Symantec ALTIRIS CLIENT MANAGEMENT SUITE 7.0 SP2 -... User manual

Altiris™Real-Time System
Manager from Symantec User
Guide
Version 7.0 SP2 MR1

Altiris™Real-Time System Manager from Symantec
User Guide
The software described in this book is furnished under a license agreement and may be used
only in accordance with the terms of the agreement.
Documentation version 7.0 SP2 MR1
Legal Notice
Copyright © 2010 Symantec Corporation. All rights reserved.
Symantec, the Symantec Logo, Altiris, and any Altiris or Symantec trademarks used in the
product are trademarks or registered trademarks of Symantec Corporation or its affiliates
in the U.S. and other countries. Other names may be trademarks of their respective owners.
The product described in this document is distributed under licenses restricting its use,
copying, distribution, and decompilation/reverse engineering. No part of this document
may be reproduced in any form by any means without prior written authorization of
Symantec Corporation and its licensors, if any.
THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT,
ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO
BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL
OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING,
PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED
IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be commercial computer software
as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19
"Commercial Computer Software - Restricted Rights" and DFARS 227.7202, "Rights in
Commercial Computer Software or Commercial Computer Software Documentation", as
applicable, and any successor regulations. Any use, modification, reproduction release,
performance, display or disclosure of the Licensed Software and Documentation by the U.S.
Government shall be solely in accordance with the terms of this Agreement.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043
http://www.symantec.com

Technical Support
Symantec Technical Support maintains support centers globally. Technical
Support’s primary role is to respond to specific queries about product features
and functionality. The Technical Support group also creates content for our online
Knowledge Base. The Technical Support group works collaboratively with the
other functional areas within Symantec to answer your questions in a timely
fashion. For example, the Technical Support group works with Product Engineering
and Symantec Security Response to provide alerting services and virus definition
updates.
Symantec’s support offerings include the following:
■A range of support options that give you the flexibility to select the right
amount of service for any size organization
■Telephone and/or Web-based support that provides rapid response and
up-to-the-minute information
■Upgrade assurance that delivers software upgrades
■Global support purchased on a regional business hours or 24 hours a day, 7
days a week basis
■Premium service offerings that include Account Management Services
For information about Symantec’s support offerings, you can visit our Web site
at the following URL:
www.symantec.com/business/support/
All support services will be delivered in accordance with your support agreement
and the then-current enterprise technical support policy.
Contacting Technical Support
Customers with a current support agreement may access Technical Support
information at the following URL:
www.symantec.com/business/support/
Before contacting Technical Support, make sure you have satisfied the system
requirements that are listed in your product documentation. Also, you should be
at the computer on which the problem occurred, in case it is necessary to replicate
the problem.
When you contact Technical Support, please have the following information
available:
■Product release level

■Hardware information
■Available memory, disk space, and NIC information
■Operating system
■Version and patch level
■Network topology
■Router, gateway, and IP address information
■Problem description:
■Error messages and log files
■Troubleshooting that was performed before contacting Symantec
■Recent software configuration changes and network changes
Licensing and registration
If your Symantec product requires registration or a license key, access our technical
support Web page at the following URL:
www.symantec.com/business/support/
Customer service
Customer service information is available at the following URL:
www.symantec.com/business/support/
Customer Service is available to assist with non-technical questions, such as the
following types of issues:
■Questions regarding product licensing or serialization
■Product registration updates, such as address or name changes
■General product information (features, language availability, local dealers)
■Latest information about product updates and upgrades
■Information about upgrade assurance and support contracts
■Information about the Symantec Buying Programs
■Advice about Symantec's technical support options
■Nontechnical presales questions
■Issues that are related to CD-ROMs or manuals

Support agreement resources
If you want to contact Symantec regarding an existing support agreement, please
contact the support agreement administration team for your region as follows:
[email protected]Asia-Pacific and Japan
[email protected]Europe, Middle-East, and Africa
[email protected]North America and Latin America

