Lenovo ThinkPad Tablet Deployment Guide [en, id, ru]

Download

ThinkPadTabletDeploymentGuide

Note:Beforeusingthisinformationandtheproductitsupports,readthegeneralinformationinAppendixA “Notices”onpage17.

FirstEdition(August2011)

©CopyrightLenovo2011.

LIMITEDANDRESTRICTEDRIGHTSNOTICE:IfdataorsoftwareisdeliveredpursuantaGeneralServicesAdministration “GSA”contract,use,reproduction,ordisclosureissubjecttorestrictionssetforthinContractNo.GS-35F-05925.

Contents

Chapter1.Overview..........1

LenovoDevicePolicyManagerService.....2

Chapter2.Conguration.......5

XMLcongurationles...........5

ActiveDirectorydomainserver........11

CongurationProleSignandEncryptUtility...11

LenovoProleManager...........11

Chapter3.UsingMicrosoftExchange

ActiveSync..............13

Chapter4.LenovoMobility

Manager................15

AppendixA.Notices..........17

Trademarks................18

©CopyrightLenovo2011

iii

ivThinkPadTabletDeploymentGuide

Chapter1.Overview

TheLenovoThinkPadT abletgivesyoutheabilitytocongureandmanagethetabletusingregulartoolssuch asyouusewithinyourenterprise.Youcancontroltabletfunctions,enablecorporatesecurity,passwords, encryptionanddigitalsignatures.

YoucanpushdowncongurationorpolicysettingstotheThinkPadTabletintheseways:

•MicrosoftExchangeActiveSync

•AnXMLcongurationle

•LenovoMobilityManager

©CopyrightLenovo2011

HereistheinformationowfortheThinkPadTablet:

Figure1.ThinkPadT abletow

MicrosoftExchangeisusedasthecorporateemailcommunicationmethod.

YoucancreateormodifyanXMLleusingeitheratexteditororanXMLeditortopushdowntotheThinkPad tabletthroughtheLenovoCongurationFileHandlerAPK.OryoucanuseLenovoMobilityManagerSuiteto manageyouruser’sThinkPadtabletsusingthesuppliedLenovoMobilityManagerAPK.Thesemethodsthen arepassedthroughtheLenovoDevicePolicyManagerService.Formoreinformation,see“LenovoDevice PolicyManagerService”onpage2

LenovoDevicePolicyManagerService

TheDevicePolicyManagerServicehandlesthemanagementoftheThinkPadTablet.Thiscomponent providesaninterfacethatallowsmanagementtools,suchasActiveSync,anXMLle,orLenovoMobility Managertoconguredevicefeatures,suchasWiFiprolesanddevicepolicies.

2ThinkPadT abletDeploymentGuide

ThisinterfaceallowsyoutopushthefollowingcongurationstotheThinkPadTablet:

•WiFiproles

•WiFiaccesspointlters

•WiFiradiopowersettings

•MicrosoftExchangeE-mailserverconguration

•VPNconguration

•ActiveSyncserverconguration

•Devicefeaturedisable,including:

–Camera

–USBport

–SDcard

–Microphone

–Pen

–Bluetooth

–WiFi

•Clientcerticates

•Webproxy

•SDcardencryption

•AndroidPasswordpolicies

Chapter1.Overview3

4ThinkPadT abletDeploymentGuide

Chapter2.Conguration

TheThinkPadT abletallowsyoutocongurethecorporateservicesthatusersneedbyspecifying congurationsettingsinXMLles.WhentheseXMLlesaredeliveredtousersandimportedbytheThinkPad Tablet,thesettingsareappliedbytheThinkPadTablet.ConguringtheThinkPadT abletwithXMLleshelps makeiteasierforuserstoconnecttotheircorporatenetworksandaccounts,andquicklybeproductive.

XMLcongurationles

TheThinkPadT abletallowsyoutocongurecorporateservicesforusersbyspecifyingcongurationsettings intheXMLle.WhentheseXMLlesaredeliveredtousersandloadedontheThinkPadTablet,thesettings areautomaticallyappliedbythetablet.ConguringtheThinkPadT abletwithXMLlesmakesiteasierforthe usertoconnecttocorporatenetworksandaccounts.

