Installing Shopping

In this lab, you will install all Shopping Central components on the 1ETRNAP server along with the Shopping Receiver on the 1ETRNCM server. In addition, the Shopping agent will be installed on all PCs using ConfigMgr.

Prepare the environment

In this exercise, you will prepare the lab environment with the necessary configuration and components required by Shopping.

Understanding Shopping Users and Groups

Several components of Shopping are run with the identity of either a defined user account or a special system account (such as Network Service). Beyond the accounts used by the system, there are also roles within Shopping that define the level of access that users of the system have. These roles are assigned to AD security groups and users are added into these groups to assign them the associated role. In this task, you will review the accounts and groups that need to be created or designated for Shopping.

Installer Accounts

The installation of the various Shopping components requires specific permissions. Whichever user performs the installation of the various components requires the permissions specified below. 
To install the Shopping Central server components, the installer account requires the following:

• Local admin rights on the server that Shopping Central is being installed on
• SQL Server sysadmin rights on the Shopping Database server
  
  

• Local admin rights on the ConfigMgr server that Shopping will connect to
• SQL Server sysadmin rights on the ConfigMgr Primary site database server that Shopping Central will connect to (the CAS in multi-site hierarchy) in order to create a SQL Login for the Shopping Central service account (this is then added as a user to the ConfigMgr database)
• Must be a member of the local SMS Admins group on the ConfigMgr server as the installer adds ConfigMgr security rights (through WMI) for the Shopping Central Service account
• Must be configured as a Full Administrator in ConfigMgr
• Must have a minimum of "Write Member" security right on the Full Shopping DB Admin Access and SMS / ConfigMgr Database Access AD groups defined during installation either through the UI or the installer properties SHOPPINGCONSOLEADMINUSERS and SHOPPINGCONSOLESMSUSERS.

To install the Shopping Receiver, the installer account requires the following:

• Local admin rights on the ConfigMgr Primary site server where the Receiver is being installed
• Must be a member of the local SMS Admins group on the ConfigMgr server and a member of the Full Administrators role in ConfigMgr as the installer adds ConfigMgr security rights (through WMI) for the Shopping Receiver Service account
  
  

The Shopping Central Service security principal is a Domain User specified during Shopping Central installation (through either the installer UI or using the SVCUSER and SVCPASSWORD installer properties).

On the Shopping Central server

• Log on as a service user right*

On the Shopping database

• Access to the Shopping database is managed through Database Roles (db_ShoppingConsoleAdmin and db_ShoppingConsoleUser). The installer adds the Shopping Central service user to Full Shopping DB Admin Access group, which in turn is associated with the db_ShoppingConsoleAdmin role in the Shopping database

On the ConfigMgr Primary site server (or CAS)

• db_datareader role on the ConfigMgr database*
  
  

• Requires an email account to be defined in the Email attribute of the user. This email account is used to send system emails to administrators
• If Shopping AD Integration is to be used to manage self-service of AD group membership, the Shopping Central Service account must have write access to the AD groups which are to be managed by Shopping
  
  

The Shopping Receiver Service runs on each ConfigMgr Primary Site and primarily manages the creation of Collections and Deployments on the local site.

On each ConfigMgr Primary Site

• Log on as a service user right*
• Membership of the local SMS Admins group* (required for access to the SMS Provider)
• The following ConfigMgr Security Rights are required

Class                                              Permission

Applications                                   Read

Collections                                     Full

Configuration Policy                      Full

Distribution Point                          Read

Distribution Point Group               Read

Global Condition                           Full

Site                                                Read

Status Messages                           Read

Task Sequence Package                Read

Users                                             Read

• db_datareader role on the ConfigMgr database
• EXECUTE permission on the ConfigMgr database scalar functions fn_GetAppState and fnGetSiteNumber
  
  

Before installing Shopping, you must define a Shopping Admin account or group in AD that will be used the first time you open the console (additional users can be added through the console).You also need to define AD groups that will be assigned to the Report Viewer and License Manager roles in the Shopping console.

Shopping Admin account/group

The Shopping Admin account or group specified during the Shopping Central Service installation (either in the UI or by the ADMINACCOUNT installer property) is initially the only security principal that has visibility of all nodes in the Shopping Admin Console and the Administration tab in the Shopping Web Portal.
During the Shopping Central installation, the Shopping Admin account (or group), is also added to the Full Shopping DB Admin Access and SMS/ConfigMgr Access groups (detailed later in this section) to provide the necessary access to the Shopping and ConfigMgr databases to perform all admin tasks.
This account (or group) must have a valid email account defined in AD.

