Community Administrator
Forwarding from Lynn
=====================================================
All,
I know this is a LOT of information, but it is important if you want your center computers to function correctly.
· At the following URL you will find an Excel report showing the "health" of all of the computer systems in the FHC Tivoli database.
o https://familysearch.org/remote/tivoli/ ... nters.xlsx
Center Directors and Technology Specialists, please find your "FHC ID Number" and Computers in the spreadsheet and work to resolve the following issues.
Desktop Management Components
· Missing Computers?
o If you have computers in your center that are not in the list, please get LANDesk and Tivoli installed and working on them.
o Reminder: Inventory replacements is based on this data, so it is to your benefit to get these tools installed.
· Last Tivoli Check-in
o When computers are on, each computer should be reporting into Tivoli regularly (several times per day).
· DTS:: DepartmentAbr
o This value should be set to "FHC".
o It is set by Tivoli.
o It can also be manually set in this registry entry:
§ HKLM\Software\Desktop, Department_Abr
o This value is used by HP DDMI so we know which computers belong to family history centers.
· Full Operating System Name and Service Pack Level
o Please remember, Windows 2000 is no longer supported by either FamilySearch or by Microsoft. Upgrade as soon as possible.
o Windows XP systems should have Service Pack 3 installed.
FHC Services Portal Components
· ExpiryDate_Ver
o The latest version of this file is 1.0.0.5. All computers should have this version.
o If your computer does not have 1.0.0.5, please get Tivoli installed and verify the Sophos, Windows, or other firewall is not blocking Tivoli.
§ IBM BigFix TCP/UDP 52311
§ IBM Bigfix TCP/UDP 888
§ DDMI TCP/UDP 2738
· While you are working on your firewalls, make sure that HP DDMI can get through too.
· It is the corporate standard for inventory reporting and will replace LANDesk's inventory functionality in 2013.
· Portal_Expiry_Date
o Any future date listed in this column is acceptable except when it has a GMT offset of -07:00. These offsets are no longer used.
o Making sure the ExpiryDate_Ver gets updated to 1.0.0.5 and then runs successfully, it should update this value.
· new.PortalSvc_Ver
o The latest version is currently 2.0.1.2, however most systems should be at 2.0.1.1.
o Again, Tivoli should update this, so make sure Tivoli is running.
· Web-Filtered
o The Presiding Bishopric has set policy that states that all Church owned computers are required to be web-filtered.
o This functionality is provided by your Cisco firewall device (PIX, ASA, or 881).
o A web-filter test is run regularly on each computer.
o A value of "Filtered" or "Inconclusive" is required for the new implementation of the FHC Services Portal to function.
§ New.PortalSvc.exe will not register computers with the new Portal when they are not filtered.
· PhoneHomeStatus_Simplified
o This is the last recorded results of new.PortalSvc.exe's attempt to "phone home" to the new FHC Services Portal.
o Systems need to have a value of "Accepted" in order to have access to the new Portal.
o Make sure you're the ExpiryDate and the new.PortalSvc versions are up-to-date.
o Verify Sophos is not quarantining portal related files. If so, run this tool:
§ http://downloads.sophos.com/tools/FixIssues.exe
§ Then reboot your systems and give them some time to update.
Sophos Related Components
· Sophos Anti-virus Version
o The current version is 10.0.6.6995.
o If Tivoli is working correctly (and not blocked by a broken Sophos installation or a firewall), then Tivoli should update each system to version 10.0.6.6995.
o If the Sophos system tray icon is not being displayed by the system clock (and is not hidden), or Sophos is quarantining files you don't think it should be quarantining, run this tool:
§ http://downloads.sophos.com/tools/FixIssues.exe
§ Then reboot your systems and give them some time to update.
o You can manually update Sophos by downloading and installing this package:
§ https://familysearch.org/remote/sophos/ ... nstall.exe
· Update Policy Date
o This tells Sophos how it should obtain updates via our FHC Sophos Relay Servers.
o It should be a date later than October 12, 2012.
o If your systems are not updating, you can either wait for Tivoli to do it automatically, or you can update it manually.
· Antivirus Policy Date
o This configures Sophos to handle our files correctly.
o It should be a date later than October 12, 2012.
o If your systems are not updating, you can either wait for Tivoli to do it automatically, or you can update it manually.
· Firewall Policy Date
o This should only exist if your systems have the Sophos firewall installed.
o It should be a date later than October 12, 2012.
o The firewall policy opens up the necessary ports to allow File and Printer sharing in our FHC networks.
o If your systems are not updating, you can either wait for Tivoli to do it automatically, or you can update it manually.