Technical Support ............................................................................................... 3
Chapter 1 Introducing Real-Time System Manager ........................ 11
About Real-Time System Manager ................................................... 11
What's new in Real-Time System Manager ........................................ 12
How Real-Time System Manager works ............................................ 12
About the Symantec Management Console .................................. 13
About out-of-band management ............................................... 13
About one-to-one and one-to-many management ......................... 13
About Intel AMT .................................................................... 14
About ASF ............................................................................ 14
About DASH .......................................................................... 15
About WMI ........................................................................... 15
About managing target computers without the Altiris Agent
installed ......................................................................... 15
About the Real-Time view ........................................................ 16
What you can do with Real-Time System Manager ............................. 17
Where to get more information ....................................................... 19
Chapter 2 Installing Real-Time System Manager ............................ 21
System requirements .................................................................... 21
About Real-Time System Manager installation
requirements .................................................................. 21
About client computer software requirements ............................. 22
About client computer hardware requirements ............................ 22
Installing or upgrading the Real-Time System Manager product ........... 22
Uninstalling Real-Time System Manager .......................................... 23
Chapter 3 Preparing target computers for management .............. 25
Preparing target computers for management .................................... 25
Discovering computers ........................................................... 26
Installing the Altiris Agent ...................................................... 27
Configuring out-of-band capable computers ................................ 27
Installing and configuring the SNMP component ............................... 28
Contents

Chapter 4 Using Real-Time System Manager ................................... 31
Running real-time one-to-one tasks ................................................. 31
Accessing the Real-Time view ................................................... 32
Turning off, turning on, or restarting a computer ........................ 33
Starting a remote control session ............................................. 34
Booting a computer from another device ................................... 35
Filtering network traffic ......................................................... 37
Configuring alerts ................................................................. 38
Configuring the Intel AMT device settings ................................. 40
Viewing Intel AMT log ............................................................ 40
Running real-time one-to-many tasks .............................................. 41
Booting multiple computers from another device ........................ 41
Filtering network traffic on multiple computers .......................... 42
Resetting a local user password on multiple computers ................. 43
Running or stopping a process on multiple computers .................. 44
Running or stopping a service on multiple computers ................... 45
Chapter 5 About Real-Time System Manager pages ...................... 47
Configuration node: Intel AMT Configuration mode page .................... 48
Configuration node: Intel AMT Settings page .................................... 48
Configuration node: Intel Remote Access Policy page ......................... 49
Controllers and Ports node ............................................................ 49
Event Logs node ........................................................................... 50
Input and Output Devices node ....................................................... 50
Management Operations node: Manage Alerts page ............................ 51
Management Operations node: Manage Local Users and Groups
page .................................................................................... 51
Management Operations node: Manage Power State and Redirection
page .................................................................................... 52
Management Operations node: Manage Printers page ......................... 52
Management Operations node: Manage Processes page ....................... 52
Management Operations node: Manage Services page ......................... 53
Management Operations node: Remote Control page .......................... 53
Mass Storage node ....................................................................... 54
Memory node .............................................................................. 54
Networking node .......................................................................... 55
Operating System node ................................................................. 56
Physical System node ................................................................... 57
Altiris Agent node ........................................................................ 58
Manage Virtual Layers page ........................................................... 58
Summary page ............................................................................ 59
Network Filters page ..................................................................... 59
Contents8

Appendix A Troubleshooting .................................................................. 61
Troubleshooting connection through the Real-Time view .................... 61
Configuring the firewall to allow WMI connection ........................ 64
Disabling simple file sharing on Windows XP SP2 ........................ 67
Configuring User Access Control on Windows Vista and Windows
7 ................................................................................... 67
Appendix B Technical Reference ........................................................... 69
About the ports used by Real-Time System Manager ........................... 69
About authentication .................................................................... 71
About changes in default system security ......................................... 72
About network filtering ports and settings ........................................ 72
Modifying the list of open network filtering ports .............................. 73
About power management and redirection ........................................ 74
Glossary ............................................................................................................... 77
Index .................................................................................................................... 79
9Contents

Contents10

Introducing Real-Time
System Manager
This chapter includes the following topics:
■About Real-Time System Manager
■What's new in Real-Time System Manager
■How Real-Time System Manager works
■What you can do with Real-Time System Manager
■Where to get more information
About Real-Time System Manager
The Altiris Real-Time System Manager software lets you manage a single computer
from the Symantec Management Console in real time. Real-Time System Manager
can connect to the target computer using the following protocols:
■WMI - Microsoft Windows Management Instrumentation
■ASF - Alert Standards Format 2.0
■Intel® AMT - Intel® Active Management Technology
■DASH - Desktop and mobile Architecture for System Hardware
■SNMP - Simple Network Management Protocol
■IPMI - Intelligent Platform Management Interface
With Real-Time System Manager, you can view detailed real-time information
about the managed computer and remotely perform various administrative tasks.
1
Chapter