UsingtheXMLle,youcancongurethefollowing:

•MicrosoftExchangee-mailserver

•VirtualPrivateNetwork(VPN)

•WirelessNetworkSettings

•Digitalcerticates

•ActiveDirectorydomainserver

•DevicePolicies

Youcancreateasingle,commonXMLcongurationleformultipleusers.TheXMLlemaycontain,for example,thecongurationsettingsforthesecurecorporatewirelessnetwork,theCAcerticateforthe wirelessnetwork,andtheaddressofthecorporateExchangeserver.YoucanmakethisXMLleavailableto theuserbysendingittotheuser’spersonale-mailaccount,whichtheusercanaccessusinganunsecured visitornetworkconnection,ortheuser’shomeinternetconnection.OryoucanalsoputtheXMLconguration leonaWebserver,makingitaccessibletoanyuserthatalreadyhastheproperintranetcredentials.

OncetheXMLcongurationleisreceivedbytheuser,thatusersimplytapstheleandtheLenovo CongurationProleHandlerislaunchedtoimportandapplythecongurationsettingsonthedevice.The usermaybepromptedtoenterpersonallogoncredentialsiftheywerenotincludedinthecongurationle, butallofthecommonserverinformationandsettingswillbepredenedfortheuser.

YoucansecuretheXMLcongurationlebydigitallysigningand/orencryptingit.Encryptinghelpsensure thatsensitivedataincludedinthecongurationle,suchaspasswords,cannotbereadbyunauthorized users.Digitalsignatureshelpsensurethatthecontentsofthelearenotchangedinanyway.

TheCongurationProleSignandEncryptUtilityallowssigningofthecongurationprolewithan embeddedprivatekey.Theutilityalsoallowstheletobeencryptedusinganencryptionkeyderived fromthepasswordprovidedtotheutility.

TheXMLcongurationlenamingconventionalwayshasaleextensionof.lenovocong,sothatthe ThinkPadTabletwillrecognizeitasacongurationle.Theleconsistsofthreeparts:

1.LenovoCongSettings

2.LenovoPolicySettings

3.AndroidPolicySettings

©CopyrightLenovo2011

TheLenovoCongSettingssectionprovidescontrolforthesecurityandencryptionfortheThinkPadT ablet.It importscongurationsettingssuchasWiFiproles,corporatedomainservers,virtualprivatenetworks,and certicates.Oncetheseareapplied,theycannotbedeleted.

TheLenovoPolicySettingssectionallowsyoutosetcontrolsforthevariousfunctionsoftheThinkPadtablet suchasthecamera,microphone,SDcardsandBluetooth,andWiradios.Anyofthesefunctionscanbe enabledordisableddependingonyourcorporatepolicy.

TheAndroidPolicySettingsectionisusedtosetuppolicysettingssupportednativelybyAndroid,including storageencryption,passwordlength,numberofnumbersandlettersrequired.

NotethataUUIDisrequiredforeachXMLlethatyoucreate.Ifyouwanttooverwriteorremoveanyexisting policies,youcansenddownanewlewiththesameUUIDoftheexistingappliedpolicy,anditwilloverwrite theexistingle.SincemultipleXMLles(withdifferentUUIDs)canberesidentontheThinkPadTablet,the lewiththestrongestpolicieswillbeapplied.Forexample,ifyouhaveanXMLlethatrequiresonlya numericpasswordandanotherlewithadifferentUUIDthatrequiresalonger,alphanumericpassword,the lewiththealphanumericpasswordwillbeapplied.

ThefollowingtablesprovideinformationonsettingsfortheXMLle.Thetableheadersare:

•Setting-Thesettinginthexmllethatyoucanuserequireausertologintoacorporateserverortoallo orpreventuserfromusingacertainfunctionrequireofthedevice.

•Parameter-Theeldsinthesettingthatyouassignavaluefortheusertollin

•Value-Therequiredvalueyouneedtoenterforthateldsuchasserveraddress,userid,Y es/Noand soon.

•Notes-Anyspecialnotesthatapplytoasetting.

Table1.LenovoCongSettings

SettingParameterValuesNotes

EmailAccount•Type

•SSL

•AcceptAllCerts

DomainServer•ServerAddress

•UserID

•Password

CerticateType

VPN•PPTP

•T ype

•Name

•Filename/Encoded

–Name

–Server

–OverwriteIfExists

–DNSSearchDomain

–Encryption

•L2TP

–Name

•Exchange

•Y es/No

•Serveraddress

•UserID

•Password

•Root/User

•CerticateName

•?

