Lenovo ThinkPad Series Deployment Manual

Brand: Lenovo

Model: ThinkPad Series

Category: Servers

Type: Deployment Manual

This manual is also suitable for

ThinkPad Hard Disk Drive

ThinkPadTabletDeploymentGuide

Note:Beforeusingthisinformationandtheproductitsupports,readthegeneralinformationinAppendixA

“Notices”onpage17.

FirstEdition(August2011)

©CopyrightLenovo2011.

LIMITEDANDRESTRICTEDRIGHTSNOTICE:IfdataorsoftwareisdeliveredpursuantaGeneralServicesAdministration

“GSA”contract,use,reproduction,ordisclosureissubjecttorestrictionssetforthinContractNo.GS-35F-05925.

Contents

Chapter1.Overview..........1

LenovoDevicePolicyManagerService.....2

Chapter2.Conguration.......5

XMLcongurationles...........5

ActiveDirectorydomainserver........11

CongurationProleSignandEncryptUtility...11

LenovoProleManager...........11

Chapter3.UsingMicrosoftExchange

ActiveSync..............13

Chapter4.LenovoMobility

Manager................15

AppendixA.Notices..........17

Trademarks................18

©CopyrightLenovo2011

iii

ivThinkPadTabletDeploymentGuide

Chapter1.Overview

TheLenovoThinkPadTabletgivesyoutheabilitytocongureandmanagethetabletusingregulartoolssuch

asyouusewithinyourenterprise.Youcancontroltabletfunctions,enablecorporatesecurity,passwords,

encryptionanddigitalsignatures.

YoucanpushdowncongurationorpolicysettingstotheThinkPadTabletintheseways:

•MicrosoftExchangeActiveSync

•AnXMLcongurationle

•LenovoMobilityManager

©CopyrightLenovo2011

HereistheinformationowfortheThinkPadTablet:

Figure1.ThinkPadTabletow

MicrosoftExchangeisusedasthecorporateemailcommunicationmethod.

YoucancreateormodifyanXMLleusingeitheratexteditororanXMLeditortopushdowntotheThinkPad

tabletthroughtheLenovoCongurationFileHandlerAPK.OryoucanuseLenovoMobilityManagerSuiteto

manageyouruser’sThinkPadtabletsusingthesuppliedLenovoMobilityManagerAPK.Thesemethodsthen

arepassedthroughtheLenovoDevicePolicyManagerService.Formoreinformation,see“LenovoDevice

PolicyManagerService”onpage2

LenovoDevicePolicyManagerService

TheDevicePolicyManagerServicehandlesthemanagementoftheThinkPadTablet.Thiscomponent

providesaninterfacethatallowsmanagementtools,suchasActiveSync,anXMLle,orLenovoMobility

Managertoconguredevicefeatures,suchasWiFiprolesanddevicepolicies.

2ThinkPadTabletDeploymentGuide

ThisinterfaceallowsyoutopushthefollowingcongurationstotheThinkPadTablet:

•WiFiproles

•WiFiaccesspointlters

•WiFiradiopowersettings

•MicrosoftExchangeE-mailserverconguration

•VPNconguration

•ActiveSyncserverconguration

•Devicefeaturedisable,including:

–Camera

–USBport

–SDcard

–Microphone

–Pen

–Bluetooth

–WiFi

•Clientcerticates

•Webproxy

•SDcardencryption

•AndroidPasswordpolicies

Chapter1.Overview3

4ThinkPadTabletDeploymentGuide

Chapter2.Conguration

TheThinkPadTabletallowsyoutocongurethecorporateservicesthatusersneedbyspecifying

congurationsettingsinXMLles.WhentheseXMLlesaredeliveredtousersandimportedbytheThinkPad

Tablet,thesettingsareappliedbytheThinkPadTablet.ConguringtheThinkPadTabletwithXMLleshelps

makeiteasierforuserstoconnecttotheircorporatenetworksandaccounts,andquicklybeproductive.