· ComputerDescriptionOverride
o This value gets set by Tivoli.
o It allows us to recognize the geographical area and center ID number, for each computer in the Sophos console.
· Sophos Primary
o These are so our FHC systems can obtain Sophos updates.
o The primary FHC relay servers are
§ http://ldssr3d.ldschurch.org, and
§ http://ldssr3e.ldschurch.org
o If the computer's primary relay servers are not set correctly, they will not receive the correct policy configurations.
o Sophos SHOULD set these correctly. However, when it doesn't, we make the attempt with Tivoli.
o Hopefully these will be resolved over time. However, if you would like to update Sophos manually, please do so.
o If no primary relay server is listed, or that relay server is temporarily unavailable, then the secondary entry is used.
· Sophos Secondary
o It should be set to http://es-web.sophos.com/update/, which is main Sophos update servers.
o It will keep your systems up-to-date with the latest virus definition files, and Sophos version,
o However, it will not provide the correct Update Policy, Antivirus Policy, or Firewall Policy.
o If no primary and no secondary server entries are listed, your systems will not be protected correctly, nor will they have the correct policies.
o Hopefully these will be resolved over time with Tivoli. However, if you would like to update Sophos manually, please do so.
Deep Freeze Components
· Deep Freeze Status
o If your systems have Deep Freeze installed on them (NOT required), then
o Please make sure your Deep Freeze agent is configured to run maintenance on a nightly basis for several hours.
o Make sure your staff remember to leave the computers on so maintenance can run.
o The agent may be configured to shut down your systems at the end of the maintenance cycle.
o If you need help configuring your Deep Freeze, please contact FamilySearch support.
· DPCustomCfg Last Ran Date
o If your systems have Deep Freeze installed on them,
o the Deep Freeze agent should be automatically running the latest version of DPCustomCfg.exe (also known as the "LANDesk Updater")
§ Version 9.0.5.0, last updated November 4, 2010.
o If the date listed is more than a month old, or isn't listed at all, then your Deep Freeze agent is NOT configured correctly. Please fix it as soon as possible.
Lynn Shaw
Engineer
FHC Admin Team
FamilySearch
=====================================================
All,
I know this is a LOT of information, but it is important if you want your center computers to function correctly.
· At the following URL you will find an Excel report showing the "health" of all of the computer systems in the FHC Tivoli database.
o https://familysearch.org/remote/tivoli/ ... nters.xlsx
Center Directors and Technology Specialists, please find your "FHC ID Number" and Computers in the spreadsheet and work to resolve the following issues.
Desktop Management Components
· Missing Computers?
o If you have computers in your center that are not in the list, please get LANDesk and Tivoli installed and working on them.
o Reminder: Inventory replacements is based on this data, so it is to your benefit to get these tools installed.
· Last Tivoli Check-in
o When computers are on, each computer should be reporting into Tivoli regularly (several times per day).
· DTS:: DepartmentAbr
o This value should be set to "FHC".
o It is set by Tivoli.
o It can also be manually set in this registry entry:
§ HKLM\Software\Desktop, Department_Abr
o This value is used by HP DDMI so we know which computers belong to family history centers.
· Full Operating System Name and Service Pack Level
o Please remember, Windows 2000 is no longer supported by either FamilySearch or by Microsoft. Upgrade as soon as possible.
o Windows XP systems should have Service Pack 3 installed.
FHC Services Portal Components
· ExpiryDate_Ver
o The latest version of this file is 1.0.0.5. All computers should have this version.
o If your computer does not have 1.0.0.5, please get Tivoli installed and verify the Sophos, Windows, or other firewall is not blocking Tivoli.
§ IBM BigFix TCP/UDP 52311
§ IBM Bigfix TCP/UDP 888
§ DDMI TCP/UDP 2738
· While you are working on your firewalls, make sure that HP DDMI can get through too.
· It is the corporate standard for inventory reporting and will replace LANDesk's inventory functionality in 2013.
· Portal_Expiry_Date
o Any future date listed in this column is acceptable except when it has a GMT offset of -07:00. These offsets are no longer used.
o Making sure the ExpiryDate_Ver gets updated to 1.0.0.5 and then runs successfully, it should update this value.
· new.PortalSvc_Ver
o The latest version is currently 2.0.1.2, however most systems should be at 2.0.1.1.
o Again, Tivoli should update this, so make sure Tivoli is running.
