Service Desk Guide. Version 8.2. Mobile Service Manager

(1)

Version 8.2

Mobile Service Manager

(2)

copyrights, and other intellectual property rights covering the subject matter in these documents. The

furnishing of this, or any other document, does not in any way imply any license to these or other in-

tellectual properties, except as expressly provided in written license agreements with Good. This doc-

ument is for the use of licensed or authorized users only. No part of this document may be used, sold,

reproduced, stored in a database or retrieval system or transmitted in any form or by any means,

electronic or physical, for any purpose, other than the purchaser’s authorized use without the express

written permission of Good. Any unauthorized copying, distribution or disclosure of information is a

violation of copyright laws.

While every effort has been made to ensure technical accuracy, information in this document is sub-

ject to change without notice and does not represent a commitment on the part of Good. The software

described in this document is furnished under a license agreement or nondisclosure agreement. The

software may be used or copied only in accordance with the terms of those written agreements.

The documentation provided is subject to change at Good’s sole discretion without notice. It is your

responsibility to utilize the most current documentation available. Good assumes no duty to update

you, and therefore Good recommends that you check frequently for new versions. This documenta-

tion is provided “as is” and Good assumes no liability for the accuracy or completeness of the con-

tent. The content of this document may contain information regarding Good’s future plans, including

roadmaps and feature sets not yet available. It is stressed that this information is non-binding and

Good creates no contractual obligation to deliver the features and functionality described herein, and

expressly disclaims all theories of contract, detrimental reliance and/or promissory estoppel or similar

theories.

Legal Information

© Copyright 2015. All rights reserved. All use is subject to license terms posted at www.good.com/le-

gal. GOOD, GOOD TECHNOLOGY, the GOOD logo, GOOD FOR ENTERPRISE, GOOD FOR GOV-

ERNMENT, GOOD FOR YOU, GOOD APPCENTRAL, GOOD DYNAMICS, SECURED BY GOOD,

GOOD MOBILE MANAGER, GOOD CONNECT, GOOD SHARE, GOOD TRUST, GOOD VAULT, and

GOOD DYNAMICS APPKINETICS are trademarks of Good Technology Corporation and its related

entities. All third-party technology products are protected by issued and pending U.S. and foreign

patents.

(3)

Service Desk User Guide 3

Introduction to Service Desk 6

About Good MSM 6

About the Service Desk Console 6

Who Should Use the Service Desk Console? 6

Getting Started in the Console 7

Service Desk Console 8

Overview 8

User Roles 8

Requirements 9

Service Desk Overview 10

User Search Bar 11

System Tabs 12

Status Tab 12

Security Management Compliance Messages 12

Example of an “Inactive Device” 14

Example of an “Unmanaged Device” 14

Example of a Device Status tab for an “Unmanaged Device” 15 Example of an “Unknown Device” 15

Example of an “Unapproved Device” 16

Example of a “Compromised Device” 16

Example of an “Blacklisted App” 17

Example of an “Missing Required App” violation 18

Example of a "Quarantined" Device 18

Messages Tab 19

History 21 Enterprise Applications for Devices with Good Dynamics 23

Applications Tab for BlackBerry Devices 25

Details Tab in the Navigation Bar 26

iOS Devices on Exchange ActiveSync 26

(4)

iOS Devices with Security Management 28

Good Dynamics 29

Good Dynamics Diagnostic View 32

Actions Links 34

Device Actions Displayed on the Accordion 34

BlackBerry Actions, Messaging Path Statuses, and Flow Graphs 35 BlackBerry Messaging Path Status (BlackBerry Platform Only) 39

Ping Test Button (BlackBerry Platform Only) 39

Flow Delivery Graph (BlackBerry Platform Only) 41

Actions for iOS Devices with Exchange ActiveSync 43

Email an Issue Report (iOS Devices with AS) 43

Manage Device (iOS Devices with AS) 44

Actions for Android Devices on Exchange ActiveSync 47

Email an Issue Report (Android on AS) 47

Wipe Device (Android Device on AS) 47

Email an Issue Report (Other Devices on AS) 48

Wipe Device (Other Devices on AS) 49

Remove Pairing (Device Status tab) 50

Actions for Good for Enterprise (GFE) 51

Activating GFE 51

Locking GFE 53

Reactivate GFE 55

Unlock GFE/ Reset GFE Password 55

Wipe GFE 57

Reset GFE 58

Actions for Security Management (iOS Devices) 59

Wipe Device (iOS Devices with SM) 60

Lock Device (iOS Devices with SM) 62

Actions for Security Managed Android Devices 64

Email an Issue Report (Security Managed Android) 64

Issue report email for Security Managed Android 64

Role Governing Actions 65

(5)

Introduction to Service Desk

About Good MSM

Good Mobile Service Manager is the innovator of automated Enterprise Mobility Management (EMM). Only Good MSM ’s single unified mobile management platform powered by patented real-time automation technology addresses the entire mobile lifecycle: Mobile Device Management (MDM), Mobile App Management (MAM), mobile support and operations management. And only Good MSM delivers real-time centralized control of all mobile devices and tablets including iPhone and iPad, Google Android, BlackBerry and Windows Phone, as well as the enterprise apps that run on them. Good MSM also provides an interactive App Analytics console that gives an overview of cross-platform app deployments and usage data on individual apps. Usage data depends on data collected from Good Dynamics.

About the Service Desk Console

The Service Desk Console is a web-based interface that allows support personnel to quickly identify and resolve issues affecting a mobile user. For the Operations team, the Service Desk provides a single consolidated view of all the ways in which a given user is connected to the enterprise services provided by IT. The console is built to leverage Good MSM’s deep user-level monitoring and integrated knowledge base to detect issues affecting mobile users and provide step-by-step instructions and, for some issues, one-click resolutions to quickly resolve any issues.