For example, you can restart the computer, reset a password, run a port scan,
terminate a process, and more.
Real-Time System Manager also lets you run some of the management tasks on
a collection of computers, immediately or on a schedule.
See “About one-to-one and one-to-many management”on page 13.
What's new in Real-Time System Manager
In the 7.0 SP2 release of Real-Time System Manager, the following new features
are introduced:
■Support for Microsoft Windows 7 operating system.
■Limited support for Intel AMT version 6.
You can manage computers with Intel AMT 6 in the same way as you managed
earlier versions of Intel AMT. The new features that were introduced in Intel
AMT 6 are not currently supported.
In the maintenance release (7.0 SP2 MR1) of Real-Time System Manager, the
following new features are introduced:
■Support for the Intel AMT 6.0 KVM feature.
Keyboard, Video and Mouse (KVM) capability enables remote control of an
Intel AMT system using a remote keyboard and mouse and viewing the managed
system’s screen output at a remote monitor. You can start a KVM session from
the Real-Time view, using the Remote Control page.
How Real-Time System Manager works
First, you select a computer that you want to manage from the Symantec
Management Console. Then Real-Time System Manager checks for the remote
management technologies that the target computer supports. The supported
technologies are WMI, ASF, DASH, Intel AMT, SNMP, and IPMI. Real-Time System
Manager then uses these technologies to remotely query the computer for various
pieces of information. Real-Time System Manager displays the actual information
that is received from the computer in the Resource Manager's Real-Time view.
From the Real-Time view, you can perform various tasks on the target computer
to which Real-Time System Manager is connected and immediately see the results.
With Real-Time System Manager, you can manage computers in band, as well as
out of band.
See “About the Symantec Management Console”on page 13.
See “About out-of-band management”on page 13.
Introducing Real-Time System Manager
What's new in Real-Time System Manager
12

About the Symantec Management Console
The Symantec Management Console is the Web browser based administration
console for working with Symantec Management Platform and solutions, including
Real-Time System Manager. The console lets you perform tasks, schedule events,
run reports, perform configuration, configure security, and more. You can run
the console from the Notification Server computer (locally) or from a remote
computer with a network connection to Notification Server. This means that you
can perform administration tasks from wherever you are.
The console lets you set security that is specific to each console user. You specify
which areas of the console a user has access to and the rights that a user has to
perform specific actions. For example, one user can run reports while another
user can only view reports that have already been run.
You can start the console remotely by typing the following URL into the Internet
Explorer's address bar: http://<Notification_Server_name>/altiris/console
For more information on the console, see the Symantec Management Platform
Help, which can be accessed through the console's Help menu.
About out-of-band management
Remote management of client computers often requires the managed computer
to be turned on with an operating system running. When a computer is turned
on with a running operating system, the computer is considered in-band.
Out-of-band is when a client computer is in one of the following out-of-band states:
■The computer is plugged in but is not actively running (off, standby,
hibernating).
■The operating system is not loaded (software or boot failure).
■The software-based management agent is not available.
Out-of-band management is the ability to manage computers in these states.
Computers with Intel AMT, ASF, DASH, or IPMI capabilities can be managed out
of band.
About one-to-one and one-to-many management
One-to-one management is performed in real time during a live connection between
Real-Time System Manager and the target computer that you manage. You can
run management tasks on the target computer and immediately see the results
in the Symantec Management Console, in the Resource Manager's Real-Time
view.
13Introducing Real-Time System Manager
How Real-Time System Manager works

See “About the Real-Time view”on page 16.
One-to-many management is when you create a task, assign it to one or more
computers, and configure it to run at a later time.
About Intel AMT
Intel Active Management Technology (Intel AMT) is a part of Intel vPro technology,
which provides the following technology capabilities:
Lets you remotely inventory, diagnose, and repair computers—even
those that are turned off —reducing costly desk-side visits and
increasing user uptime.
Remote manageability
Lets third-party security software identify more threats before
they reach the operating system. You can isolate infected systems
more quickly and update computers regardless of their power
state.
Security
Intel AMT is a solution that is based in hardware and firmware and is connected
to the system's auxiliary power plane. Despite the power state or the operating
system state of the client computer, Intel AMT provides IT administrators with
access to alerts, hardware inventory, power management, network filtering, and
agent presence functionality. Intel AMT functionality requires the computer to
be plugged into the power source and connected to the network. Intel AMT
functionality does not require a software agent to be installed on the client
computer.
Altiris Out of Band Management Component, Altiris Real-Time Console
Infrastructure, and Altiris Real-Time System Manager software support Intel
AMT 2.0 and later.
About ASF
ASF (Alert Standard Format) is an industry standards-based technology that lets
IT administrators manage computers regardless of the operating system state.
ASF performs completely out of band and only relies on the operating system to
configure the solution.
ASF provides alerting and power management functionality as long as the
computer is plugged in with Ethernet connection. ASF functionality is
accomplished through hardware on the network card or system board, a software
agent on the client computer, and management software on the server.
Altiris Out of Band Management Component, Altiris Real-Time Console
Infrastructure, and Altiris Real-Time System Manager software support ASF 2.0.
Introducing Real-Time System Manager
How Real-Time System Manager works
14