•Point-toPointT unnelingProtocol

–Protocolnames

–ServerIPaddress

–Y es/No

–DomainIPAddress

–DomainIPaddress

–Y es/No

•Layer2T unnelProtocol

–Nameoftheserver

MicrosoftExchangeis theonlysupportedemail typeatthistime.

•Serveraddressis required

•Optional

Certicatesmaybe includedintheXMLle inaBase-64encoded format.

6ThinkPadT abletDeploymentGuide

Table1.LenovoCongSettings(continued)

SettingParameterValuesNotes

–Server

–OverwriteIfExists

–DNSSearchDomain

–Encryption

•L2TPIPSecPSK

–Name

–Server

–OverwriteIfExists

–Secret

–IPSecPresharedKey

•L2TPIPSecCrt

–Name

–Server

–OverwriteIfExists

–DNSSearchDomain

–UserCerticate

–CaCerticate

•AnyConnect

–Name

–Host

–OverwriteIfExists

–UserCert

–CertCommonName

–ServerIPaddress

–Y es/No

–IPAddress

–Y es/No

•AndroidPSK

–PSKname

–ServerURL

–Y es/No

–Password

–PresharedKey

•L2TPIPSecCrt

–CRTName

–URL

–Y es/No

–DomainIPAddress

–DomainIPadress

–Certicatename

–Certicateinfo

•AnyConnect

–VPNnames

–HostIPaddress

–Y es/No

–Certicatename

Table2.LenovoPolicySettings

SettingFieldValuesNotes

DeviceControl•Camera

•SDCardSlot

•Mic

•Bluetooth

•Dataroaming

•USBPort

•MicroUSBPort

•SDCardSlot

•UnknownSources

•USBDebugging

•Wi

•HDMI

•T ethering

•Allow/Block

Chapter2.Conguration7

Table2.LenovoPolicySettings(continued)

SettingFieldValuesNotes

•Hotspot

SecurityPolicy•SDCardEncryption

•ADScreenLock

Table3.AndroidPolicySettings

SettingFieldValuesNotes

StorageEncryption•Required/Notrequired

Password•maxFailuresForWipe

•maxTimeToLock

•expirationTimeout

•historyLength

•minLength

•minLetters

•minLowercase

•minNonletters

•minNumeric

•minSymbols

•minUppercase

•Quality

•Allow/Block

•Notrequired/Required

•Numberoffailuresbeforedeviceis wiped

•Numberinmilliseconds

•Numberofpreviouspasswords

•Minimumcharacterlength

•Minimumnumberofletters

•Minimumnumberoflowercaseletters

•Minimumnumberofnonletters

•Minimumnumericdigits

•Minimumsymbols

•MinimumUppercaseletters

•Setpasswordrestrictionssuchas numericsandalphanumerics

FormoreinformationonAndroidPolicySettings,see http://www.google.com/support/a/bin/answer.py?answer=1056433&topic=14576

HereisasampleXMLle:

<?xmlversion="1.0"encoding="utf-8"?>

<lenovocong

xmlns:xsi="http://www.w3.org/2001/XML Schema-instance" xsi:noNamespaceSchemaLocation="lenovocong.xsd" uuid="2237f15e-1ce5-4e55-9fe6-767118c370c8"> <Header>

<DisplayName>Samplepolicy</DisplayName> <Author>DavidRivera</Author> <Source>Manual</Source> <AllowUserRemove>yes</AllowUserRemove> <RebootOnApply>no</RebootOnApply>