Who Should Use the Service Desk Console?

The Service Desk Console was designed for Tier I, Tier II, and Tier III Help Desk/Service Desk personnel that support mobile users. The Service Desk Console has dedicated roles for each tier of support, with features optimized for each role’s tasks and expertise. The Service Desk Console provides one-click Fix-It resolutions and step-by-step resolution instructions optimized for Tier I personnel, as well as access to the advanced Analysis Console for Tier III personnel to analyze data and diagnose complex and chronic issues.

(6)

Getting Started in the Console

The following steps describe the basic workflow recommended by Good MSM . This may differ from your company’s established practice. When in doubt, follow your company’s procedures.

1. When a user calls, you should begin by looking up that user’s information using the User Search Bar. You can type in a portion of the user’s name, email address or phone number. Click the user link from the drop-down.

!

Note: The search display is intended to return small sets of records. It is not a scrollable report; a maximum of one page of records is displayed. If the search terms are too broad, a valid result may be hidden. Redefine your search criteria to narrow down the number of records returned to ensure the valid result is not truncated from the list.

2. The Service Desk page will be displayed. Problems will be listed in the Device Status and Messages tabs, along with suggested resolution steps and one-click Fix- It actions.

3. Follow the listed step-by-step instructions or use the one-click Fix-It to resolve the user’s problem.

Fix-It actions will also allow you to lock, unlock, or wipe a user’s device to respond to locked, lost, or stolen devices.

(7)

Service Desk Console

Overview

The Service Desk provides a set of monitoring and diagnostic tools to help support personnel respond to and resolve mobile device service issues. Key features of the Service Desk Console include:

Support for BlackBerry, Exchange ActiveSync, Good Mobile Messaging, Good Dynamics and Security Managed devices

Search feature which locates information about a specific user or user device

Visual display of the BlackBerry. ActiveSync and Good Dynamics provisioning infrastructure

Current and historical problem descriptions

Capability to email diagnostic information directly from the Service Desk Console

Detail and summary message flow statistics

User Roles

Good MSM users have defined user roles. You have been assigned one of the roles in the following table.

Check with your Good MSM administrator for more information.

User Role Description

Administrator This role has full access to all resources except Security Management and User Self-Service (USS) Administrator. May view all of the Good MSM applications including the Service Desk, and Analysis Console.

AdvancedMessagingDesk Advanced Messaging Desk users have access to the Service Desk and Incident Management Console.

(8)

User Role Description

AssetManager The role permits the Asset Manager to access reports and dashboards associated with Asset, Expense, Compliance Management (AECM). It becomes available when the Asset, Expense, & Compliance Management (AECM) module is installed.

HelpDesk The Help Desk role permits users to only access the Service Desk Console.

MessagingDesk Messaging Desk role users have access to the Service Desk Console

MobileDeviceUsers This role is associated with authorized iOS device users under Security Man- agement. It becomes available if the Security Management module is installed Operations Operations users have access to the Service Desk, Incident Management, and

the Dashboard.

SMAdministrator The MDM Administrator role is associated with the Security Management Administrator. It becomes available if the Security Management module is installed. This role authorizes the user to perform a subset of actions that are performed by the Administrator role

ussdeviceowner The role is associated with User Self-Service access by the device owner. It becomes available if the User Self-Service module is installed .

Requirements

The following table lists the requirements for viewing the Service Desk Console.

Component Requirement

Internet Browser Internet Explorer 11, Mozilla Firefox (latest), or Google Chrome (latest).

Flash Player Flash Player 10x or greater.

(9)

9

post in the Device Status panel next to each selected device to inform users about service issues, alerts and updates.

Device Carousel

Allows users to view information for the device rotated forward (in the event the user has more than one device.

Device Policy and Information Displays the platform, OS version, associated IT policies, and device status.

User Information

Displays the platform, OS version, associated IT policies, and device status.

Fix-It Actions

The available corrective actions for a device.

Device Status /Issues (Tab) Shows all system or device issues by date.

Device Messages (Tab) Timestamps for email messages sent to and from the device.

Device History (Tab) Displays device connectivity and compliance issues for the day at the top and for the month at the bottom of the screen.

Last Contact

Display the last device/message sync information.

(10)

User Search Bar

The User Search Bar is used to locate a user. Search criteria includes

User name

Email address

Phone number

Operating System

To search for a user or device:

1. In the User Search Bar at the top of the page, type all or part of a user name, email address, or phone number into the search data field. Do not use blank spaces.

2. Click Enter.

The users who match the search criteria are displayed below.

3. Click on the name of a user to open the user page. If only a single record is retrieved, Good MSM will automatically open the User Console in a new browser window.

You can also perform Fix-It actions from this page. Fix-it actions are corrective actions that can be taken on a

(11)

System Tabs

There are five system tabs: Status, Messages, History, Details and Enterprise Apps. The following sections describe each of these tabs in detail.

Status Tab

Use the Device Status tab to view a description of any detected problems and recommended resolution actions. The number of problems is displayed in the tab.

For example, a low flash memory problem on a BlackBerry device will be displayed when the free flash memory drops below two megabytes. At that point, the device is in jeopardy of deleting emails and call logs.

!

Note: If there are no problems found for the selected user or device, the Device Status tab will display a message stating “There are no known issues for this device”.

Security Management Compliance Messages

Those devices which are under Security Management must comply with compliance rules associated with the security policy, or automatic actions will be executed to mitigate potential risk to the enterprise (See the Securi- ty Management Guide for more information).

Notifications appear on the Device Status tab when the Compliance Engine determines a device is in one of the following states.

Inactive

Unmanaged

Unknown

Unapproved

Blacklisted App

Missing Required App

Compromised

Quarantine

!