The Shopping Report Viewer account or group defined during the installation of the Shopping Central Service (using either the UI or the REPORTSACCOUNT installer property) is granted permissions necessary to view the Shopping reports by the Shopping Central Service installer. Only this user (or members of the group) will see the Reporting tab on the Shopping Web Portal.

The Shopping License Manager account or group defined during the installation of the Shopping Central Service (using either the UI or the LICENSEMGRACCOUNT installer property) receives e-mail notifications when application license thresholds are reached. This user or group must therefore have a valid email address defined in Active Directory.

When a user of the Shopping Console requires access to either the Shopping database (to manage Shopping objects) or the Principal ConfigMgr Site database (to look-up Sites, Packages and Programs), they are granted access through SQL Database Roles defined (and created during the Shopping Central installation) in the respective databases. The three AD groups described below are associated with these SQL Database Roles.

Full Shopping DB Admin Access group

This group, specified during the Shopping Central Service installation using either the UI or the SHOPPINGCONSOLEADMINUSERS installer property, is associated with the db_ShoppingConsoleAdmin Database Role in the Shopping database.
The db_ShoppingConsoleAdmin database role is granted full permissions on all objects presented through the Shopping Admin Console. This allows members of the Full Shopping DB Admin Access group to manage Node Security, allowing them to define the users and groups that can access each of the nodes in the Shopping Console.
The specified Shopping Admin account / group is added to the Full Shopping DB Admin Access group during installation of the Shopping Central component.

This group, specified during the Shopping Central Service installation using either the UI or the SHOPPINGCONSOLEUSERS installer property, is associated with the db_ShoppingConsoleUser Database Role in the Shopping database. 

The db_ShoppingConsoleUser role has restricted permissions in the Shopping database necessary for managing Approvers and User and Computer Categories.

Definition of Sites and Applications in the Shopping Console require read access to the Principal ConfigMgr site database. This is provided through membership of the SMS / ConfigMgr Access group specified during the Shopping Central installation using either the UI or the SHOPPINGCONSOLESMSUSERS installer property. The specified group is associated with the db_datareader Database Role on the Principal ConfigMgr site database.

By default, as users or groups are granted access to a node within the Shopping console, the console adds these users or groups (under the context of the logged on user) to the relevant database access groups according to the access required for that particular node. This requires the Full Shopping DB Admin Access group to be granted full permissions on itself and the other two groups when they are first set up in AD. 
This automatic group management can be disabled in the Console Settings by setting the Admin Console Manages Groups setting to False. If this is done, users and groups will need to be manually added to the appropriate groups before they attempt to use the Shopping Console. The table below lists the Admin Console Nodes and the group memberships that provide access to them.

Ensure users and groups have email AD attribute set

Shopping uses email as the primary notification method. It is therefore important that all users that interact with Shopping, as well as some of the special accounts and groups identified in the previous task, have a valid email address defined in Active Directory.

65. Log on to 1ETRNDC as 1ETRN\Administrator and start Active Directory Users and Computers
66. Review the following users and groups and ensure they have the specified email address defined in the General Properties tab

User or Group	Email address
svc_ShoppingCentral	SVC_ShoppingCentral@1etrn.local
Shopping_Admins (group)	shopping_admins@1etrn.local
Shopping_LicenseManagers (group)	Shopping_LicenseManagers@1etrn.local
Manager1	manager1@1etrn.local
Manager2	manager2@1etrn.local
User	user@1etrn.local
Finance Director	FinanceDirector@1etrn.local

As Shopping is used by most users throughout an organization, it is good practice to use an easily remembered DNS alias for the Shopping Central Web Server. This alias is then defined as the Host Header for the Shopping web site in IIS. This not only makes it easier for users to remember the site name, but also allows the web site to be moved to a different server in the future if required.

Create a DNS Alias

In this lab environment, the chosen DNS alias is APPSTORE.
67. Log into 1ETRNDC as 1ETRN\Administrator
68. On 1ETRNDC select DNS from the Start page
69. In DNS manager, expand 1ETRNDC > Forward Lookup Zones and select 1ETRN.LOCAL
70. Select the Action menu and select New Alias (CNAME)…
71. In the Alias name field, type APPSTORE

73. Select OK to complete the New Resource Record wizard
74. From a command prompt, ping appstore. Ensure it returns 10.0.0.4(1ETRNAP)

Review Windows Features, Roles and Role Services

1ETRNAP has IIS configured as required to support ActiveEfficiency up to this point in the lab exercises. The Shopping Central Server components will also be installed on 1ETRNAP and has an additional role service that is required.