</Header>

<LenovoCongSettings>

<EmailType="Exchange"SSL="yes"AcceptAllCerts="yes">

<ServerAddress>gmail.com</ServerAddress> <UserID>t.cloud09@gmail.com</UserID>

</Email>

<ServerAddress>dc.lenovo.com</ServerAddress>

8ThinkPadT abletDeploymentGuide

<UserID>drivera</UserID>

</DomainServer>

<Certicatetype="Root">

<name>CorporateCACert</name>

<encoded> MIIDEzCCAnygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBxDELMAkGA1UEBhMCWkEx FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv biBTZXJ2aWNlcyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEm MCQGCSqGSIb3DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wHhcNOTYwODAx MDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCBxDELMAkGA1UEBhMCWkExFTATBgNVBAgT DFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYDVQQKExRUaGF3 dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNl cyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEmMCQGCSqGSIb3 DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wgZ8wDQY JKoZIhvcNAQEBBQAD gY0AMIGJAoGBANOkUG7I/1Zr5s9dtuoMaHVHoqrC2oQl/Kj0R1HahbUgdJSGHg91 yekIYfUGbTBuFRkC6VLAYttNmZ7iagxEOM3+vuNkCXDF/rFrKbYvScg71CcEJRCX L+eQbcAoQpnXTEPew/UhbVSfXcNY4cDk2VuwuNy0e982OsK1ZiIS1ocNAgMBAAGj EzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAB/pMaVz7lcxG 7oWDTSEwjsrZqG9JGubaUeNgcGyEYRGhGshIPllDfU+VPaGLtwtimHp1it2ITk6e QNuozDJ0uW8NxuOzRAvZim+aKZuZGCg70eNAKJpaPNW15yAbi8qkq43pUdniTCxZ qdq5snUb9kLy78fyGPmJvKP/iiMucEc=

</encoded>

</Certicate>

<VPN>

<PPTP>

<Name>MyPPTPVPN</Name> <Server>pptp.server .com</Server> <OverwriteIfExists>yes</OverwriteIfExists> <DNSSearchDomain>10.10.10.10</DNSSearchDomain> <DNSSearchDomain>11.11.11.11</DNSSearchDomain>

<Name>MyL2TPVPN</Name>

<Server>l2tp.server.com</Server>

<Name>MyL2TPIPSecPSKVPN</Name>

<Server>ipsecpsk.server.com</Server>

<Secret>FEDCBA987654</Secret>

<IPSecPresharedKey>MyPreshardKey</IPSecPresharedKey> </L2TPIPSecPSK> <L2TPIPSecCRT>

<Name>MyL2TPIPSecCRTVPN</Name>

<Server>ipseccrt.server.com</Server>

<UserCerticate>DavidRiveraCert</UserCerticate>

<CaCerticate>CorporateCACert</CaCerticate> </L2TPIPSecCRT> <AnyConnect>

<Name>MyCiscoVPN</Name>

<CertCommonName>DavidRiveraCert</CertCommonName>

Chapter2.Conguration9

</AnyConnect>

</VPN>

<WirelessProleversion="0.01"type="WLAN">

<name>MyHomeNetwork</name> <SSIDtype="Normal">MyHome</SSID> <networktype>Infrastructure</networktype> <AuthenticationAlgorithm>Shared</AuthenticationAlgorithm> <keymgmt>None</keymgmt> <WEPKeys>

<Def aultKeyIndex>1</Def aultKeyIndex> <key1>MyWEPKey</key1>

</WEPKeys>

</WirelessProle>

<WirelessProleversion="0.01"type="WLAN">

<name>MyOfceNetwork</name> <SSIDtype="Normal">MyOfce</SSID> <networktype>Infrastructure</networktype> <AuthenticationAlgorithm>Open</AuthenticationAlgorithm> <keymgmt>WPA_PSK</keymgmt> <presharedkey>somepresharedsecret</presharedkey> <protocol>RSN</protocol> <proxytype="HTTP"requiresauth="no">

</proxy>

</WirelessProle>

<allow>

<SSID>MyHome</SSID>

<SSID>Coff eeShop</SSID> </deny>

</AccessPointFilter>

</LenovoCongSettings>

<Camera>Allow</Camera> <SDCardSlot>Allow</SDCardSlot> <Mic>Allow</Mic> <Bluetooth>Allow</Bluetooth> <DataRoaming>Block</DataRoaming> <USBPort>Allow</USBPort> <MicroUSBPort>Allow</MicroUSBPort> <SDCardSlot>Allow</SDCardSlot> <UnknownSources>Block</UnknownSources> <USBDebugging>Allow</USBDebugging> <Wi>Allow</Wi> <HDMI>Allow</HDMI> <Tethering>Block</T ethering> <Hotspot>Block</Hotspot>

</DeviceControl>

10ThinkPadT abletDeploymentGuide

<!–<SDCardEncryption>Required</SDCardEncryption>–> <SDCardEncryption>Notrequired</SDCardEncryption> <ADScreenLock>Notrequired</ADScreenLock>

</SecurityPolicy>

</LenovoPolicySettings>

<storageEncryption>Notrequired</storageEncryption> <Password>

</Password>

</AndroidPolicySettings>

</lenovocong>

TheThinkPadTabletXMLschemacanbefoundontheLenovoWebsiteatwww.lenovo.com/support.