Note: If a device fails a Compliance Engine check, a warning flag will appear in the carousel, su- perimposed on the image of the device that has been flagged as out-of-compliance. If a compliance rule violation related to an app is detected (Missing Required App rule, Blacklisted App rule), a red warning triangle will appear in the Apps Tab beside the offending app.

(12)

The following table describes the meaning of each classification.

Classification Description

Inactive The Compliance Engine detects no Security Management communication nor any attempts by the device to synchronize mail in the enterprise over a specified time.

Unmanaged The Compliance Engine detects that the device does not respond to any of Security Management’s queries but does detect attempts by the device to synchronize mail in the enterprise.

Unknown The Compliance Engine detects that the device is not managed by Security Management yet is making attempts to synchronize mail within the enterprise.

Unapproved The Compliance Engine detects that the device is under Security Management yet does not meet specific IT specifications (such as the having an acceptable version of the device operating system, or having hardware encryption enabled).

If the particular device exceeds a limit placed on the number of devices permitted to the user, the device will also be flagged as unapproved.

Blacklisted App The Compliance Engine detects that the managed device has one or more apps installed that are forbidden. The device is flagged as in violation of the Blacklisted App rule.

Missing Required App The Compliance Engine detects that required apps have not been installed on the device. Enterprise apps that have been defined as required (as opposed to optional) in Security Management must be installed by the user. The Compliance Engine will detect their absence and flag the device as being in violation of the Missing Required App rule.

Compromised The Compliance Engine detects that the managed device has been Jailbroken or Rooted. Security Management integrates with both Good for Enterprise and Good Dynamics to determine whether a device is compromised. Only devices that are running one or more Good apps will be checked for Jailbreak or Root.

Quarantine The Compliance Engine detects that a device has been jailbroken,

compromised, or is out of compliance for another violation. If this occurs, the device may be forced into a Quarantined status in which case corporate email, profiles, VPN and Wi-Fi will all be removed from the device until the required action is taken to bring the device back into compliance.

(13)

These non-compliance classifications are described in the text which follows.

Example of an “Inactive Device”

A device can appear inactive for various legitimate reasons, or a device might have been lost or stolen. To pro- tect against loss of enterprise data, the device can be wiped of its enterprise information and retired to sever its connection to the enterprise.

When the Compliance Engine detects that a device has been silent for longer than a grace period (31 days), it will issue a notification. The Device Status tab message which appears in Service Desk provides recommendations for follow-up and links to execute actions.

!

Note: If a device fails a Compliance Engine check, a warning flag will appear in the carousel, su- perimposed on the image of the device that has been flagged as out-of-compliance. If a compliance rule violation related to an app is detected (Missing Required App rule, Blacklisted App rule), a red warning triangle will appear in the Apps Tab beside the offending app.

Example of a Device Status tab for an “Inactive Device”.

In the figure above, an “Inactive Device” notification was issued which provides recommendations for follow-up.

Example of an “Unmanaged Device”

If a device that had been under management is suddenly flagged as unmanaged by the Compliance Engine, the MDM profile may have been deleted.

(14)

If mail synchronization attempts are being detected from a device that is not under Security Management, a notification appears on the Device Status tab with recommendations to either bring the device under Security Management or wipe the device.

Example of a Device Status tab for an “Unmanaged Device”

Example of an “Unknown Device

^”

!

Note: If Security Management has been configured to automatically execute compliance actions for inactive devices, notification of these actions will also appear in the Device Status tab (as well as the Device History tab). For more information on configuring the Compliance Engine to perform remedi- al actions automatically when devices are flagged as non-compliant, see the Security Management Guide.

If a device that is not managed by Security Management attempts to synchronize mail, a notification is issued.

Example of a Device Status tab for an “Unknown Device”.

(15)

An “Unknown Device”, may be a device of a type that is not authorized to connect to the enterprise.

Alternatively, a legitimate user may be authorized to use a non-iOS device to synchronize mail. Because the authorized device is not an iOS device, it will appear in Service Desk as “Unknown”.

Unknown iOS or Android devices can be placed under Security Management, and unauthorized devices can be wiped or have their Exchange ActiveSync /3LM disabled for that user. Legitimate users with authorized devices can be ignored.

Example of an “Unapproved Device”

Security Management can be used to configure the Compliance Engine to identify and reject devices that do not meet specific IT requirements. When it encounters a device that is out-of-compliance, it will send a notification to the Device Status tab.

Example of a Device Status tab for an “Unapproved Device”

If an “Unapproved Device” is detected, a notification appears on the Device Status tab with recommendations for follow-up.

Example of a “Compromised Device

^”

Security Management can be used to configure the Compliance Engine to identify and reject devices that have been compromised. The Compliance Engine detects that the device is either jailbroken or rooted by Security Management through both Good for Enterprise and Good Dynamics sync. When it encounters a device that is compromised, it will send a notification to the Device Status tab.

Only devices that are running one or more Good apps will be checked for Jailbreak or Root in the case of Good Dynamics sync.

Example of a Device Status tab for an “Compromised Device”.

(16)

If a “Compromised Device” is detected, a notification appears on the Device Status tab with recommendations for follow-up.

Example of an “Blacklisted App”

Security Management can be used to configure the Compliance Engine to identify and reject devices that have forbidden apps installed. When it encounters such an app, it declares the device out-of-compliance and it will send a notification to the Device Status tab.

Example of a Device Status tab for an “Blacklisted App”.

If a “Blacklisted App” is detected, a notification appears on the Device Status tab with recommendations for follow-up.

(17)

Example of a “Missing Required App” violation

Security Management can be used to configure the Compliance Engine to identify and take compliance actions against devices that do not have all of the required enterprise apps installed. When it encounters such a device and detects the absence of the required app, it declares the device out-of-compliance and it will send a notification to the Device Status tab with recommended corrective actions to bring the device back into compliance.

Example of a Device Status tab for an “Missing Required App”.

