Chapter 8

Network administrators have long been asking for management utilities that make network management easier. Networks have gotten larger, and computing needs have become more complex with changes in technology. Novell has created Z.E.N.works, or Zero Effort Networks, in response to this business requirement.

Z.E.N.works is a utility set that automates installing and managing network clients. Z.E.N.works is a time saver for administrators, reducing the cost of ownership for enterprise networked workstations. For example, when a change needs to be replicated to 10,000 client workstations that would take the administrator10 minutes at each workstation, it would take several months to perform. An automating utility such as Z.E.N.works can push many types of workstation changes to the desktop without the administrator personally visiting each desk.

The main purpose of Z.E.N.works is to reduce the cost involved with managing workstations on a network. There are several interrelated processes that it uses to achieve this purpose:

• Software management and distribution
• Desktop management and maintenance, using remote control
• Help desk application

Z.E.N.works is enabled for Novell Directory Services; in fact, much of it is integrated within NDS and managed using the NetWare Administrator. This adds a level of security to remote control features and software management and distribution.

NDS provides a framework of hierarchical relationships for network resources. Users are granted access to resources through their explicit rights and those granted from group memberships, security equivalence, and inheritance. Z.E.N.works builds on this relationship framework, adding:

• Application access information
• Printer access information
• Help Desk information
• Windows PC configuration
• Remote access security applied to a workstation

Z.E.N.works adds workstation objects to NDS, and depends on them for features such as remote control. The workstation object is independent of the user who logs in at it. The workstation object can assist with:

• Inventorying network hardware
• Applying policies to the workstation operating system
• Setting the preferred tree and context on the workstation

Z.E.N.works is included with NetWare 5 on the NetWare 5 installation CD. The version of Z.E.N.works that comes with the NetWare 5 CD is the Z.E.N.works Starter Kit, a cut-down version of the fully featured Z.E.N.works, which is a separate purchase item in the current market release version. The Z.E.N.works client is located in the directory D:\PRODUCTS\ZENWORKS, if D: is the letter indicating the CD-ROM drive.

This installation process extends the schema of the selected NDS tree with the Z.E.N.works objects, and adds the functionality to it. All the required files are copied to the selected server.

When choosing a remote control management package, consider three issues:

• Security whether users must be authorized before accessing a remote workstation
• Bandwidth whether the remote control application causes traffic problems
• Ease of use whether it is easy to navigate the remote control application

Because Z.E.N.works uses NDS, it is secured through login authentication. Remote control works only if the user has been granted appropriate object rights to the workstation object. This answers the security issue.

Regarding the issue of bandwidth, there is no excess traffic causing bandwidth problems because a remote control agent is not required to constantly advertise. Instead, the IP and IPX addresses of the workstation are stored in NDS. When remote control is initiated, it uses this information instead. Z.E.N.works is fairly easy to use. It uses the NetWare Administrator as the single point for network management. In order to execute remote control, the authorized user simply navigates the NDS tree to the appropriate workstation object, accesses the workstation object details, and clicks on Remote Control.

Workstation objects are required for Z.E.N.works to perform workstation management and remote control. The workstation objects are created automatically after the following steps are executed:

The workstation must register to capture the following information:

• Registration time
• Network address
• Last server
• Last user

This demonstrates the need to run the registration program every time a user logs into the network. NetWare 5 offers the ability to run the registration program from a login script to automate this process.

The logic of the login script must recognize the type of workstation operating system and run the correct registration program. The registration programs are:

• Windows NT or Windows 95/98—WSREG32.EXE
• Windows 3.1x—WSREG16.EXE

The registration program is run from the SYS:PUBLIC directory of a server that has been installed with Z.E.N.works. It works in conjunction with the WSREG32.DLL file in the windows\system32 directory (or windows\system directory).

