NightWatchman Enterprise 7.3

Subnet-directed broadcasts are not considered secure and will leave a network open to potential denial of service (DoS) attacks. It is mostly disabled by default on routers and it is accepted as recommended best practice to leave it disabled.

Magic packets sent using subnet directed broadcast are forwarded by intervening routers, and then broadcast only once they reach the destination subnet. The computer with the specific MAC address in the magic packet will respond and wake up. For this method to be successful, all intervening routers must be configured to enable subnet-directed broadcasts forwarding.

Forwarding of subnet broadcasts leaves your network susceptible to denial of service attacks. Many wake-on-LAN solutions require the use of subnet directed broadcasts. However WakeUp is highly secure and scalable as it uses a dynamic agent discovery process to ensure that computers can be remotely and securely woken without the use of subnet directed broadcasts.

You can test if your network is capable of passing on directed subnet broadcasts by using the MagicTst.exe utility to send a single packet to a remote subnet and the RecvFrom.exe to test if magic packets are received by the target machine.

If you integrate WakeUp with Configuration Manager, the WakeUp server must be installed on all primary site servers with clients in the hierarchy. You must also install WakeUp onto the central site if you intend to wake computers directly from that computer's Configuration Manager administrator's console. WakeUp scans Configuration Manager for mandatory deployments. It uses system inventory information to send out wake-ups in time for the deployment schedule and contains extensions to the Configuration Manager Administrator console to explicitly wake-up single computers or whole collections.

The WakeUp components are:

The WakeUp server communicates with the recently used primary agent. If this agent is unavailable, it attempts to use the previously discovered alternate agent. If neither are available, it attempts to locate other agents on that subnet.

If you integrate with Configuration Manager and use the multi-agent mode, policy refresh is available to you. Systems that have just been woken up will immediately check Configuration Manager for new deployments. This significantly reduces the time taken for patch implementation, allowing more patches to take place in a given time period – particularly useful when you patch large number of systems overnight. Computers which are already on will check for a policy update immediately bypassing the normal polling cycle. Policy refresh works by sending a wake up to the computer that needs to be refreshed and can be tailored to your environment by using configuration options in the WakeUp Administrator console.

For example, in a minimal lab environment with one Configuration Manager server, one client and a five-minute polling interval, the lag time between a wake up and initiating a deployment for a computer which is already on can be reduced from seven to two minutes – a saving of over 60%. For longer polling periods, the time saved is even more significant.

WakeUp requires at least one computer is on per subnet. For the dedicated agent mode, you must ensure that the computer the agent is running on is always left on. In the multi-agent mode, you need to ensure that at least one of the computers in the subnet is left on. To make this easier, WakeUp provides Last Man Standing feature where the primary and alternate agents communicate with each other to prevent both of them being off at the same time.

If either of the primary or alternate agents gets turned off, they signal the other Agent. The other agent then knows that it is potentially in a Last Man Standing situation. If an attempt is made to shut it down, it sends a signal to its counterpart to wake up. This ensures that at least one of the agents is on, thereby providing constant coverage.

There are some edge cases where this may fail. For example, if a primary agent was hard powered-off, i.e. the power cable is unplugged, it will not have time to signal the alternate agent to wake up. If another computer is on, it will be found during the next agent discovery process and it will become the primary agent. However, if no other computer is available on that subnet, then neither a primary nor an alternate agent will exist and it will not be possible to wake up any computers until the next working day.

To prevent interfering with the last man standing feature, NightWatchman modifies its own behavior on WakeUp primary agent computers by:

WakeUp and NightWatchman combine with Configuration Manager to provide a complete solution for scheduled software distribution. WakeUp can be used with Configuration Manager to ensure that computers are powered-on to receive a scheduled software distribution from Configuration Manager. NightWatchman ensures that all the awoken computers are powered-down after the software distribution to ensure minimum power usage.

For example, here's an illustration of how NightWatchman is configured to perform scheduled events and manage users who are logged on when the event starts. You may need to create additional scripts to add to the default set (Refer to the Windows 1E NightWatchman Agent scripting reference and the Mac 1E Agent scripting reference ) that comes as part of a NightWatchman installation.

We are going to send a deployment or assignment to install new software during the night. On the left, are computers on a subnet with both WakeUp and NightWatchman installed. Two of the computers are powered-off and two are on. The main WakeUp agent wakes-up the powered-off computers by sending a magic packet.

The newly awoken computers are now in a position to receive the Configuration Manager deployment. If the deployment requires a reboot to complete the installation, Nightwatchman saves open documents before the reboot.

On completion of the deployment, NightWatchman only shuts down the computers it wakes – energy savings are maximzed while still enabling the network to be easily patched, upgraded or distributed to.

Encrypting WakeUp communications prevents packet sniffers from examining the contents of the packets sent between the WakeUp server and the agent and closes a potential security flaw where the packets could be examined to determine information about your network.

If you choose full encryption when you install WakeUp, any unencrypted communications are ignored. This prevents the new installation from working in conjunction with an earlier version where encryption was not supported. Installing WakeUp using partial encryption enables the use of both encrypted and unencrypted packets.

If you are upgrading and decide to make use of the encryption feature, you will either need to roll out the change simultaneously to every computer where WakeUp is installed or install it using partial encryption and upgrade all the WakeUp installations incrementally. The encryption feature can be introduced during the upgrade using the installer or from a command-line. Since the WakeUp 7.2.500 and later agent is a module of Tachyon, see the Tachyon client installation documentation for details.

The NightWatchman Management Center and its associated components can be configured to use FIPS. This is achieved with the USEFIPS installer property which must be set to the same value on the NightWatchman Management Center, WakeUp server and NightWatchman Agent.