Example of a "Quarantined" Device

Security Management can be used to configure the Compliance Engine to identify and reject devices that have been compromised. The Compliance Engine detects if the device is jailbroken or out of compliance due to a violation of another rule. If corrective actions are not taken, the device will be forced into a Quarantined state.

In Quarantine, the device will have VPN, Wi-Fi, and email removed from the device and will be blocked from accessing corporate resources. Users with managed devices who are removed from the mobile device owners group will now be quarantined instead of being retired.

(18)

Messages Tab

The Messages tab lists information about each message as it flows from the mail server to the user’s mobile device. This can be used for advanced analysis and provides access to the real-time and historical message delivery and problem monitoring data collected by Good MSM.

!

Note: This feature is only available to the Advanced Messaging Desk, Messaging Desk, BES Opera- tions, and Administrator roles.

The data displayed in the Messages tab is specific to the messaging platform in use (e.g. Exchange Ac- tiveSync ,Good Mobile Messaging and BlackBerry). The following illustrations depict the messages displayed for each of the platforms.

Messages Tab on the Exchange ActiveSync Messaging Platform

Data includes:

The email quantity and synchronized calendar and contacts information

Time stamps for each time the device was synced with the server

The amount of time the sync took to complete in milliseconds

(19)

Messages Tab on the Good Mobile Messaging (GMM) Platform

Data includes:

Time the message was sent

Time the user mobile device was synced with the server

Messages Tab on the BlackBerry Enterprise Server (BES) Platform

Data includes:

Time that the message was sent

Hop time to the Mail Server

Hop time between the Mail Server and the BES

Hop time between the BES and the BlackBerry device

Time that the message was delivered

(20)

History

The History tab provides a timeline that represents errors the user experienced in the recent past. The History tab provides scrollable access to historical information for problems and events for the user, as well as the components of the messaging path, including details of provisioning and service.

A timeline of historical problems can be used to identify patterns or determine when an issue initially started.

The History tab displays an hourly timeline in the upper area, and a daily timeline in the lower area, shown in grey scale. In the daily timeline, the period of time shown in the hourly view above is shown in white to provide perspective. The daily timeline allows long-lasting events to be seen more clearly.

The color in which the time line displays indicates the severity of the error as follows:

Green: Information item

Yellow: a warning level issue occurred

Red: a critical issue occurred Additional information is available as follows:

To view additional time frames, click and drag the top or bottom slider. The top of the slide scrolls by hours and that the bottom scrolls by days.

To view additional information about a specific error, click on the timeline.

(21)

There are three categories of events on the History tab:

Provisioning: Events that relate to provisioning activities, including activation, sychronization, and Fix-It actions.

Server: Events that relate to server activities, including connection status changes and PING events.

User: Events that relate to user activities.

Uncheck a filter check box at the bottom of the History tab (Blackberry only) to exclude infrastructure related events or user events from the timeline. Select a check box to include events. By default, only user events are displayed on the timeline.

(22)

Enterprise Applications for Devices with Good Dynamics

This tab provides information on the software applications installed on the managed GD device. Users can sort the data by clicking on the column heading. Clicking on the same heading will sort ascending and descending.

Applications on a managed device appear in the Applications tab.

The following table describes the columns and fields found on the Applications tab.

Field Description

App Displays the name and version number of the installed application.

Versions The size of the application in Kilobytes (KB) or Megabytes (MB) of memory.

Last Activity Displays the last contact time for each application.

(23)

Enterprise Apps Tab for BlackBerry Devices

When the selected BlackBerry device is running, an Enterprise Apps tab becomes available. This tab provides information on the software applications installed on the device.

The following table describes the columns and fields found on the Applications tab.

Field Description

App Display the name of the installed application

By Displays the company who created the application.

Discovered The date and time when a sync revealed the presence of the application.

(24)

Details Tab in the Navigation Bar

The following tables describe the information device information that may be listed in the Details section for each type of device and the messaging platform that supports it.

iOS Devices on Exchange ActiveSync

Item Description

ID The device identification provided by Microsoft Exchange ActiveSync .

Ownership The owner of the device. Will display as “‘Personal” if it is an employee owned device.

Status Current status of the device

IT Policy Name of the IT policy that controls the behavior of the device.

OS Version The name and version of the software operating system running on the device

Other Devices on Exchange ActiveSync

Ownership The owner of the device. Will display as “‘Personal” if it is an employee owned device.

Status Current status of the device

IT Policy Name of the IT policy that controls the behavior of the device.

IMEI/MEID Unique identifying number for the device (International Mobile Equipment Identi- ty). MEID is mobile equipment identifier.

OS Version The name and version of the software operating system running on the device

Android Devices with Security Management

Item

Description

Model The model of the Android device

(25)

Ownership The owner of the device. Will display as “‘Personal” if it is an employee-owned device.

OS Version The name and version of the software operating system running on the device Advanced SM This field is only displayed when the device has an Enhanced 3LM client

Home Carrier Wireless carrier that the device is provisioned with. This can be compared to the active carrier to determine if the user is roaming.

Blackberry Device Information

Blackberry PIN The Personal Identification Number assigned to the BlackBerry device user.

IMEI/MEID Unique identifying number for the handheld (International Mobile Equipment Identity). MEID is mobile equipment identifier.

OS Version The name and version of the software operating system running on the device Available Total amount of free flash memory on the device. When flash memory is low (ap-

proximately <1 Mb) the device may delete call logs and messages.

Total Total flash memory available on the device. Flash memory is used to store messages, call logs, and applications.

Battery Displays the remaining battery level expressed as a percentage.

Active Carrier Wireless carrier that the device is currently using. This can be compared to the home carrier to determine if the user is roaming.

(26)

Devices on Good Mobile Messaging

Item Description

OS Version The name and version of the software operating system running on the device GMM Server Name of the Good Mobile Messaging server that is managing this device.

