AirWatch Remote Management Guide v4 v9 - 1

VMware AirWatch Remote Management
Guide
Installing, configuring, and using the Remote Management Service
v4.1
AirWatch v9.1
Have documentation feedback?Submit a Documentation Feedback support ticket using the Support Wizard on
support.air-watch.com.
Copyright 2017 VMware, Inc. All rights reserved. This product is protected by copyright and intellectual property laws in the United States and other countries as well as by
international treaties. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and other jurisdictions. All other marks and names mentioned herein may be trademarks of their
respective companies.
VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

Copyright 2017 VMware, Inc. All rights reserved.
1
Table of Contents
Chapter 1: Overview 3
Introduction to Remote Management v4.1 4
Remote Management v4.1 Components 4
Remote Management v4.1 Supported Platforms 5
Remote Management v4.1 Requirements 5
Typical Deployment of the Remote Management v4.1 Server 12
Chapter 2: Remote Management Service Configuration and Installation 13

Remote Management v4.1 on-premises Installation Overview 14
Generate the Remote Management v4.1 Certificates 14
Create the Common Name from the AirWatch Database 15
Configure the Remote Management Installer 16
Install the Remote Management Server Components 18
Configure the AirWatch Console 20
Chapter 3: Remote Management v4.1 22

Start a Remote Management v4.1 Connection 23
Remote Management v4.1 Client Tools 23
Remote Management Server Installation PowerShell Scripts 25
Accessing Other Documents 30

2
Chapter 1:
Overview
Introduction to Remote Management v4.1 4
Remote Management v4.1 Components 4
Remote Management v4.1 Supported Platforms 5
Remote Management v4.1 Requirements 5
Typical Deployment of the Remote Management v4.1
Server 12

3
Chapter 1: Overview
Introduction to Remote Management v4.1

Remote Management v4.1 allows you to connect to end-user devices remotely to aid in troubleshooting and
maintenance. Remote Management v4.1 is a premium upgrade that uses a new remote management client with
enhanced functionality.
The Remote Management v4.1 client also has additional support tools and device information available. The
combination of remote control and information allows you to troubleshoot any issues on devices quickly and accurately.
Remote Management v4.1 is already configured for SaaS customers who have purchased the upgrade.
Remote Management v4.1 requires devices to have the AirWatch Agent and the Remote Management client installed.
Remote Management v4.1 Components

Remote Management v4.1 uses multiple components to facilitate the communication between admins and end-user
devices.
The core components are as follows.
Database
The database handles system and tenant configuration, operations, and logging such as the accrual of historical device
enrollment data.
Portal Services
The Portal Services component handles the administrative and management services for Remote Management v4.1. The
Management Website is installed as part of the portal services component.
T10 Interface
The T10 interface is the part of the Management website under Portal Services that defines an integration portal between
AirWatch and the Remote Management server.
The T10 interface uses Representational State Transfer (REST) communication with a JavaScript Object Notation (JSON)
payload. The T10 interface allows AirWatch to make a mobile device eligibility call.
The T10 interface can also start a remote support session using the Remote Management tool and delete the device from
the Remote Management system.
Core Services
The Core Services component provides service discovery and auxiliary services for the Remote Management solution
through Web services and Windows services.
Connection Proctor
The Connection Proctor component uses the Windows Connection Proctor service to manage device connections to the
Remote Management server. The component also simultaneously handles multiple requests for sessions.

4
Chapter 1: Overview
Remote Management v4.1 Supported Platforms

Remote Management v4.1 supports Windows Rugged and Android devices running the proper AirWatch Agent and
Remote Management service.
Remote Management v4.1 supports the following platforms.
l Windows Mobile/CE running .NET 2.0+ with the AirWatch Agent v6.0.40 installed.
l Android devices with the AirWatch Agent v7.0 installed.

You must also download the required Remote Management CAB or APK from Accessing Other Documents on page 30.
Remote Management v4.1 Requirements

You must meet the listed requirements before using Remote Management v4.1.
General Requirements
For SaaS customers, the general requirements are the only requirements that must be met.
The Remote Management v4.1 requires the following on the admin side.
Requirements Minimum
Supported Latest version of Google Chrome, Safari, Internet Explorer, or Edge.
Browsers
AirWatch version AirWatch v9.0.2+ with the AirWatch Rugged EMM Bundle.
Ensure that your version of AirWatch includes these features by contacting your account
representative.
Active Directory Requirements

Remote Management v4.1 requires specific Active Directory users and groups.
Requirement Description
AD Group Create an Active Directory group.
Consider naming this group RMAdminGroup.

