eXtreme Deployment Distributing and Configuring 450 Student Notebooks in Five Hours E. Axel Larsson & Russell Sprague Drew University

Drew University Computer Initiative Started 20 years ago in Started 20 years ago in First liberal arts university to give all students computers. First liberal arts university to give all students computers. Switched to laptops in Switched to laptops in Around 600 computers purchased per year. Around 600 computers purchased per year. Computers a major part of the curriculum. Computers a major part of the curriculum. Educational software delivered over the network. Educational software delivered over the network. Laptops often brought to class. Laptops often brought to class.

Campus Networking A residential network drop was not in all student rooms until Fall A residential network drop was not in all student rooms until Fall Students accessed , campus directory, and other services on a central VMS machine via a digital phone system. Students accessed , campus directory, and other services on a central VMS machine via a digital phone system. “Client software” consisted of MS Kermit / Kermit 95. “Client software” consisted of MS Kermit / Kermit 95. Campus networking extended to “one port per pillow” from Campus networking extended to “one port per pillow” from

Campus Networking (cont’d) Novell eDirectory is the primary campus directory service. Novell eDirectory is the primary campus directory service. Single-password access to most services. Single- sign-on when possible. Single-password access to most services. Single- sign-on when possible. File/print, , web proxy, etc. File/print, , web proxy, etc. Novell iChain for web applications (webmail, Blackboard, etc.) Novell iChain for web applications (webmail, Blackboard, etc.) Identity-based services. Identity-based services. Departmental space. Departmental space. Space for courses, based upon enrollments. Space for courses, based upon enrollments.

Campus Networking (cont’d) Clients prior to 2002 Clients prior to 2002 Win 9x clients only. No support for Win NT, 2K on end-user machines. Win 9x clients only. No support for Win NT, 2K on end-user machines. Novell Client software only. Novell Client software only. No need to join workstations to a Windows domain. No need to join workstations to a Windows domain. No need to manage local accounts on the workstations. No need to manage local accounts on the workstations.

Campus Networking (cont’d) Management of workstations Management of workstations Novell ZENWorks for Desktops Novell ZENWorks for Desktops Application launcher delivers apps to users “on demand”. Application launcher delivers apps to users “on demand”. “Force run” apps deliver needed patches and updates. “Force run” apps deliver needed patches and updates. Limited use of user policies and 95/98 workstation policies. Limited use of user policies and 95/98 workstation policies. Limited deployment of Win2K in labs Limited deployment of Win2K in labs ZENWorks “dynamic local user” feature to manage local user accounts. ZENWorks “dynamic local user” feature to manage local user accounts. Limited ability to manage DLU on a per-workstation basis. Other deployment difficulties. Limited ability to manage DLU on a per-workstation basis. Other deployment difficulties.

First use of Windows XP August of 2002 on student laptops August of 2002 on student laptops Used a local administrator account. Used a local administrator account. Students logged in as “Drew User” in Windows. Students logged in as “Drew User” in Windows. Students logged in as themselves in Novell eDirectory. Students logged in as themselves in Novell eDirectory. Machines weren’t customized to the student owner. Machines weren’t customized to the student owner. Very similar to the way a 9x machine is set up. Very similar to the way a 9x machine is set up.

Problems with this setup Lack of security. Lack of security. Users unintentionally locking themselves out. Users unintentionally locking themselves out. Not using the same name for both logins. Not using the same name for both logins. Not in domain. Not in domain. Harder to manage. Harder to manage. Cannot utilize all features of Windows XP. Cannot utilize all features of Windows XP. File sharing. File sharing. Separate user profiles for separate users. Separate user profiles for separate users.

Active Drew First campus Active Directory domain in First campus Active Directory domain in Mirrors eDirectory tree. All users and groups (except course groups) synchronized between eDir and AD using Novell DirXML. Mirrors eDirectory tree. All users and groups (except course groups) synchronized between eDir and AD using Novell DirXML. Password synchronization provided by Novell DirXML Windows Password Sync product. Password synchronization provided by Novell DirXML Windows Password Sync product. Windows XP workstations created in the domain. Windows XP workstations created in the domain. Users log into eDirectory and an AD domain account when logging into XP workstations. Users log into eDirectory and an AD domain account when logging into XP workstations.

Initial use of Active Directory Microsoft’s Sysprep tool. Microsoft’s Sysprep tool. Used with faculty/staff desktops and updated laptop configuration. Used with faculty/staff desktops and updated laptop configuration. Machines run through mini-setup. Machines run through mini-setup. Process executed by CNS staff, not the end user. Process executed by CNS staff, not the end user. Configuration found to be far superior than using a generic account. Configuration found to be far superior than using a generic account.

Problems with using Sysprep for student handout Required a level of access to domain. Required a level of access to domain. No enforceable way to mandate naming convention. No enforceable way to mandate naming convention. Needed to give the owner administrative access and Administrator password. Needed to give the owner administrative access and Administrator password. While user-friendly, a manual process susceptible to user error. While user-friendly, a manual process susceptible to user error.

Alternatives considered Manually provisioning every machine. Manually provisioning every machine. Using Altiris Deployment Solution. Using Altiris Deployment Solution. Using ZENworks. Using ZENworks. Other commercial imaging packages. Other commercial imaging packages. Having vendor customize each machine. Having vendor customize each machine.