GMM Client Version The Good Mobile Messaging client version that is installed on the device.

iOS Devices with Security Management

Item Description

Device Number The name the device was given when it was first attached to iTunes.

Model The model of the Apple iPhone device.

Serial Number The serial number identifying the device.

OS Version The name and version of the software operating system running on the device Available Total amount of free flash memory on the device. When flash memory is low

(approximately <1 Mb) the device may delete call logs and messages.

Total Total flash memory available on the device. Flash memory is used to store messages, call logs, and applications.

Battery Displays the remaining battery level expressed as a percentage.

(27)

Item Description

Active Carrier Wireless carrier that the device is currently using. This can be compared to the home carrier to determine if the user is roaming.

Cellular Network This will be GSM or CDMA.

Good Dynamics

Item Description

Network Serial Number The device identification provided by GD.

OS Version The name and version of the software operating system running on the device Carrier Wireless carrier that the device is currently using.

(28)

Device Carousel

The Service Desk page provides quick access to details on the user's enrolled devices, statuses, any security restrictions that are in place, and other key information.

Device Carousel and Accordion Information Panel

The device carousel provides a rotating display of devices that are associated with a particular user. Selecting a device from the carousel will automatically expand device details in the accordion below. Similarly, selecting a device from the accordion will rotate the image of that device to the front of the carousel.

The Service Desk accordion will expand to display device details, available fix-it actions, and status alerts for each device. The range of available device details will vary by platform.

Device Reconciliation

Through device and platform-specific data, we attempt to consolidate multiple connections on the same device, also referred to as device reconciliation. For example, if the system discovers a device has a Good Dynamics connection and an ActiveSync connection, we will reconcile the connections to appear in consolidated display under one device (instead of displaying the device twice). In most cases, devices will be reconciled within a few minutes of any activation/service changes in Service Desk and User-Self Service. The platform

Device Accordion

(29)

Device Reconciliation Table

Full Reconciliation Combinations

Descriptions

GFE +GD Good for Enterprise and Good Dynamics: Where a user is using Good for Enterprise to receive email on a device where Good Dynamics apps have also been installed, the MSM will combine the device details received from both systems to display a single device record.

GD + AS Good Dynamics and ActiveSync: Where Good Work is used to receive email, MSM will

combine the device details received from Good Dynamics with the device details received from ActiveSync that are associated with the Good Work client so that a single device record is displayed on the accordion.

MDM +AS Mobile Device Management and ActiveSync: Where MDM has been used to provision an ActiveSync account to a device, MSM will combine device details from ActiveSync and MDM to display a single record on the accordion.

MDM+GFE Mobile Device Management and Good for Enterprise: Where Good for Enterprise is used to receive mail on a device that is enrolled in MDM, MSM will combine device details from both platform to display a single device on the accordion.

* MDM does not include 3LM/Android Security Management in the table above.

(30)

Known Limitations

Though we make every attempt to reconcile connections for ease of use and convenience, there are some instances when connections are unable to be reconciled and may appear individually within the dashboard (resulting in a device being listed more than once). This occurs primarily because the data collected varies across platforms. These dissimilarities in collected data make it difficult to associate the connections with the same device. The platform combinations in the table below will be listed once for each connection in Service Desk.

Incomplete Reconciliations

Descriptions

AS + AS ActiveSync and ActiveSync: Where two different ActiveSync accounts are present on a single device MSM will not reconcile them to create a single device. This allows both ActiveSync connections to be separately managed.

GFE + AS Good for Enterprise and ActiveSync: Where both Good for Enterprise and ActiveSync are both used to check email on a device, typically the data MSM receives from both platforms makes it difficult to say definitively whether the data received from the two systems describe a single device, or two separate devices. In most cases two devices will be displayed in the accordion.

(31)

When a warning flag is shown, select the device from the carousel or from the accordion and review the Device Status tab to see the explanation of the warning. The tab will list a set of recommendations to help identify and resolve the condition.

A user’s error condition shown in the Device Status Tab

(32)

Good Dynamics Diagnostic View

The Good Dynamics Diagnostic View provides insight into single user activity and enables Administrators to troubleshoot complex service issues with Good Dynamics apps by monitoring app transactions and detected errors as they pass through system components.

Accessing the GD Diagnostic View Page

The Good Dynamics Diagnostic View can be accessed through the Service Desk Console or through the Event Console.

!

Note: The GD Diagnostic View link will only appear if the user has at least one Good Dynamics (GD) app in Service Desk.

Enter the user's name, email, phone number, or device ID into the search field (from anywhere in the entire Web Console, not just Service Desk) and press enter. This will bring up the user's details in Service Desk.

In the upper right corner of the Service Desk page there will be a button to access the GD Diagnostic View.

Press it. By default, the page will display data for the application that was most recently connected for that user.

Alternate Navigation Paths to the GD Diagnostic View Page

1. Find the search field in the web console > enter a user's name > this will bring up the user in Service Desk Console > Press the GD Diagnostic View link in the upper right hand corner of the screen. This will open the Diagnostic page for that user.

2. Recommended *: Expand the Support Menu > Select a new user or select a user from

the Recent Lookups menu. This will open the Service Desk Console > Press the GD Diagnostic View link in the upper right hand corner of the screen. This will open the Diagnostic page for that user

3. Go to the Operate Menu > Select the Universal Event Console > scroll through the element list to find a user > Press the user name link, this will bring up the User Diagnostic Page.

!

Note: There might be a slight delay of a few seconds as the chart data loads on the page.

(33)

Actions Links

Use the various Actions links to perform Fix-It actions on the device, view more user information, or email an issue report. Which particular action links are displayed in the accordion will depend upon the characteristics of the device that has been selected and the platform.