5
Chapter 1: Overview
Portal Admin User Create a user with the following settings.
l First name: Portal.
l Last name: Admin.
l Full name: PortalAdmin.
l User login name: PortalAdmin.
l Create a password that the user cannot change and which does not
expire.
l Add this user to the RMAdminGroup.

T10 Interface User Create a user with the following settings.
l First name: T10.
l Last name: User.
l Full name: T10User.
l User login name: T10User.
l User the same password as PortalAdmin.
Hardware Requirements
Hardware Minimum
Remote Management Server
CPUs 2.4 GHz Processors,
4 Logical Processors,
2 CPU 2 Core 2x2 or 4 Physical
depending on machine type VM vs
Physical.
Memory 16 GB
Hard Drive IOPS 15,000 SAS minimum
Hard Drive Space 100 GB for OS drive
Remote Management Database
Hard Drive Space 200 GB for databases
200 GB for backups and logs
Remote Device Maximum
Given a single server deployment with the above minimum
specifications, the maximum number of concurrent remote
device sessions is 250.

6
Chapter 1: Overview
Software Requirements
Ensure that you meet the following on-premises installation requirements.
To ensure proper configuration of the roles and features, use the Remote Management installation PowerShell scripts.
For more information, see Remote Management Server Installation PowerShell Scripts on page 25.
Requirements
Remote Management Server
Operating Microsoft Windows 2012 R2.
System
Software Microsoft .NET Framework 4.5.
Microsoft Report Viewer 2012 Redistributable Package.
Server Roles l Application Server.
l Web Server IIS.

To ensure proper configuration of the roles and features, use the Remote Management installation
PowerShell scripts. For more information, see Remote Management Server Installation PowerShell
Scripts on page 25.

7
Chapter 1: Overview
Requirements
Features l .NET Framework 3.5 Features.
o .NET Framework 3.5 (includes .NET 2.0 and 3.0).
o HTTP Activation.
o Non-HTTP Activation.
o IIS Management Console.
l .NET Framework 4.5 Features.

o .NET Framework 4.5.
o ASP .NET 4.5.
o WCF Services.
n HTTP Activation.
n Message Queuing (MSMQ) Activation.
n Named Pipe Activation.
n TCP Activation.
n TCP Port Sharing.
l Message Queuing Services.
l Windows Process Activation Service.

o Process Model.
o .NET Environment 3.5.
o Configuration APIs.
Remote Management Database

Operating l Microsoft Windows 2012 R2.
System
l MS SQL Server 2012 Standard.
l MS SQL Management Studio 2012.
l Microsoft .Net Framework 4.5.1.
l Microsoft SQL Server Management Objects (SMO) DLL.
l Microsoft Report Viewer 2010 Redistributable Package.

Server Roles l Bulkadmin.
l Dbcreator.

8
Chapter 1: Overview
Requirements
User Mapping l Dbowner.
l Dbbackupoperator.
l SQLAgent dependent.
l serverGroup dependent.
Network Requirements
Source Component Destination Component Protocol Port

AirWatch Console Remote Management Server TCP 443 or 8446
End-User Devices Remote Management Server TCP 443 or 8446
Console User Remote Management Server TCP 443 or 8446
Remote Management Server Remote Management Database TCP 1433
Remote Management Server Active Directory TCP 389/53

9
Chapter 1: Overview
Domain Name Service

The Remote Management server requires a forward lookup zone and three DNS records within the forward lookup zone.
These records enable devices to communicate properly with the components within the Remote Management server.
The forward lookup zone, the host record, and service records all must point to the Remote Management server.
Consider using the PowerShell Script for creating controlplane Forward Lookup Zone. For more information, see Remote
Management Server Installation PowerShell Scripts on page 25.
Forward Lookup Zone Create a forward lookup zone that points to your Remote Management server.
The forward lookup zone must be named.
controlplane.aetherpal.internal
Host Record Create a host record in your DNS that points to your Remote Management
Server.
The host record must be named
admin.
Service Coordinator Service Create a service record for the Service Coordinator.
Records
l Record type: SRV.
l Domain: Enter the forward lookup zone of your Remote Management server.
l Service: _svc.
l Protocol: _tcp.
l Priority: 0.
l Weight: 0.
l Port number: 8870.
l Host Offering this service: Enter your Remote Management server hostname.
Data Tier Proxy Service Record l Record type: SRV.
l Domain: Enter the forward lookup zone of your Remote Management server.
l Service: _dtp.
l Protocol: _tcp.
l Priority: 0.
l Weight: 0.
l Port number: 8865.
l Host Offering this service: Enter your Remote Management server hostname.