The following login script commands will apply this logic:

*********************************

*Workstation Registration Login Script *
*********************************
MAP DISPLAY OFF
MAP ERRORS OFF
MAP F:=SERVER\SYS:PUBLIC
IF "%PLATFORM"="W95" THEN BEGIN
#F:\PUBLIC\WSREG32.EXE
END
IF "%PLATFORM"="WNT" THEN BEGIN
#F:\PUBLIC\WSREG32.EXE
END
IF "%PLATFORM"="WIN" THEN BEGIN
#F:\PUBLIC\WSREG16.EXE
END
IF "%PLATFORM"="DOS" THEN BEGIN
#F:\PUBLIC\WSREG16.EXE

END

In order to control a workstation remotely, the administrator must enable the Remote Control Agent on the workstation. Table 8-1 lists the Remote Control Agents for each platform.

In addition to these launch methods, installing the new client for NetWare 5 that is included with Z.E.N.works will copy the Remote Control Agent (see Figure 8-10) to the workstation, add it to the startup folder, and run it automatically for Windows 95.

For full-screen DOS windows to be remote-controlled on Windows 3.1 and Windows 95 workstations, the administrator must install a driver in addition to the standard Remote Control Agent. If the Remote Control Agent is initialized using NAL, then the driver enabling full-screen DOS window remote control is installed automatically. The difficulty occurs if the NAL application is not used.

When initializing the Remote Control Agent from another method, login script or manual, the following steps will enable full-screen DOS window remote control:

1. Copy SYS:PUBLIC\VUSER.386 and SYS:PUBLIC\VUSER98.386 to the Windows system directory on the workstation.
2. Choose Start | Run and type NOTEPAD C:\WINDOWS\SYSTEM.INI. Locate the [386Enh] section and add the following line (substitute the appropriate windows system directory path, if different): device=c:\windows\system\vuser.386

For Windows NT, the Remote Control Agent is not explicitly run. It is a service that is installed and runs whenever Windows NT runs. As a service, the NT Workstation can be remotely controlled as soon as the service initializes. The Remote Control Agent installation program is SYS:PUBLIC\NTSACFG.EXE. This program registers the Novell WUser Agent service in Windows NT, and can subsequently be found in the Start | Settings | Control Panel | Services icon.

The other portion of enabling remote control is the creation and application of a remote control policy. This is done within the NDS User Policy Package associated with the users and types of workstations that they use.

When users have a problem, they usually contact a member of the Help Desk staff or a network administrator. To assist in users’ requests for help, Z.E.N.works includes the Help Requester. This application contains the workstation information that an administrator might need for logging the help request. It also contains the contact information for the administrator, so that messages and phone calls are directed to the correct administrator for a specific group of users.

• The Help Request application is automatically added to the NetWare Application Launcher (NAL) as an object. All NAL applications are objects within NDS. To launch the application from NAL, the users must be granted the appropriate object rights to the application. The actual Help Requester executable is: SYS:PUBLIC\HLPREQ32.EXE for Windows 95 and Windows NT, and
• SYS:PUBLIC\HLPREQ16.EXE for DOS\Windows 3.1x

Before you can launch the Help Requester an appropriate Help Desk Policy must be created for users in an NDS User Policy Package. The Help Desk Policy details are shown in Figure 8-16.

The configuration properties for the Help Desk Policy enable the electronic messaging component of the Help Desk Request. The Trouble ticket delivery mode has two options: Groupwise 5.0, which is a Novell messaging and groupware application, and MAPI, which is a standard messaging component. A large number of e-mail systems use MAPI: Lotus Notes, Microsoft Exchange Server, older versions of GroupWise, and Outlook Express client for Internet Mail, to name just a few. The information page, illustrated in Figure 8-17, shows the contact information for the administrator, and this e-mail address is automatically used for the messages sent from the Help Requester application.

From the Help Requester application, the user can click on Call or Mail buttons to request help (see Figure 8-18). The Call button will display a dialog box with the contact information for the Administrator. This information is pulled directly from the Help Desk Policy. Since there can be multiple Help Desk Policies assigned to different administrators, each group of users associated with a Help Desk Policy can be administered by a different person.

The Mail button will prompt an electronic message to be sent to the administrator’s e-mail address. The user’s e-mail address is automatically entered by the system. Next, the subject line is selected from a drop-down menu of the subject lines that the administrator added to the Help Desk Policy (see Figure 8-19). This practice automatically organizes the help requests according to the administrator’s needs. Finally, there is space for the user to type a message.

Both the call and the e-mail address will automatically include the user and workstation information pulled from NDS. This allows the user to have the appropriate information to give the person at the Help Desk, which expedites the help request process.