XMLcongurationles

TheThinkPadT abletallowsyoutocongurecorporateservicesforusersbyspecifyingcongurationsettings

intheXMLle.WhentheseXMLlesaredeliveredtousersandloadedontheThinkPadTablet,thesettings

areautomaticallyappliedbythetablet.ConguringtheThinkPadTabletwithXMLlesmakesiteasierforthe

usertoconnecttocorporatenetworksandaccounts.

UsingtheXMLle,youcancongurethefollowing:

•MicrosoftExchangee-mailserver

•VirtualPrivateNetwork(VPN)

•WirelessNetworkSettings

•Digitalcerticates

•ActiveDirectorydomainserver

•DevicePolicies

Youcancreateasingle,commonXMLcongurationleformultipleusers.TheXMLlemaycontain,for

example,thecongurationsettingsforthesecurecorporatewirelessnetwork,theCAcerticateforthe

wirelessnetwork,andtheaddressofthecorporateExchangeserver.YoucanmakethisXMLleavailableto

theuserbysendingittotheuser’spersonale-mailaccount,whichtheusercanaccessusinganunsecured

visitornetworkconnection,ortheuser’shomeinternetconnection.OryoucanalsoputtheXMLconguration

leonaWebserver,makingitaccessibletoanyuserthatalreadyhastheproperintranetcredentials.

OncetheXMLcongurationleisreceivedbytheuser,thatusersimplytapstheleandtheLenovo

CongurationProleHandlerislaunchedtoimportandapplythecongurationsettingsonthedevice.The

usermaybepromptedtoenterpersonallogoncredentialsiftheywerenotincludedinthecongurationle,

butallofthecommonserverinformationandsettingswillbepredenedfortheuser.

YoucansecuretheXMLcongurationlebydigitallysigningand/orencryptingit.Encryptinghelpsensure

thatsensitivedataincludedinthecongurationle,suchaspasswords,cannotbereadbyunauthorized

users.Digitalsignatureshelpsensurethatthecontentsofthelearenotchangedinanyway.

TheCongurationProleSignandEncryptUtilityallowssigningofthecongurationprolewithan

embeddedprivatekey.Theutilityalsoallowstheletobeencryptedusinganencryptionkeyderived

fromthepasswordprovidedtotheutility.

TheXMLcongurationlenamingconventionalwayshasaleextensionof.lenovocong,sothatthe

ThinkPadTabletwillrecognizeitasacongurationle.Theleconsistsofthreeparts:

1.LenovoCongSettings

2.LenovoPolicySettings

3.AndroidPolicySettings

©CopyrightLenovo2011

TheLenovoCongSettingssectionprovidescontrolforthesecurityandencryptionfortheThinkPadTablet.It

importscongurationsettingssuchasWiFiproles,corporatedomainservers,virtualprivatenetworks,and

certicates.Oncetheseareapplied,theycannotbedeleted.

TheLenovoPolicySettingssectionallowsyoutosetcontrolsforthevariousfunctionsoftheThinkPadtablet

suchasthecamera,microphone,SDcardsandBluetooth,andWiradios.Anyofthesefunctionscanbe

enabledordisableddependingonyourcorporatepolicy.

TheAndroidPolicySettingsectionisusedtosetuppolicysettingssupportednativelybyAndroid,including

storageencryption,passwordlength,numberofnumbersandlettersrequired.

NotethataUUIDisrequiredforeachXMLlethatyoucreate.Ifyouwanttooverwriteorremoveanyexisting

policies,youcansenddownanewlewiththesameUUIDoftheexistingappliedpolicy,anditwilloverwrite

theexistingle.SincemultipleXMLles(withdifferentUUIDs)canberesidentontheThinkPadTablet,the

lewiththestrongestpolicieswillbeapplied.Forexample,ifyouhaveanXMLlethatrequiresonlya

numericpasswordandanotherlewithadifferentUUIDthatrequiresalonger,alphanumericpassword,the

lewiththealphanumericpasswordwillbeapplied.

