Lenovo ThinkPad G40 Series Quick reference guide

Access Connections
Deployment Guide
Date: April 15, 2008

Access Connections
Deployment Guide
Date: April 15, 2008

Third Edition (April 2008)
©Copyright Lenovo 2008.
Portions ©Copyright International Business Machines Corporation 2005.
All rights reserved.
LENOVO products, data, computer software, and services have been developed exclusively at private expense and
are sold to governmental entities as commercial items as defined by 48 C.F.R. 2.101 with limited and restricted
rights to use, reproduction and disclosure.
LIMITED AND RESTRICTED RIGHTS NOTICE: If products, data, computer software, or services are delivered
pursuant aGeneral Services Administration ″GSA″contract, use, reproduction, or disclosure is subject to restrictions
set forth in Contract No. GS-35F-05925.

Preface
This guide is intended for IT administrators, or those who are responsible for
deploying the Access Connections™program on computers in their organizations.
The purpose of this guide is to provide the information required for installing
Access Connections on one or many computers, provided that licenses for the
software are available for each target computer. The Access Connections
application provides application help, which administrators and users can consult
for information about using the application itself.
ThinkVantage®Technologies is developed for IT professionals and the unique
challenges they may encounter. This deployment guide will provide instructions
and solutions for working with Access Connections. If you have suggestions or
comments, communicate with your Lenovo™authorized representative. To learn
more about the technologies that can help you lower the total cost of ownership
and to check for periodic updates to this guide, visit the following Web site:
www.lenovo.com
©Lenovo 2008. Portions ©IBM Corp. 2005. iii

iv Access Connections Deployment Guide

Contents
Preface ............... iii
Chapter 1. Overview .........1
Features ................1
Considerations for deploying Access Connections ..2
Requirements and specifications for deployment .2
Access Connections deployment features .....3
Chapter 2. Installing Access
Connections .............5
Installing Access Connections without user
interaction ...............5
Uninstalling Access Connections ........5
Chapter 3. Working with the
Administrator Feature.........7
Enabling the Administrator feature .......7
Using the Administrator feature ........8
Creating adistribution package ........8
Defining policies for Access Connections ...10
Chapter 4. Deploying Access
Connections ............21
Deploy on new computers .........21
Deploy on existing client computers ......21
Deleting locked profiles .........22
Updating deployed Profiles ........22
Upgrade Access Connections on existing computers 22
Chapter 5. Working with Active
Directory and ADM files .......23
Adding Administrative Templates .......23
Installing the client configuration plugin for Access
Connections ..............23
Group Policy settings ...........24
Deploying .LOA and .SIG files through Active
Directory with logon scripts .........26
Adding logon scripts into Group policy ....26
Appendix A. Command line interface 29
Appendix B. Integrated Packaging ...31
The integrated Access Connections package ...31
Directory structure ............32
Appendix C. Notices .........33
Trademarks ..............34
©Lenovo 2008. Portions ©IBM Corp. 2005. v

vi Access Connections Deployment Guide

Chapter 1. Overview
Access Connections is aconnectivity assistant program which helps to configure
various network connections including wireless LANs. Users can create and
manage location profiles that stores the network and Internet configuration settings
needed to connect aclient computer to anetwork from aspecific location, such as
home or at work. The network connection can be made using amodem, awired
network adapter, abroadband device (DSL, cable modem, or ISDN), or awireless
network adapter. Virtual private network (VPN) connections are also supported. By
switching between location profiles as you move your computer from place to
place, Access Connections can quickly and easily help users connect to anetwork
without having to reconfigure network settings manually. Alocation profile
supports advanced security settings, default printer, and automatic application
launch.
Access Connections has the ability to support automatic location switching
between Ethernet and wireless LAN connections.
Features
Access Connections has features that enable you to find wireless and network
connections quickly and effortlessly. These features increase the portability of your
wireless activity. Access Connections includes the following functions:
vCreate new location profiles
Access Connections provides awizard that helps you create location profiles that
define the settings required to connect to various types of networks. The
Connection Status window is opened by default when Access Connections is
started.
vView location profile and connection status
The Connection Status window allows you to view the status of the network
connection associated with each location profile defined in Access Connections
allowing you to switch between location profiles. When you open the window,
status is shown for the network connection and for the components used by the
currently applied location profile.
vSwitch between location profiles
Access Connections allows you to change location profiles. You can simply
choose another location profile from the list and connect to it. Aprogress
indicator window shows the state of the connection. If the connection fails, a
button appears to help you fix the connection.
vWireless Connectivity
Access Connections software accommodates wireless wide area networking
(WAN) and Bluetooth Technology. With the introduction of 3G cellular
technologies, wireless WAN services are emerging as effective alternatives for
high-speed wireless access to networks. Access Connections provides portability
when users are away from the office and not near apublic WLAN hot spot.
vFind wireless networks.
Access Connections can search for wireless networks that are in range of your
wireless adapter. This feature is useful when you are traveling or in apublic
place, and you are not sure about what, if any, wireless networks are available to
you. You can attempt to connect to any wireless networks that are found. If the
©Lenovo 2008. Portions ©IBM Corp. 2005. 1

