Exercise Overview:

Working with Management Groups

Management Groups are used to partition Installations and Licenses within AppClarity to allow for granular management of reporting, licensing and software reclaim. A Management Group defines a group of installations, so that for example each department or geographical entity can view and manage their own Installations. A Management Group can also be defined as a License Container, which enables Licenses to be allocated to the individual groups, rather than being applied centrally.

Each installation can only exist in a single given Management Group (except the Global View Management group which shows all installations). By default, they will be added to the Central Management Group, which is a built-in Management Group that is configured as a License Container and used to contain all Installations that do not meet the criteria for any other Management Group. There is also a Global View Management Group, which will always show every installation.
For some small or centrally managed organizations, where a single team is responsible for management and licensing of software, it may be perfectly acceptable to manage everything centrally through these built-in Management Groups. However, many organizations will require some level of partitioning to allow different groups to manage Installations and Licenses on different groups of machines.

It may be useful in some organizations to use a term such as 'Cost Center' or 'Business Unit' instead of 'Management Group'. AppClarity allows an administrator to define their own term for Management Group as it appears in the console by modifying values in the SiteSettings table in the AppClarity database. The following example SQL query could be used to change the label for Management Group to Business Unit. The AppClarity console will need to be closed and reopened for the changes to reflect.

UPDATE [SiteSettings] SET uss_ManagementGroup_ManagementGroupLabel='Business Unit'
UPDATE [SiteSettings] SET uss_ManagementGroup_AllManagementGroupsLabel='All Business Units'

Creating a Management Group

In this exercise, you will create a new Management Group, define the rules which will determine which Installations become members of the group and then observe the effects of this in the console.

Create a Management Group

  1. In the AppClarity console, click the Configuration icon  in the vertical toolbar to open the Configuration page
  2. Select All Management Groups. Note the built-in Central and Global View Management Groups
  3. If you changed the naming convention for Management Groups per the SQL query above, you will see the changed verbiage in place of Management Groups if the console has been closed and restarted.
  4. Select the Global View Management Group and note the Is license container option is not checked. Observe this setting on the Central Management Group
  5. In the middle pane, under the Management Group heading, click the link labelled Click here to add a new Management Group
  6. Enter Sales as the group Name. A description can be added if required
  7. Uncheck the Is license container box – this group will not be used to manage licensing
  8. Click Apply to create the new Management Group and observe that it is added to the list of Management Groups in the middle pane

Create a Management Group Rule

Installations are added to a Management Group by applying Management Group Rules. Each Installation passes through the defined rules in order, and is added to the group associated with the first rule that applies. If none of the rules apply (or no rules are defined) the Installation will be added to the Central group. 

In this task, you will create a rule that adds Installations to the Sales Management Group if the name of the computer that the Installation has been discovered on contains SAL.

  1. From the Configuration page of the AppClarity console, select Management Group Rules. Note that there are no rules defined by default (which is why everything ends up in Central)
  2. By default, the list of rules is displayed as a read-only view. Click the Edit button at the bottom of the page, then click the link labelled Click here to add a new rule…
  3. Enter Sales Computers as the Rule Name
  4. In the text that defines the query rule below the Rule Name, click the <variable> link and note the options that are available. Select device NetBIOS Name from the drop-down
  5. Click the equal to link and change this to containing
  6. Click the <value> link and enter SAL and hit Enter
  7. Click the <Management Group> link and select Sales from the list

  1. The rule should now look like this

  1. Click OK to save the Rule. Note that the new rule is added to the top of the list, meaning it will be evaluated first, and if an Installation meets the criteria (i.e. the NetBIOS name contains SAL) it will be added to the Sales Management Group
  2. The rule must be committed before it becomes active. This enables you to determine the effects of the rule on any existing Software Reclaim polices before you make it active.
  3. Ensure the new Sales Computers rule is selected and click the Preview button at the bottom of the pane. This indicates that 0 additional installations will be reclaimed as a result of applying this rule (we'll cover software reclaim soon enough!) Click Commit to apply changes

Viewing Products for the Sales group

You can now see the effect of creating this Management Group when viewing Products in the AppClarity console.

