FARONICS DEEP FREEZE ENTERPRISE 6 User manual

CaS`5cWRS
/0A=:CB3AgabS[7\bSU`Wbg
3<B3@>@7A3

is page intentionally le blank

3<B3@>@7A3
 
SecurityNotice
Deep Freeze does not protect against booting from a oppy drive or CD-ROM drive. e CMOS
should be congured to prevent booting from the oppy drive or CD-ROM drive (i.e. set to boot to the
hard drive) and the CMOS must be password protected. is is a normal precaution for most public
access computers. e Windows Registry, the computer CMOS and the boot sector are protected by
Deep Freeze from within Windows.
TechnicalSupport
Every eort has been made to design this soware for ease of use and to be problem free. If problems
are encountered, contact Technical Support:
Email: suppo[email protected]m
Phone: [phone] or 604-637-3333
Hours: 7:00am to 5:00pm (Pacic Time)
ContactInformation
Web: www.faronics.com
Email: [email protected]m
Phone: [phone] or 604-637-3333
Fax: [phone] or 604-637-8188
Hours: 7:00am to 5:00pm (Pacic Time)
Address: Faronics Technologies USA Inc.
Suite 170 – 2411 Old Crow Canyon Road
San Ramon, CA 94583
USA
Faronics Corporation
620 - 609 Granville St.
Vancouver, BC V7Y 1G5
Canada
AboutFaronics
Faronics develops and markets intelligent utilities for absolute control of multi-user computing
environments. Faronics’ market-leading solutions have dramatically impacted the day-to-day
lives of thousands of information technology professionals and computing lab managers, ensuring
100% availability of systems. Our user-driven, powerful technology innovations benet educational
institutions, libraries, government organizations and corporations. Incorporated in 1996, Faronics has
two oces situated in the USA and Canada.
Last modied: January, 2007
© 2007 Faronics Corporation. All rights reserved. Deep Freeze, Faronics, Faronics Anti-Executable, Faronics System Proler, FreezeX,
and WINSelect are trademarks and/or registered trademarks of Faronics Corporation. All other company and product names are
trademarks of their respective owners.

is page intentionally le blank

3<B3@>@7A3
 
Contents
Deep Freeze Overview .......................................................................................................................................7
About Deep Freeze .........................................................................................................................................................7
System Requirements.....................................................................................................................................................7
Deep Freeze Enterprise Components ..........................................................................................................................7
Deep Freeze Conguration Administrator.......................................................................................................8
Installing the Conguration Administrator................................................................................................................8
Initializing the Customization Code............................................................................................................................8
Re-Initializing the Customization Code......................................................................................................................9
Using the Conguration Administrator....................................................................................................................10
Welcome Tab .................................................................................................................................................................10
Toolbar......................................................................................................................................................................10
File Menu..................................................................................................................................................................11
Password Protection................................................................................................................................................11
Conguration Tab ........................................................................................................................................................12
Passwords .................................................................................................................................................................12
Drives........................................................................................................................................................................13
Restart/Shutdown....................................................................................................................................................15
Maintenance.............................................................................................................................................................16
Advanced Maintenance ..........................................................................................................................................18
Miscellaneous...........................................................................................................................................................19
One Time Passwords Tab ............................................................................................................................................21
Create Programs Tab....................................................................................................................................................22
Uninstalling the Conguration Administrator.........................................................................................................23
Deep Freeze Enterprise Console .....................................................................................................................24
Creating the Enterprise Console ................................................................................................................................24
Activating the Enterprise Console..............................................................................................................................24
Using the Enterprise Console .....................................................................................................................................25
Status Icons...............................................................................................................................................................25
View Options ...........................................................................................................................................................26
Managing Communication Between the Console and Workstations ...................................................................26
Managing Deep Freeze with the Console..................................................................................................................27
Updating Deep Freeze Soware ............................................................................................................................28
Sending Text Messages to Workstations...............................................................................................................28
Target Installing Deep Freeze ................................................................................................................................29
Updating a Deep Freeze Conguration File ........................................................................................................30
Dynamically Updating a Deep Freeze Conguration File.................................................................................31
Scheduling Deep Freeze Tasks ....................................................................................................................................33
Assigning Workstations to Scheduled Tasks........................................................................................................35
Deleting a Task.........................................................................................................................................................36
Scheduled Task Properties .....................................................................................................................................36
Managing Network and Groups .................................................................................................................................37
Adding a New Group..............................................................................................................................................37
Building a User Dened Group Structure............................................................................................................37
Importing Groups from Active Directory............................................................................................................38
Adding Workstations to a User Dened Group..................................................................................................38
Sorting Groups Alphabetically ..............................................................................................................................38
Importing or Exporting Groups to File................................................................................................................38
Viewing the Console Log File .....................................................................................................................................38
Installing Deep Freeze .....................................................................................................................................39
Attended Install or Uninstall.......................................................................................................................................39
Uninstalling Deep Freeze .......................................................................................................................................40
Silent Install or Uninstall .............................................................................................................................................41
Silent Install or Uninstall Using a Shortcut...............................................................................................................41
Network Install on Multiple Workstations................................................................................................................42
Installing Over Existing Deep Freeze Versions ........................................................................................................42