10
Chapter 1: Overview
Security Certificates Requirements

To deploy the Remote Management tool and make it work alongside AirWatch, you need multiple SSL certificates
installed on the Remote Management server.
Site Certificate
The site certificate secures HTTPS binding for the management website for port 443 and allows a secure connection. This
secure connection is between the admin and Web services. Also, the site certificate secures the connection to the
Connection Proctor on port 8446. The customer provides the site certificate as a wildcard certificate. You must use a PFX
file containing the public/private key and certificate chain during installation.
Enrollment Certificate
The enrollment certificate is an SSL certificate that enables remote management devices to enroll or register with the
Remote Management server. The enrollment certificate also secures the connection to the server. AirWatch provides the
certificate in a PFX file containing the private and public key and the certificate chain.
T10 Interface Certificate

The T10 interface certificate contains two major certificates that enable AirWatch to communicate with the T10 portal.
These major certificates are the Root certificate and the AirWatch portal intermediate certificate in a p7b file. You must
install these certificates on the Remote Management server in the appropriate certificate authorities.

11
Chapter 1: Overview
Typical Deployment of the Remote Management v4.1 Server

Most users typically deploy the Remote Management v4.1 server in an enterprise network to facilitate the
communication between the various components.
This sample diagram is a typical deployment.
1. Queue RM Command
2. Queuing Command to Connect to RMS
3. Confirm Command
4. Create Remote Management Session
5. Send Session URL
6. Request Remote Management Session URL
7. Admin Joins Remote Management Session
8. Device Joins Remote Management Session
9. Send Commands/Get Frames

12
Chapter 2:
Remote Management Service
Configuration and Installation
Remote Management v4.1 on-premises Installation
Overview 14
Generate the Remote Management v4.1 Certificates 14
Create the Common Name from the AirWatch Database 15
Configure the Remote Management Installer 16
Install the Remote Management Server Components 18
Configure the AirWatch Console 20

13
Chapter 2: Remote Management Service Configuration and Installation
Remote Management v4.1 on-premises Installation Overview

On-premises customers must run the Remote Management installer on a server to use Remote Management v4.1. After
installation, you must configure AirWatch to communicate with the new Remote Management server.
The Remote Management installer works in two parts, the Configure portion and the Install portion. The Configure part
creates an install.config file that contains the configuration settings for the different components of the Remote
Management v4.1 server. The Install portion uses the install.config file to install the components onto the server. Before
running the installer, you must configure the database server and the server that hosts the Remote Management
components. This configuration includes setting up an Active Directory group for Remote Management.
To facilitate configuration, consider running the PowerShell scripts. For more information, see Remote Management
Server Installation PowerShell Scripts on page 25.
After running the installer, you must configure AirWatch to communicate with the server. This process includes
configuring the AirWatch tenant and configuring the T10 interface website.
SaaS customers do not need to install a Remote Management server.
Generate the Remote Management v4.1 Certificates

As part of deploying the Remote Management v4.1 server, generate the root and intermediate certificates used during
installation.
Prerequisites
l Download the Remote Management v4.1 Certificate Generator.
l Gather the Common Name for the certificates.

o Run a SQL script against the AirWatch Database to get the CN. For more information, see Create the Common
Name from the AirWatch Database on page 15.
Procedure
1. Open the Remote Management v4.1 Certificate Generator. Be certain to use the correct version of the tool according
to the version of AirWatch you are using.
AirWatch Version Certificate Generator Tool Version
Pre 9.2 RemoteManagementCertificateGenerator_Before_9_2
9.2 and above RemoteManagementCertificateGenerator_9_2
2. Set the following values.

Setting Value
Certificate Type Remote Management.
Deployment On-premises.
Certificate Common Name Paste the Certificate Common Name.
3. Select Generate Certificates.

14
4. Navigate to the folder on your device holding the Remote Management v4.1 Certificate Generator. Find the
generated certificates in the Artifacts\public folder.
5. In the Artifacts folder, find the "Certificate Seed Script.sql". Run this script against the AirWatch Database to seed the
generated certificates into the AirWatch database.
6. Install the certificates onto the Remote Management server into the appropriate certificate stores.
a. Add the file named "root_cert.cer" to the Root cert store.
b. Add the file named "intermediate_cert.cer" to the Intermediate cert store.
7. Switch to the Cert Store and find the file you just added called "intermediate_cert.cer"
8. Right click the "intermediate_cert.cer" file and select Export. Now choose P7B as the export type.
9. This P7B file is needed for when you Configure the Remote Management Installer on page 16.
Create the Common Name from the AirWatch Database