connection attempt is successful, anew wireless location profile will be created
using the detected wireless network name and default settings. You can also
manually create alocation profile for adetected wireless network if you know
the appropriate settings.
vAutomatic switching of location profiles
If anetwork associated with your currently applied location profile becomes
unavailable, Access Connection can search for available networks and
automatically switch to amatching location profile. You can automatically switch
between wireless location profiles, and Ethernet location profiles. You can
establish awireless priority list that allows you to define which wireless location
profile will be made active when your computer is in range of multiple wireless
networks, or when more than one location profile uses the same wireless
network name.
vCreate location profiles for remote deployment administrator only
An Access Connections administrator can define location profiles for export to
the client computers.
Access Connections provides an icon in the system tray which allows you to
launch the application, view the status of the current location profile, and switch
between profiles.
Considerations for deploying Access Connections
Collecting information about the various places where users might attempt to
connect and the kinds of connections available in those locations will help you
develop pre-configured profiles that users can import and use right away. By
capturing working configurations in profiles which can be deployed with the
initial image, support calls can be reduced and users can immediately take
advantage of their network connections without intervention.
The Administrator Feature Enabler tool available with version 4.0 or later
simplifies the task of deploying location profiles, global settings, and control
policies to individuals or groups of individuals running Access Connections in a
corporate environment. The deployment of profiles and settings can be
accomplished during the initial system deployment as part of the preload image or
after systems are in the field using standard remote deployment methods.
Requirements and specifications for deployment
To view the current list of supported ThinkPad®systems and wireless WLAN and
WAN drivers, see the following Web site:
http://www.lenovo.com/pc/support/site.wss/document.do?sitestyle=
lenovo&lndocid=MIGR-4ZLNJB
2Access Connections Deployment Guide

Access Connections deployment features
The Access Connections Administrator Profile Deployment feature is required to
deploy location profiles that you create for client users. The Administrator Profile
Deployment feature is available to IT professionals only at:
http://www.lenovo.com/pc/support/site.wss/document.do?sitestyle=
lenovo&lndocid=ACON-DEPLOY
For more information about the Administrator Profile Deployment feature, see:
Chapter 3, “Working with the Administrator Feature,” on page 7.
The following list of features help IT administrators deploy and manage Access
Connections:
vAdministrators can create location profiles and distribute them as part of a
preload image or install them after the client systems have been deployed.
vControl policies can be set for each profile.
vDistribution control lists can be created to limit who can import various
deployment packages.
vAclient configuration policy can be set to configure the operation of Access
Connections on the client computer.
vDeployment packages are encrypted and password protected to be sure that
only authorized individuals can import the location profiles that may contain
wireless security information such as WEP or static password, for example.
Chapter 1. Overview 3

4Access Connections Deployment Guide

Chapter 2. Installing Access Connections
The following instructions provide installation procedures for the standalone
version of Access Connections. For instructions on installation of the integrated
Access Connections package, see Appendix B, “Integrated Packaging,” on page 31.
Installing Access Connections without user interaction
To install Access Connections without user interaction, complete the following
steps:
1. Start Microsoft®Windows®2000, Windows XP, or Windows Vista®and then log
on with administrative privileges.
2. Extract the Access Connections software package to the hard disk drive. For
example: C:\Drivers\W2k\Accon.
3. Click Start,and then click Run.
4. The following command can be used to install Access Connections.
a. To install interactively, type:
<path>\setup.exe
b. To install silently with default path for install log, type:
<path>\setup.exe -S-SMS-f2x
c. To install silently with customized setup script with log path specified, type:
<path>\setup.exe -S-SMS-f1<fullpath>\setup.iss-f2<path>\setup.log.
d. To install silently from aCD, type:
<path>\silent.bat
Note: If you are installing Access Connections onto Windows Vista, install the
Access Connections designed specifically for Windows Vista. Other versions of
Access Connections may not function properly with the Vista operating system.
Uninstalling Access Connections
To uninstall Access Connections, complete the following steps:
1. Start Windows 2000, Windows XP or Windows Vista, and then log on with
administrative privileges.
2. Click Start,then click Run.
3. The following commands will uninstall Access Connections:
a. To uninstall interactively type,
<path>\setup.exe -0x9 anything
b. To uninstall silently with acustomized script,
1) Create auninst.iss file by completing the following steps:
a) Go to the Access Connections install directory and Run setup.exe -r
-remove.
b) Click Uninstall when prompted.
c) Click No to restart the system later. This will prevent automatic
restart.
d) Copy the script file generated at C:\Windows\setup.iss to your local
directory.
©Lenovo 2008. Portions ©IBM Corp. 2005. 5