3<B3@>@7A3

Installing Using Imaging .............................................................................................................................................42
Target Install..................................................................................................................................................................42
Managing Deep Freeze Workstations..............................................................................................................43
Workstation Logon.......................................................................................................................................................43
Boot Control..................................................................................................................................................................43
Network ........................................................................................................................................................................44
Clone ..............................................................................................................................................................................44
One Time Passwords....................................................................................................................................................44
awSpace .....................................................................................................................................................................45
Permanent Soware Installations, Changes, or Removals......................................................................................45
Deep Freeze Command Line Control (DFC.EXE)..........................................................................................46
DFC Return Values.......................................................................................................................................................47
Batch File Example .......................................................................................................................................................47
Update Mode.................................................................................................................................................................48
Remote Administration...................................................................................................................................49
Remote Console............................................................................................................................................................49
Server Service................................................................................................................................................................49
Remote Control Enabled (RCE) Console..................................................................................................................49
Dierences Between Server Service and RCE Console...........................................................................................50
Creating a Server Service.................................................................................................................................50
Conguring the Server Service ..................................................................................................................................51
Updating the Server Service from the Console ........................................................................................................51
Conguring a Remote Control Enabled (RCE) Console ................................................................................52
Setting Up a Remote Console ..........................................................................................................................54
Connecting to a Remote Console ..............................................................................................................................55
Ports and Protocols Explained ........................................................................................................................56
Appendix A: Network Examples......................................................................................................................57
Example 1 - Single Subnet ...........................................................................................................................................58
Example 2 - Multiple Subnets One Console .............................................................................................................59
Example 3 - Multiple Subnets Remote Control Enabled Console .........................................................................60
Example 4 - Multiple Subnets Central Server Service .............................................................................................61
Example 5 - Multiple Subnets Multiple Server Services..........................................................................................62
Appendix B: Troubleshooting a Remote Console Connection.......................................................................63
No Clients In the Console ...........................................................................................................................................63
Port is in Use Error When Starting the Console ......................................................................................................64

3<B3@>@7A3
 
DeepFreezeOverview
AboutDeepFreeze
With over ve million installations, Deep Freeze has a proven track record of non-restrictive, complete
Windows protection. Deep Freeze provides network administrators with a simple and 100% successful
method of maintaining desktop systems and reduces soware technical support to an absolute
minimum. Completely invulnerable to hacking, Deep Freeze instantly protects and preserves original
computer congurations. No matter what changes a user makes to a workstation, simply restart to
eradicate all changes and reset the computer to its original state. Computing environments are easier
to manage and maintain, and expensive computer assets are kept running at 100% capacity. e result
is a truly protected and parallel network, completely free of harmful viruses and unwanted programs.
SystemRequirements
e Deep Freeze Conguration Administrator and the Enterprise Console require Windows 2000/XP/Vista
to function properly. Deep Freeze requires Windows 95/98/Me/2000/XP/Vista and 10% free hard drive
space. e hardware requirements are the same as the recommended requirements for the host operating
system.
DeepFreezeEnterpriseComponents
Deep Freeze uses dierent colored icons to represent the functions of its components.
Files identied by a red icon should generally only be installed on an administrator computer, while
yellow icons should generally only be installed on workstations:
Deep Freeze Enterprise Conguration Administrator installation le
e Conguration Administrator application is used to create customized, pre-
congured workstation installation program les, Workstation Seeds, the Enterprise
Console, and generate One Time Passwords
e Enterprise Console application is used to centrally deploy, monitor, manage, and
maintain Deep Freeze installations
Optional: e Server Manager is used to install, uninstall, manage and maintain the
Deep Freeze Enterprise Server Service that allows Remote Console operation
A customized Deep Freeze workstation installation le is created in the Conguration
Administrator and deployed to workstations within the enterprise
Optional: A Workstation Seed is used to Target Install Deep Freeze from the Enterprise
Console; this Seed can be freely imaged with no license restrictions to enable rapid
deployment

