FARONICS DEEP FREEZE ENTERPRISE - INTEGRATING WITH BIGFIX PATCH MANAGER... User manual

B316<71/:E67B3>/>3@
:Oab[]RWTWSR(8c\S# '
eeeTO`]\WQaQ][
''' '4O`]\WQa1]`^]`ObW]\/ZZ`WUVba`SaS`dSR4O`]\WQa2SS^4`SShS
4O`]\WQa1]`S1]\a]ZS4O`]\WQa/\bW3fSQcbOPZS4O`]\WQa2SdWQS4WZbS`4O`]\WQa
>]eS`AOdS4O`]\WQa7\aWUVb4O`]\WQaAgabS[>`]TWZS`O\RE7<ASZSQbO`S
b`ORS[O`YaO\R]``SUWabS`SRb`ORS[O`Ya]T4O`]\WQa1]`^]`ObW]\/ZZ]bVS`
Q][^O\gO\R^`]RcQb\O[SaO`Sb`ORS[O`Ya]TbVSW``Sa^SQbWdS]e\S`a
4O`]\WQa
B]ZZ4`SSBSZ(&'"!$"
B]ZZ4`SS4Of(&'"!$"&&
7\bS`\ObW]\OZBSZ($"$!%!!!!
7\bS`\ObW]\OZ4Of($"$!%&&&
2SS^4`SShS3\bS`^`WaS0WU4Wf>ObQV;O\OUS`

3<B3@>@7A3
2
Introduction
Deep Freeze Enterprise integrates seamlessly with most third-party soware management solutions
including BigFix, ZenWorks,Altiris, and others. is white paper addresses how to deploy and manage
Deep Freeze Enterprise through BigFix Patch Manager.
is document assumes that Deep Freeze Enterprise is deployed over a large network with multiple
remote sites that have an Enterprise Console for local administration. It also assumes the Central
Office is able to reboot workstations into a awed state, make updates, and set the workstations back
into a Frozen state from the BigFix Console.
DeployingDeepFreezeEnterprisewithBigFix
Install the Deep Freeze Configuration Administrator on the same computer as the BigFix Console and
create a set of installation files (Enterprise Console, Workstation installation file, and, if necessary, the
Workstation Seed) configured accordingly to your needs. ose installation files should already have
configured passwords, Maintenance Periods, and any other settings the central administration wants
modified.
Since we are not using the Deep Freeze Enterprise Console to manage the workstations, at least one
password with Command Line privileges (CMD) must be set, because CMD passwords are used to set
the workstations into a awed state before making updates. Another workstation (WKS) password
should be created to allow local administration to make changes in the workstations.Once Deep Freeze
has been deployed, the workstation password(s) must be changed by the local administration so every
site has a unique password.

3<B3@>@7A3
3
Once the installation files are created, BigFix can be used to deploy them to every remote site.
To deploy Deep Freeze using BigFix, complete the following steps:
1. In the BigFix Enterprise Console, go to Wizards > Windows Soware Distribution, as shown.

3<B3@>@7A3
4
2. e Windows Soware Distribution Wizard appears, as shown below. Specify a name for the
task.
Click Next.
3. In the dialog shown below, specify the location of the workstation installation file.
Click Next.

3<B3@>@7A3
5
4. Select all platforms that you want to install Deep Freeze on.Since Deep Freeze is not supported
by Windows NT and Windows Server 2003, clear the check boxes. Click Next. If the Deep
Freeze Server version is to be deployed, select Windows Server 2003.
5. Select how to target relevant computers. For this example, None-Target by OS only has been
selected.

3<B3@>@7A3
6
6. Enter the full command line used to perform the Silent Install: DFWks.exe /Install.
Click Next.
7. On the next screen, the text fields for this task can be customized. If needed, edit the text
fields and click Next.
8. Click Finish. A password screen is displayed. Enter the password and click OK.

3<B3@>@7A3
7
9. e next screen is used to create a customized Task message. Click OK to continue. e
BigFix Enterprise Console main screen appears, showing the new task.
10. Double-click the Deploy Deep Freeze task. e details are shown on the bottom half of the
screen. Click on the indicated link to start deployment.
11. e Take Action window appears. Select the workstations to install Deep Freeze on.
Although Deep Freeze will not be deployed on any Windows NT or Windows Server 2003,
BigFix can install it on any Windows 2000 Server present on the network.
12. Ensure that any Windows 2000 Servers and remote site administrative workstations are
deselected from the list. Click OK.

