Lenovo ThinkPad Series Deployment Manual

ThinkPadTabletDeploymentGuide

Note:Beforeusingthisinformationandtheproductitsupports,readthegeneralinformationinAppendixA

“Notices”onpage17.

FirstEdition(August2011)

©CopyrightLenovo2011.

LIMITEDANDRESTRICTEDRIGHTSNOTICE:IfdataorsoftwareisdeliveredpursuantaGeneralServicesAdministration

“GSA”contract,use,reproduction,ordisclosureissubjecttorestrictionssetforthinContractNo.GS-35F-05925.

Contents

Chapter1.Overview..........1

LenovoDevicePolicyManagerService.....2

Chapter2.Conguration.......5

XMLcongurationles...........5

ActiveDirectorydomainserver........11

CongurationProleSignandEncryptUtility...11

LenovoProleManager...........11

Chapter3.UsingMicrosoftExchange

ActiveSync..............13

Chapter4.LenovoMobility

Manager................15

AppendixA.Notices..........17

Trademarks................18

©CopyrightLenovo2011

iii

ivThinkPadTabletDeploymentGuide

Chapter1.Overview

TheLenovoThinkPadTabletgivesyoutheabilitytocongureandmanagethetabletusingregulartoolssuch

asyouusewithinyourenterprise.Youcancontroltabletfunctions,enablecorporatesecurity,passwords,

encryptionanddigitalsignatures.

YoucanpushdowncongurationorpolicysettingstotheThinkPadTabletintheseways:

•MicrosoftExchangeActiveSync

•AnXMLcongurationle

•LenovoMobilityManager

©CopyrightLenovo2011

HereistheinformationowfortheThinkPadTablet:

Figure1.ThinkPadTabletow

MicrosoftExchangeisusedasthecorporateemailcommunicationmethod.

YoucancreateormodifyanXMLleusingeitheratexteditororanXMLeditortopushdowntotheThinkPad

tabletthroughtheLenovoCongurationFileHandlerAPK.OryoucanuseLenovoMobilityManagerSuiteto

manageyouruser’sThinkPadtabletsusingthesuppliedLenovoMobilityManagerAPK.Thesemethodsthen

arepassedthroughtheLenovoDevicePolicyManagerService.Formoreinformation,see“LenovoDevice

PolicyManagerService”onpage2

LenovoDevicePolicyManagerService

TheDevicePolicyManagerServicehandlesthemanagementoftheThinkPadTablet.Thiscomponent

providesaninterfacethatallowsmanagementtools,suchasActiveSync,anXMLle,orLenovoMobility

Managertoconguredevicefeatures,suchasWiFiprolesanddevicepolicies.

2ThinkPadTabletDeploymentGuide

ThisinterfaceallowsyoutopushthefollowingcongurationstotheThinkPadTablet:

•WiFiproles

•WiFiaccesspointlters

•WiFiradiopowersettings

•MicrosoftExchangeE-mailserverconguration

•VPNconguration

•ActiveSyncserverconguration

•Devicefeaturedisable,including:

–Camera

–USBport

–SDcard

–Microphone

–Pen

–Bluetooth

–WiFi

•Clientcerticates

•Webproxy

•SDcardencryption

•AndroidPasswordpolicies

Chapter1.Overview3

4ThinkPadTabletDeploymentGuide

Chapter2.Conguration

TheThinkPadTabletallowsyoutocongurethecorporateservicesthatusersneedbyspecifying

congurationsettingsinXMLles.WhentheseXMLlesaredeliveredtousersandimportedbytheThinkPad

Tablet,thesettingsareappliedbytheThinkPadTablet.ConguringtheThinkPadTabletwithXMLleshelps

makeiteasierforuserstoconnecttotheircorporatenetworksandaccounts,andquicklybeproductive.

XMLcongurationles

TheThinkPadT abletallowsyoutocongurecorporateservicesforusersbyspecifyingcongurationsettings

intheXMLle.WhentheseXMLlesaredeliveredtousersandloadedontheThinkPadTablet,thesettings

areautomaticallyappliedbythetablet.ConguringtheThinkPadTabletwithXMLlesmakesiteasierforthe

usertoconnecttocorporatenetworksandaccounts.

