Activates the System Update entitlement for the ZENworks 11SP3 software in the Management Zone to receive the latest version of ZENworks System Updates and Product Recognition Updates (PRUs) from the Novell Customer Center (NCC) server.
(mail ID) - A valid e-mail address to be used for communication from Novell. We recommended that you specify the e-mail address used to purchase the System Update Maintenance Entitlement.
(activation code) - The System Update entitlement activation code.
NOTE:Before activating the entitlement, ensure that the Primary Server you want to use to activate the entitlement can communicate with the NCC server.
Displays the System Update entitlement status.
Rebuilds the deployment packages on this server with the content of the specified update.
(system update name) - System update name or UID.
-f, --force - Force the package to be rebuild, even if there are no new packages included in the update.
Patches an update with new versions of file(s).
(system update name) - System update name or UID.
(path to patch) - Full path of the zip file or the folder where patch files can be found.
Creates the specified standalone update package. This command can be used to create a package for a specific device, using the Update GUID and the device GUID, or to create a package for the platform using the platform and architecture details.
(system update name) - System update name or UID.
[device path] - Path of the device relative to /Devices.
-n, --packagename=<Standalone update package name> - Name of standalone update package. If not specified, name is calculated from the device name or the platform specified.
-p, --platform=<OS Platform> - OS platform for the standalone update package. Valid value is Windows.
-a, --arch=<Architecture> - Device architecture for the standalone update package. Valid values are 32 or 64.
These commands are used to manage users, belonging to the user sources configured in ZENworks. The user sources are to be configured from an existing LDAP Authoritative Source like e‑Directory or Active Directory. User commands begin with user- in the long form, or with the letter u in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
user-add-bundle (uab) (user object path) (bundle or bundle group) [...] [options]
user-add-policy (uap) (user object path) (policy or policy group) [...] [options]
user-container-create (ucc) (user source) (user container) (display name)
user-group-add (uga) (ZENworks user group path) (user path) [...] [options]
user-group-remove (ugr)(ZENworks user group path) (user path) [...] [options]
user-remove-bundle (urb) (user object path) (bundle or bundle group) [...] [options]
user-remove-policy (urp) (user object path) (policy or policy group) [...] [options]
user-reorder-policies (urop) (user object path) (current position) (new position)
user-source-create (usc) (user source XML file path) [options]
user-source-remove-connection (usrc) (user source) (connection name)
user-source-trustedcert-add (usta) (certificate alias) (certificate file path)
user-source-trustedcert-remove (user-source-trustedcert-remove|ustr) (certificate alias)
Assigns bundles to a user object.
Accepts the following options:
Assigns policies to a user object.
Accepts the following options:
Adds a user container to a user source configured in ZENworks.
(user container) - The user container to be added in RDN (Relative Distinguished Name) format, relative to the root context of the LDAP Source.
(display name) - Displays the name for the user container.
Adds users to a ZENworks user group.
Accepts the following option:
Creates a ZENworks user group and adds members to it.
Accepts the following options:
Deletes one or more ZENworks user groups.
(ZENworks user group path) [...] - The path of the ZENworks user group relative to /Users/ZENworks User Groups.
Lists members of a ZENworks user group or LDAP Directory user group.
Accepts the following option:
Removes users from a ZENworks user group.
Accepts the following option:
Lists detailed information about a user.
Lists user objects.
Accepts the following options:
Lists bundles assigned to a user object.
Accepts the following options:
Lists groups of which the given user is a member.
Accepts the following option:
Lists policies assigned to a user object.
Displays the devices on which a user is logged in.
Lists the user’s primary workstation, number of logins, and number of minutes that the user has been logged in to the primary workstation.
Removes bundles assigned to a user object.
Accepts the following option:
Removes policies assigned to a user object.
Accepts the following option:
Changes the order of policies assigned to a user.
Adds a new server connection for a user source.
Accepts the following options:
-a, --accept-certificate - Accepts the certificate presented by the user source when SSL mode is chosen. This option is provided to avoid interactive mode for scripting. It is advisable to view the certificate and then accept it.
-s, --use-ssl - Specifies that SSL should be used when accessing the new server.
Sets an user as a test user.
Examples
To set user1 as a test user:
zman usat user1
Sets an user as a non-test user.
Examples
To set user1 as a non-test user:
zman usan user1
Configures a user source.
Accepts the following option:
-a, --accept-certificate - Accepts the certificate presented by the user source when SSL mode is chosen. This option is provided to avoid interactive mode for scripting. It is advisable to view the certificate and then accept it.
Lists the configured user sources.
List the server connections for a user source.
Removes a server connection from a user source.
Adds an additional trusted certificate for another LDAP server that can be referred to during the processing of an LDAP search request when using secure user source connections.