ActiveDirectorydomainserver

AnexclusivefeatureoftheLenovoThinkPadtabletisthatyoucanuseMicrosoftActiveDirectorytoallowthe usertounlocktheThinkPadTabletusingcorporatecredentials.YousettheXMLletorequireanActive directorylogon,andtheusertouchesSettings->Location&Security->Congurelockscreen->Corporate logon.TheuserentersthedomainnameorIPaddress,username,andpassword.Afterthis,theusercan onlyusetheActiveDirectorydomaincredentialstounlockthemachine.

CongurationProleSignandEncryptUtility

ITadministratorscansecuretheXMLcongurationlebydigitallysigningand/orencryptingit.Encrypting helpsensurethatsensitivedataincludedinthecongurationle,suchaspasswords,cannotbereadby unauthorizedparties.Digitalsignatureshelpensurethatthecontentsofthelearenottamperedwith.

TheCongurationProleSignandEncryptUtilityallowssigningofthecongurationprolewithan embeddedprivatekey.Theutilitywillalsoallowtheletobeencryptedusinganencryptionkeyderived fromthepasswordprovidedtotheutility.

ThiscomponentisintendedonlyforthepreparationoftheXMLcongurationlefordeploymenttodevices. Itisavailableatwww.lenovo.com/supportandclickDownloadDrivers&Software

LenovoProleManager

TheLenovoProleManagerisanAndroidapplication(APK)thatispreloadedontheThinkPadTablet.This APKtakesXMLcongurationlesandhasthecongurationandpolicysettingsapplied,anddisplays informationaboutnewandinstalledcongurationproles.

Chapter2.Conguration11

AcongurationlereceivedbytheThinkPadTabletmusthaveaspecicleextension(.lenovocong). TheLenovoProleManagerisregisteredasthehandlerforleswiththisextension.Whenalewiththis extensionisreceivedonthedeviceandtappedbytheuser,theXMLCongurationProleHandlerwillrun.

TheLenovoProleManagercallsintotheLenovoDevicePolicyManagerServicetoperformaninitial parseofthecontentsofthele.Theinitialparse:

•VeriesthattheXMLlecontentsarevalidagainsttheschema

•Determineswhatsettingsareincludedinthele

TheLenovoProleManagerisregisteredasanAndroidDeviceAdministrationReceiverusingthenative Androidcapabilities.

TheLenovoProleManageralsodisplaysinformationabouttheinstalledprolestotheuser.Whentheuser touchesSettings->Location&security->Congurationproles,alistofinstalledproleswillbedisplayed usingthe“DisplayName”propertyofthecongurationle.Ifnoprolesareinstalled,theapplicationwill displaythemessage“Nocongurationproleshavebeenapplied. ”Ifmultipleprolesareinstalled,theuser willseealistofthem.Thedevicewillshowwhichpolicyistheappliedpolicyatthebottomofthepage.

Iftheuserselectsaninstalledprolefromthelist,thedetailsofthecongurationsettingsinthatlistwillbe displayed.AllinstalledprolesaredisplayedbytheCongurationProleHandler.Thisallowstheuserto viewallcongurationsettingsthathavebeenapplied.

Theproledisplayalsoallowstheusertoremoveselectedproles.Onlycongurationprolesthatwere installedbytheLenovoProleManagercanberemovedbytheuser,aslongasyoudidnotsettheproperty indicatingthatthepolicycannotberemoved.CongurationsettingsthatwerenotsetbytheLenovoProle Managerwillbedisplayed,butcannotberemovedbytheuser.

TheLenovoProleManageralsocallsintotheLenovoDevicePolicyManagerServicetoreceivealistof installedproles,andreceivesthelistofinstalledproles,theirsource,andwhethertheproleisallowedto beinstalledfromtheLenovoDevicePolicyManagerService.