You must run an SQLscript against the AirWatch Database to create the Common Name. Use the generated CN to create
the root and intermediate certificates for Remote Management v4.1.
Prerequisites
Download the Remote Management v4.1 Certificate Generator.
Procedure
To create the Common Name.
1. Open the Remote Management v4.1 Certificate Generator.
2. Select the Question Mark button.
3. Copy the displayed text. This text is the SQL script to run against the AirWatch Database.
4. On the AirWatch Database server, open SQL Server Management Studio.
5. Create a query with the copied text.
6. On the fist line of the query, replace the NULLvalue with the GroupID for the customer type OG that you want to
use. The OG you choose must be a customer type, it cannot be of any other type including global, partner,
container, and so on.
For example,
DECLARE @GroupID NVARCHAR(20) = NULL;
becomes

15
DECLARE @GroupID NVARCHAR(20) = 'RemoteManagement';
7. In the Results, copy the created Common Name.

The Common Name is used to generate the root and intermediate certificates for Remote Management v4.1. For more
information, see Generate the Remote Management v4.1 Certificates on page 14.
Configure the Remote Management Installer

The Remote Management v4.1 installer requires configuring the installer settings before starting installation. The
configuration file allows you to save the configuration for use with multiple servers.
Prerequisites
Install the proper certificates onto the server. For more information on the certificates, see Remote Management v4.1
Requirements on page 5.
l Install the Site certificate to secure HTTPS binding for the server.
l Install the AirWatch portal certificate onto the server. Install the root certificate into the Root Trusted Certificate
Authorities store and the intermediate certificate into the Intermediate Trusted Certificates store. For information on
generating the certificates, see Generate the Remote Management v4.1 Certificates on page 14.
l Install the Enrollment certificate onto the server. Install the root certificate into the Root Trusted Certificate
Authorities store. Next, install the intermediate certificate into the Intermediate Trusted Certificates store. Then
install the client certificate into the Personal store.
Procedure
Configure the installer.
1. On the database server, extract the contents of the installer ZIP file into C:\temp.
Important: Extract all contents from the ZIP file into c:\temp. Do not move the files around inside the temp folder
as the installer needs all the files in their extracted locations. Do not rename or move the temp folder.
2. Start the installer.
3. Select Next.
4. Select Configure to configure the server settings before installation.
5. Enter the Database credentials.

Setting Description
Database Server Enter the server hostname, IP address, or loopback address (as it is a single server).
Name

16
Setting Description
DB Owner user Enter the user name of the internal Remote Management Database user that the installation
name automatically creates in the database.
DB Application Enter the user name of the internal Remote Management Database user that the installation
user name automatically creates in the database.
6. (Optional) Select the Advanced button to configure the Port, LDF, MDF, and NDF paths for the database.
7. Select Next.
8. Configure the Portal Server settings.

Setting Description
Webserver
IPAddress Enter the IP address for the webserver.
Port Enter the port. The default is 80.
Select Check to validate the port. If you leave the IIS Default website bound to port 80, you must
either remove the Default website or use a different port.
Enable This setting is required. The port defaults to 443.
HTTPS
Binding
Active Directory
Domain Enter your Active Directory domain name.
Name
Group Enter the Active Directory group created for remote management.
User name Enter the Active Directory user name created for remote management.
Enrollment Certificate
Enrollment Select the ... Button to browse for the AirWatch enrollment certificate.
Certificate When you select the certificate, the installer asks for the certificate password. After entering the
password and selecting OK, if the Enrollment Certificate setting remains empty, the password did not
validate. Select the certificate again and reenter the password.
Select Next.
9. Configure the App Service settings, including:

Setting Description
Enable T10 Select to enable the T10 service.
Service

17
Setting Description
T10 Certificate Browse for the T10 certificate by selecting the ... Button.
Consider using a P7B format for this certificate. The P7B format includes the whole certificate
chain and does not require a password to install. The P7B format also places the Root and
Intermediate certificates into the correct certificate stores automatically.
Auto generate a Create a user for the T10 service in the machine's Local Users and Groups.
user in Local
Users and
Groups
10. Select Finish.