ThefollowingtablesprovideinformationonsettingsfortheXMLle.Thetableheadersare:

•Setting-Thesettinginthexmllethatyoucanuserequireausertologintoacorporateserverortoallo

orpreventuserfromusingacertainfunctionrequireofthedevice.

•Parameter-Theeldsinthesettingthatyouassignavaluefortheusertollin

•Value-Therequiredvalueyouneedtoenterforthateldsuchasserveraddress,userid,Y es/Noand

soon.

•Notes-Anyspecialnotesthatapplytoasetting.

Table1.LenovoCongSettings

SettingParameterValuesNotes

EmailAccount•Type

•SSL

•AcceptAllCerts

•Exchange

•Yes/No

MicrosoftExchangeis

theonlysupportedemail

typeatthistime.

DomainServer•ServerAddress

•UserID

•Password

•Serveraddress

•UserID

•Password

•Serveraddressis

required

•Optional

CerticateType

•Type

•Name

•Filename/Encoded

•Root/User

•CerticateName

•?

Certicatesmaybe

includedintheXMLle

inaBase-64encoded

format.

VPN•PPTP

–Name

–Server

–OverwriteIfExists

–DNSSearchDomain

–Encryption

•L2TP

–Name

•Point-toPointT unnelingProtocol

–Protocolnames

–ServerIPaddress

–Yes/No

–DomainIPAddress

–DomainIPaddress

–Yes/No

•Layer2TunnelProtocol

–Nameoftheserver

6ThinkPadTabletDeploymentGuide

Table1.LenovoCongSettings(continued)

SettingParameterValuesNotes

–Server

–OverwriteIfExists

–DNSSearchDomain

–Encryption

•L2TPIPSecPSK

–Name

–Server

–OverwriteIfExists

–Secret

–IPSecPresharedKey

•L2TPIPSecCrt

–Name

–Server

–OverwriteIfExists

–DNSSearchDomain

–UserCerticate

–CaCerticate

•AnyConnect

–Name

–Host

–OverwriteIfExists

–UserCert

–CertCommonName

–ServerIPaddress

–Yes/No

–IPAddress

–Yes/No

•AndroidPSK

–PSKname

–ServerURL

–Yes/No

–Password

–PresharedKey

•L2TPIPSecCrt

–CRTName

–URL

–Yes/No

–DomainIPAddress

–DomainIPadress

–Certicatename

–Certicateinfo

•AnyConnect

–VPNnames

–HostIPaddress

–Yes/No

–Certicatename

Table2.LenovoPolicySettings

SettingFieldValuesNotes

DeviceControl•Camera

•SDCardSlot

•Mic

•Bluetooth

•Dataroaming

•USBPort

•MicroUSBPort

•SDCardSlot

•UnknownSources

•USBDebugging

•Wi

•HDMI

•Tethering

•Allow/Block

Chapter2.Conguration7

Table2.LenovoPolicySettings(continued)

SettingFieldValuesNotes

•Hotspot

•Allow/Block

SecurityPolicy•SDCardEncryption

•ADScreenLock

•Notrequired/Required

Table3.AndroidPolicySettings

SettingFieldValuesNotes

StorageEncryption•Required/Notrequired

Password•maxFailuresForWipe

•maxTimeToLock

•expirationTimeout

•historyLength

•minLength

•minLetters

•minLowercase

•minNonletters

•minNumeric

•minSymbols

•minUppercase

•Quality

•Numberoffailuresbeforedeviceis

wiped

•Numberinmilliseconds

•Numberofpreviouspasswords

•Minimumcharacterlength

•Minimumnumberofletters

•Minimumnumberoflowercaseletters

•Minimumnumberofnonletters

•Minimumnumericdigits

•Minimumsymbols

•MinimumUppercaseletters

•Setpasswordrestrictionssuchas

numericsandalphanumerics

FormoreinformationonAndroidPolicySettings,see

http://www.google.com/support/a/bin/answer.py?answer=1056433&topic=14576

HereisasampleXMLle:

<?xmlversion="1.0"encoding="utf-8"?>

<lenovocong

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:noNamespaceSchemaLocation="lenovocong.xsd"

uuid="2237f15e-1ce5-4e55-9fe6-767118c370c8">

<DisplayName>Samplepolicy</DisplayName>

<Author>DavidRivera</Author>

<Source>Manual</Source>

</Header>

<LenovoCongSettings>

<EmailType="Exchange"SSL="yes"AcceptAllCerts="yes">

<ServerAddress>gmail.com</ServerAddress>

<UserID>t.cloud09@gmail.com</UserID>

</Email>

<ServerAddress>dc.lenovo.com</ServerAddress>

8ThinkPadTabletDeploymentGuide

<UserID>drivera</UserID>

</DomainServer>

<Certicatetype="Root">

<name>CorporateCACert</name>

MIIDEzCCAnygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBxDELMAkGA1UEBhMCWkEx

FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD

VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv

biBTZXJ2aWNlcyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEm

MCQGCSqGSIb3DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wHhcNOTYwODAx

MDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCBxDELMAkGA1UEBhMCWkExFTATBgNVBAgT

DFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYDVQQKExRUaGF3

dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNl

cyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEmMCQGCSqGSIb3

DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD

gY0AMIGJAoGBANOkUG7I/1Zr5s9dtuoMaHVHoqrC2oQl/Kj0R1HahbUgdJSGHg91

yekIYfUGbTBuFRkC6VLAYttNmZ7iagxEOM3+vuNkCXDF/rFrKbYvScg71CcEJRCX

L+eQbcAoQpnXTEPew/UhbVSfXcNY4cDk2VuwuNy0e982OsK1ZiIS1ocNAgMBAAGj

EzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAB/pMaVz7lcxG

7oWDTSEwjsrZqG9JGubaUeNgcGyEYRGhGshIPllDfU+VPaGLtwtimHp1it2ITk6e

QNuozDJ0uW8NxuOzRAvZim+aKZuZGCg70eNAKJpaPNW15yAbi8qkq43pUdniTCxZ

qdq5snUb9kLy78fyGPmJvKP/iiMucEc=

</encoded>

</Certicate>

<VPN>

<PPTP>

<Name>MyPPTPVPN</Name>

<Server>pptp.server.com</Server>

</PPTP>

<L2TP>

<Name>MyL2TPVPN</Name>

<Server>l2tp.server.com</Server>

</L2TP>

<Name>MyL2TPIPSecPSKVPN</Name>

<Server>ipsecpsk.server.com</Server>

<Secret>FEDCBA987654</Secret>

<IPSecPresharedKey>MyPreshardKey</IPSecPresharedKey>

</L2TPIPSecPSK>

<Name>MyL2TPIPSecCRTVPN</Name>

<Server>ipseccrt.server.com</Server>

<UserCerticate>DavidRiveraCert</UserCerticate>

<CaCerticate>CorporateCACert</CaCerticate>

</L2TPIPSecCRT>

<Name>MyCiscoVPN</Name>

<CertCommonName>DavidRiveraCert</CertCommonName>

Chapter2.Conguration9

</AnyConnect>

</VPN>

<WirelessProleversion="0.01"type="WLAN">

<name>MyHomeNetwork</name>

<SSIDtype="Normal">MyHome</SSID>

<networktype>Infrastructure</networktype>

<AuthenticationAlgorithm>Shared</AuthenticationAlgorithm>

<key1>MyWEPKey</key1>

</WEPKeys>

</WirelessProle>

<WirelessProleversion="0.01"type="WLAN">

<name>MyOfceNetwork</name>

<SSIDtype="Normal">MyOfce</SSID>

<networktype>Infrastructure</networktype>

<presharedkey>somepresharedsecret</presharedkey>

<proxytype="HTTP"requiresauth="no">

</proxy>

</WirelessProle>