UsingtheXMLle,youcancongurethefollowing:

•MicrosoftExchangee-mailserver

•VirtualPrivateNetwork(VPN)

•WirelessNetworkSettings

•Digitalcerticates

•ActiveDirectorydomainserver

•DevicePolicies

Youcancreateasingle,commonXMLcongurationleformultipleusers.TheXMLlemaycontain,for

example,thecongurationsettingsforthesecurecorporatewirelessnetwork,theCAcerticateforthe

wirelessnetwork,andtheaddressofthecorporateExchangeserver.YoucanmakethisXMLleavailableto

theuserbysendingittotheuser’spersonale-mailaccount,whichtheusercanaccessusinganunsecured

visitornetworkconnection,ortheuser’shomeinternetconnection.OryoucanalsoputtheXMLconguration

leonaWebserver,makingitaccessibletoanyuserthatalreadyhastheproperintranetcredentials.

OncetheXMLcongurationleisreceivedbytheuser,thatusersimplytapstheleandtheLenovo

CongurationProleHandlerislaunchedtoimportandapplythecongurationsettingsonthedevice.The

usermaybepromptedtoenterpersonallogoncredentialsiftheywerenotincludedinthecongurationle,

butallofthecommonserverinformationandsettingswillbepredenedfortheuser.

YoucansecuretheXMLcongurationlebydigitallysigningand/orencryptingit.Encryptinghelpsensure

thatsensitivedataincludedinthecongurationle,suchaspasswords,cannotbereadbyunauthorized

users.Digitalsignatureshelpsensurethatthecontentsofthelearenotchangedinanyway.

TheCongurationProleSignandEncryptUtilityallowssigningofthecongurationprolewithan

embeddedprivatekey.Theutilityalsoallowstheletobeencryptedusinganencryptionkeyderived

fromthepasswordprovidedtotheutility.

TheXMLcongurationlenamingconventionalwayshasaleextensionof.lenovocong,sothatthe

ThinkPadTabletwillrecognizeitasacongurationle.Theleconsistsofthreeparts:

1.LenovoCongSettings

2.LenovoPolicySettings

3.AndroidPolicySettings

©CopyrightLenovo2011

TheLenovoCongSettingssectionprovidescontrolforthesecurityandencryptionfortheThinkPadTablet.It

importscongurationsettingssuchasWiFiproles,corporatedomainservers,virtualprivatenetworks,and

certicates.Oncetheseareapplied,theycannotbedeleted.

TheLenovoPolicySettingssectionallowsyoutosetcontrolsforthevariousfunctionsoftheThinkPadtablet

suchasthecamera,microphone,SDcardsandBluetooth,andWiradios.Anyofthesefunctionscanbe

enabledordisableddependingonyourcorporatepolicy.

TheAndroidPolicySettingsectionisusedtosetuppolicysettingssupportednativelybyAndroid,including

storageencryption,passwordlength,numberofnumbersandlettersrequired.

NotethataUUIDisrequiredforeachXMLlethatyoucreate.Ifyouwanttooverwriteorremoveanyexisting

policies,youcansenddownanewlewiththesameUUIDoftheexistingappliedpolicy,anditwilloverwrite

theexistingle.SincemultipleXMLles(withdifferentUUIDs)canberesidentontheThinkPadTablet,the

lewiththestrongestpolicieswillbeapplied.Forexample,ifyouhaveanXMLlethatrequiresonlya

numericpasswordandanotherlewithadifferentUUIDthatrequiresalonger,alphanumericpassword,the

lewiththealphanumericpasswordwillbeapplied.

ThefollowingtablesprovideinformationonsettingsfortheXMLle.Thetableheadersare:

•Setting-Thesettinginthexmllethatyoucanuserequireausertologintoacorporateserverortoallo

orpreventuserfromusingacertainfunctionrequireofthedevice.

•Parameter-Theeldsinthesettingthatyouassignavaluefortheusertollin

•Value-Therequiredvalueyouneedtoenterforthateldsuchasserveraddress,userid,Y es/Noand

soon.

•Notes-Anyspecialnotesthatapplytoasetting.

Table1.LenovoCongSettings

SettingParameterValuesNotes

EmailAccount•Type

•SSL

•AcceptAllCerts

•Exchange

•Yes/No

MicrosoftExchangeis

theonlysupportedemail

typeatthistime.

DomainServer•ServerAddress

•UserID

•Password

•Serveraddress

•UserID

•Password

•Serveraddressis

required

•Optional

CerticateType

•Type

•Name

•Filename/Encoded

•Root/User

•CerticateName

•?

Certicatesmaybe

includedintheXMLle

inaBase-64encoded

format.