In most production environments, Active Efficiency and Shopping would not be hosted on a single server. This configuration is suitable for small lab environments.
75. Open Server Manager on 1ETRNAP
76. Select Add roles and features in the Configure this local server section of the Dashboard page
77. Click Next on the Before You Begin page
78. Click Next on the InstallationType page
79. Click Next on the Server Selection page
80. In the list of roles on the Server Roles page, scroll down and expand Web Server (IIS) and then Web Server
81. Expand Common HTTP Features and select HTTP Redirection and click Next
82. Click Next on the Features page
83. Click Install on the Confirmation page and close the wizard when complete
84. Close Server Manager

Create Service Principal Name (SPN)

The Shopping Website Application feature creates the Shopping Application Pools in IIS that use the NETWORK SERVICE identity. Connection to the web application is made through an HTTP service class request on the DNS address of the host. However, because the Shopping web site is not part of the default web site, it requires a separate Host Header and corresponding DNS alias to distinguish it from the Default Web Site on the same server. 

It is therefore necessary to define the host (1ETRNAP) as the security principal for the HTTP service class on the address APPSTORE.1ETRN.LOCAL, so that when clients request a connection to http://appstore.1etrn.local, Kerberos identifies 1ETRNAP as the actual security principal for that service. This is done by defining a Service Principal Name (SPN) as follows.

85. Log on to 1ETRNDC as 1ETRN\Administrator
The 1ETRN\Administrator account is the Domain Admin account. Service Principal Names are attributes of the security principal in AD, so it doesn't actually matter which computer you perform this task on, as long as the user you are logged on as has full permissions on the security principal (in this case the 1ETRNAP computer account) that you are trying to update.
86. Open a command prompt and type the following command. This will list all Service Principal Names currently held by the 1ETRNAP computer

SETSPN -L 1ETRNAP

88. To add an SPN to 1ETRNAP for the DNS name APPSTORE , run the following commands

89. To verify the update, run the following command again

SETSPN -L 1ETRNAP

Create ConfigMgr Administrative User for the Shopping Central Service

One of the features of Shopping, OS Filtering, provides the ability to filter the applications presented to users based on operating system criteria such as Operating System Version (Windows 7 vs. Windows 10) or Operating System Architecture (32-bit vs. 64-bit). If an application installation will fail because of operating system related prerequisites, it doesn't make sense to display these applications to users in the Shopping portal.

Because the information required to filter applications based on operating system criteria resides in WMI, the Shopping Central Service will need to be granted permission to access WMI remotely.
In this task, you will grant the Shopping Central Service these rights by adding them as an administrative user with Read access to ConfigMgr objects in WMI. This will support the OS Filtering exercise later in the labs.

91. Log into 1ETRNCM as 1ETRN\SCCMAdmin. Launch the SkyTap Shared Drive shortcut on the desktop and navigate to 1E Shopping - Course Content\Shopping 5.6 Course Content download the MiscFiles.zip to c:\temp and right click and extract all files.
92. Launch the ConfigMgr console. In the Administration workspace of the ConfigMgr console, expand Security and select Security Roles
93. Right-click on Security Roles and choose Import Security Roles
94. Browse to C:\Temp\MiscFiles and double-click on the 1E Shopping Central Service Security Role.xml file and observe that 1E Shopping Central Service now appears in the list of Security Roles
Ensure the right XML file is being copied, there are two in the folder, we will use the second one during the Shopping Receiver installation.
The 1E Shopping Central Service Security Role was created using the same permissions that are granted to the Read-only Analyst Security Role. The Shopping Central Service does not have rights to make any changes to ConfigMgr – only to read information.
95. Right-click on Administrative Users in the Administration pane and select Add User or Group
96. Click on the Browse… button and enter svc_ShoppingCentral as the object name and click Check Names
97. Click OK when the name resolves
98. In the Assigned security roles section, click the Add… button
99. Select 1E Shopping Central Service and click OK
100. Click OK to close the Add User or Group dialog box
By adding the Shopping Central Service account as an Administrative User in the ConfigMgr console, it also adds the account to the local SMS Admins group that has access to WMI remotely.

Install Shopping Central

In this exercise, you will install all Shopping Central components onto 1ETRNAP.

