Optional Directory Protection

SmartShield has a new feature, Optional Directory Protection (ODP). ODP is designed to optionally remove a directory from being protected by SmartShield. This allows a user to specify directories to allow changes that persist from boot to boot. Directories that have been marked for ODP allow files and folders to be saved, changed and deleted. This feature will allow the user profile directories like My Documents and Desktop to accept changes. ODP can also be used in Program Files sub directories to allow the possibility for updates to a program without disabling protection. Rather than redirecting saves this all-new technology allows you to save directly to the hard drive. This removes the need for the special storage space; therefore you are only limited by the size of your hard drive.

ODP on Smart Shield Client

Open up the client and click the Storage Configuration button.

Navigate to the Optional Directory Protection tab.

On this tab, select the folder(s) that need to be excluded from protection. In this example, the desktop and my documents have been selected. Press Submit.

Enter the password for the SmartShield software.

Your changes will take place after reboot.

The “List Directories” button will show all of the directories that are excluded from protection.

ODP on Smart Control Resource Manager

Access ODP through the File Menu: Client Control > Misc. Configuration > Optional Directory Protection

Or through the right click menu of a client Misc. Configuration > Optional Directory Protection

The Optional Directory Protection screen will show up.

From the Smart Control, you can now enter the directory to exclude from protection. If the directory exists on the targeted computer(s), it will be excluded from protection. Conversely, if protection needs to be restored to a directory from the Smart Control, check the box before submitting the form to return protection.

Select Yes to continue, or No, to return.

That is all there is to it! Optional Directory Protection is a simple yet powerful way to use SmartShield to be more productive than ever before while computing in a safe environment!

Restrictions:

ODP will not allow Junction Points, Reparse Point or System Directories.

ODP may also affect the way system files or shortcuts are used and created.

Changes or Updates that require updates to the registry will not be compatible with ODP.

SmartShield with Smart Control

Managing Environments Over 1000 clients

Every day we speak to Smart Control users that are expected to do more with less. Whether you are managing 25 clients in a library or 5000 clients across a campus, you need the ability to track and control them in one location. We have posted on our website and our blog the minimum requirements for a Smart Control. Smart Control can be installed on a machine with 512 MB of RAM (not shared to other devices), XP, Vista, Windows 7, Server 2003, or Server2008 as the operating system. These minimum requirements will work for any smaller implementations of Smart Control and SmartShield, but as the number of clients grows so do the hardware requirements for the Smart Control server. As we tested for version 2.1.10 we set a benchmark of connecting ten thousand machines. Using a virtual environment we were able to manage this large number of machines with the following configuration.

Server 2008 Operating System

3.1 MHZ Quad Core Processor

16 GB RAM

Slowed the keep-alive time to ten minutes via the Smart Control preferences panel. We recommend slowing down the keep alive to one minute for every thousand machines pointed to the Smart Control.

10,000 machines / 1,000 machines per minute à 10 minute keep alive

At this time we are confident that this configuration makes it possible for almost any deployment we have encountered.  This testing leads us to believe that the Smart Control may be able to handle even more clients given more advanced hardware.  As you are implementing your Smart Control/SmartShield network please contact us with any question or for tips on configuration.

Controlling Smart Shield from a Second Smart Control

Starting with version 2.1.10 SmartShield will have the ability to report to a second Smart Control. The primary Smart Control, which is the one entered at install or through the client configuration panel, will have the ability to assign a second Smart Control to a client. The Secondary Smart Control will receive keep-alive messages from the client and will be able to fully control the client including schedules and ScreenView. The only restrictions are that licenses and product updates must come from the primary Smart Control. This feature was created to facilitate management of clients from a local Smart Control and centralized Smart Control.

Many customers have requested that Smart Shield have functionality to work with System Control Center Manager (SCCM). We have found that Smart Shield’s entire disk protection makes running updates in protected mode impossible to manage. The solution we have devised for SCCM managed machines is to stop all SCCM updates from running while protected, then allow SCCM updates when unprotected. This will allow users to schedule a maintenance window via the Smart Control so that updates can run. This eliminates the possibility of updates being run then removed on protected client machines.

888.265.6055
support@centuriontech.com

Hogan Haake
Support Manager

As we continue to add features to the Smart Shield and Smart Control Products, we have found that some customers have a requirement to limit some features on a set of machines, while allowing said feature on others. For example, an organization may only allow desktop monitoring on public access computers. Controlling licensing at this granular level previously required the client to license with a standalone key or a separate Smart Control. Standalone licensing can be restrictive and may not be suited for all environments. In order to give administrators the flexibility of Smart Control Managed Licensing and control over the clients features, we have created Advance License Discreteness.

With Advance License Discreteness, the Smart Control exposes license groups to the administrator allowing him/her to organize machines into the license group that work with the specific set of permissions required for that client. Once the client is added to a group it will be assigned a license with that group’s feature set on every license request. Advance License Discreteness does require that one of the license types be set as the default license type. The default license type is assigned to clients that are not specifically added to a license group.

Setting up Advance License Discreteness is no more complicated than a normal installation. When the Smart Control detects that the client licenses have different license types the License Group form pops up.

Using the drop down list, select the group that will be the default license type.

After selecting the default license type you will be prompted to restart the Smart Control panel. When the panel reconnects, the tree panel on the left side will include a new set of nodes called “Licensing”.

For each type of license there will be a key icon with a description of the features for that license type. These nodes are used just like groups. Add machines to a license group by dragging and dropping or cutting and pasting the machines into the group.