3<B3@>@7A3

DeepFreezeCongurationAdministrator
e Conguration Administrator is intended to be installed only on the computer used to administrate
Deep Freeze. e Conguration Administrator is used to create a customized Deep Freeze installation
le pre-congured with passwords, schedules, Workstation Seeds, the Enterprise Console, and the
Server Service Manager. It is also able to generate One Time Passwords.
InstallingtheCongurationAdministrator
Complete the following steps to install the Conguration Administrator:
1. Insert the CD-ROM from the media package into the CD-ROM drive.
2. Select Install Deep Freeze Enterprise Administrator in the window that appears on the
desktop.
If Deep Freeze has been downloaded via the Internet, double-click the le DF6Ent.exe to
begin the installation process.
e following screen appears:
3. Follow the steps presented. Read and accept the license agreement.
4. Click Install and the Conguration Administrator is installed on the computer.
InitializingtheCustomizationCode
Open the Conguration Administrator by selecting the following path from the Start menu:
Start > All Programs > Faronics > Deep Freeze 6 Enterprise > Deep Freeze Administrator
e Deep Freeze Enterprise Customization window appears the rst time the Conguration
Administrator is opened.

3<B3@>@7A3
 
Deep Freeze requires the administrator to enter a Customization Code to initialize the Conguration
Administrator. e code must be at least eight characters long and may consist of any combination of
alpha-numeric characters.
is code is not a password that can be used to access Deep Freeze. It is a unique identier that encrypts
the Conguration Administrator, the Enterprise Console, the workstation installation les, the One
Time Password Generation System, and Deep Freeze Command Line Control.
e Customization Code ensures that no other administrators can access or control a workstation.
Multiple Deep Freeze administrators controlling the same group of workstations should use a matching
Customization Code.
Aer entering a customization code, the following dialog appears:
e Customization Code must be recorded and guarded with care. Faronics is unable to
recover a lost or forgotten Customization Code!
Re-InitializingtheCustomizationCode
If another administrator wants to create installation les with the same Conguration Administrator
using a dierent Customization Code, the DFInit6.exe program should be run. is resets the existing
Customization Code for the Conguration Administrator. Enter a new Customization Code. Click OK
for the new Customization Code to become active.

3<B3@>@7A3
10
UsingtheCongurationAdministrator
e Conguration Administrator is used to create a customized Deep Freeze installation program pre-
congured with passwords, schedules, and other options.
ere are four main tabs for accessing the various options available: Welcome, Conguration, One Time
Passwords, and Create Programs.
WelcomeTab
e Welcome tab provides contact information for Faronics, including a link to the company and
Technical Support Web sites.
Toolbar
e Toolbar is available at the top of every tab in the Conguration Administrator.
e following ve buttons provide convenient access to some of the most commonly used functions:
Create a New
Conguration File
Open a
Conguration File
Save a
Conguration File
Save a Conguration
File with a new name
Access Help
Menu

3<B3@>@7A3
 11
FileMenu
e File Menu contains the same options as those available on the Toolbar, with the additions of
Password Protection, Create Server Console, Create Server Manager, Create Workstation Seed, and Create
Workstation Install Program.
PasswordProtection
Password Protection oers an optional layer of security for the administrator.
To password protect access to the Conguration Administrator, complete the following steps:
1. Check the Protect with password box.
2. Enter and conrm the password
3. Click OK to set the password or Cancel to exit the dialog without setting a password.