After selecting Finish, the installer creates the install.config file. This file contains all the configuration settings for the
Remote Management v4.1 installer. You can skip the configuration step when installing on multiple Remote
Management v4.1 servers by exporting this file to other systems.
Next, start the Install portion of the installer. For more information, see Install the Remote Management Server
Components on page 18.
Install the Remote Management Server Components

After running the Configure portion of the Remote Management v4.1 installer, run the Install portion to install the
components.
Prerequisites
l Copy the install.config file created during the Configuration portion of the Remote Management v4.1 onto the server
hosting the Remote Management v4.1 components. For more information, see Configure the Remote Management
Installer on page 16.
Procedure
1. On the server, extract the contents of the installer ZIP file into C:\temp.
Important: Extract all contents from the ZIP file into c:\temp. Do not move the files around inside the temp folder
as the installer needs all the files in their extracted locations. Do not rename or move the temp folder.
2. Start the installer.
3. Select Next.
4. Select Install.
5. Select the components you want to install on the server.

For example, if you are installing the Database component on a separate server, select only Database when selecting
components.
Install the following components on the same server.

18
l Core Services
l Portal Services
l Application Services
l Connection Proctor
6. Select Next.
7. If you are installing the database component, configure the Database Credentials settings.
Setting Description
SQL Database
Server Name Enter the Database server hostname.
Authentication Select the database account authentication. The authentication can be either Windows
Authentication or SQL Authentication.
User name Enter the user name of the database account. This user name is used by the installer to
automatically create all the databases required to install Remote Management.
Password Enter the password of the database account.
Application Access
Database Set the password for the Remote Management database owner SQL account. This account does
Owner not have system-wide permissions. The account only has permissions within the Remote
Password Management databases.
Database User Set the password for the Remote Management database user SQL account. This account does
Password not have system-wide permissions. The account only has permissions within the Remote
Management databases.
8. Select Next.
9. If you are installing the remaining components, configure the Authentication Credentials.
Setting Description
Enrollment Certificate Details
Enrollment Certificate Enter the password for the enrollment certificate added during the Configuration
Password portion.
Active Directory Authentication
User name Enter the Active Directory user name.
Password Enter the Active Directory password.
10. Select Next.
11. If you are installing the remaining components, configure the Portal Credentials.

19
Setting Description
SSL Select the ... Button to browse for the Site certificate installed before starting the Configuration
Certificate portion. For more information, see Remote Management v4.1 Requirements on page 5.
12. Select Next.
13. If you are installing the remaining components, configure the Connection Proctor Credentials.
Setting Description
CP This setting is auto-populated.
Binding
(Local)
Port This setting is a verification which you can use to check for port 8446.
CP FQDN Enter the server fully qualified domain name. For example, "<hostname>"
Port Enter the actual port number used for the Connection Proctor component. Consider using 8446.
CP Select the ... Button to browse for the Site certificate installed before starting the Configuration
certificate portion. For more information, see Remote Management v4.1 Requirements on page 5.
This certificate is the same one used on the Authentication Credentials screen in the previous step.
14. Select Next.
15. Select OK to confirm that you have opened the firewall ports.
16. After installation completes, select Close.

After completing installation, configure the AirWatch Console to communicate with the Remote Management v4.1
server. For more information, see Configure the AirWatch Console on page 20.
Configure the AirWatch Console

After installing the Remote Management v4.1 server and all its components, configure the AirWatch Console to
communicate with the Remote Management v4.1 server.
To configure the AirWatch Console.
1. In the AirWatch Console, ensure that you are in the Global OG.
2. Navigate to Settings > System > Advanced > Site URLs > External Remote Management.

20
3. Complete the Remote Management settings.

Settings Description
Console Connection Enter your Remote Management server hostname plus "/t10"
Hostname For example.
https://<hostname>/t10
Device Connection Name Enter the Remote Management server fully qualified domain name. For example,
"https://<hostname>"
4. Select Save.
The Remote Management server is now ready to handle remote management sessions with end-user devices.

21
Chapter 3:
Remote Management v4.1
Start a Remote Management v4.1 Connection 23
Remote Management v4.1 Client Tools 23
Remote Management Server Installation PowerShell Scripts25

22
Chapter 3: Remote Management v4.1
Start a Remote Management v4.1 Connection

Connect to devices for troubleshooting and maintenance using the Remote Management v4.1 connection tool. This tool
starts a remote management session and controls the connection to the remote device.
To start a Remote Management v4.1 connection.
1. Navigate to Details View for the device you want to create a remote connection with. Select the More Actions drop-
down menu and select Remote Management.
2. In the Remote Support window, select Launch Session after the connection process completes.
After selecting Launch Session, a new tab opens and the connection steps display.
Once the connection is made, the remote management client opens and the device is ready for use.
Remote Management v4.1 Client Tools

The Remote Management client provides support tools to facilitate troubleshooting and remotely controlling end-user
devices. The tools are located around the device view.
Watch a tutorial video on the Remote Management v4.1 client tools:https://support.air-

watch.com/articles/115003018507.
Remote Management v4.1 does not have the same functionality as Remote Management v3.0. The following features
are not currently available in Remote Management v4.1.
l Registry Manager
l Macros during the session.
Remote Control
The main section of the Remote Management client is a device screen view that allows you to control the end-user device
remotely.