  1. In the AppClarity console, open the Products page

  1. Note that at the top of the page there is now a Management Group drop-down. This is used to filter the view to include only Products for which there are Installations in the selected Management Group. The view is currently filtered to show Installations from the Central Management Group

    The Management Group filter drop-down list is only displayed once you have defined custom Management Groups. Until that point it is not required as every Installation will exist in the default Central Management Group.
  1. Select Global View from the drop-down, select 1E under Publishers then locate the Shopping Agent Product and observe the Install Count
  2. Remember the Global View group includes all Installations.
    Remember to clear the Search field in the upper right-hand corner if it still contains search criteria from previous exercises.
  3. Keep the 1E Shopping Agent Product selected and change the Management Group to CENTRAL. Note that the Install Count has reduced, indicating that some Installations are no longer included in the Central Management Group
  4. Keep the 1E Shopping Agent Product selected and change the Management Group to Sales. The Install Count should reflect the number of Installations that were removed from the Central Management Group into the Sales Management Group
  5. Navigate to the Linked Installations tab in the section at the bottom. Notice the only installs showing under the Sales Management Group are machines with SAL in the machine name
  6. Browse around some other Products with the Sales Management Group selected. Note that the Linked Installations tab confirms that only Installations on computers containing SAL are included in this view

Delegating Management of a Management Group

Until now, you have been using the AppClarity console logged in as an AppClarity Administrator, and have therefore had visibility of all Management Groups. One of the reasons for defining Management Groups is to delegate management of them to others. In this exercise, you will add a new user to AppClarity and grant them access to just the Sales Management Group.

Create a new user

  1. In the AppClarity console, open the Configuration page and select the Users tab
  2. Click on Click here to add a new user
  3. Add a new user with the following properties
  4. Name: AppConsoleUser1
    Logon: 1ETRN\AppConsoleUser1
    Email: AppConsoleUser1@1etrn.local
  5. Select the Roles tab, which enables permissions to be granted to each specific Management Group. Select Product Editor for the Sales Management Group (note that selecting the Product Editor permission automatically adds the Product Viewer permission) then click Apply
  6. The reason License Viewer and License Editor roles show n/a is because we have not defined the Sales management group as a license container.

View the console as a restricted user

In this task, you will open the console logged on as AppConsoleUser1 and observe the limitations that have been applied.

  1. Log 1ETRN\User off of 1ETRNW72 and log as 1ETRN\AppConsoleUser1
  2. Open Internet Explorer and browse to http://1etrnap/1EAppClarity to install the AppClarity console
  3. This user is configured for email and an email notification was sent as well, but we are going to the install directly in this exercise. If someone hits the URL and has not been added in the AppClarity Console as a user, they will not be able to install the console.
  4. Note that when the console opens on the Preferences page, the Default Management Group is set to Sales. Click the drop-down and note that this user has no other options. Role based security has limited what this user can access, which is the Sales Management Group
  5. Change the Home Screen to Products and click Apply. This user's activity is restricted to Product administration so it makes sense to have the Products page as their home screen
  6. Note that settings on all other tabs on the Configuration page are not accessible to this user. Click on the Reporting tab and review the message stating you do not have permission
  7. If you click through the reports on the page you will notice that the AppConsoleUser1 account does have access to the Product Installation and Product Reclaimer reports for the Sales Management Group only.
  8. Open the Products page and note that the list of Products is filtered by the Sales Management Group, which this user cannot change
  9. Change the Licensable filter to include Non-licensable products to ensure there is a fair comparison to the products displayed for the AppInstaller account that is logged onto on 1ETRNAP. Note the number of Publishers is smaller than what the entire estate shows
  10. Close the AppClarity console and log AppConsoleUser1 out of the machine

Understanding Management Group Rules

So far you have created a single Management Group and defined a rule that adds Installations to that group when the computer's NetBIOS name contains 'SAL'. All other Installations that do not meet the conditions of this rule fall into the Central Management Group. In this exercise, you will add some more Management Groups and create rules to add Installations to these. You will then observe the effect and importance of the order that rules are sequenced.