3<B3@>@7A3
12
CongurationTab
e Conguration tab has six sub-tabs used to congure various options. Aer all the desired
conguration options have been selected, a customized workstation installation program le is
ready to be created. is program le is used to install a pre-congured version of Deep Freeze on
workstations.
Passwords
Deep Freeze Enterprise allows the administrator to choose up to 15 passwords, in addition to the One
Time Password Generation System.
To create a password, complete the following steps:
1. Check Enable on the appropriate line.
2. From the Type drop-down list, choose the preferred kind of password. e following options
are available:
Workstation: designated for use at a workstation
Command Line: for use with Command Line Controls; the Command Line Control tool
(DFC.exe) does not function unless at least one Command Line password is dened
LANDesk: designated for use through the LANDesk Management Suite Console.
3. Optional: For Workstation passwords, check the User Change checkbox to allow a user to
change the password at the workstation.
4. Enter the password.
5. To set a password to become active and expire on specied dates, check the Timeout checkbox
and use the drop-down calendars to specify an Activation date and Expiration date.
NOTE: Deep Freeze can use both One Time Passwords (OTPs) and xed passwords. e OTP feature
is always available and cannot be disabled. e xed workstation passwords, dened in the Passwords
tab, are optional.

3<B3@>@7A3
 1
Drives
e Drives tab is used to select which drives are to be Frozen (protected by Deep Freeze) or awed
(unprotected), and to create a awSpace—a virtual partition on a Frozen drive where data can be
saved permanently.
Frozen Drives
By default, all drives are Frozen. To put a drive in a awed state, clear the checkbox of the preferred
drive.
In the example above, the C: drive is checked, but not the D: drive. is results in all workstations with
only a C: drive being Frozen. Workstations with a D: partition or drive have a Frozen C: drive and a
awed D: partition or drive.
While only local drives (partitions or physical drives) can be Frozen, all drive letters are shown because
the pre-congured installation le may be installed on many workstations with various hardware and
soware setups.
Thaw External Hard Drives
External hard disks connected via USB or IEEE 1394 (FireWire) are exempt from Deep Freeze
protection by default on Windows 2000/XP/Vista workstations (i.e. they are not Frozen).
To put the external drives in a awed state, check the USB and/or IEEE 1394 (FireWire) checkboxes.
Network drives and removable media drives (oppy, memory keys, CD-RW, etc.) are
not aected by Deep Freeze and therefore cannot be Frozen.
ThawSpace
awSpace is a virtual partition on a workstation that can be used to store programs, save les, or make
permanent changes. All les stored in the awSpace are saved aer a restart, even if the workstation
is Frozen.
To create a awSpace in the installation program, complete the following steps.

3<B3@>@7A3
14
1. In the awSpace pane, check Create.
2. e awSpace Drive option is used to select the drive letter assigned to the awSpace.
e default letter is T:, but it can be changed to any available letter. e next available letter is
used if the selected drive letter already exists on a workstation when Deep Freeze is installed.
3. e Size option reects the size of the awSpace; the default size is 1 GB and the minimum
size is 16MB.
Workstations running Windows 95/98/Me can host a maximum awSpace of 2GB.
Workstations running Windows 2000/XP/Vista can host a maximum awSpace of 1 TB
when using the NTFS le system or 4GB when using the FAT32 le system. If the workstation
does not have enough free space to accommodate the selected awSpace size, the size of the
awSpace is adjusted downward to ensure proper operation of the workstation.
4. Workstations running Windows 95/98/Me must use the FAT16 le system for a awSpace.
Workstations running Windows 2000/XP/Vista use the NTFS le system by default, but this
can be changed to FAT32 by selecting the radio button.
5. Check Retain existing awSpace to retain an existing awSpace on a Windows 2000/XP/
Vista workstation when Deep Freeze is uninstalled.
If the option to include a awSpace has also been checked, the existing awSpace is retained
during re-installation. A dialog is always displayed asking if the awSpace should be retained
or deleted during an Attended Uninstall, regardless of whether Retain Existing awSpace has
been checked. is option is not displayed if the uninstall is performed through the console.