23
Control the device by clicking or dragging on the displayed screen and buttons. You can send keystrokes to the device
and copy and paste information onto the device during a session.
If a user needs privacy, they can pause a remote control session.
Device Whiteboard (Android Only)

The device whiteboard functionality allows you to highlight a specific item to the user. The whiteboard allows you to
draw, highlight, and point to areas on the screen.
To use the whiteboard, select the whiteboard icon ( ) in the bottom right of the device screen view.
The whiteboard menu consists of the following items.
Shortcuts
The Remote Management client provides a shortcuts menu to navigate quickly to a screen or menu item on the device.

24
The shortcuts icon is on the bottom right, near the whiteboard icon. Navigate to that screen by selecting an item from
the shortcuts menu.
Device Summary
The Remote Management client provides a device summary of information similar to Device Details. Use this information
to diagnose issues on a device while connected without navigating away from the Remote Management client.
The Device Summary pane provides at-a-glance information to use during troubleshooting. The pane displays signal
strength, battery, network status, storage, and main memory information. Display additional information not displayed
in the information by selecting the Additional Information ( ) icon.
Detailed Device Information

The Additional Information screen provides detailed information on the device, applications, processes, and remote
control history.
Select each information list from the left navigation bar.
The Device information displays Device make and model, battery details, storage, connection, RAM, and more. Minimize
the pane and manage which panes are visible by clicking each device details section header. You may also search for
specific information with the search bar in the top right corner.
The application list provides a list of applications installed on the device and application details such as the version
number and package name. You can kill any running app from this list.
The process list displays the current processes running on the device and detailed information. You can kill any running
process from this list.
Remote Management Server Installation PowerShell Scripts

Simplify the installation of the Remote Management server with PowerShell scripts designed to provide shortcuts in the
process. These scripts gather information or create settings on the server.
PowerShell Commands for enabling PowerShell script execution on the local machine
Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force

Set-ExecutionPolicy Unrestricted -Scope LocalMachine -Force
Set-ExecutionPolicy Unrestricted -Scope Process -Force

25
PowerShell Script for Application and Web Server Roles and Features
Install Features
Install-WindowsFeature AD-Domain-Services, DNS, Application-Server, AS-NET-Framework, AS-TCP-Port-

Sharing, AS-Web-Support, AS-WAS-Support, AS-HTTP-Activation, AS-MSMQ-Activation, AS-TCP-Activation,
FileAndStorage-Services, File-Services, FS-FileServer, Storage-Services, Web-Server, Web-WebServer,
Web-Common-Http, Web-Default-Doc, Web-Dir-Browsing, Web-Http-Errors, Web-Static-Content, Web-Http-
Redirect, Web-DAV-Publishing, Web-Health, Web-Http-Logging, Web-Custom-Logging, Web-Log-Libraries,
Web-ODBC-Logging, Web-Request-Monitor, Web-Performance, Web-Stat-Compression, Web-Dyn-Compression,
Web-Security, Web-Filtering, Web-Basic-Auth, Web-CertProvider, Web-Client-Auth, Web-Digest-Auth,
Web-Cert-Auth, Web-IP-Security, Web-Url-Auth, Web-Windows-Auth, Web-App-Dev, Web-Net-Ext45, Web-
AppInit, Web-ASP, Web-Asp-Net45, Web-CGI, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Mgmt-Tools, Web-Mgmt-
Console, Web-Scripting-Tools
Install-WindowsFeature NET-Framework-Features, NET-Framework-Core, NET-Framework-45-Features, NET-

Framework-45-Core, NET-Framework-45-ASPNET, NET-WCF-Services45, NET-WCF-HTTP-Activation45, NET-WCF-
MSMQ-Activation45, NET-WCF-Pipe-Activation45, NET-WCF-TCP-Activation45, NET-WCF-TCP-PortSharing45,
GPMC, MSMQ, MSMQ-Services, MSMQ-Server, RSAT, RSAT-Role-Tools, RSAT-AD-Tools, RSAT-AD-PowerShell,
RSAT-ADDS, RSAT-AD-AdminCenter, RSAT-ADDS-Tools, RSAT-DNS-Server, FS-SMB1, Telnet-Client, User-
Interfaces-Infra, Server-Gui-Mgmt-Infra, Desktop-Experience, Server-Gui-Shell, PowerShellRoot,
PowerShell, PowerShell-V2, PowerShell-ISE, WAS, WAS-Process-Model, WAS-Config-APIs, WoW64-Support