The Help Requester maintains a list of previously logged help requests, as shown in Figure 8-20. The end user can double-click on the line of a previous request and view the information that was logged for that request.

Z.E.N.works brings a Workstation Inventory Policy to NDS. This policy polls the workstation for information and stores it within the workstation object, which integrates it with the workstation import policy. Once a workstation has been imported into NDS, each time the Workstation Registration program runs, the workstation will provide NDS with updated Workstation Inventory information. This synchronization between the workstation and NDS objects is accomplished by the Workstation Registration application.

To enable the Workstation Inventory Policy, open the Workstation Policy package. Check the box next to the Workstation Inventory Policy. To change the schedule for the inventory event, click the schedule button and select the times and days to run. Click the Associations page button and add the NDS container for the workstations in order to finalize the policy package to run the inventory.

When administering a network that contains Windows 95 and Windows NT Workstation clients, the terms, "policies" and "profiles", come up often, along with a question or dilemma over which to use. Understanding what each does will make the choice easier. In the simplest terms, profiles determine what a user sees on computer’s desktop; shortcuts to executables, "Start Menu" shortcuts, wallpaper and other items. A profile, or the desktop’s "appearance" can be modified while the user’s session is in effect, although whether that same desktop appears when the same user’s next session starts, depends on whether the administrator enabled the profile as mandatory or roaming. Nevertheless, the user is able to change the desktop’s appearance, pretty much at will, during a given session. A policy can be thought of as the parameters, or limits put on a user, or a specific machine, how the registry settings can be changed, including a currently loaded profile. Think of profiles as changes made to the registry and policies as restrictions placed on a user’s or machine’s ability to access and use the tools (Control Panel) used to modify the system registry. Z.E.N.works offers the administrator another tool to manage and administer policies via NDS.

—By Dan Cheung, CNI, MCNE, MCT

Z.E.N.works enables centralized administration of workstations and their users. This includes the ability to manage and distribute software, manage desktops, remote control workstations, and enable help desk support for end users.

Z.E.N.works Starter Kit is included with NetWare 5 andcan be installed from the NetWare 5 CD-ROM. When Z.E.N.works is installed, it is installed from a workstation onto a server. It extends the schema of NDS and adds new objects,which are the policy packages and the workstation objects through which Z.E.N.works manages the network.

One of the biggest benefits of Z.E.N.works is the ability to remote control workstations. Using remote control with Z.E.N.works is very secure due to the use of NDS secured objects. A user must be granted access to a workstation object in the NDS tree in order to take remote control of the workstation. Z.E.N.works also avoids excess bandwidth consumption through remote control. Instead of using an advertising protocol on the network for the remote control agent, Z.E.N.works relies on the workstation object’s network address for locating the workstation.

In order to take remote control of a workstation, it first must be created as a workstation object in NDS, which is a five-step process:

1. The users must be granted access to the registered objects. This is done through the NetWare Administrator using the Prepare Workstation Registration option. Or the WSRIGHTS.EXE executable can be run from SYS:PUBLIC.
2. The workstations must then register with NDS. This is done through the Workstation Registration application available in NAL, or it can be run from the WSREG32.EXE or WSREG16.EXE files run from SYS:PUBLIC.
3. The workstations must then be imported into NDS using the NetWare Administrator to create a Workstation Import Policy and associate it to users, then running the Tools | Import Workstations utility. The import can be done using the WSIMPORT.EXE file in SYS:PUBLIC.
4. The workstations must then register with NDS a second time, and continue to run each time the workstation logs in. This can be done through a login script, utilizing a line such as IF %PLATFORM = "WIN95" THEN WSREG32.EXE END to run the command. Or, it can be launched from NAL, or manually executed.
5. To be successful, the workstation import must be verified. Each workstation has a log written to the root of C: called WSREG32.LOG or WSREG16.LOG, which are text files viewable in Notepad.

To configure a workstation for remote control, both NDS and the workstation must be involved. In NDS, the remote control policy must be created for both a workstation and for a user policy package. Then each of the workstation policies and the user policy must be associated to the respective workstations and users. The security restrictions are such that if a security restriction is higher on either the workstation or the User object in NDS, then the higher level of security is applied to the remote control.