About DASH
DASH (Desktop and Mobile Architecture for System Hardware) is a Web
services-based management technology that enables IT professionals to remotely
manage desktop and mobile computers from anywhere in the world. The
technology lets administrators securely turn the power on/off, query system
inventory, and push firmware updates among other things, regardless of the state
of the remote computer.
Altiris Out of Band Management Component, Altiris Real-Time Console
Infrastructure, and Altiris Real-Time System Manager software support Broadcom
and Intel implementations of DASH.
About WMI
Windows Management Instrumentation (WMI) is the Microsoft implementation
of Web-based Enterprise Management (WBEM), which is an industry initiative to
develop a standard technology for accessing management information in an
enterprise environment. WMI uses the Common Information Model (CIM) industry
standard to represent systems, applications, networks, devices, and other managed
components. CIM is developed and maintained by the Distributed Management
Task Force (DMTF).
WMI lets applications obtain management data from remote computers.
About managing target computers without the Altiris Agent installed
To use the full set of features that Altiris solutions offer, we recommend that you
install the Altiris Agent on the computers in your environment. However,
Real-Time System Manager lets you manage the computers that do not have the
Altiris Agent installed. If you choose not to install the Altiris Agent on the
computers, you cannot:
■Perform one-to-many management tasks on a collection of computers.
Computers that do not have the Altiris Agent installed do not register
themselves with Notification Server and are not visible in the computer filters.
See “Running real-time one-to-many tasks”on page 41.
See “About one-to-one and one-to-many management”on page 13.
With agentless computers you can:
■Perform one-to-one management tasks on a single computer in real time
through the Real-Time view.
Agentless computers do not appear in the computer filters—you must type the
IP or the hostname of the computer that you want to manage into the Symantec
Management Console.
15Introducing Real-Time System Manager
How Real-Time System Manager works

See “Running real-time one-to-one tasks”on page 31.
See “About one-to-one and one-to-many management”on page 13.
About the Real-Time view
Real-Time System Manager adds its own Real-Time System Manager tree to the
Real-Time view of the Resource Manager. The Resource Manager is a page in the
Symantec Management Console that displays information about an individual
computer.
For more information, see topics about Resource Manager in the Symantec
Management Platform Help.
See “Accessing the Real-Time view”on page 32.
From the Real-TimeSystemManager tree, you can view live inventory information
about the target computer and perform management tasks in real time.
The Real-Time System Manager tree has various nodes that let you manage the
target computer.
Table 1-1 Real-Time System Manager nodes in the Real-Time view
DescriptionNode
This node is visible only if Real-Time System Manager detects
that the target computer is configured to use Intel AMT.
From this node you can view and change setup and
configuration settings of the target computer's Intel AMT
device.
Configuration
This node lets you view controller and port information.Controllers and Ports
This node lets you view event logs.Event Logs
This node contains input and output device items.Input and Output Devices
From this node, you can turn on, turn off, or restart the
computer, manage printers, users, processes, and services.
Management Operations
This node contains mass storage items.Mass Storage
This node lets you view memory information.Memory
This node contains networking items.Networking
This node contains operating system information.Operating System
This node contains firmware and hardware information.Physical System
Introducing Real-Time System Manager
How Real-Time System Manager works
16

Table 1-1 Real-Time System Manager nodes in the Real-Time view (continued)
DescriptionNode
This node contains software information.Software
This page displays the target computer's summary.Summary
Depending on the computer you connect to, you can experience the following
behavior of the Real-Time view:
■If an item is disabled, then the corresponding WMI class is not supported on
the connected computer.
■If the WMI class is supported, but there is no instance of it on the computer,
then it is displayed as “No instances found.”
■If Intel AMT, ASF, DASH, or IPMI technologies are detected on the target
computer, additional nodes appear in the tree.
The information that is available in the Real-Time System Manager section
includes only a subset of the WMI data. However, you can customize the data that
can be accessed. Contact Symantec Technical Support if you want to create your
own views on the WMI data.
What you can do with Real-Time System Manager
From the Real-Time view, you can perform a variety of one-to-one tasks, such as
the following tasks:
■View the target computer's software and hardware information.
■Start and stop processes and services.
■View the printer's configuration and manage print jobs.
■Turn off and restart the target computer.
■Turn on the target computer. An out-of-band capable computer, which is
properly configured, is required to use this feature. Use Altiris Out of Band
Management Component to configure computers for out-of-band management.
■View the Altiris Agent configuration information and logs, send basic inventory,
request configuration, and change the Notification Server computer to which
the Altiris Agent is assigned.
■Enable and disable Software Virtualization Layers. This feature requires
installed Symantec Workspace Virtualization Agent.
See “About the Real-Time view”on page 16.
17Introducing Real-Time System Manager
What you can do with Real-Time System Manager