VPN•PPTP

–Name

–Server

–OverwriteIfExists

–DNSSearchDomain

–Encryption

•L2TP

–Name

•Point-toPointT unnelingProtocol

–Protocolnames

–ServerIPaddress

–Yes/No

–DomainIPAddress

–DomainIPaddress

–Yes/No

•Layer2TunnelProtocol

–Nameoftheserver

6ThinkPadTabletDeploymentGuide

Table1.LenovoCongSettings(continued)

SettingParameterValuesNotes

–Server

–OverwriteIfExists

–DNSSearchDomain

–Encryption

•L2TPIPSecPSK

–Name

–Server

–OverwriteIfExists

–Secret

–IPSecPresharedKey

•L2TPIPSecCrt

–Name

–Server

–OverwriteIfExists

–DNSSearchDomain

–UserCerticate

–CaCerticate

•AnyConnect

–Name

–Host

–OverwriteIfExists

–UserCert

–CertCommonName

–ServerIPaddress

–Yes/No

–IPAddress

–Yes/No

•AndroidPSK

–PSKname

–ServerURL

–Yes/No

–Password

–PresharedKey

•L2TPIPSecCrt

–CRTName

–URL

–Yes/No

–DomainIPAddress

–DomainIPadress

–Certicatename

–Certicateinfo

•AnyConnect

–VPNnames

–HostIPaddress

–Yes/No

–Certicatename

Table2.LenovoPolicySettings

SettingFieldValuesNotes

DeviceControl•Camera

•SDCardSlot

•Mic

•Bluetooth

•Dataroaming

•USBPort

•MicroUSBPort

•SDCardSlot

•UnknownSources

•USBDebugging

•Wi

•HDMI

•Tethering

•Allow/Block

Chapter2.Conguration7

Table2.LenovoPolicySettings(continued)

SettingFieldValuesNotes

•Hotspot

•Allow/Block

SecurityPolicy•SDCardEncryption

•ADScreenLock

•Notrequired/Required

Table3.AndroidPolicySettings

SettingFieldValuesNotes

StorageEncryption•Required/Notrequired

Password•maxFailuresForWipe

•maxTimeToLock

•expirationTimeout

•historyLength

•minLength

•minLetters

•minLowercase

•minNonletters

•minNumeric

•minSymbols

•minUppercase

•Quality

•Numberoffailuresbeforedeviceis

wiped

•Numberinmilliseconds

•Numberofpreviouspasswords

•Minimumcharacterlength

•Minimumnumberofletters

•Minimumnumberoflowercaseletters

•Minimumnumberofnonletters

•Minimumnumericdigits

•Minimumsymbols

•MinimumUppercaseletters

•Setpasswordrestrictionssuchas

numericsandalphanumerics

FormoreinformationonAndroidPolicySettings,see

http://www.google.com/support/a/bin/answer.py?answer=1056433&topic=14576

HereisasampleXMLle:

<?xmlversion="1.0"encoding="utf-8"?>

<lenovocong

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:noNamespaceSchemaLocation="lenovocong.xsd"

uuid="2237f15e-1ce5-4e55-9fe6-767118c370c8">

<DisplayName>Samplepolicy</DisplayName>

<Author>DavidRivera</Author>

<Source>Manual</Source>

</Header>

<LenovoCongSettings>

<EmailType="Exchange"SSL="yes"AcceptAllCerts="yes">

<ServerAddress>gmail.com</ServerAddress>

<UserID>t.cloud09@gmail.com</UserID>

</Email>

<ServerAddress>dc.lenovo.com</ServerAddress>

8ThinkPadTabletDeploymentGuide

<UserID>drivera</UserID>

</DomainServer>

<Certicatetype="Root">

<name>CorporateCACert</name>

MIIDEzCCAnygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBxDELMAkGA1UEBhMCWkEx

FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD

VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv

biBTZXJ2aWNlcyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEm

MCQGCSqGSIb3DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wHhcNOTYwODAx

MDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCBxDELMAkGA1UEBhMCWkExFTATBgNVBAgT

DFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYDVQQKExRUaGF3

dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNl

cyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEmMCQGCSqGSIb3

DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD

gY0AMIGJAoGBANOkUG7I/1Zr5s9dtuoMaHVHoqrC2oQl/Kj0R1HahbUgdJSGHg91

yekIYfUGbTBuFRkC6VLAYttNmZ7iagxEOM3+vuNkCXDF/rFrKbYvScg71CcEJRCX

L+eQbcAoQpnXTEPew/UhbVSfXcNY4cDk2VuwuNy0e982OsK1ZiIS1ocNAgMBAAGj

EzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAB/pMaVz7lcxG

7oWDTSEwjsrZqG9JGubaUeNgcGyEYRGhGshIPllDfU+VPaGLtwtimHp1it2ITk6e

QNuozDJ0uW8NxuOzRAvZim+aKZuZGCg70eNAKJpaPNW15yAbi8qkq43pUdniTCxZ

qdq5snUb9kLy78fyGPmJvKP/iiMucEc=

</encoded>

</Certicate>

<VPN>

<PPTP>

<Name>MyPPTPVPN</Name>

<Server>pptp.server.com</Server>

</PPTP>

<L2TP>

<Name>MyL2TPVPN</Name>

<Server>l2tp.server.com</Server>

</L2TP>

<Name>MyL2TPIPSecPSKVPN</Name>

<Server>ipsecpsk.server.com</Server>

<Secret>FEDCBA987654</Secret>

<IPSecPresharedKey>MyPreshardKey</IPSecPresharedKey>

</L2TPIPSecPSK>

<Name>MyL2TPIPSecCRTVPN</Name>

<Server>ipseccrt.server.com</Server>

<UserCerticate>DavidRiveraCert</UserCerticate>

<CaCerticate>CorporateCACert</CaCerticate>

</L2TPIPSecCRT>

<Name>MyCiscoVPN</Name>

<CertCommonName>DavidRiveraCert</CertCommonName>

Chapter2.Conguration9

</AnyConnect>

</VPN>

<WirelessProleversion="0.01"type="WLAN">

<name>MyHomeNetwork</name>

<SSIDtype="Normal">MyHome</SSID>

<networktype>Infrastructure</networktype>

<AuthenticationAlgorithm>Shared</AuthenticationAlgorithm>

<key1>MyWEPKey</key1>

</WEPKeys>

</WirelessProle>

<WirelessProleversion="0.01"type="WLAN">

<name>MyOfceNetwork</name>

<SSIDtype="Normal">MyOfce</SSID>

<networktype>Infrastructure</networktype>

<presharedkey>somepresharedsecret</presharedkey>

<proxytype="HTTP"requiresauth="no">

</proxy>

</WirelessProle>

<allow>

</allow>

<allow>

<SSID>MyHome</SSID>

</allow>

<deny>

<SSID>CoffeeShop</SSID>

</deny>

</AccessPointFilter>

</LenovoCongSettings>

<Camera>Allow</Camera>

<SDCardSlot>Allow</SDCardSlot>

<Mic>Allow</Mic>

<Bluetooth>Allow</Bluetooth>

<DataRoaming>Block</DataRoaming>

<USBPort>Allow</USBPort>

<MicroUSBPort>Allow</MicroUSBPort>

<SDCardSlot>Allow</SDCardSlot>

<UnknownSources>Block</UnknownSources>

<USBDebugging>Allow</USBDebugging>

<Wi>Allow</Wi>

<HDMI>Allow</HDMI>

<Tethering>Block</Tethering>

<Hotspot>Block</Hotspot>

</DeviceControl>

10ThinkPadTabletDeploymentGuide

<!–<SDCardEncryption>Required</SDCardEncryption>–>

<SDCardEncryption>Notrequired</SDCardEncryption>

<ADScreenLock>Notrequired</ADScreenLock>

</SecurityPolicy>

</LenovoPolicySettings>

<storageEncryption>Notrequired</storageEncryption>

</Password>

</AndroidPolicySettings>

</lenovocong>

TheThinkPadTabletXMLschemacanbefoundontheLenovoWebsiteatwww.lenovo.com/support.

ActiveDirectorydomainserver

AnexclusivefeatureoftheLenovoThinkPadtabletisthatyoucanuseMicrosoftActiveDirectorytoallowthe

usertounlocktheThinkPadTabletusingcorporatecredentials.YousettheXMLletorequireanActive

directorylogon,andtheusertouchesSettings->Location&Security->Congurelockscreen->Corporate

logon.TheuserentersthedomainnameorIPaddress,username,andpassword.Afterthis,theusercan

onlyusetheActiveDirectorydomaincredentialstounlockthemachine.

CongurationProleSignandEncryptUtility

ITadministratorscansecuretheXMLcongurationlebydigitallysigningand/orencryptingit.Encrypting

helpsensurethatsensitivedataincludedinthecongurationle,suchaspasswords,cannotbereadby

unauthorizedparties.Digitalsignatureshelpensurethatthecontentsofthelearenottamperedwith.

TheCongurationProleSignandEncryptUtilityallowssigningofthecongurationprolewithan

embeddedprivatekey.Theutilitywillalsoallowtheletobeencryptedusinganencryptionkeyderived

fromthepasswordprovidedtotheutility.

ThiscomponentisintendedonlyforthepreparationoftheXMLcongurationlefordeploymenttodevices.