3<B3@>@7A3
8
Deep Freeze Enterprise is then deployed to the specified workstations. ese workstations will later
reboot into a Frozen state.
e workstations must then be configured to prevent BigFix from generating a different entry into its
database every time a Frozen workstation starts up. To do this, complete the following steps:
1. Set BigFix service to start manually in the workstations.
2. From the workstation where the Deep Freeze Enterprise Configuration Administrator is
located, copy the Command Line Control tool (DFC.exe) to all the workstations.
is program is located in C:\WINDOWS\system32.
3. A few lines must be added to the login script to guarantee that the BigFix service doesn’t start
up unless the workstation is in a awed state.
e following is a batch file to ensure that the BigFix service doesn’t start up unless the workstation is
in a awed state:
@ ECHO OFF
IF EXIST C:\PERSI0.SYS GOTO INSTALLED
GOTO END
:INSTALLED
DFC.EXE get /ISFROZEN
IF ERRORLEVEL 1 GOTO ERROR1
IF ERRORLEVEL 0 Goto ERROR0
:ERROR1
ECHO ERRORLEVEL 1
NET STOP BESCLIENT
GOTO END
:ERROR0
ECHO ERRORLEVEL 0
NET START BESCLIENT
GOTO END
:END
DeployingtheDeepFreezeEnterpriseConsole
Since the Enterprise Console is a stand-alone executable file, it can be deployed by copying it into
every single remote site administrative workstation. e first time the local administrator runs the
Console, a One Time Password (OTP) must be entered in order for the console to be activated. is
OTP must be created using the Configuration Administrator, located in the same workstation as the
BigFix Enterprise Console.
Once the Deep Freeze Enterprise Console is deployed to all administrative workstations throughout all
remote sites, every local administrator should replace the default Deep Freeze workstation password
with one of their own.

3<B3@>@7A3
9
MakingPermanentCongurationChangeswithBigFix
In order to make any permanent configuration changes in the workstations, such as updating critical
patches and/or virus definitions, Deep Freeze must be disabled by rebooting the workstations into a
awed state. e updates can then be deployed through BigFix or an Enterprise antivirus solution.
One method to accomplish this is by making updates and critical patches strictly during the Maintenance
Period.
Another way is using BigFix to run a batch file to set the workstations into a awed state and, aer the
updates have been installed, another batch file to return them to a Frozen state.
e command used to reboot the workstations into a awed state is: DFC password /BOOTTHAWED.
e command used to reboot the workstations into a Frozen state is: DFC password /BOOTFROZEN.
e Command Line Control tool (DFC.exe) must be in all workstations for the batch file to work.
If the Command Line Control was not copied to the workstations, then the steps to set workstations
into a awed state are very similar to those in the deployment process.
CreatingTasksinBigFix
To create a task with BigFix, complete the following steps:
1. Open the BigFix Enterprise Suite and start the Windows Soware Distribution Wizard. Name
the task Reboot awed.
2. Follow the steps until the Choose the source of the package to be deployed to the BES Client
computers window appears, as shown below.
3. Click Browse and locate the DFC.exe file. It is located on the same workstation where the
Configuration Administrator was installed.
4. Continue to follow the prompts until the field Enter the full command line to use to execute the
installer. Type in DFC password /BOOTTHAWED.

3<B3@>@7A3
10
To create the task that sets the workstations into a Frozen state, the above steps must be completed
again, using the command to restore Deep Freeze’s protection, which is DFC password /BOOTFROZEN.
Name that task Reboot Frozen. It is important to remember that the password used here is the one set
up with Command Line rights.
e reason for using the BigFix Soware Distribution Wizard, instead of running a regular batch file
to set the workstations into a awed or Frozen state, is that the DFC.exe file is not present anywhere
except the central office’s administrative workstation. erefore, the file has to be pushed and executed.
Since BigFix is not actually installing it, no trace of the program is le behind.
DeployingCriticalUpdatesandVirusDenitions
All workstations are set up with the same Maintenance Period so updates can be performed during
that time frame. To push down patches at a different time, complete the following steps:
1. Open the BigFix Enterprise Console.
2. Reboot the desired workstations into a awed state by performing the Reboot awed task.
3. Wait approximately 10 to 15 minutes to give all the workstations enough time to restart.
4. Perform the updates as usual.
5. Reboot the workstations into a Frozen state by performing the Reboot Frozen task.
e workstations are then updated and protected by Deep Freeze.