<allow>

</allow>

<allow>

<SSID>MyHome</SSID>

</allow>

<deny>

<SSID>CoffeeShop</SSID>

</deny>

</AccessPointFilter>

</LenovoCongSettings>

<Camera>Allow</Camera>

<SDCardSlot>Allow</SDCardSlot>

<Mic>Allow</Mic>

<Bluetooth>Allow</Bluetooth>

<DataRoaming>Block</DataRoaming>

<USBPort>Allow</USBPort>

<MicroUSBPort>Allow</MicroUSBPort>

<SDCardSlot>Allow</SDCardSlot>

<UnknownSources>Block</UnknownSources>

<USBDebugging>Allow</USBDebugging>

<Wi>Allow</Wi>

<HDMI>Allow</HDMI>

<Tethering>Block</Tethering>

<Hotspot>Block</Hotspot>

</DeviceControl>

10ThinkPadTabletDeploymentGuide

<!–<SDCardEncryption>Required</SDCardEncryption>–>

<SDCardEncryption>Notrequired</SDCardEncryption>

<ADScreenLock>Notrequired</ADScreenLock>

</SecurityPolicy>

</LenovoPolicySettings>

<storageEncryption>Notrequired</storageEncryption>

</Password>

</AndroidPolicySettings>

</lenovocong>

TheThinkPadTabletXMLschemacanbefoundontheLenovoWebsiteatwww.lenovo.com/support.

ActiveDirectorydomainserver

AnexclusivefeatureoftheLenovoThinkPadtabletisthatyoucanuseMicrosoftActiveDirectorytoallowthe

usertounlocktheThinkPadTabletusingcorporatecredentials.YousettheXMLletorequireanActive

directorylogon,andtheusertouchesSettings->Location&Security->Congurelockscreen->Corporate

logon.TheuserentersthedomainnameorIPaddress,username,andpassword.Afterthis,theusercan

onlyusetheActiveDirectorydomaincredentialstounlockthemachine.

CongurationProleSignandEncryptUtility

ITadministratorscansecuretheXMLcongurationlebydigitallysigningand/orencryptingit.Encrypting

helpsensurethatsensitivedataincludedinthecongurationle,suchaspasswords,cannotbereadby

unauthorizedparties.Digitalsignatureshelpensurethatthecontentsofthelearenottamperedwith.

TheCongurationProleSignandEncryptUtilityallowssigningofthecongurationprolewithan

embeddedprivatekey.Theutilitywillalsoallowtheletobeencryptedusinganencryptionkeyderived

fromthepasswordprovidedtotheutility.

ThiscomponentisintendedonlyforthepreparationoftheXMLcongurationlefordeploymenttodevices.

Itisavailableatwww.lenovo.com/supportandclickDownloadDrivers&Software

LenovoProleManager

TheLenovoProleManagerisanAndroidapplication(APK)thatispreloadedontheThinkPadTablet.This

APKtakesXMLcongurationlesandhasthecongurationandpolicysettingsapplied,anddisplays

informationaboutnewandinstalledcongurationproles.

Chapter2.Conguration11

AcongurationlereceivedbytheThinkPadTabletmusthaveaspecicleextension(.lenovocong).

TheLenovoProleManagerisregisteredasthehandlerforleswiththisextension.Whenalewiththis

extensionisreceivedonthedeviceandtappedbytheuser,theXMLCongurationProleHandlerwillrun.

TheLenovoProleManagercallsintotheLenovoDevicePolicyManagerServicetoperformaninitial

parseofthecontentsofthele.Theinitialparse:

•VeriesthattheXMLlecontentsarevalidagainsttheschema

•Determineswhatsettingsareincludedinthele

TheLenovoProleManagerisregisteredasanAndroidDeviceAdministrationReceiverusingthenative

Androidcapabilities.