· Web-Filtered
o The Presiding Bishopric has set policy that states that all Church owned computers are required to be web-filtered.
o This functionality is provided by your Cisco firewall device (PIX, ASA, or 881).
o A web-filter test is run regularly on each computer.
o A value of "Filtered" or "Inconclusive" is required for the new implementation of the FHC Services Portal to function.
§ New.PortalSvc.exe will not register computers with the new Portal when they are not filtered.
· PhoneHomeStatus_Simplified
o This is the last recorded results of new.PortalSvc.exe's attempt to "phone home" to the new FHC Services Portal.
o Systems need to have a value of "Accepted" in order to have access to the new Portal.
o Make sure you're the ExpiryDate and the new.PortalSvc versions are up-to-date.
o Verify Sophos is not quarantining portal related files. If so, run this tool:
§ http://downloads.sophos.com/tools/FixIssues.exe
§ Then reboot your systems and give them some time to update.
Sophos Related Components
· Sophos Anti-virus Version
o The current version is 10.0.6.6995.
o If Tivoli is working correctly (and not blocked by a broken Sophos installation or a firewall), then Tivoli should update each system to version 10.0.6.6995.
o If the Sophos system tray icon is not being displayed by the system clock (and is not hidden), or Sophos is quarantining files you don't think it should be quarantining, run this tool:
§ http://downloads.sophos.com/tools/FixIssues.exe
§ Then reboot your systems and give them some time to update.
o You can manually update Sophos by downloading and installing this package:
§ https://familysearch.org/remote/sophos/ ... nstall.exe
· Update Policy Date
o This tells Sophos how it should obtain updates via our FHC Sophos Relay Servers.
o It should be a date later than October 12, 2012.
o If your systems are not updating, you can either wait for Tivoli to do it automatically, or you can update it manually.
· Antivirus Policy Date
o This configures Sophos to handle our files correctly.
o It should be a date later than October 12, 2012.
o If your systems are not updating, you can either wait for Tivoli to do it automatically, or you can update it manually.
· Firewall Policy Date
o This should only exist if your systems have the Sophos firewall installed.
o It should be a date later than October 12, 2012.
o The firewall policy opens up the necessary ports to allow File and Printer sharing in our FHC networks.
o If your systems are not updating, you can either wait for Tivoli to do it automatically, or you can update it manually.
· ComputerDescriptionOverride
o This value gets set by Tivoli.
o It allows us to recognize the geographical area and center ID number, for each computer in the Sophos console.
· Sophos Primary
o These are so our FHC systems can obtain Sophos updates.
o The primary FHC relay servers are
§ http://ldssr3d.ldschurch.org, and
§ http://ldssr3e.ldschurch.org
o If the computer's primary relay servers are not set correctly, they will not receive the correct policy configurations.
o Sophos SHOULD set these correctly. However, when it doesn't, we make the attempt with Tivoli.
o Hopefully these will be resolved over time. However, if you would like to update Sophos manually, please do so.
o If no primary relay server is listed, or that relay server is temporarily unavailable, then the secondary entry is used.
· Sophos Secondary
o It should be set to http://es-web.sophos.com/update/, which is main Sophos update servers.
o It will keep your systems up-to-date with the latest virus definition files, and Sophos version,
o However, it will not provide the correct Update Policy, Antivirus Policy, or Firewall Policy.
o If no primary and no secondary server entries are listed, your systems will not be protected correctly, nor will they have the correct policies.
o Hopefully these will be resolved over time with Tivoli. However, if you would like to update Sophos manually, please do so.
Deep Freeze Components
· Deep Freeze Status
o If your systems have Deep Freeze installed on them (NOT required), then
o Please make sure your Deep Freeze agent is configured to run maintenance on a nightly basis for several hours.
o Make sure your staff remember to leave the computers on so maintenance can run.
o The agent may be configured to shut down your systems at the end of the maintenance cycle.
o If you need help configuring your Deep Freeze, please contact FamilySearch support.
· DPCustomCfg Last Ran Date
o If your systems have Deep Freeze installed on them,
o the Deep Freeze agent should be automatically running the latest version of DPCustomCfg.exe (also known as the "LANDesk Updater")
§ Version 9.0.5.0, last updated November 4, 2010.
o If the date listed is more than a month old, or isn't listed at all, then your Deep Freeze agent is NOT configured correctly. Please fix it as soon as possible.
Lynn Shaw
Engineer
FHC Admin Team
FamilySearch
Have you searched the Help Center? Try doing a Google search and adding "site:churchofjesuschrist.org/help" to the search criteria.
So we can better help you, please edit your Profile to include your general location.
So we can better help you, please edit your Profile to include your general location.