Lists the additional trusted certificates used for secure user source connections.
Removes a trusted certificate used for secure user source connections.
Displays the advanced deployment status of bundles assigned to a user.
Accepts the following options:
Displays the advanced deployment status of policies assigned to a user.
Accepts the following options:
These commands are used to manage workstations. Workstation commands begin with workstation- in the long form, or with the letter w in the short form.
All of the commands below accept the option flags listed in the Global Options section. In addition, they accept individual options as listed with each command.
workstation-add-bundle (wab) (workstation object path) (bundle or bundle group) [...] [options]
workstation-add-policy (wap) (workstation object path) (policy or policy group) [...] [options]
workstation-delete (wd) workstation object path) [...] [options]
workstation-folder-create (wfc) (folder name) [parent folder] [options]
workstation-group-add (wga) (workstation group path) (workstation path) [...] [options]
workstation-group-create (wgc) (group name) [parent folder] [options]
workstation-group-members (wgm) [options] (workstation group path)
workstation-group-remove (wgr) (workstation group path) (workstation path) [...] [options]
workstation-list-bundles (wlb) (workstation object path) [options]
workstation-list-policies (wlp) (workstation object path) [options]
workstation-move (wmv) (workstation object path) [destination folder path]
workstation-refresh (wrf) (workstation object path) [...] [options]
workstation-remove-bundle (wrb) (workstation object path) (bundle or bundle group) [...] [options]
workstation-remove-policy (wrp) (workstation object path) (policy or policy group) [...] [options]
workstation-rename (wr) (workstation object path) (new name)
workstation-reorder-policies (wrop) (workstation object path) (current position) (new position)
workstation-view-all-bundles-status (wvabs) (workstation path) [options]
workstation-view-all-policies-status (wvaps) (workstation path) [options]
workstation-wakeup (ww) (workstation object path) [...] [options]
Assigns bundles to a workstation object.
Accepts the following options:
Assigns policies to a workstation object.
Accepts the following options:
Deletes one or more workstation objects.
(workstation object path) [...] - The path of the workstation objects (workstation, workstation folder or workstation group) relative to /Devices/Workstations. The wildcard * can be used in the object names if it is enclosed in quotations. Exercise caution while using wildcards for deleting objects.
Accepts the following options:
Creates a new folder for containing workstations.
Accepts the following option:
Adds workstations to a workstation group.
Accepts the following option:
Creates a workstation group and adds members to it.
Accepts the following options:
Lists members of a workstation group or a dynamic workstation group.
Accepts the following option:
Removes workstations from a workstation group.
Accepts the following option:
Lists detailed information about a workstation.
Lists workstation objects.
Accepts the following options:
Lists bundles assigned to a workstation object.
Accepts the following options:
Lists groups of which the given workstation is a member.
Accepts the following option:
Lists policies assigned to a workstation object.
Accepts the following options:
Moves a workstation object to a different folder.
Refreshes the ZENworks Adaptive Agent in the workstations.
Accepts the following option:
-f, --folder=[workstation folder] - The path of a workstation folder relative to /Devices/Workstations. If this option is specified, the path of the workstation objects is determined relative to this folder. This can be used to specify multiple workstation objects under the same folder.
--server=<server/server folder/server group object path>[...] - The path of Primary Server objects (server, server folder or server group) relative to /Devices/Servers to send Quick Task notifications.
--notify=<minutes> - Time in minutes to notify all devices.
--expire=<minutes> - Time in minutes for expiry after creation of the quick task. Specify 0 to expire immediately.
--currentserver - Add quick task to the current Primary Server.
--anyserver - Add quick task in any of the Primary Servers.
--expirenever - The quick task never expires in the Primary Server.
Removes bundles assigned to a workstation object.
Accepts the following option:
Removes policies assigned to a workstation object.
Accepts the following option:
Renames a workstation object.
Changes the order of policies assigned to a workstation. Use the workstation-list-policies command to get the order of assigned policies.
Retires the selected workstation from your ZENworks system at its next refresh. Retiring a device is different from deleting a device. When you retire a device, its GUID is retained (as opposed to when you delete a device, which also deletes its GUID). As a result, all inventory information is retained and is accessible but all policy and bundle assignments are removed. If you reactivate the device in the future, its assignments are restored.
Accepts the following option:
Sets a workstation as a test device.
Examples
To set workstation1 as a test device:
zman wsat workstation1
Sets a workstation as a non-test device.
Examples
To set workstation1 as a non-test device:
zman wsan workstation1
Reactivates the selected workstation at its next refresh and reapplies all policy and bundle assignments that the device previously had.
Accepts the following option:
Displays the advanced deployment status of bundles assigned to a workstation.