Device Actions Displayed on the Accordion

For each device, links are provided to execute actions specific to the type of device and the mobile message platform in use. Clicking the link executes the action. Actions that are not available are shown in gray scale.

The tables that follow describe those specific actions which are available for each type of device for the particular mobile messaging platform. A description and illustration of the actions being performed follows each table.

(34)

BlackBerry Actions, Messaging Path Statuses, and Flow

Graphs

For BlackBerry devices, if only the Reset device passcode link is active, the user’s device has not yet been activated. Once the activation password is sent, and the user activates the device using the password, the other links will become available.

!

Note: If all action links are unavailable, check to make sure there is a User Admin Tool configuration created for the Configuration Database associated with the current user displayed on the Service Desk. See the Good MSM Ops Dashboard User’s Guide for more information

View Additional Device Info For BlackBerry devices, it invokes the Analysis Console with the current device selected as the subject (context). The Analysis Console will open to the User Data tab.

Email an Issue Report Prepares an email message populated with current device status information that can be edited and then sent for escalation.

Resend Service Book Resends configuration sets (service books) to the BlackBerry device to enable or re-enable specific services. The wireless service provider and IT policies set up by your organization determine what service books are available.

Reset Device Passcode Sets the passcode on the BlackBerry device to a new passcode Wipe Device Completely wipes information from the BlackBerry device.

Email an Issue a Report (BlackBerry)

The Email an issue report link automatically prepares an email message that contains information found on the User Diagnostic page. The issue report email can be edited and then sent from the Service Desk when it is necessary to escalate a support issue or report a problem.

The link to Email an issue report, on the accordion.

(35)

Resend Service Book (BlackBerry

⁾

A service book contains configuration information for a BlackBerry and enables specific services. Your wireless service provider and the IT policies set up by your organization determine what service books are available.

To resend the service book to a BlackBerry:

1. Click the Resend service book link.

The Fix-It action will be queued for execution. To the right of the link, a rotating progress spinner will display as the action begins.

(36)

!

Note: If you hover over the current stage, the percent complete will be shown. You may not see all of stages as they occur, since the page is refreshed every 10 seconds. If multiple stages are completed within one 10 second refresh interval, not all of the stage names will be displayed on the page.

Reset Device Passcode (BlackBerry)

Resetting the user’s passcode locks the user out of the device until they enter the new passcode.

The Reset device passcode link for a BlackBerry device is shown below.

1. Press the Reset device passcode link.

The New Password dialog box opens.

2. Enter a new password for the device.

!

Note: The minimum number of characters is obtained from the IT Policy associated with the device (the default is four characters). The OK button will be inactive until the password meets the IT Policy requirements. If the IT Policy has a password pattern check specified, the check will appear below the minimum length message.

3. Press OK.

(37)

Wipe Device (BlackBerry)

Selecting the Wipe Device link opens a dialog asking you to confirm the wipe of the selected BlackBerry device.

1. Press the Wipe link.

Selecting the Wipe device link on the Accordion.

2. Press OK to confirm the wipe.

The success message is displayed when the wipe action has been completed.

(38)

BlackBerry Messaging Path Status (BlackBerry Platform Only)

The Messaging Path Status displays the BlackBerry communication delivery infrastructure and identifies the component that is causing a problem.

Each component is represented as a tell-tale indicator (circle) that changes color if a problem is detected. An error condition will result in red and a warning condition will result in yellow. Each component circle consists of a top half and a bottom half. The bottom half represents problems related to the infrastructure component. The top half represents problems related to the user device.

For example, if a user’s mail box is full, the bottom half of the circle turns red.

In another example, if the BlackBerry Enterprise Server (BES) is having issues loading configuration information for a user, the top half of the Enterprise Server circle turns red. If the mail server is down, the bottom half of the Mail Server circle turns red.

Ping Test Button (BlackBerry Platform Only)

The Ping Test is available if the Good MSM PING Agent is installed on a BlackBerry device dedicated to the Service Desk Console. If the PING test is available, the PING button is activated. A PING test sends two types of messages to the dedicated BlackBerry device:

A Pin-to-Pin Test (P2P) checks the Messaging Path from the RIM NOC to the user device. The P2P test does not test the flow through the Mail Server or the BES Server. Thus, the P2P test checks the Messaging Path outside of a corporate firewall usually with the carrier network or user device. When this test fails, issues usually exist with the carrier network or the user device.

An Email Test sends a message to the device to verify all the components of the messaging path. If the P2P test does not indicate a problem and the email test fails, it indicates a problem with the mail server or BES server or its connection with the RIM NOC.

When a PING test executes, a request is made to the dedicated Good MSM Device to send the P2P and email.

(39)

tests to the user device. While the tests are being conducted a line displays under the Messaging Path Status area.

The P2P test displays under the components from the RIM NOC to the user device. The email test displays under the components from the mail server to the BES server. A status indicator displays that shows how long the test has been running. If a test is successful, the status line turns green. If a test fails, the status line turns red and the description of the detected problem and resolution steps will be displayed in the Problem Description area.

When a PING Test is executed, it progresses through a number of stages as indicated by several types of lines as described below. If a PING test is successful, the status line turns green. If a test fails, the status line turns red.The status line turns green when receiving a successful acknowledgment or red if the test is canceled before an acknowledgment is received.

A dotted line indicates that a request is being made to the Good MSM PING agent to conduct the test.

A line with dashes and dots indicates the PING agent received the request and is initiating the test.

A line with bold dashes and dots indicates the PING agent is waiting for an acknowledgment from the device

(40)

Flow Delivery Graph (BlackBerry Platform Only)

The Flow Delivery Graph provides information about messages sent to the user’s BlackBerry device. It can be used to analyze recent messaging patterns to identify problems potentially related to slow delivery, pending messages, flow quality, and emails that are grouped and delivered simultaneously. Each vertical line in this graph represents the delivery of a real email message. This can be used to quickly identify if mail is being delivered to the BlackBerry device and where the messages are pending if the messages are not being delivered.