Once the machine is assigned to a group it will request that specific license type on all subsequent license requests. It is a good idea to reboot immediately so that the client can request a new license. The license group in bold, is the default group. To change the default group, right click the “License” node and the License Group form will appear.

888.265.6055
support@centuriontech.com

Hogan Haake
Support Manager

Previous versions of Smart Series products did not always work correctly when subnets were involved. Many network administrators were able to configure their networks to work around this issue, but not all customers have network administrators available to modify their network.
How do you know if this is a problem for you?

The simplest way to know if this issue affects you is to look at your Smart Control. If there are multiple computers reporting to the Smart Control that have the same IP address, then you would be affected by the subnet issue. This is easily reproduced by adding a home router to your existing network and connecting two machines up to it. The machines will display the same IP address and appear to be connected to the Smart Control, but they cannot be controlled by the Smart Control.

How did we fix it?
Centurion’s software engineers looked at the communication methods of our legacy products and tried to reproduce those as closely as possible for this version. Starting with this version, clients can communicate with the server using the previous proven method, or a newer method that lets us work with subnets to provide a constant reliable connection to the server. In all of our in-house and remote tests, the new communication method provides reliable cross subnet communication.

How do I get the new communication?
There is a new preference in the Smart Control that users must enable. It is located in the Smart Control preferences under the “Network” tab. The checkbox has a long description reminding users what it does. It is important to note that Smart Shield clients must be on version 2.1.9 or higher to take advantage of this new feature.

888.265.6055
support@centuriontech.com

Hogan Haake
Support Manager

A common question asked is, “What ports do your products use?”. Centurion products use the following ports:

25552
25553
25554
25555

The ports listed above must be open on the Smart Shield Client and the Smart Control machines. In addition, any network device such as a router or firewall must also allow the ports to be open. If these ports are not open, the software will not be able to communicate correctly.

If you are having issues setting up your software, please contact technical support. They have software tools to test that the correct ports are open between two machines.

888.265.6055
support@centuriontech.com

Hogan Haake
Support Manager

Advantages for Smart Control Managed Licensing:

1. The only license key that is needed is for Smart Control.
   No client license keys to enter at install or track/document.
2. Allows for a generic image to be installed on numerous computers.
3. Hardware changes on the client computer will not affect the license status.
4. Client attempts to renew license and update permissions on each reboot.
5. The license lease is transferable allowing for client computers to be easily replaced or temporary taken off line in the event of hardware failure or maintenance.
6. Allows the client to be installed using the answer file install.

Drawbacks to Smart Control Managed Licensing:

1. Clients must connect to their licensing Smart Control every 30 days for license lease renewal. Interruptions in the network communication can cause licensing issues.
2. Licensing with Smart Control may require some network, firewall and port configuration
3. Clients that leave the local network, like laptops, may go suspended if they cannot reach the licensing Smart Control.
4. The Smart Control must be powered on at all times.
5. If the Smart Control license status changes, the clients will also change.

Advantages for Standalone Client Licensing:

1. Once the client has been licensed at install, the license is permanent and will stay active regardless of Internet/Smart Control connectivity. This is best for laptop programs.
2. Clients can still be controlled by the Smart Control even if they have a standalone license.

Drawbacks for Standalone Client Licensing:

1. License keys must be entered into each client install manually. Does not allow for answer file install and makes imaging more difficult. In versions after 2.1.8 the key can be assigned from the Smart Control.
2. Licenses must be tracked/documented. In versions after 2.1.8 the standalone key will be a part of the client record and can be exported to CSV file.
3. Multiple hardware changes on the client may cause the license to be invalid.
4. License can only be reused if Smart Shield is fully and properly uninstalled, otherwise the license maybe invalid.
5. Updates to license permissions will be propagated monthly by calling to our licensing server. This requires active Internet connection. If the client is unable to contact the server the license remains in its current state.

Due to many improvements made to speed up the TCP/IP communication in Smart Control Resource Manger the service is now loading much faster. Unfortunately, we have found that in some cases when rebooting, Smart Controls running version 2.1.8 on Windows 7 our service may be loading faster that the TCP/IP connection can handle. There is a simple solution to this problem. Windows 7 Smart Controls may need to slow down the service start up type to allow for the IP address to be registered in the service. To do this open the Service Control manager and change the Centurion Smart Control service startup type from Automatic toAutomatic (Delayed Start). Changing the service to Automatic (Delayed Start) will give the machine time register its IP address before listening for clients on all subsequent reboots.

We received a technical support phone call regarding the use of the command line functionality in Smart Shield. The customer had some issues getting command line to work when there was no user logged into the client machine. Once the user was logged in, the command line portion worked as they expected. Many times, the way we use and design our software is not the same as the way that our customers use and understand our software. Because of this mix up, we’re writing to explain changes to command line and expand on its use.

Starting with release 2.1.5 (released in October of 2010), the command line functionality was separated from the primary application into a separate application.

Before 2.1.5 release
c:\program files\centurion technologies\client\ctsrgui.exe
2.1.5 and After
c:\program files\centurion technologies\client\ctsrcmd.exe

For a list of commands available, navigate to the folder and type “ctsrcmd /h”

You may notice that some functionality for command line still works with the previous executible (ctsrgui.exe), however, going forward it will not be supported. Giving command line its own application makes it faster and allows us to include more functionality.

As always, call, email, or comment so we can know what you think or to clarify.

Hogan Haake
Support Manager