Accepts the following options:
Examples
To view the deployment status of bundles assigned to workstation1:
zman wvabs workstation1
To view the deployment status of bundles assigned to workstation1 having bundle deployment status as success or pending:
zman wvabs workstation1 --statusfilter S,P
Displays the advanced deployment status of policies assigned to a workstation.
Accepts the following options:
Wakes up a workstation by using Wake-On-LAN.
Accepts the following options:
These commands are used to manage servers that have ZENworks installed. ZENworks Server commands begin with zenserver- in the long form, or with the letters zs in the short form.
Backs up the configuration files needed to duplicate this server on another ZENworks Server.
Restores the backed-up configuration files of the crashed ZENworks Server to a new ZENworks Server installation.
The following options can be applied to any zman command:
Provides help at various levels. Refer to the Guide to Usage section for more details on using help.
Displays the syntax of the command.
Displays terse output.
Displays debugging output.
Enables verbose output.
Quiets output, printing only error messages.
Provides a username. If it is not provided, you are prompted.
Specifies a password. If it is not provided, you are prompted.
Specifies the host name or IP address to connect to (default: localhost).
Specifies the port that the server is listening on (default: 443).
Disables SSL for debugging purposes. If the port is not set to the clear text port, it connects to port 80 by default.
Redirects the output of the screen to a file. Use this option over the command line redirection operator (>) to save data in UTF-8 format and to preserve non-English characters.
Ignore the global options file specified in zman-config.properties.
Running each command requires administrator authorization. To avoid entering administrator credentials for every command, use the admin-store-credential command to store the credentials. The credentials are encrypted and stored in the home folder of the operating system user running the command. The credentials only apply to that logged-on user. It is safer to clear the information by running the admin-clear-credential command after the execution of all the other commands is done.
IMPORTANT:Although command line options for entering usernames and passwords exist, avoid using them. In Linux, they display in the ps listing. In addition, pressing the Up-arrow or Down-arrow keys displays the previous commands entered in both Windows and Linux. Either enter the credentials when prompted or use the admin-store-credential command.
zman-config.properties is a property file used to configure zman and is located in the following locations:
On Windows: %ZENWORKS_HOME%\conf\zman\properties
On Linux: /etc/opt/novell/zenworks/zman/properties
The various options available are:
RENDERER_SCROLLSIZE: Controls the output of a list command globally. Results are retrieved and displayed in counts of scroll size specified. This setting can be overridden by using the --scrollsize option in the list commands.
GLOBAL_OPTIONS_FILE: Global options can be added to every command by storing them in a file and specifying the path of the file as the value to this property. For Windows files, use \\ instead of \. The contents of the file should be in a single line similar to a command.
For example:
GLOBAL_OPTIONS_FILE=C:\\zman\\globaloptions.txt
Sample content for the file is as follows:
--host 123.34.45.56 --port 8080 –cleartext --verbose
To bypass the options stored in this file, use the –ignore-global-file option. All the global options except, -U|--User and -P|--Password can be stored in the global options file. The admin-store-credential and admin-clear-credential commands should be used to add administrator credentials to each command. Refer to the Security section for guidelines on using administrator credentials.
GLOBAL_OPTIONS_HELP: Global options for the commands are displayed in the help for every command. To turn off the display of global options, set GLOBAL_OPTIONS_HELP=false.
DEBUG_LEVEL: Controls the volume of debug messages logged into the zman.log file located in Installation_drive:\Novell\zenworks\logs in Windows and /var/opt/novell/log/zenworks in Linux. Level 3, which is the default, logs the command entered and exception stack traces if any errors are encountered. Level 4 logs the command entered, the output of the command, and more debug messages.
zman returns exit codes in the range of 0-255. 0 indicates successful execution of the command; 1-255 indicate an error in execution.
Exit Codes for Parse Errors:
Exit Codes for General Errors:
Exit Codes for General Object Related Errors:
Exit Codes for Other General Errors:
Exit Codes for File Related Errors:
Exit Codes Specific to Registration Commands:
Exit Codes Common to Bundle and Policy Commands:
Exit Codes Specific to Bundle Commands:
Exit Codes Common to Device and User Command:
Exit Codes Specific to User Commands:
Exit Codes Specific to License Commands:
Exit Codes Specific to Administrator Command:
Exit Codes Specific to Database Commands:
Exit Codes Specific to Deployment Commands:
Exit Codes Specific to Report Commands:
The zman zeus command is used to import the latest ZeUS MSIs into the Zone and get the current ZeUS configuration.
Gives the configuration of the last imported ZeUS msi.
Imports the latest ZeUS MSIs into the Zone.
(path to ZeUS Msis) - Provide the full path to the ZeUS directory.
Accepts the following options:
-f, --force - Reimports the MSI even if the versions are the same. This will overwrite the current zeus configuration in the server.
Retrieves the system update when it is assigned to a device.