See “Running real-time one-to-one tasks”on page 31.
Using Real-Time System Manager with properly configured out-of-band capable
computers, you can manage the computers that are turned off or that failed to
load an operating system. Managing computers remotely out of band lets you
significantly reduce the number of desk-side visits.
See “About out-of-band management”on page 13.
Table 1-2 Out of band features that Real-Time System Manager supports
DescriptionFeature
(Intel AMT and DASH only)
Lets you change the system boot device to a CD, DVD,
or to an image that is located on a remote network
drive. For example, you can boot from a system
recovery disk.
See “Booting a computer from another device ”
on page 35.
Remote boot through Integrated
Drive Electronics Redirection
(IDE-R)
(Intel AMT only)
Lets you establish a remote console session and walk
the computer through a troubleshooting session, for
example, when you want to reinstall the operating
system, or change BIOS settings.
See “Starting a remote control session ”on page 34.
Remote console redirection through
Serial-over-LAN (SOL)
(Intel AMT only)
Lets you block all inbound network traffic and all
outbound network traffic from a target computer.
For example, you can block network traffic from an
infected computer to prevent threats from spreading.
See “Filtering network traffic ”on page 37.
Hardware filtering of network
traffic (Circuit Breaker) using Intel
vPro System Defense technology
Real-Time System Manager also lets you perform some of the tasks on a collection
of computers. You can run the tasks immediately or on a schedule.
See “Running real-time one-to-many tasks”on page 41.
Introducing Real-Time System Manager
What you can do with Real-Time System Manager
18

Table 1-3 One-to-many tasks that are available in Real-Time System Manager
DescriptionTask
Lets you boot a group of computers from either a PXE,
a floppy/HDD/CD device, or an image that is located on
a hard drive.
See “Booting multiple computers from another device
”on page 41.
Boot Redirection task (Intel
AMT, ASF, DASH)
Lets you block network traffic to and from the client
computer's operating system.
See “Filtering network traffic on multiple computers ”
on page 42.
Network Filtering task (Intel
AMT)
Lets you remotely reset a password for a local user
account on a group of computers.
See “Resetting a local user password on multiple
computers”on page 43.
Password Management task
(WMI)
Lets you remotely start or stop a process on a group of
computers.
See “Running or stopping a process on multiple
computers”on page 44.
ProcessManagement task (WMI)
Lets you remotely control a service on a group of
computers in the following ways:
■Start
■Stop
■Restart
■Change start mode to Automatic, Manual, or
Disabled.
See “Running or stopping a service on multiple
computers”on page 45.
ServiceManagement task (WMI)
Where to get more information
Use the following documentation resources to learn and use this product.
19Introducing Real-Time System Manager
Where to get more information

Table 1-4 Documentation resources
LocationDescriptionDocument
http://kb.altiris.com/
You can search for the product name under
Release Notes.
Information about new features and
important issues.
This information is available as an article in
the knowledge base.
Release Notes
■The Documentation Library, which is
available in the Symantec Management
Console on the Help menu.
■The Product Support page, which is
available at the following URL:
http://www.symantec.com/business
/support/all_products.jsp
When you open your product’s support
page, look for the Documentation link
on the right side of the page.
Information about how to use this product,
including detailed technical information and
instructions for performing common tasks.
This information is available in PDF format.
User Guide
The Documentation Library, which is
available in the Symantec Management
Console on the Help menu.
Context-sensitive help is available for most
screens in the Symantec Management
Console.
You can open context-sensitive help in the
following ways:
■The F1 key
■The Context command, which is available
in the Symantec Management Console
on the Help menu.
Information about how to use this product,
including detailed technical information and
instructions for performing common tasks.
Help is available at the solution level and at
the suite level.
This information is available in HTML help
format.
Help
In addition to the product documentation, you can use the following resources to
learn about Altiris products.
Table 1-5 Altiris information resources
LocationDescriptionResource
http://kb.altiris.com/Articles, incidents, and issues about Altiris
products.
Knowledge base
http://www.symantec.com/connect
/endpoint-management-virtualization
An online magazine that contains best
practices, tips, tricks, forums, and articles
for users of this product.
Symantec Connect
(formerly Altiris Juice)
Introducing Real-Time System Manager
Where to get more information
20