12ThinkPadT abletDeploymentGuide

Chapter3.UsingMicrosoftExchangeActiveSync

TheThinkPadTabletincludessupportforMicrosoftExchangeActiveSync.TheThinkPadT abletscanbe managedwithMicrosoftExchangeActiveSyncinthesamewayasothermobiledevices.

MicrosoftExchangeActiveSyncofferspushmailcapabilityformobiledevices.Inadditiontopushinge-mail andcalendarentries,ActiveSyncallowstheyoutopushdevicepolicies.

TheThinkPadTabletsupportsthefollowingExchangeActiveSynccontrols:

•Remotewipe

•Passwordpolicies

•Deviceencryption

•Camera

•Wi-Fi

•Bluetooth

•SyncfromPC

•Removablestorage

•SDcardencryption

OnceaThinkPadT abletisconguredtoconnecttotheExchangeserver,policysettingspushedtothe devicefromtheExchangeserverareautomaticallyapplied,ensuringthatthedevicemaintainsthesecurity settingsthatyourITdepartmentrequires.

TheThinkPadtablete-mailclientincludessupportforExchangeActiveSyncpolicies.Thesepoliciesarefor passwordenforcementandfordeviceencryption.ThosesettingsnativelysupportedbyAndroid,including passwordanddeviceencryption,aresupportedwithoutchangebyLenovo.

ThiscomponentextendsthenativeActiveSynccapabilitybuiltintothee-mailclienttosupportadditional devicepoliciesnotnativelysupportedbyAndroid.TheadditionalActiveSyncpoliciessupportedonthe ThinkPadTabletinclude:

•Removablestorage(USBportandSDcardenable/disable)

•Camera

•WiFi

•Desktopsynchronization(microUSBenable/disable)

•Bluetooth(onlyBluetoothenable/disableissupported.IftheyousetBluetoothto“Handsfreeonly”inthe ActiveSyncconsole,itdisablestheBluetoothradio).

14ThinkPadT abletDeploymentGuide

Chapter4.LenovoMobilityManager

Lenovohasamobilitymanagementplug-inthatenablesyouto:

•Discoverdevices,withoutanagentatthepointofdataaccess,throughMicrosoftExchangeActiveSync systems

•Knowwhichusersareconsumingcorporatedataandwhatdevicestheyareusing

•Pushdowncorporatemanagementandsecuritysettingstoout-of-policydevices

•Wipedatausingasingleuser-basedpolicyfromdevicesthatarelostorstolenorwhensomeoneleaves yourorganization

•ImprovebusinessprocessesforreclaimingcorporateITassetsandproprietaryinformationasinthe caseofemployeetermination

TheLenovoMobilityManagerrequirestheusertologintothecongurationserverusingaPIN,whichthe userretrievesbyloggingintoaPINserverfromaPC.TheuserauthenticatestothePINserverusing corporatecredentials,andsuppliesthatPINwhenloggingontotheLenovoMobilityManagerconguration serverfromhisThinkPadTablet.Afterconnectingtothecongurationserver,theIT-providedconguration informationispushedtothedeviceandthedeviceisautomaticallycongured.

TousetheMobilitymanagementtools,thefollowingprerequisitesarerequired:

•LenovoThinkManagementConsoleVersion9.0withSP2orlater.

•ForExchange-enableddevices,youmusthaveinstalledtheExchangeManagementTools,availableasan optionfromwithintheMicrosoftExchangeinstallation.

•WindowsCommunicationFoundation(WCF)andInternetInformationServices(IIS)mustbeinstalledand registered.

Whenamobiledevicelogsintosynchronizee-mail,contact,andcalendarinformation,itdoessousingan existingOutlookmailboxaccount.Oncethedevicehasloggedin,theExchangeserverstoresidentifying informationinitsdatabase,includingtheDeviceID,owner,thedate/timeitloggedin,andsoon.That informationcanthenberetrievedfromtheExchangeserveranddisplayedintheMobilitymanagementtool.