Install Shopping Central on Application Server

101. On 1ETRNAP and log in as 1ETRN\AppInstaller. Launch the SkyTap Shared Drive shortcut on the desktop and navigate to 1E Shopping - Course Content\Shopping 5.6 Course Content and download the Shopping.v5.6.0.409.zip and copy C:\Temp and right click and extract all
102. Start a command prompt (Run as administrator) and switch to the C:\Temp\shopping.v5.6.0.409 directory
103. Run the following command to start the installation wizard

msiexec.exe /i ShoppingCentral.msi /l*v ShoppingCentral-Install.log

104. On the Welcome page click Next
105. On the Shopping Prerequisite page, ensure all the checks passed and click Next
106. Accept the license agreement and click Next
107. On the Installation Type page, select Complete Install and click Next
108. On the Customer Information page, input an Organization name. Copy and paste the Shopping license key from 1E Shopping - Course Content\Shopping 5.6 Course Content\License.txt by launching the SkyTap Shared Drive shortcut on the desktop into Shopping License Key: field and click Next
WSA is out of scope for this course, so we will leave that blank.
109. On the Custom Setup page, ensure all features are selected for installation and click Next
110. On the Database Server page, leave the server as (local) and the Database Name as Shopping2 and click Next
111. On the 1E ActiveEfficiency Server page, enter 1ETRNAP as the name of the ActiveEfficiency Server and click Next
112. On the Active Directory Integration page, type 1ETRN.LOCAL and click Next




This can be either the name of a domain controller or the fully qualified domain name.
113. On the Service Account page, in the User name field, type 1ETRN\svc_ShoppingCentral and in the Password field, type Passw0rd
114. In the field for the receiver service account, type 1ETRN\svc_ShoppingReceiver and click Next




The Shopping Receiver service connects to the Shopping Central Web Site using HTTP. The Shopping Central installer checks that this is a valid account (or group) during installation of Shopping Central.
The recommended approach in production environments is to add the Receiver service account to an AD group and specify the group rather than the actual account. This allows for future changes to the Receiver service account, adding the new account into the defined group rather than having to reconfigure Shopping.
115. On the Exchange or SMTP Server page, type 1ETRNDC.1ETRN.LOCAL and click Next
For this lab, a simple SMTP application has been installed on 1ETRNDC to enable the sending of email via Shopping. In a production environment, this should be the fully qualified domain name of the SMTP server where Shopping will send emails.
116. On the SMS / System Center Configuration Manager Integration page, enter the name of the Principal ConfigMgr site server, in this case 1ETRNCM.1ETRN.LOCAL and click Next




The Principal ConfigMgr site is the site where the Packages to be offered through Shopping are defined. This is typically the Central site in ConfigMgr 2007 and the CAS (if installed) in ConfigMgr 2012. However, if you are using ConfigMgr 2007 and have Packages defined on primary sites below the Central site (e.g. on Regional Primary Sites), Shopping Central may need to be configured to use this site. In these scenarios, it is often necessary to create multiple Shopping environments – one for each Regional primary site.
117. On the Admin Console Node Security page, enter the following information and click Next
Full Shopping DB Admin Access:        1ETRN\ShoppingConsole_Admins
Limited Shopping DB Admin Access:  1ETRN\ShoppingConsole_Users
SMS / ConfigMgr Access:                    1ETRN\ShoppingConsole_SMSUsers
Refer to the Database Access groups information for details of these groups
118. On the Shopping Management Accounts page, enter the following information and click Next
Admin account:                  1ETRN\Shopping_Admins
Reports access account:     1ETRN\Shopping_ReportViewers
License manager account: 1ETRN\Shopping_LicenseManagers
Refer to the Management Accounts and Groups section for more details of these groups.
119. On the Website Configuration page, in the Host Header field, type APPSTORE and click Next
If a non-standard port is used, the Shopping URL will need to have the port appended to the end. e.g. If port 8081 is used, then the host header for this example would be http://appstore:8081.
120. On the Shopping URL prefix page, ensure that http://appstore is displayed and click Next
121. On the Ready to Install the Program page, click Install
122. Click Finish to close the setup wizard once complete

Review the installation

In this task, you will observe the changes made by the Shopping Central installer.

123. Open Windows Explorer and browse to C:\Program Files (x86)\1E\Shopping. Note the following subfolders:

Folder	Description
AdminConsole	This is the Shopping Administrator Console
CentralService	This is the Shopping Central Service and includes workflow integration components for integration with 3rd party systems
Database	This folder contains all the binary files used to configure the Shopping SQL database. Using compiled code to manage the SQL configuration enables Shopping to be easily patched using Windows Installer patches (MSP).
Website	This folder contains the Shopping website and Shopping API components