The Flow Delivery Graph provides information about the flow of messages for specific time intervals for the mail server, BES server, and user device. Time is shown on the horizontal (x) axis. The fine vertical lines mark 5 minute intervals; the heavy vertical lines mark 15 minute intervals. The slope of the data lines provides a visual reference of the speed of message delivery.

The following table provides examples of Delivery Flow Graphs and their meaning.

Delivery Flow Graph

Interpretation

Healthy Flow

Straight vertical data lines represent messages that travel through the messaging path quickly.

(41)

Delivery Flow Graph Interpretation

Healthy High Volume

Straight vertical lines that are spaced closely together indicate a high volume of messages that are delivered quickly.

Slow Delivery From Mail Server to the BES Server

Lines that slope in the top half of the graph to the mobile management server or BES indicate that the delivery speed from the mail server to the management server is taking time. The slope of the line indicates the amount of time it takes a message to traverse that particular hop in the overall delivery path. Note: A noticeable slope in the upper area (Mail to management server) suggests a carrier or RIM NOC issue Slow Delivery from BES Server to User device

Lines that slope in the bottom half of the graph indicate that the delivery from the BES server to the user device is being delayed. The slope of the line indicates the amount of time it takes a message to traverse the hop from the mobile management server or BES to the device.

Pending Messages Not Delivered to User device

Lines that do not continue to the bottom half of the graph indicate that messages are waiting for delivery in the BES server. This may be caused simply by the user being out of coverage or having their device turned off. Or, this could suggest a problem with the carrier, the RIM NOC, or the user device

Mail Delivery “Clumping” From BES Server to the User device

Lines that slope in the bottom half of the graph and converge to a single delivery point on the device indicate that a group of messages were initially pending and were delivered to the user device simultaneously.

Mail Delivery “Clumping” From Mail Server to the BES Server

Lines that slope in the top half of the graph and converge to a single delivery point on the BES server indicate that a group of messages were delayed on the mail server and were then delivered to the BES server simultaneously.

(42)

Actions for iOS Devices with Exchange ActiveSync

Manage Device Sends an invitation email to the user to allow them to activate the device for Security Management

Wipe Device Executes a complete wipe of the device via Exchange ActiveSync .

Email an Issue Report (iOS Devices with AS)

The Email an issue report link automatically prepares an email message that contains information found on the User Diagnostic page. The issue report email can be edited and then sent when it is necessary to escalate a support issue or report a problem.

Selecting Email an issue report from the Accordion.

The link opens a message in the default email application, and populates the header and body of the message with information on the selected device. The addressee field is left blank. Enter the addressee manually.

Issue report email for iPhone on Exchange ActiveSync .

(43)

Manage Device (iOS Devices with AS)

To send a notification of enrollment to an unmanaged Apple iOS, click the Manage Device action. The Manage Device link creates an enrollment message and instructions for the particular device and user.

The Manage device link in the Accordion information area.

1. Click Manage Device.

When the Manage Device link is selected, a confirmation dialog appears explaining that the instructions for Security Management Activation will be sent via e-mail.

The confirmation dialog for sending a Mange Device e-mail is displayed.

(44)

1. Click Send Instructions to execute the notification.

The enrollment instructions to activate the device are sent to the device.

Wipe Device (iOS Devices with AS)

Executes a complete wipe of the iOS device via Exchange ActiveSync during the next synchronization.

The Wipe Device link in the Accordion information area.

1. Press the Wipe Device link.

The Wipe Device confirmation dialog appears.

!

Note: An iOS managed device will continue to appear managed in the Service Desk if inactive for up to 30 days. If a user manually removes the management profile on the device or performs a device-side wipe of the device, the device will continue to appear until 30 days have passed. This behavior allows devices that are inactive for legitimate reasons (e.g. vacation or travel) to remain vis- ible until the device’s owner returns. However, it may also result in unmanaged devices erroneously appearing as active within the Service Desk.

(45)

1. Accept the confirmation by selecting the check box.

2. Click OK.

Exchange ActiveSync executes a complete wipe of the device upon next synchronization.

(46)

Actions for Android Devices on Exchange ActiveSync

Wipe Device Displays a warning dialog requiring confirmation to wipe the complete device.

When confirmed, the device is wiped on the next synchronization if the device has a regular Active Sync client. If the device has Active Sync via a touchdown client then the touchdown account will be removed during the next synchronization. This link does not display for Active Sync devices for Exchange 2003 users.

Email an Issue Report (Android on AS)

Issue report email for Android on the Exchange ActiveSync messaging platform.

Wipe Device (Android Device on AS)

Executes a complete wipe of the Android device via Active Sync during the next synchronization when

(47)

the device has a regular Active Sync client. If the device has Active Sync via a touchdown client then the touchdown account will be removed during the next synchronization. The device will not be completely wiped.

1. Click the Wipe Device link.

The Wipe Device confirmation dialog appears.

3. Click OK.

Exchange ActiveSync executes a complete wipe of the device upon next synchronization.

Item

Description

Email an Issue Report Prepares an email message populated with current device status information that can be edited and then sent for escalation

Wipe Devices Executes a complete wipe of the device via Exchange ActiveSync .

Email an Issue Report (Other Devices on AS)

(48)

Issue report email for a generic device on the Exchange ActiveSync messaging platform.

!

Note: Android and many other devices come with an Exchange ActiveSync client pre-installed.

BlackBerry and some other devices do not. Before executing the steps below, ensure that the user has an Exchange ActiveSync client installed on their device.

Wipe Device (Other Devices on AS)

Executes a complete wipe of the generic device via Exchange ActiveSync during the next synchronization.