e) Rename the script file to uninst.iss.
2) Enter the following command:
<path>\setup.exe -S-f1<fullpath>\uninst.iss anything -f2x
6Access Connections Deployment Guide

Chapter 3. Working with the Administrator Feature
This chapter provides you with the information you need to enable and use the
administrator features of Access Connections.
Enabling the Administrator feature
Access Connections must be installed on your system prior to enabling the
Administrator feature. To enable the Administrator feature, complete the following
steps:
1. To deploy Access Connections on to client systems, download and install the
Administrator Profile Deployment feature from the following Lenovo Web site:
http://www.lenovo.com/pc/support/site.wss/document.do?sitestyle=
lenovo&lndocid=ACON-DEPLOY
Note: The Import/Export feature of Access Connections is used for migrating
profiles only. Do not use the Import/Export feature for deploying Access
Connections.
2. Run AdmEnblr.exe that is installed in the following path:
C:\Program Files\ThinkPad\ConnectUtilities
3. Click Enable,and then click Exit.This will create the deployment feature menu
on Access Connection main application panel.
Figure 1. Enabler for Administrator Profile Deployment Feature for Windows 2000 and XP
Figure 2. Enabler for Administrator Profile Deployment Feature for Windows Vista
©Lenovo 2008. Portions ©IBM Corp. 2005. 7

4. Click Enable Administrator Feature.
5. Click Exit to close the Enabler.
6. Start Access Connections.
Using the Administrator feature
After you have enabled the administrator feature, you can manage location profiles
for users by creating or editing distribution packages. Distribution packages have
the file extension of .loa and contains the metadata for location profiles used by
Access Connections. The following steps provide the ideal scenario for using the
administrator feature of Access Connections:
1. Using Access Connections, create location profiles. Consider the following
scenarios as you create the location profiles:
vOffice and building connections
vHome connections
vBranch-office connections
vConnections while traveling and hot-spot connections
For instructions on how to create location profiles, or how to use Access
Connections, see the Access Connections User's Guide located at the following
Lenovo Web site:
http://www.lenovo.com/pc/support/site.wss/document.do?sitestyle=
lenovo&lndocid=MIGR-63042
2. Create or edit adistribution package with the Administrator Profile
Deployment feature.
3. Deploy the distribution package to client systems.
Creating adistribution package
Complete the following steps to create adistribution package:
1. Click Profile Distribution and then click Create Distribution Package.
2. Select the location profiles that you want to deploy. If aprofile that is selected
contains awireless profile with encryption enabled, you will be prompted to
re-enter the wireless settings data to ensure sensitive data is not exposed. When
deploying location profiles that provide awireless network connection, the
donor and recipient must contain wireless adapters which support the
capabilities defined in the location profile. If the location profile being deployed
is configured for LEAP authentication, the adapters on the recipient systems
must support LEAP authentication.
Figure 3. Create Distribution Package
8Access Connections Deployment Guide