124. From the Start screen start Internet Information Services (IIS) Manager, expand 1ETRNAP > Sites and observe the Shopping website
125. Select Application Pools (just above Sites) and note that there are two application pools for Shopping (Shopping Pool and ShoppingAPI Pool) and that they are configured to run with the identity of NETWORK SERVICE
126. Start the Registry Editor (from the Start screen, start typing regedit and click regedit.exe when it appears in the search results) then navigate to HKLM\Software\1E\ShoppingCentral. Note that this only contains licensing information which is hashed
127. In the Registry Editor, navigate to HKLM\Software\Wow6432Node\1E\ShoppingCentral. Note that this contains basic information regarding the installation
128. Open the Services console (from the Start screen) and identify the 1E Shopping Central service. Ensure this service is running
129. Open Microsoft SQL Server Management Studio (from the Start screen) and expand the Shopping2 database. Note that the installer has created objects (tables, views, stored procedures etc)
130. In the Security node of the Shopping2 database, navigate to Roles > Database Roles and note that the db_ShoppingConsoleAdmin and db_ShoppingConsoleUser roles have been created by the Database feature installation. View the properties of both and note that the group ShoppingConsole_Admins is added to the ShoppingConsoleAdmin role and that ShoppingConsole_Users is added to the ShoppingConsoleUser role
131. Browse to C:\ProgramData\1E\ShoppingCentral. This is where you will find the ShoppingCentral diagnostic log. Double-click ShoppingCentral.log to open it. Review the log entries focussing on service startup tasks
132. From the Start screen, start typing Shopping. When Shopping Administration appears in the search results, right-click it and select Pin to Taskbar (you'll be using this a lot, so let's make it easy to get to)
133. Now click Shopping Administration on the Start screen. Ensure that the Shopping Admin Console opens without errors and note the different nodes available in the left-hand pane. We'll come on to each of these throughout this course
134. Open Internet Explorer (from the Start screen) and go to http://appstore/shopping
135. Ensure the Shopping web page opens successfully. There won't be much of interest on it currently, but the Home page should load without errors

Configure HTTP Redirection

Now, the URL to connect to Shopping is http://appstore/shopping. HTTP Redirection (a Web Server (IIS) Role Service - see earlier task) can be used to simplify this to http://appstore.

136. Open Internet Information Services (IIS) Manager and select the Shopping web site
137. In the main center pane with all the icons, double-click the HTTP Redirect icon in the IIS section (you may need to scroll down to see it)
138. Check the Redirect requests to this destination option and enter ../shopping
139. Check the Only redirect requests to content in this directory (not subdirectories) option
By default, IIS will apply the redirection to all sub-sites (/Shopping and /ShoppingAPI in this case). This would cause any attempts to load the page to enter an infinite loop as /Shopping would redirect to itself! In some cases, even if this option is selected, you may find the subdirectories still have the redirection applied. To be sure, check the HTTP Redirect settings on the /Shopping and /ShoppingAPI subdirectories and ensure redirection is DISABLED on these.
140. Click Apply (in the Actions list on the right)
141. Open Internet Explorer (if the Shopping site is already open, close and reopen the browser) and browse to http://appstore to confirm the redirection is working and the shorter URL can be used

Increase Shopping Central logging level

In order to use the Central Service log file to monitor processes throughout this course, you will now increase the level of detail that is written to the ShoppingCentral log.

142. On 1ETRNAP browse to C:\Program Files (x86)\1E\Shopping\CentralService
143. Make a backup copy of ShoppingCentral.exe.config
The lab environment has been modified so that file extensions are displayed, but this may not be the case in many production environments. In the default Windows Explorer view (with file extensions hidden), ShoppingCentral.exe.config will appear as ShoppingCentral.exe, and ShoppingCentral.exe appears as ShoppingCentral.
144. Right-click on ShoppingCentral.exe.config and select Edit to open the file in Notepad
145. Search for the text <level value="INFO"/> in the <log4net> section of the file
146. Replace the word INFO with ALL and save the file, then restart the 1E Shopping Central Service
If the 1E Shopping Central service fails to start, an error was made when editing the file.

Reduce the Cache Duration for user access to the portal

When a user launches the Shopping portal from a given computer for the first time, Shopping will evaluate the applications that are available to the user based on the User Categories associated with that the user and Computer Categories associated with that the computer. Rather than performing this evaluation every time the user logs on to the Shopping portal, the information is cached, along with the last logon time for that particular user and computer combination. If the Shopping portal is launched within 15 minutes of the last time the user launched Shopping from the same computer, the available applications will reflect whatever was cached at that earlier time.
As we will be making many changes to categories throughout this course, we do not want to be waiting around for up to 15 minutes before we see the effect of these. In this task, you will reduce this duration down to 1 minute to make things move a bit faster.