Our conclusion: rolling our own solution Requirements: Requirements: Standard image placed on every machine by the vendor. Standard image placed on every machine by the vendor. “Just in time” personalization for every user. “Just in time” personalization for every user. User friendly, wizard based. User friendly, wizard based. Reproducing at least all that Sysprep does. Reproducing at least all that Sysprep does. Modular and re-usable. Modular and re-usable. Integrates with uTrack, our existing home-grown asset tracking package (SQL Server based). Integrates with uTrack, our existing home-grown asset tracking package (SQL Server based).

Using Existing Skills Experience with web-based applications. Experience with web-based applications. Lots of experience developing database driven web applications in PHP, Perl, and Python. Lots of experience developing database driven web applications in PHP, Perl, and Python. Very little in house experience with Windows application development. Very little in house experience with Windows application development. Limited time-frame mandated skill reuse. Limited time-frame mandated skill reuse. 3 weeks to design and develop the complete solution. 3 weeks to design and develop the complete solution. Decided upon a web based client. Decided upon a web based client.

Backend Tech. Requirements Had to talk to an existing database for computer inventory tracking (uTrack) Had to talk to an existing database for computer inventory tracking (uTrack) MS SQL Server based. MS SQL Server based. ODBC accessible. ODBC accessible. Active Directory Active Directory Accessible via LDAP, but some of the attributes are really only usable via Microsoft’s ADSI (i.e. ntSecurityDescriptor) Accessible via LDAP, but some of the attributes are really only usable via Microsoft’s ADSI (i.e. ntSecurityDescriptor) Result: Windows server backend. Result: Windows server backend.

Deployment Server Tech. Windows Server 2003 Windows Server 2003 Apache web server exposing an XML-RPC interface (SSL wrapped) to deployment clients. Apache web server exposing an XML-RPC interface (SSL wrapped) to deployment clients. XML-RPC methods written in PHP. XML-RPC methods written in PHP. PHP ODBC support to talk to the uTrack inventory database. PHP ODBC support to talk to the uTrack inventory database. PHP COM bindings enabled the use of ADSI for talking to AD from within PHP scripts. PHP COM bindings enabled the use of ADSI for talking to AD from within PHP scripts.

Deployment Server Tasks Provides updated versions of the XD client components to clients. Provides updated versions of the XD client components to clients. Provides an XML-RPC interface to the clients in order to: Provides an XML-RPC interface to the clients in order to: Query the inventory database for computer ownership. Query the inventory database for computer ownership. Query AD for information about computer objects. Query AD for information about computer objects. Securely store workstation Administrator passwords. Securely store workstation Administrator passwords. Provides a web-based admin interface to the helpdesk. Provides a web-based admin interface to the helpdesk. Add and remove PCs from the domain and deployment database. Add and remove PCs from the domain and deployment database.

Client Technology Presents a browser based interface. Presents a browser based interface. Full screen IE browser. Full screen IE browser. Local self-contained Apache serves up the UI. Local self-contained Apache serves up the UI. Just presents the UI. No ActiveX controls. The PHP scripts (under Apache) actually touch the PC. Just presents the UI. No ActiveX controls. The PHP scripts (under Apache) actually touch the PC. Local self-contained Apache/PHP Local self-contained Apache/PHP Use a combination of COM and simple command line utilities to configure the PC. Use a combination of COM and simple command line utilities to configure the PC. Local Apache serves up pages to the local PC only, and only runs during deployment (Apache runtime). Local Apache serves up pages to the local PC only, and only runs during deployment (Apache runtime).

Client Tasks Use the BIOS asset tag information to query the deployment server for owner information. Use the BIOS asset tag information to query the deployment server for owner information. Set the computer name. Set the computer name. Change the SID. (calls Sysinternals NewSID) Change the SID. (calls Sysinternals NewSID) Join the domain. Join the domain. Add the computer owner’s domain account as a local administrator. Add the computer owner’s domain account as a local administrator. Setting the Administrator password; escrow. Setting the Administrator password; escrow.

The Process Most students receive their notebooks at an annual computer handout event. Most students receive their notebooks at an annual computer handout event. One day event computers distributed in 5 hours. One day event computers distributed in 5 hours. Up to six stations operating at once accessing a web- based application. Up to six stations operating at once accessing a web- based application. Notebook and printer serial numbers are barcode scanned into the form. Notebook and printer serial numbers are barcode scanned into the form. Inventory database is updated. Inventory database is updated. Computer object created in Active Directory. Computer object created in Active Directory. Contract printed and signed. Contract printed and signed. Student returns to their room and boots their PC for the first time… Student returns to their room and boots their PC for the first time…

eXtreme Deployment in action User is prompted with data about the computer from the database.

eXtreme Deployment in action (cont’d) User is prompted to join the computer to the domain.

eXtreme Deployment in action (cont’d) User is presented with the Administrator account’s password.

Results 2003 handout a success 2003 handout a success Students deployed from dorms or the lounge Students deployed from dorms or the lounge Over 450 computers deployed in 5 hours Over 450 computers deployed in 5 hours

Continued use of eXtreme Deployment Used with all Windows XP configurations Used with all Windows XP configurations Helpful ability to update layers Helpful ability to update layers Ease of obtaining Administrator password securely Ease of obtaining Administrator password securely

Questions?