Define Management Groups and Rules based on Device Tags

ActiveEfficiency has the ability to define custom attributes (named Device Tags) for devices it has discovered. There are a number of useful Device Tags (such as Operating System Name, ConfigMgr Site Code and Primary User) that are captured by default from the scout against the ConfigMgr database, but the feature provides an extensible key/value definition that can be used to tag devices with just about any identifier.

Refer to the ActiveEfficiency documentation at http://help.1e.com for information about adding custom Device Tags.
In this task, you will create some new Management Groups and define rules based on default Device Tags to add Installations to these.

  1. From the Configuration page in the AppClarity console, create new Management Groups named Lab Computers and Production Computers, leaving each enabled as a License Container 

  1. Create a new Management Group Rule named Lab Computers with the following properties

  1. Note that when you add the new rule it is inserted into the rule sequence below whichever rule was selected when you clicked Click here to add new rule…added the new rule (in this case, below Sales Computers. With the Lab Computers rule selected click the  symbol to the right to move this rule above the Sales Computers rule

  1. Ensure the Lab Computers rule is selected and add another rule named Production Computers configured as below

  1. The sequence of rules should now look like this:

  1. If the rules are not in that order, use the arrow to move rules around to get it in the right order
  2. When you have created the new rules, remember to Preview and Commit the effects to make the new rules active

Note that after the rules are committed, the rules may be displayed out of order, but the sequence will be correct.

View the effects of the new rules

In this task, you will view the effects of the new rules on the Products page.

  1. In the AppClarity console open the Products page and filter the list to the Lab Computers Management Group. Click on 'a' for product to review the Apple Inc. products installed. Note that this is showing only Installations from the training lab environment (i.e. where the computers' NetBIOS names starts with 1etrn) under the Linked Installations tab
  2. If you don't see Apple products, ensure that the licensable filter is set to show all 3 categories.
  3. Click on 'a' to remove the Publisher filter applied in the previous step and change the management group filter to Production Computers to observe the Installations from the restored Production ConfigMgr database (domain equals 1E)
  4. Change the filter to the CENTRAL Management Group and observe that there are very few Installations in this group (most Installations have now been added to the other Management Groups). Navigate to Microsoft Corporation Publisher to see a few installs
  5. Change the filter to the Sales Management Group. Note that there are no longer any Installations in this group
  6. Management Group Rules are applied in the order defined by their sequence number. Installations are added to the group defined in the first Rule (in sequence order) of whose criteria the installation meets. Since all Sales machines are actually part of the 1E domain, they have all fallen into the Production Computers category.
  7. Return to the Management Group Rules on the Configuration page and click Edit

  1. Change the order of the rules so that Sales Computers appears above Production Computers, as shown below

  1. Preview and Commit the change to make the new rule sequence active
  2. Return to the Products page and select the Apple Inc. publisher. Note that the Sales Management Group now includes Installations (the sales machines are now being moved into the Sales management group before they qualify for the Production Computers management group criteria)
  3. Select the Production Computers Management Group from the filter drop-down. This group now includes all Installations from the 1E domain that were not captured by the Sales Computers rule first (i.e. whose computer name does not contain SAL)

Lab Summary

You have now learned how Management Groups can be used to partition up Installations in your environment. Installations are assigned to a group based on Management Group Rules, which can use various pre-defined properties or custom Device Tags to match Installations to the correct Management Group. You have observed how the sequencing of Management Rules is extremely important and may result in Management Groups not including the expected Installations. 
Management Groups are typically used to define the scope of delegated management of Installations, including Policies to reclaim installations, and Licenses. You have seen how Users can be assigned to Roles for specific Management Groups. These Roles define the tasks they are able to complete on Installations and Licenses associated with the Management Group.

Next Lab
Ex 8 - AppClarity 5.2 - Entitlement Management and Compliance