147. Open Microsoft SQL Server Management Studio, select the Shopping2 database and click New Query in the toolbar
148. Enter the following query and click !Execute in the toolbar. You should see (1 row(s) affected) in the Messages tab

Update tb_Preference set PreferenceValue=1 where PreferenceName='Cache Duration'

The tb_Preference table stores all the settings that you see in the Settings node in the console. Cache Duration is defined as a hidden setting so it can only be changed directly in the database.
149. Restart the 1E Shopping Central service for the logging info and cache duration changes to take effect
150. If the ShoppingCentral service fails to start, an error was made when editing the config file

Install the Shopping Receiver

In this exercise, you will install the Shopping Receiver Installer components onto 1ETRNCM.

Create Shopping Receiver security role in ConfigMgr

The Shopping Receiver service account requires the ConfigMgr permissions defined earlier in the Understanding Shopping Users and Groups section. 1E provide an XML file that can be imported to create a ConfigMgr Security Role with the required permissions.

151. Log on to 1ETRNCM as 1ETRN\SCCMAdmin
152. Earlier we imported the Shopping Central security role, here we will import the 1E Shopping Receivers Security Role in CB1906 and later.xml
153. Open the Configuration Manager Console from the Start screen
154. Select the Administration workspace and expand the Security node
155. Right-click Security Roles and select Import Security Role
156. In the Import Security Role dialog box browse to C:\Temp\MiscFiles\1E Shopping Receivers Security Role in CB1906 and later.xml and click Open
157. Once imported right click the new role and select Properties
158. Select the Permissions tab
159. Scroll to and open the Folder Class node
160. Review the configuration (this is new in CB1906) and click cancel when done
161. Right-click the Administrative Users node and select Add User or Group
162. In the Add User or Group dialog box, click Browse… then enter svc_ShoppingReceiver and click OK
163. Click the Add… button to the right of the Assigned security roles list, select 1E Shopping Receivers from the list of roles and click OK
Do not get the receiver and central roles/users mixed up!
164. Click OK to close the Add User or Group

Install the Shopping Receiver on ConfigMgr Primary Site

In this task, you will install the Shopping Receiver Service on the ConfigMgr Primary site server.

165. Launch Explorer from the desktop and navigate to \\1etrnap\Temp\shopping.v5.6.0.409 and copy ShoppingReceiver.msi to C:\Temp
166. Start a command prompt (run as administrator) and switch to the C:\Temp directory
167. Type the following to start the Shopping Receiver install wizard

msiexec.exe /i ShoppingReceiver.msi /l*v ShoppingReceiver-Install.log

168. On the Welcome page click Next
169. Accept the license agreement and click Next
170. On the Destination Folder page, click Next
171. On the Register Service Account page, select This Account and in the user name field, type 1ETRN\svc_ShoppingReceiver and in the password field type Passw0rd, then click Next
172. On the Policy Refresh page, ensure Native is selected and set the Policy Refresh delay to 30 seconds then click Next
Policy refresh triggers the ConfigMgr agent to perform a 'Machine Policy Retrieval & Evaluation Cycle' to accelerate the delivery of the deployed program or application. With policy refresh enabled, Shopping is able to deliver applications immediately after the approval process has been completed. Policy Refresh can be invoked directly via the Shopping Receiver (native) or by integration with 1E WakeUp. The Policy refresh delay allows ConfigMgr to process the Collection update and policy assignment before getting the client to check for the new policy. While 10 seconds is usually sufficient time, in this lab we increase the delay to 30 seconds to allow for performance of the virtual ConfigMgr server.
173. On the Shopping URL Prefix page, type http://appstore and click Next
174. On the Default Advanced Client Flags page, select Default and click Next

The Receiver installer allows you to enter default settings that will be used when it creates a Deployment in ConfigMgr. These settings are especially useful if integrating Shopping with 1E Nomad. The following options are available:

Default – Uses the default deployment options for ConfigMgr.
Always download from DP – The package is always downloaded from the distribution point. This should be used when integrating with 1E Nomad.
Always run from DP –The package is always run from the distribution point (only applicable to legacy Packages).

175. Click Next on the Configuration Manager Database Connection page. On the Ready to Install the Program page, click Install. When the installation completes, close the setup wizard

Review the installation

In this task, you will review the effects of the Shopping Receiver installation.