16ThinkPadT abletDeploymentGuide

AppendixA.Notices

Lenovomaynotoffertheproducts,services,orfeaturesdiscussedinthisdocumentinallcountries.Consult yourlocalLenovorepresentativeforinformationontheproductsandservicescurrentlyavailableinyour area.AnyreferencetoaLenovoproduct,program,orserviceisnotintendedtostateorimplythatonlythat Lenovoproduct,program,orservicemaybeused.Anyfunctionallyequivalentproduct,program,orservice thatdoesnotinfringeanyLenovointellectualpropertyrightmaybeusedinstead.However,itistheuser's responsibilitytoevaluateandverifytheoperationofanyotherproduct,program,orservice.

Lenovomayhavepatentsorpendingpatentapplicationscoveringsubjectmatterdescribedinthis document.Thefurnishingofthisdocumentdoesnotgiveyouanylicensetothesepatents.Youcansend licenseinquiries,inwriting,to:

Lenovo(UnitedStates),Inc. 1009ThinkPlace-BuildingOne Morrisville,NC27560 U.S.A. Attention:LenovoDirectorofLicensing

LENOVOPROVIDESTHISPUBLICATION“ASIS”WITHOUTWARRANTYOFANYKIND,EITHEREXPRESS ORIMPLIED,INCLUDING,BUTNOTLIMITEDTO,THEIMPLIEDWARRANTIESOFNON-INFRINGEMENT , MERCHANTABILITYORFITNESSFORAPARTICULARPURPOSE.Somejurisdictionsdonotallow disclaimerofexpressorimpliedwarrantiesincertaintransactions,therefore,thisstatementmaynotapply toyou.

Thisinformationcouldincludetechnicalinaccuraciesortypographicalerrors.Changesareperiodically madetotheinformationherein;thesechangeswillbeincorporatedinneweditionsofthepublication. Lenovomaymakeimprovementsand/orchangesintheproduct(s)and/ortheprogram(s)describedinthis publicationatanytimewithoutnotice.

Theproductsdescribedinthisdocumentarenotintendedforuseinimplantationorotherlifesupport applicationswheremalfunctionmayresultininjuryordeathtopersons.Theinformationcontainedinthis documentdoesnotaffectorchangeLenovoproductspecicationsorwarranties.Nothinginthisdocument shalloperateasanexpressorimpliedlicenseorindemnityundertheintellectualpropertyrightsofLenovo orthirdparties.Allinformationcontainedinthisdocumentwasobtainedinspecicenvironmentsandis presentedasanillustration.Theresultobtainedinotheroperatingenvironmentsmayvary.

Lenovomayuseordistributeanyoftheinformationyousupplyinanywayitbelievesappropriatewithout incurringanyobligationtoyou.

Anyreferencesinthispublicationtonon-LenovoWebsitesareprovidedforconvenienceonlyanddonotin anymannerserveasanendorsementofthoseWebsites.ThematerialsatthoseWebsitesarenotpartof thematerialsforthisLenovoproduct,anduseofthoseWebsitesisatyourownrisk.

Anyperformancedatacontainedhereinwasdeterminedinacontrolledenvironment.Therefore,the resultinotheroperatingenvironmentsmayvarysignicantly.Somemeasurementsmayhavebeenmade ondevelopment-levelsystemsandthereisnoguaranteethatthesemeasurementswillbethesame ongenerallyavailablesystems.Furthermore,somemeasurementsmayhavebeenestimatedthrough extrapolation.Actualresultsmayvary.Usersofthisdocumentshouldverifytheapplicabledatafortheir specicenvironment.

Trademarks

ThefollowingtermsaretrademarksofLenovointheUnitedStates,othercountries,orboth:

Lenovo TheLenovologo ThinkPad ThinkVantage

IntelisatrademarkorregisteredtrademarkofIntelCorporationoritssubsidiariesintheUnitedStatesand othercountries.

Microsoft,ActiveDirectory,ActiveSync,andWindowsaretrademarksoftheMicrosoftgroupofcompanies.

Othercompany,product,orservicenamesmaybetrademarksorservicemarksofothers.

18ThinkPadT abletDeploymentGuide

PartNumber:

PrintedinUSA

(1P)P/N:

Lenovo ThinkPad Tablet Deployment Guide [en, id, ru]

Specifications and Main Features

Frequently Asked Questions

User Manual

Chapter1.Overview

LenovoDevicePolicyManagerService

ActiveDirectorydomainserver

Chapter3.UsingMicrosoftExchangeActiveSync

Chapter4.LenovoMobilityManager

AppendixA.Notices

Trademarks