TheLenovoProleManageralsodisplaysinformationabouttheinstalledprolestotheuser.Whentheuser

touchesSettings->Location&security->Congurationproles,alistofinstalledproleswillbedisplayed

usingthe“DisplayName”propertyofthecongurationle.Ifnoprolesareinstalled,theapplicationwill

displaythemessage“Nocongurationproleshavebeenapplied.”Ifmultipleprolesareinstalled,theuser

willseealistofthem.Thedevicewillshowwhichpolicyistheappliedpolicyatthebottomofthepage.

Iftheuserselectsaninstalledprolefromthelist,thedetailsofthecongurationsettingsinthatlistwillbe

displayed.AllinstalledprolesaredisplayedbytheCongurationProleHandler.Thisallowstheuserto

viewallcongurationsettingsthathavebeenapplied.

Theproledisplayalsoallowstheusertoremoveselectedproles.Onlycongurationprolesthatwere

installedbytheLenovoProleManagercanberemovedbytheuser,aslongasyoudidnotsettheproperty

indicatingthatthepolicycannotberemoved.CongurationsettingsthatwerenotsetbytheLenovoProle

Managerwillbedisplayed,butcannotberemovedbytheuser.

TheLenovoProleManageralsocallsintotheLenovoDevicePolicyManagerServicetoreceivealistof

installedproles,andreceivesthelistofinstalledproles,theirsource,andwhethertheproleisallowedto

beinstalledfromtheLenovoDevicePolicyManagerService.

12ThinkPadTabletDeploymentGuide

Chapter3.UsingMicrosoftExchangeActiveSync

TheThinkPadTabletincludessupportforMicrosoftExchangeActiveSync.TheThinkPadTabletscanbe

managedwithMicrosoftExchangeActiveSyncinthesamewayasothermobiledevices.

MicrosoftExchangeActiveSyncofferspushmailcapabilityformobiledevices.Inadditiontopushinge-mail

andcalendarentries,ActiveSyncallowstheyoutopushdevicepolicies.

TheThinkPadTabletsupportsthefollowingExchangeActiveSynccontrols:

•Remotewipe

•Passwordpolicies

•Deviceencryption

•Camera

•Wi-Fi

•Bluetooth

•SyncfromPC

•Removablestorage

•SDcardencryption

OnceaThinkPadTabletisconguredtoconnecttotheExchangeserver,policysettingspushedtothe

devicefromtheExchangeserverareautomaticallyapplied,ensuringthatthedevicemaintainsthesecurity

settingsthatyourITdepartmentrequires.

TheThinkPadtablete-mailclientincludessupportforExchangeActiveSyncpolicies.Thesepoliciesarefor

passwordenforcementandfordeviceencryption.ThosesettingsnativelysupportedbyAndroid,including

passwordanddeviceencryption,aresupportedwithoutchangebyLenovo.

ThiscomponentextendsthenativeActiveSynccapabilitybuiltintothee-mailclienttosupportadditional

devicepoliciesnotnativelysupportedbyAndroid.TheadditionalActiveSyncpoliciessupportedonthe

ThinkPadTabletinclude:

•Removablestorage(USBportandSDcardenable/disable)

•Camera

•WiFi

•Desktopsynchronization(microUSBenable/disable)

•Bluetooth(onlyBluetoothenable/disableissupported.IftheyousetBluetoothto“Handsfreeonly”inthe

ActiveSyncconsole,itdisablestheBluetoothradio).

14ThinkPadTabletDeploymentGuide

Page is loading ...

Lenovo ThinkPad Series Deployment Manual

Brand: Lenovo

Model: ThinkPad Series

Category: Servers

Type: Deployment Manual

This manual is also suitable for

ThinkPad Hard Disk Drive

Download PDF

report

Lenovo ThinkPad Series Deployment Manual

This manual is also suitable for

Lenovo ThinkPad Series Deployment Manual

Related papers

Other documents