176. Run regedit.exe and navigate to HKLM\Software\Wow6432Node\1E\Shopping.Receiver.v5.6.0. Note that this contains basic information regarding the installation
177. Open the Services console from the Start menu and identify the 1E Shopping Receiver+5.6.0 service
178. Browse to C:\ProgramData\1E\Shopping.Receiver\v5.6.0. This is where you will find the Shopping Receiver diagnostic log. Double-click Shopping.Receiver.log to open it in CM Trace and ensure the Shopping Receiver service started successfully without any errors
179. Browse to C:\Program Files (x86)\1E\Shopping\Shopping.Receiver.v5.6.0. This folder contains the Shopping Receiver binaries that interact with ConfigMgr
180. Double-click Shopping.Receiver.exe.config to open it in Notepad and observe the configurable settings for the Shopping Receiver service in the <appSettings> section. Many of these settings were specified in the Install wizard
181. Search for level value="INFO"
182. Change the INFO to ALL
183. Save the file
Leave this file open, we'll be returning to it to make a configuration change in the next task.
184. Open SQL Server Management Studio and navigate to Databases > CM_PS1 > Security > Users
185. Double-click the 1ETRN\svc_ShoppingReceiver user (this user was added to the ConfigMgr database by the Shopping Receiver installation) to view its properties
186. In the Database User – 1ETRN\svc_ShoppingReceiver dialog box, select the Membership page on the left and observe that this user has been assigned only the db_datareader role on the ConfigMgr database
187. In the Database User – 1ETRN\svc_ShoppingReceiver dialog box, select the Securables page. Note that the user has been granted Execute permissions on the fn_GetAppState and fn_GetSiteNumber scalar functions
188. Click OK to close the user properties dialog box
You may have observed that the Shopping Receiver folders, service and registry keys all include the version number in their name. This is to allow side-by-side upgrade from previous versions where a new instance of Shopping Central is being implemented alongside an existing instance of an earlier version.

Configure the Default Limiting Collection

The Shopping Receiver is responsible for creating ConfigMgr objects (collections and deployments) and placing computers and users into appropriate collections to allow software to be deployed. By default, the Limiting Collections for all the collections created by the Shopping Receiver is 'All Systems' and 'All Users and User Groups'. In many environments, this is not a desired configuration.
In this task, we will modify the default limiting collection for computer collections.

189. Return to the Shopping.Receiver.exe.config file
190. Locate the <appSettings> section and observe the values in RootDeviceCollectionId and RootDeviceCollectionName
191. Replace the RootDeviceCollectionId value with PS10000B
Be sure to input the collection name and ID exactly as they are in the console. The ID is with 4 zeros. If these values are not inputted correctly, the Shopping Receiver will fail to create objects in ConfigMgr.
192. Replace the RootDeviceCollectionName value with Lab Workstations
193. Save and close the file
194. Restart the 1E Shopping Receiver+ 5.6.0 service
All collections created by the Shopping Receiver will now use Lab Workstations as the limiting collection. This methodology can be used to prevent certain machines (servers for example) from getting software inadvertently deployed to them by not allowing them to be members of the Shopping deployment collections

Deploy the 1E Client

Previous versions of Shopping used the Shopping Agent to enable the Shopping website to retrieve information about the user's PC. In an effort to reduce the number of agents customers need to deploy, 1E is in the process of combining existing agent functionality into a single agent, which happens to be the Tachyon Agent. With Shopping 5.6, the functionality of the Shopping Agent and the new Windows Servicing Assistant (WSA) functionality has been implemented as a module of the 1E Client. The 1E Client must be installed on all PCs from which users will access the Shopping portal. This integration requires specific client machine identification so that Configuration Manager knows the correct client deployment target. 

In this exercise, we will use the 1E Agent Endpoint Installation Solution Accelerator to create the ConfigMgr deployment objects and deploy the 1E Client to all ConfigMgr clients.

Prepare to Deploy the 1E Client

195. Launch the SkyTap Shared Drive shortcut on the desktop and navigate to 1E Tools and download the 1EClientDeploymentAssistant.v1.4.0.27.zip to C:\Temp\ and right click and extract all of the contents
196. Browse to the C:\Temp\1EClientDeploymentAssistant.v1.4.0.27 folder and double-click on 1EClientDeploymentAssistant.exe to launch the wizard
You might have to change the resolution of the remote computer session to fit the wizard to the screen depending on the size of your display.
197. On the Welcome page, click Next to continue
198. Accept the license terms on the License Terms page and click Next
199. On the ConfigMgr Connection page, with Local ConfigMgr Site Server selected, click Connect. When the status changes to Connected, click Next
200. On the General Settings page, Set the fields to contain the following and then Click Next
1E License File: Browse to C:\Temp\1EClientDeploymentAssistant.v1.4.0.27\1EClientDeploymentAssistant.v1.4.0.27\ and select Licenses.txt
1E ActiveEfficiency Server URL: http://1etrnap.1etrn.local/activeefficiency
Application Content Source: \\1etrndc\ConfigMgrSource\Software
Package Content Source: \\1etrndc\ConfigMgrSource\Software
Distribute Content: Check
Distribution Point Group: All Distribution Points
201. On the Agent Selection page, deselect all items except 1E Client 4.1.0.267 and click Next
202. On the 1E Client 4.1.0.267 page, verify that the limiting collection is set to Lab Workstations and click Next to continue
203. On the Tachyon Settings page, verify that Enable Shopping Module and Edge Windows App browser support are ticked and also ensure that Shopping Web URL has http://appstore/shopping/ address is entered. Click Next to continue