The following screen captures provide examples for Windows 2000 or XP, and
Windows Vista:
3. Select the User Access Policy from the drop down menu. The user access
policy defines the restrictions that are in place for aparticular profile. User
access policies can be defined per profile and can have the following values:
vDeny all changes /Deny Deletion:Users cannot perform operations such as
modify, copy, or delete on the profile.
vDeny network setting changes /Deny deletion:The network settings in the
profile cannot be modified, deleted or copied. The non-modifiable parameters
are TCP/IP settings, Advanced TCP/IP settings, and wireless settings. The
profile cannot be deleted.
Figure 4. Create Distribution Package panel for Windows 2000 and XP
Figure 5. Create Distribution Package panel for Windows Vista
Chapter 3. Working with the Administrator Feature 9

vDeny all changes /Allow deletion:Users can not modify or copy the
profile; however, users can delete the profile.
vAllow all changes /Deny deletion:Users can modify the profile; however,
users cannot delete the profile.
vAllow all changes /Allow deletion:Users can modify, copy and delete the
profile.
4. Define the Access Connections policy settings for the following options:
v“Distribution Control List with this package”
v“Client Configuration Policy” on page 11
v“PAC AID Groups with this package (Windows 2000 and XP only)” on page
18
v“Allow silent import of this package after client installation” on page 20
5. Click the Create button located at the bottom of the Create Distribution
Package panel.
6. When prompted, enter apassphrase to encrypt the *.loa file. This same
passphrase will be required to import the deployment package (*.loa) on client
systems. The passphrase is also encrypted in a*.sig file which is needed to
import the deployment package silently.
7. On the Export Location Profiles dialog box, navigate to your applicable
directory path. and type the name for your .loa file. By default, the .loa and .sig
files which are required for deployment are saved in C:\Program
Files\Thinkpad\ConnectionUtilities\Loa directory.
Attention: For image deployment, the *.loa file must reside in the Access
Connections install directory -(C:\PROGRAM FILES\THINKPAD\
CONNECTUTILITIES).
8. Click Save.
Defining policies for Access Connections
The following settings control the Access Connections policies for the user. If you
do not set apolicy, the applicable function will be greyed out for the user.
Distribution Control List with this package
This setting is used to define the Distribution Control List based on computer
serial numbers.
Figure 6. Define Distribution Control list
10 Access Connections Deployment Guide

This method of distribution enables you to type individual serial numbers or to
create different groups of serial numbers that represent different organizations of
users who need different location profiles. This optional step is designed primarily
for securing the distribution of the profile location file (*.loa), when it is being sent
to remote users for manual importing. Distribution control lists ensure that
individuals install appropriate network connection profiles only. The Distribution
Control List helps reduce unauthorized network access.
Creating Groups: When creating groups of serial numbers, flat text files can be
imported which contain the group of serial numbers.
The file must be formatted such that each line contains asingle serial number.
These text files can be created by exporting alist that has been created with the
Administrator Feature or by an asset management system if it has such
capabilities. This simplifies the process of controlling distribution to alarge
number of computers based on their serial number.
Client Configuration Policy
This setting defines the Client Configuration Policy, which controls the capabilities
that will be available to the user after the *.loa file is imported. Marking the box
beside Do not allow clients to become an administrator: will prevent users from
enabling the Administrator Feature on their installation of Access Connections.
This setting is useful in large enterprise environments when you want to prevent
others from creating and distributing network access profiles. You can also control
ausers ability to complete the following tasks:
vCreate, import and export location profiles.
vChange global settings, see “Global settings” on page 12.
vCreate and apply WLAN location profiles using the Find Wireless Network
function for Windows users without administrator privileges.
vAutomatic location profile switching.
vChecking for updates.
Figure 7. Create Group
Chapter 3. Working with the Administrator Feature 11

The following screen capture displays the settings you can configure for the Client
tab of the Client Configuration Policy:
Marking the box beside Do not allow clients to become an administrator: will
prevent users from enabling the Administrator Feature on their installation of
Access Connections. This setting is useful in large enterprise environments when
you want to prevent others from creating and distributing network access profiles.
You can also control ausers ability to complete the following tasks:
vCreate, import and export location profiles.
vChange global settings, see “Global settings.”
vCreate and apply WLAN location profiles using the Find Wireless Network
function for Windows users without administrator privileges.
vAutomatic location profile switching.
vChecking for updates.
Global settings: On the Network panel of Global Settings, you can set the
following policies:
vAllow Windows users without administrator privileges to create and apply
location profiles
vAllow wireless connection at Windows logon
vClose all wireless network connections when auser logs off
vDisable Adhoc connection type option in wireless LAN profiles
vEnable automatic wireless LAN radio control
vAllow selection of location profiles with Fn+F5 On Screen Display menu
vDisable Ethernet adapter when Ethernet cable is unplugged
Note: If this setting is enabled, the Ethernet port will be disabled when the
Ethernet cable is unplugged from the system. The Ethernet port will remain
Figure 8. Client Configuration Policy
12 Access Connections Deployment Guide