26
Remove Features
Remove-WindowsFeature AD-Domain-Services, DNS, Application-Server, AS-NET-Framework, AS-TCP-Port-

Sharing, AS-Web-Support, AS-WAS-Support, AS-HTTP-Activation, AS-MSMQ-Activation, AS-TCP-Activation,
FileAndStorage-Services, File-Services, FS-FileServer, Storage-Services, Web-Server, Web-WebServer,
Web-Common-Http, Web-Default-Doc, Web-Dir-Browsing, Web-Http-Errors, Web-Static-Content, Web-Http-
Redirect, Web-DAV-Publishing, Web-Health, Web-Http-Logging, Web-Custom-Logging, Web-Log-Libraries,
Web-ODBC-Logging, Web-Request-Monitor, Web-Performance, Web-Stat-Compression, Web-Dyn-Compression,
Web-Security, Web-Filtering, Web-Basic-Auth, Web-CertProvider, Web-Client-Auth, Web-Digest-Auth,
Web-Cert-Auth, Web-IP-Security, Web-Url-Auth, Web-Windows-Auth, Web-App-Dev, Web-Net-Ext45, Web-
AppInit, Web-ASP, Web-Asp-Net45, Web-CGI, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Mgmt-Tools, Web-Mgmt-
Console, Web-Scripting-Tools
Remove-WindowsFeature NET-Framework-Features, NET-Framework-Core, NET-Framework-45-Features, NET-

Framework-45-Core, NET-Framework-45-ASPNET, NET-WCF-Services45, NET-WCF-HTTP-Activation45, NET-WCF-
MSMQ-Activation45, NET-WCF-Pipe-Activation45, NET-WCF-TCP-Activation45, NET-WCF-TCP-PortSharing45,
GPMC, MSMQ, MSMQ-Services, MSMQ-Server, RSAT, RSAT-Role-Tools, RSAT-AD-Tools, RSAT-AD-PowerShell,
RSAT-ADDS, RSAT-AD-AdminCenter, RSAT-ADDS-Tools, RSAT-DNS-Server, FS-SMB1, Telnet-Client, User-
Interfaces-Infra, Server-Gui-Mgmt-Infra, Desktop-Experience, Server-Gui-Shell, WAS, WAS-Process-
Model, WAS-Config-APIs, WoW64-Support

27
PowerShell Script for creating Active Directory Objects
Import-Module ActiveDirectory
$DomainName = Get-ADDomain | Select Forest -ExpandProperty Forest
$GroupName = "RMAdminGroup"
$PUDN = "Portal Admin"

$PUFN = "Portal"
$PULN = "Admin"
$PUSAM = "PortalAdmin"
$PUUPN = $PUSAM + "@" + $DomainName
Write-Host "Enter Password for Portal Admin User: " -ForegroundColor White -BackgroundColor Black
"`n"
$PUPassword1 = Read-Host -AsSecureString
New-ADGroup -Name $GroupName -SamAccountName $GroupName -GroupCategory Security -GroupScope Global -

DisplayName $GroupName
New-ADUser -Name $PUDN -AccountPassword $PUPassword1 -DisplayName $PUDN -Enabled $True -GivenName
$PUFN -Surname $PULN -SamAccountName $PUSAM -PasswordNeverExpires $True -UserPrincipalName $PUUPN
Add-ADGroupMember $GroupName $PUSAM