3<B3@>@7A3
 1
Restart/Shutdown
e Restart/Shutdown tab is used to schedule restarts or shutdowns.
Restart/Shutdown Schedule
To create a Restart/Shutdown schedule, complete the following steps:
1. In the Restart/Shutdown Schedule pane, check the days of the week the schedule will occur on.
Optional: Check Set One Change All so all changes made apply to all schedules.
2. Choose Restart or Shutdown from the Restart/Shutdown drop-down list.
3. Enter the time the restart or shutdown is scheduled to happen in the Time eld.
Idle Restart/Shutdown Schedule
In the Idle Restart/Shutdown Schedule pane, check Enable to congure a shutdown or restart aer a
specied period of inactivity.
Choose Restart or Shutdown from the drop-down list, and indicate the number of minutes of inactivity
that must pass before the workstation automatically restarts or shuts down.
NOTE: Idle time is dened as no mouse or keyboard activity.
Notication
If the specied idle time passes, a dialog box appears on the workstation indicating that the workstation
is about to restart or shutdown.
Enter the number of minutes this dialog will remain on the screen for in the Warn user for: eld
(one minute by default). When the dialog is displayed, the user has the option to cancel the restart or
shutdown by using the keyboard or mouse.
Only one Restart/Shutdown per day can be scheduled; if the workstation needs to be
automatically restarted on a more frequent basis, the Idle Time restart should be used,
and/or the console scheduler (see p.33).

3<B3@>@7A3
1
Maintenance
e Maintenance tab is used to schedule a time when Deep Freeze is awed and when upgrades, new
installations, maintenance, or any other permanent changes can be made.
To create and congure a Maintenance Schedule, complete the following steps:
1. Check the box beside each day of the week when the Scheduled Maintenance will happen.
Optional:Check Set One Change All to apply certain changes made for one day of the week
to all other days.
2. Enter the time to start the Scheduled Maintenance period and to restart the workstation into
the awed state in the Start Time eld.
3. Optional:Check Disable Keys to prevent the keyboard and mouse from functioning on the
workstation during the maintenance period. If this option has been checked, the workstation
displays the following dialog during the maintenance period:

3<B3@>@7A3
 1
4. From the Run drop-down list, choose an action to occur during the maintenance period.
Choose Batch le to allow workstations to run a Batch le automatically during the
maintenance period. A custom Batch le can be entered on the Advanced Maintenance tab.
Choose the Windows Updates to allow workstations to automatically install critical updates
for Windows 2000/XP/Vista during the maintenance period via the Internet or an SUS
server. e choice to use an SUS server and specify the server’s IP address congured on the
Advanced Maintenance tab.
5. Enter the time to complete the Scheduled Maintenance period and to restart the workstation
into the Frozen state in the Stop Time eld.
If the Stop Time precedes the Start Time, the Stop Time is assumed to be during the next
day.
6. Optional:check the Shutdown box to shut the workstation down at the conclusion of the
maintenance period instead of restarting it. If Shutdown is checked, the workstation is Frozen
the next time it is started.
e Run Windows Updates feature does not actually perform updates, but makes the
call to have the normal update method take place during the maintenance period.
If the computer is o at the start of the maintenance period, the maintenance will not
occur.
e computer will not automatically turn on for the maintenance period unless a
Wake-on-LAN call is scheduled in the console.

3<B3@>@7A3
1
AdvancedMaintenance
e Advanced Maintenance tab is used to specify SUS or WSUS server and batch le options for a
Scheduled Maintenance period.
Windows Update
To use an SUS (Microso Soware Update Services) or a WSUS (Windows Soware Update Services)
server for Windows critical updates, check Use SUS/WSUS Server and specify the server’s IP address or
server name. If Use SUS/WSUS Server is unchecked, Windows critical updates are downloaded via the
Internet for each workstation individually.
Microso SUS client can be downloaded at:
http://www.microso.com/windows2000/downloads/recommended/susclient/default.asp
Microso SUS server can be downloaded by searching for SUS server at: http://www.microso.com
Run batch le with
By default, customized batch les execute using the local System account.
If the updates to be deployed are located on le servers that require authentication, check Specied User
Account and enter the account Login ID, Password, and Domain to access the le servers. is applies
to Windows 2000/XP/Vista only.
Batch File
Enter a custom Batch le to run during the maintenance period on days specied on the Maintenance
tab. e same Batch le applies to all days that Run Bat File has been checked. e following options
are available when running custom Batch les:
• To clear the current batch le, click New
• To load an existing le, click Open and browse to the location of the le
• To save the contents of the eld, click Save and browse to the preferred save location
e batch le can be any command or series of commands that the command processor can run. Users
can run custom scripts that require the use of a third-party scripting engine by calling the script from
the batch le as if it was being run from the command line.