Enable Shopping Integration : Enables support for the 1E self-service portal and Windows Servicing Assistace, Any previous Installation of Shopping Agent will be removed when Tachyon Agent starts. 
Shopping Central URL : It should be set to the URL for the Shopping website. The Shopping website uses a host header, for which a DNS allias was defined earlier 
http://appstore/shopping/ The Tachyon Shopping module uses a loopback mechanism that enables the browser to make calls to the Shopping Agent via the local computer. The Tachyon Shopping module contacts the Shopping Central website to get the appropriate URL to use for the local loopback mechanism and the URL is no longer locally configured, as was the case for the previous Shopping Agent Installer. 
Enable Edge/Windows App Support: If users are likely to access the Shopping web site using Microsoft Ede or other Metro Browsers.
204. Click Next on the Nomad Client Settings Page and arrive on the Summary page, once the list is finished compiling, take a moment and review the actions that are about to be taken. When ready, click the Create button




If Shopping Integration is enabled, when the 1E Client starts it will attempt to automatically remove any previous installations of the 1E Shopping Agent.
205. The actions will be recorded as they are completed on the Progress page. When the Status changes to Successful, you may review the completed actions and click Next when ready
206. Click Finish on the Completion page to close the wizard

Observe the Results of Running the 1EClientDeploymentAssistant Wizard

Once we have run the Client Deployment Assistant wizard, we will look at the objects that were created in the ConfigMgr console.

207. In the ConfigMgr console, select the Assets and Compliance workspace and click on Device Collections
208. Note that the 1E Client 4.1.0.267 - Required collection has been created and has zero members at this point
209. Click on the Deployments tab at the bottom of the page and note that the 1E Client 4.1.0.267 application has been deployed to the collection
210. In the Software Library workspace, expand Application Management and select Applications
211. Note the 1E Client 4.1.0.267 application has been created and the content has been distributed to the distribution point

Deploy the 1E Client to Lab Workstations

Now that all the required components are created in the ConfigMgr console, we simply need to add our desired targets to the 1E Client 4.1.0.267 - Required collection and force a machine policy update cycle to deploy the Tachyon Agent.

212. In the ConfigMgr console, go to the Assets and Compliance workspace and select Devices
213. Multi-select the 1ETRNW71, 1ETRNW72, 1ETRNW73, 1ETRNW101 and 1ETRNW102 computers
214. Right-click on any of them, select Add Selected Items > Add Selected Items to Existing Device Collection
215. Select the 1E Client 4.1.0.267 - Required collection and click OK
216. Click on Device Collections, select the 1E Client 4.1.0.267 - Required collection and refresh the view until the Member Count shows 5
217. Right-click on the 1E Client 4.1.0.267 - Required collection, select Client Notification and choose Download Computer Policy

Validate the 1E Client installation on each client

After a few minutes, complete the following tasks to ensure the 1E Client is installed and functioning.

218. Log on as 1ETRN\user
219. Open Programs and Features from Control Panel and verify that the 1E Client is installed
Might take a minute or two after policy refresh for the application to install. Hit F5 after a minute to refresh the view. If you don't see it after a few minutes, manually run computer policy on the client.
220. Open the Services applet from the desktop and note the 1E Client service running
221. Open the 1E.Client.log file in C:\ProgramData\1E\Client

Lab Summary

We started this lab identifying the key users and groups that Shopping uses both internally and for administration. We reviewed the permissions and security rights that these specific users and groups require, and which of these are normally configured by the Shopping Central and Receiver installers.
We learned how to use a DNS alias, combined with HTTP Redirection, to enable Shopping to be accessed using an easily remembered URL. You also understand therefore why it is necessary to define a Service Principal Name for the HTTP service class on the alias address.
We prepared the environment for the installation of Shopping. We installed the Shopping Central service on the application server, and then installed the Shopping receiver on the ConfigMgr Primary site server.
Lastly, we deployed the 1E Client to our lab workstations. The 1E Client allows for the proper identification of the machine/user accessing the Shopping portal. It is also used for WSA orders.

Next Page

Ex 3 - Shopping 5.6 - Exploring the Shopping User Interfaces