Itisavailableatwww.lenovo.com/supportandclickDownloadDrivers&Software

LenovoProleManager

TheLenovoProleManagerisanAndroidapplication(APK)thatispreloadedontheThinkPadTablet.This

APKtakesXMLcongurationlesandhasthecongurationandpolicysettingsapplied,anddisplays

informationaboutnewandinstalledcongurationproles.

Chapter2.Conguration11

AcongurationlereceivedbytheThinkPadTabletmusthaveaspecicleextension(.lenovocong).

TheLenovoProleManagerisregisteredasthehandlerforleswiththisextension.Whenalewiththis

extensionisreceivedonthedeviceandtappedbytheuser,theXMLCongurationProleHandlerwillrun.

TheLenovoProleManagercallsintotheLenovoDevicePolicyManagerServicetoperformaninitial

parseofthecontentsofthele.Theinitialparse:

•VeriesthattheXMLlecontentsarevalidagainsttheschema

•Determineswhatsettingsareincludedinthele

TheLenovoProleManagerisregisteredasanAndroidDeviceAdministrationReceiverusingthenative

Androidcapabilities.

TheLenovoProleManageralsodisplaysinformationabouttheinstalledprolestotheuser.Whentheuser

touchesSettings->Location&security->Congurationproles,alistofinstalledproleswillbedisplayed

usingthe“DisplayName”propertyofthecongurationle.Ifnoprolesareinstalled,theapplicationwill

displaythemessage“Nocongurationproleshavebeenapplied.”Ifmultipleprolesareinstalled,theuser

willseealistofthem.Thedevicewillshowwhichpolicyistheappliedpolicyatthebottomofthepage.

Iftheuserselectsaninstalledprolefromthelist,thedetailsofthecongurationsettingsinthatlistwillbe

displayed.AllinstalledprolesaredisplayedbytheCongurationProleHandler.Thisallowstheuserto

viewallcongurationsettingsthathavebeenapplied.

Theproledisplayalsoallowstheusertoremoveselectedproles.Onlycongurationprolesthatwere

installedbytheLenovoProleManagercanberemovedbytheuser,aslongasyoudidnotsettheproperty

indicatingthatthepolicycannotberemoved.CongurationsettingsthatwerenotsetbytheLenovoProle

Managerwillbedisplayed,butcannotberemovedbytheuser.

TheLenovoProleManageralsocallsintotheLenovoDevicePolicyManagerServicetoreceivealistof

installedproles,andreceivesthelistofinstalledproles,theirsource,andwhethertheproleisallowedto

beinstalledfromtheLenovoDevicePolicyManagerService.

12ThinkPadTabletDeploymentGuide

Chapter3.UsingMicrosoftExchangeActiveSync

TheThinkPadTabletincludessupportforMicrosoftExchangeActiveSync.TheThinkPadTabletscanbe

managedwithMicrosoftExchangeActiveSyncinthesamewayasothermobiledevices.

MicrosoftExchangeActiveSyncofferspushmailcapabilityformobiledevices.Inadditiontopushinge-mail

andcalendarentries,ActiveSyncallowstheyoutopushdevicepolicies.

TheThinkPadTabletsupportsthefollowingExchangeActiveSynccontrols:

•Remotewipe

•Passwordpolicies

•Deviceencryption

•Camera

•Wi-Fi

•Bluetooth

•SyncfromPC

•Removablestorage

•SDcardencryption

OnceaThinkPadTabletisconguredtoconnecttotheExchangeserver,policysettingspushedtothe

devicefromtheExchangeserverareautomaticallyapplied,ensuringthatthedevicemaintainsthesecurity

settingsthatyourITdepartmentrequires.

TheThinkPadtablete-mailclientincludessupportforExchangeActiveSyncpolicies.Thesepoliciesarefor

passwordenforcementandfordeviceencryption.ThosesettingsnativelysupportedbyAndroid,including

passwordanddeviceencryption,aresupportedwithoutchangebyLenovo.

ThiscomponentextendsthenativeActiveSynccapabilitybuiltintothee-mailclienttosupportadditional

devicepoliciesnotnativelysupportedbyAndroid.TheadditionalActiveSyncpoliciessupportedonthe

ThinkPadTabletinclude:

•Removablestorage(USBportandSDcardenable/disable)

•Camera

•WiFi

•Desktopsynchronization(microUSBenable/disable)

•Bluetooth(onlyBluetoothenable/disableissupported.IftheyousetBluetoothto“Handsfreeonly”inthe

ActiveSyncconsole,itdisablestheBluetoothradio).

14ThinkPadTabletDeploymentGuide

Lenovo ThinkPad Series, ThinkPad Hard Disk Drive Deployment Manual

Related papers

Other documents