28
PowerShell Script for creating controlplane Forward Lookup Zone
Write-Host "Please select the correct default zone" -ForeGroundColor Yellow -BackGroundColor Black
Write-Host "Example: 4" -ForeGroundColor Yellow -BackGroundColor Black
$DNSZones = Get-DnsServerZone | Select ZoneName -ExpandProperty ZoneName
$Count1 = 0
ForEach ($DNSZone in $DNSZones) { $Count1++; Write-Host $Count1")" $DNSZone }
$Selection1 = Read-Host
$GetRootZone = $DNSZones[$Selection1-1]
"`n`n`n"
$ARecord = "Admin"
$DTPRecord = "_dtp._tcp"
$SVCRecord = "_svc._tcp"
$Priority = "0"
$Weight = "0"
$DTPPort = "8865"
$SVCPort = "8870"
$FLZoneName = "controlplane.aetherpal.internal"
$FLZoneName1 = "admin.controlplane.aetherpal.internal"
Write-Host "Please enter the IP address of the Admin/Anchor/APP Server." -ForeGroundColor Cyan -BackGroundColor Black
Write-Host "If each server is seperate please enter the IP Address of the APP Server" -ForeGroundColor Cyan -BackGroundColor Black
Write-Host "Example: 10.10.30.234" -ForeGroundColor Cyan -BackGroundColor Black
$Result4 = Read-Host
$DNSServerName = Get-DnsServerSetting | Select ComputerName -ExpandProperty ComputerName
$FLZoneExist1 = Get-DnsServerZone | Where { $_.ZoneName -eq $FLZoneName } | Select ZoneName -ExpandProperty ZoneName
IF ($FLZoneExist1 -ne $Null) { Add-DnsServerResourceRecordA -Name $ARecord -ZoneName $FLZoneName -AllowUpdateAny -IPv4Address $Result4; Add-
DnsServerResourceRecord -Srv -Name $DTPRecord -ZoneName $FLZoneName DomainName $FLZoneName1 Priority $Priority Weight $Weight Port
$DTPPort; Add-DnsServerResourceRecord -Srv -Name $SVCRecord -ZoneName $FLZoneName DomainName $FLZoneName1 Priority $Priority Weight
$Weight Port $SVCPort } ELSE { Add-DnsServerPrimaryZone -Name $FLZoneName -ReplicationScope "Forest" -PassThru; Add-
DnsServerResourceRecordA -Name $ARecord -ZoneName $FLZoneName -AllowUpdateAny -IPv4Address $Result4; Add-DnsServerResourceRecord -Srv -Name
$DTPRecord -ZoneName $FLZoneName DomainName $FLZoneName1 Priority $Priority Weight $Weight Port $DTPPort; Add-DnsServerResourceRecord -
Srv -Name $SVCRecord -ZoneName $FLZoneName DomainName $FLZoneName1 Priority $Priority Weight $Weight Port $SVCPort }

29
Accessing Other Documents
Accessing Other Documents

While reading this documentation you may encounter references to documents that are not included here.
The quickest and easiest way to find a particular document is to navigate to https://my.air-
watch.com/help/9.1/en/Content/Release_Notes/Doc_List_PDFs.htmand search for the document you need. Each
release-specific document has a link to its PDFcopy on AirWatch Resources.
Alternatively, you can navigate to AirWatch Resources on myAirWatch (resources.air-watch.com)and search. When
searching for documentation on Resources, be sure to select your AirWatch version. You can use the filters to sort by
PDF file type and AirWatch v9.1.

30

AirWatch Remote Management Guide v4 v9 - 1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

AirWatch Remote Management Guide v4 v9 - 1

Uploaded by

Copyright:

Available Formats

VMware AirWatch Remote Management

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

Chapter 2: Remote Management Service Configuration and Installation 13

Chapter 3: Remote Management v4.1 22

Accessing Other Documents 30

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

Introduction to Remote Management v4.1

Remote Management v4.1 Components

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

Remote Management v4.1 Supported Platforms

l Android devices with the AirWatch Agent v7.0 installed.

Remote Management v4.1 Requirements

Active Directory Requirements

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

l Last name: Admin.

l Full name: PortalAdmin.

l User login name: PortalAdmin.

l Add this user to the RMAdminGroup.

l Last name: User.

l Full name: T10User.

l User login name: T10User.

l User the same password as PortalAdmin.

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

l Web Server IIS.

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

l .NET Framework 4.5 Features.

n Message Queuing (MSMQ) Activation.

n Named Pipe Activation.

n TCP Port Sharing.

l Message Queuing Services.

l Windows Process Activation Service.

Remote Management Database

l MS SQL Management Studio 2012.

l Microsoft .Net Framework 4.5.1.

l Microsoft SQL Server Management Objects (SMO) DLL.

l Microsoft Report Viewer 2010 Redistributable Package.

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

Source Component Destination Component Protocol Port

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

Domain Name Service

l Port number: 8870.

l Port number: 8865.

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

Security Certificates Requirements

T10 Interface Certificate

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

Typical Deployment of the Remote Management v4.1 Server

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

Remote Management v4.1 on-premises Installation Overview

Generate the Remote Management v4.1 Certificates

l Gather the Common Name for the certificates.

2. Set the following values.

3. Select Generate Certificates.

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017

b. Add the file named "intermediate_cert.cer" to the Intermediate cert store.

Create the Common Name from the AirWatch Database

2. Select the Question Mark button.

4. On the AirWatch Database server, open SQL Server Management Studio.

5. Create a query with the copied text.

DECLARE @GroupID NVARCHAR(20) = NULL;

VMware AirWatch Remote Management Guide | v.2017.10 | October 2017