The second part of enabling remote control is to run the Remote Control Agent on the workstation. For NT Workstations, this is a service called NTASCFG.EXE. For Windows 3.x and Windows 95/98, the application is WUSER.EXE.

To remotely control a workstation, locate the workstation object in NDS and view its details. Click the Remote Control page button and then click the Remote Control button.

Z.E.N.works includes a Help Requester application that allows users to contact the appropriate administrators for help. This is enabled using a Help Desk policy. The Help Requester application is installed as an object in NDS and appears in the NetWare application launcher window. The Help Requester can initiate an e-mail to the administrator with preconfigured subjects, or it can give the end user the information needed to access the administrator via phone.

The workstation must be synchronized with its NDS object in order for the Z.E.N.works remote control policy to work. The workstation inventory policy also requires synchronization. This synchronization is established by the WSREG32.EXE or WSREG16.EXE executables, and it can be launched from the NAL window.

• Z.E.N.works is a utility set that automates installing and managing network clients. Z.E.N.works is a time saver for administrators, reducing the cost of ownership for enterprise networked workstations.
• Z.E.N.works uses several interrelated processes to reduce the cost involved with managing workstations. They are: software management and distribution, remote-control desktop management and maintenance, and a Help Desk application.
• Z.E.N.works is enabled for Novell Directory Services. Much of it is integrated within NDS and managed using the NetWare Administrator.
• Z.E.N.works builds on the NDS hierarchical relationship framework, by adding application access information, printer access information, Help Desk information, Windows PC configuration, and Remote access security applied to workstations.
• The Z.E.N.works Starter Kit is included on the NetWare 5 installation CD. Z.E.N.works Starter Kit is a cut-down version of the fully featured Z.E.N.works. The Z.E.N.works client is located in the directory D:\PRODUCTS\ZENWORKS, if D: is the letter indicating the CD-ROM drive.
• Workstation objects are required for Z.E.N.works to perform workstation management and remote control.
• The workstation must register to capture registration time, network address, last server, and last user informatin, requiring the registration program to run every time a user logs into the network. NetWare 5 offers the ability to run the registration program from a login script to automate this process.
• The logic of the login script must recognize the type of workstation operating system and run the correct registration program, either WSREG32.EXE for Windows NT or Windows 95/98, or WSREG16.EXE for Windows 3.1x. The registration program is run from the SYS:PUBLIC directory of a server that has been installed with Z.E.N.works, and works in conjunction with the WSREG32.DLL file in the windows\system32 directory (or windows\system directory).
• In order to control a workstation remotely, the administrator must enable the Remote Control Agent on the workstation. Installing the new client for NetWare 5 that is included with Z.E.N.works will copy the Remote Control Agent to the workstation, add it to the startup folder, and run it automatically for Windows 95.
• For full-screen DOS windows to be remote-controlled on Windows 3.1 and Windows 95 workstations, the administrator must install a driver in addition to the standard Remote Control Agent. If the Remote Control Agent is initialized using NAL, then the driver enabling full-screen DOS window remote control is installed automatically. The difficulty occurs if the NAL application is not used.
• Z.E.N.works includes the Help Requester, an application that contains the workstation information that an administrator might need for logging the help request. It also contains the contact information for the administrator, so that messages and phone calls are directed to the correct administrator for a specific group of users.
• The Help Request application is automatically added to the NetWare Application Launcher (NAL) as an object. All NAL applications are objects within NDS. To launch the application from NAL, the users must be granted the appropriate object rights to the application. The Help Requester executable is: SYS:PUBLIC\HLPREQ32.EXE for Windows 95 and Windows NT, and SYS:PUBLIC\HLPREQ16.EXE for DOS\Windows 3.1x. Before you can launch the Help Requester, an appropriate Help Desk Policy must be created for users in an NDS User Policy Package.
• Z.E.N.works brings a Workstation Inventory Policy to NDS. This policy polls the workstation for information and stores it within the workstation object, which integrates it with the workstation import policy. Once a workstation has been imported into NDS, each time the Workstation Registration program runs, the workstation will provide NDS with updated Workstation Inventory information.