3<B3@>@7A3
 1
Miscellaneous
e Miscellaneous tab is used to congure the network communications protocol that the Enterprise
Console uses, as well as various security options.
Network
Communication between the Deep Freeze Enterprise Console and workstations with Deep Freeze
installed can use two dierent modes: LAN Mode or LAN/WAN Mode.
LAN: Check the LAN radio button to congure Deep Freeze to communicate within a Local Area
Network (LAN).
LAN mode is a self-conguring mode that requires only a port number; the default port is 7725. e
port number can be changed if it is in conict with other programs on the LAN. In LAN mode, the
Deep Freeze workstations and the Enterprise Console nd each other through UDP broadcasts. ese
broadcasts only occur when workstations or the Enterprise Console are started, ensuring that there is
little network trac associated with workstation and Console communication.
LAN/WAN: Check the LAN/WAN radio button to congure Deep Freeze to communicate in both a
LAN and a WAN (wide area network).
LAN/WAN can be used in either a LAN or WAN environment and over the Internet. is mode uses
an IP address or the computer name, along with a port number, to allow communication between the
console and the managed workstations.
e following two methods are available to identify the Console:
• specify the Console IP, which must be static
• specify the Console Name, in which case the IP can be dynamic
When the Enterprise Console is behind a rewall or a NAT (network address translation) router,
the rewall or router must be congured to allow trac to pass through to the Enterprise Console.
Depending on the rewall or router, workstations may need to be congured with the IP address of the
rewall so that trac can be forwarded.
ese settings can be changed on local workstations using the Network tab.

3<B3@>@7A3
20
For more information on conguring and using Deep Freeze in a specic network environment, refer
to Appendix A—Network Examples or contact Technical Support.
If a port number other than the default of 7725 is used, care should be taken to ensure
that there are no conicts with applications already running on the network. Well-
known ports (0–1023) should be avoided and any Registered Ports (1024–49151)
should be checked for conicts before deployment.
A complete listing of the ports assigned to various applications can be found on the
Internet Assigned Numbers Authority web site at http://www.iana.org/assignments/
port-numbers.
Advanced Options
•Win 9x
Prevent break outs from “Autoexec.bat”: Check this option if the Windows 9x workstations
are using the autoexec.bat le to execute programs before Windows starts; this prevents users
from aborting the execution of the autoexec.bat le and gaining access to the system in an
unprotected state
Use Hard reboot when awed: Check this option to force workstations to perform an immediate
restart when leaving the awed state; this option should be selected if the workstations
experience problems shutting down when leaving the Scheduled Maintenance period
•Local Policies
Enable Deep Freeze local policies: For enhanced security, Deep Freeze removes the following
local privileges: debugging programs, modifying rmware, and changing the system time;
uncheck this option to use existing privileges
Allow user to change the clock: Check this option to allow Frozen users to adjust the system
clock.
•Disable Command Line options: is option is checked by default. Unchecking this option
allows for further customization of the Deep Freeze installation program when using the Silent
Install System; checking this option prevents the pre-existing conguration choices from being
changed during installation
•Stealth Mode
Show Frozen icon in system tray: Check this option to display the icon to indicate that
Deep Freeze is installed and the workstation is Frozen
Show awed icon in system tray:Check this option to display the icon to indicate that
Deep Freeze is installed but the workstation is awed
If the options to show a Deep Freeze icon in the System Tray are unchecked, the keyboard
shortcut CTRL+ALT+SHIFT+F6 must be used to access the logon dialog
•Control Windows Updates: is option is checked by default. is option allows Deep Freeze
to override any Group Policy settings pertaining to Windows Updates.