1. Click the Wipe Device link.

The Wipe Device confirmation dialog appears

3. Click OK.

(49)

Remove Pairing (Device Status tab)

Exchange keeps a record of the activity of the devices on the Exchange ActiveSync messaging platform. If a user attempts to re-activate a device that was previously wiped by Exchange ActiveSync, as soon as the activation process begins, Exchange ActiveSync will recognize the device as the one that was be wiped, and will immediately reissue the wipe command. This will happen each time an attempt is made to re-activate the device.

In the Device Status tab for that wiped device, a Remove Paring link will appear beneath information pertaining to the device. The Remove Pairing action is specific to a wiped device that has been restored, and will only appear in the Device Status tab. If, at a later time, the Service Desk user determines that the wiped device should now be permitted to re-enroll, selecting this action will remove the Exchange ActiveSync association (pairing) between the Exchange Server and the device. Severing the pairing will stop Exchange ActiveSync from repeatedly wiping the device each time the device user attempts to re-activate it.

To remove an Exchange ActiveSync device pairing. Click the Remove Pairing link.

(50)

Actions for Good for Enterprise (GFE)

Good for Enterprise provides an encrypted, secure platform to access corporate resources for enterprises that have licensed GFE. GFE may be activated through Fix-it actions in User Self-Service, through Service Desk, or by downloading the Good for Enterprise App from the App Store or Google Play. Through the Service Desk ,administrators can initiate a sequence of actions specific to devices with GFE. When a user is required to take action, he/she will be notified via an onscreen message or an email generated by the action selected in the Service Desk console.

Manage Device Sends an invitation email to the user to allow them to activate the device for Security Management

Activate GFE Sends a command to create a Good for Enterprise account for the user.

Lock GFE Sends a command to the device which locks the GFE application immediately.

Unlock (Reset Password)

The service desk can initiate the action to unlock the application and/or reset the application password by pressing the Unlock link.

Wipe Device Wipes the Good for Enterprise container and deletes the device from the GMM server.

Reactivate GFE GFE will regenerate an OTA PIN to activate the GFE app if the existing has PIN expired

Reset GFE Wipes existing app data from the device and requires a new login and data sync to reprovision the device for the user.

Activating GFE

To activate GFE, press the link to Activate Device. The user will then receive an email with a passcode and

(51)

instructions to download the application from online through one of the application stores for the various platforms. For existing devices, press the Activate Good For Enterprise link.

Once the user downloads the application and accepts the Terms and Conditions, he/she can proceed with the configuration of GFE.

1. Press Start to initiate the activation

2. Enter the user name and access key from your welcome email.

3. After the provisioning process takes place from the device, a message will appear notifying the user that GFE has been set on the device and to wait several minutes for synchronization to occur.

Press Done to continue.

4. Depending on the policies in place, the user may be required to set a password to access the GFE application. If the password is required, the user may begin to access corporate resources

(52)

through the GFE application once the password has been entered.

Locking GFE

To put an instant lock on a GFE account, navigate to the service desk and search for the user name in order to find the page associated with that user and all corresponding devices.

1. Press Lock.

The action is immediate and the user will not be able to make any additional transactions through GFE until the lock is removed from the account. A confirmation message will appear on the screen to notify the admin that the lock command was successfully implemented on the device. The user will receive a notice to contact the administrator with a temporary lock code that appears on the device.

(53)

1. Once the user provides the unlock code to the Administrator.

!

Note: The Unlock action may also be used to remotely unlock the device when a user forgets the GFE password.

2. The administrator will enter the code in the onscreen fields in order to generate a new and unique unlock code for the user.

3. Press unlock to open GFE to the user. Read the code below to the user. The user will enter the code generated into the designated fields on the device.

Once these steps have been completed, GFE can be used normally.

(54)

Reactivate GFE

The Reactivate GFE command will generate a new OTA PIN to activate the GFE application if the existing has PIN expired .This action is an alternative to activating GFE if the user is unable to locate the welcome email with the OTA PIN. Pressing the Reactivate button will automatically initiate an email to the user with instructions for how to install, launch and reactivate GFE. The email will also contain the required PIN to access GFE.

The steps for reactivation are similar to the steps for activation on pages 49-50.

Unlock GFE/ Reset GFE Password

The reset password command is coupled with the unlock command on the user's service desk page.

From the device, the user may press the Forgot Password link on the Good App Welcome Screen to initiate the Unlock/Reset workflow. Though generally, this command will be initiated by Service Desk personnel by

(55)

pressing Unlock GFE after a user has contacted them. This will automatically bring up a "Step 1 screen"

(second screen) from which the user will be prompted to contact the IT administrator and relay the onscreen passcode to the administrator.

Press Next at the top of the screen.

The administrator will then give the user a temporary unlock passcode to enter onscreen.

Once the temporary passcode is entered and the user should press the Unlock button in the corner.

(56)

The "Set Password" screen will appear and prompt the user to enter and then re-enter a new passcode.

Press Done to complete the process.

If the action is initiated by the administrator, the same steps will be followed. However, users will first receive a message to let them know that they have been locked out of the system and to contact the IT administrator for assistance.

Wipe GFE

(57)

or reversed. Lost data within the application cannot be retrieved after the wipe completes.

Reset GFE

Reset GFE will wipe existing app data from the device and requires a new login and data sync to reprovision the device for the user.

1. Select Reset GFE from the onscreen menu

The application will be disabled on the device immediately.

(58)

Actions for Security Management (iOS Devices)

Wipe Device Displays a dialog offering the choice to “Wipe Complete Device” or “Wipe Enterprise Information and Retire Device

Unlock Device Remotely unlocks the device and prompts the user to enter a new mobile device passcode.

Lock Device Remotely locks the device.

Email an Issue Report (iOS Devices with SM)

1. Select Email an issue report from a device under Security Management

The link opens a message in the default email application, and populates the header and body of the message with information on the selected device. The addressee field is left blank.