.. Reminder for header structure: Parts (H1) : #################### with overline Chapters (H2) : ******************** with overline Sections (H3) : ==================== Subsections (H4) : -------------------- Subsubsections (H5) : ^^^^^^^^^^^^^^^^^^^^ Paragraphs (H6) : """"""""""""""""""""" .. meta:: :description: The WAPT management Console :keywords: waptconsole, management, WAPT, certificate, documentation, the WAPT Console .. |ok| image:: wapt-resources/icon-ok.png :scale: 5% :alt: feature available .. |nok| image:: wapt-resources/icon-nok.png :scale: 5% :alt: feature not available .. |date| date:: .. |add| image:: wapt-resources/icon-add.png :scale: 5% :alt: feature additional .. |enterprise_feature| image:: wapt-resources/icon_wapt_enterprise.png :scale: 3% :alt: WAPT Enterprise feature only The WAPT Server having been successfully installed, now we will install the WAPT Console. .. _installing_the_WAPT_console: *************************** The WAPT management Console *************************** .. Attention:: If you have already :ref:`generated the WAPT Agent ` and :ref:`deployed the Agent ` on your :term:`Administrator`'s workstation, then :ref:`launch the WAPT Console `. .. note:: * Managing WAPT is done mainly via the WAPT Console installed on the :term:`Administrator`'s workstation. * It is recommended that the Administrator's computer be joined to the :term:`Organization`'s Active Directory. * The host name of the Administrator's workstation **MUST NOT be longer than 15 characters.** This is a limit of *sAMAccountName* attribute in Active Directory. * **The Administrator's computer will become critical for WAPT administration and WAPT package testing.** * If DNS records are properly configured, you should be able to access the WAPT web interface by visiting https://srvwapt.mydomain.lan. * As of |date|, the WAPT Console only installs on Windows. .. _console_on_windows: .. hint:: It is **highly recommended** to use the Console on a **dedicated management host**. .. tabs:: .. tab:: WAPT Server hosted on Windows .. warning:: The WAPT Console **MUST NOT** be installed on your Windows based WAPT Server. The WAPT Console **MUST** be installed on the workstation from which you manage your network. For installing the WAPT Console, download :download:`waptsetup.exe ` from Tranquil IT on the WAPT Server. * Rename the file `waptsetup-tis.exe`. * Copy to :file:`C:\\wapt\\waptserver\\repository\\wapt`. You may now go on :ref:`downloading and launching the installation of the WAPT Console on the Administrator's computer `. .. tab:: WAPT Server hosted on Linux Go to next step, the WAPT Console is already on your WAPT Server. .. _donwloading_the_WAPT_console: .. figure:: wapt-resources/wapt_server_web-interface_browser-window.png :align: center :alt: The WAPT Server interface in a web browser The WAPT Server interface in a web browser * If DNS records are properly configured, you should be able to access the WAPT web interface by visiting: https://srvwapt.mydomain.lan. * Click on :guilabel:`WAPTSetup` link on the right-hand side of the WAPT Server web page. Installing the WAPT Agent on the Administrator's computer ========================================================= .. attention:: If **the WAPT Agent** is not compiled and installed on your computer, you need to run de WAPT Agent installer to open and :ref:`configure the WAPT Console `. * Start the executable installer as :term:`Local Administrator` on the :term:`Administrator`'s workstation. * Choose the language for the WAPT installer. .. image:: wapt-resources/wapt_deploy_choose-language_dialog-box.png :align: center :alt: Choosing the language for deploying the WAPT installer * Click on :guilabel:`OK` to go on to the next step. .. image:: wapt-resources/wapt_deploy_accept-license_dialog-box.png :align: center :alt: Accepting the WAPT license terms * Accept the licence terms and click on :guilabel:`Next` to go to next step. * Choose additional configuration tasks (leave the default if not sure). .. figure:: wapt-resources/wapt_deploy_installer-options_dialog-box.png :align: center :alt: Choosing the WAPT Agent installer options Choosing the WAPT Agent installer options .. list-table:: Available options of the WAPT Agent installer :header-rows: 1 :widths: auto :align: center * - Settings - Description - Default value * - :guilabel:`Install WAPT service` checkbox - Enables the WAPT service on this computer. - Checked * - :guilabel:`Launch notification icon upon session opening` checkbox - Launches the WAPT Agent in systray on host startup. - Not checked * - :guilabel:`Disable hiberboot, and increase shutdown GPO timeout (recommended)` checkbox - Disables Windows fast startup for stability, it increases the timeout for the WAPT Exit utility. - Checked * - :guilabel:`Install the certificates provided by this installer` checkbox - Installs Tranquil IT certificate on this computer. - Not checked * - :guilabel:`Use a random UUID to identify the computer instead of BIOS` checkbox - For more information, check the documentation on :ref:`BIOS UUID bugs ` - Not checked * Set up the WAPT Server URL. .. hint:: Here, two choices become available to you. * If this is the first installation and the WAPT Agent has not already been built / installed. * Check :guilabel:`Static WAPT Informations` and set: * WAPT repository URL: http://srvwapt.mydomain.lan/wapt. * WAPT Server URL: https://srvwapt.mydomain.lan. .. figure:: wapt-resources/wapt_deploy_choose-repo-and-server-url_dialog-box.png :align: center :alt: Choosing the WAPT repository and the WAPT Server Choosing the WAPT repository and the WAPT Server * Choose the WAPT repository and the WAPT Server; click :guilabel:`Next`. * If the WAPT Console or the WAPT Agent is already installed: * Check :guilabel:`Don't change current setup`, then click :guilabel:`Next`. .. figure:: wapt-resources/wapt_deploy_accept-repo-and-server-url_dialog-box.png :align: center :alt: The WAPT repository and the WAPT Server are already set The WAPT repository and the WAPT Server are already set * Get a summary of the WAPT Console installation. .. figure:: wapt-resources/wapt_deploy_install-summary_dialog-box.png :align: center :alt: Summary of the WAPT installation abstract Summary of the WAPT installation abstract * Click :guilabel:`Install` to launch the installation, wait for the installation to complete, then click on :guilabel:`Finish` (leave default options). .. image:: wapt-resources/wapt_deploy_installation-in-progress_dialog-box.png :align: center :alt: Dialog box showing the WAPT installation in progress .. image:: wapt-resources/wapt_deploy_installation-progress-completed_dialog-box.png :align: center :alt: Installation Wizard has finished * Uncheck :guilabel:`Show installation documentation`. .. _configure_console: Starting the WAPT Console ========================= * Launch the WAPT Console: * By looking for the binary. :file:`C:\\Program Files (x86)\\wapt\\waptconsole.exe` * Or using the :guilabel:`Start` Menu. .. figure:: wapt-resources/windows_console_start-menu_screen-item.png :align: center :alt: Launching the WAPT Console from the Windows Start Menu Launching the WAPT Console from the Windows Start Menu * Log into the WAPT Console with the :term:`SuperAdmin` login and password. .. figure:: wapt-resources/wapt_console_user-authentication_dialog-box.png :align: center :alt: The WAPT Console authentication window The WAPT Console authentication window If you have any issue logging into the WAPT Console, please refer to the FAQ: :ref:`msg_error_open`. It is recommended to launch the WAPT Console with a Local Administrator account to enable local debugging of WAPT packages. For Enterprise version, it is possible to authenticate with :ref:`Active Directory `. First start after the WAPT Server installation ---------------------------------------------- .. hint:: On first start, you **MUST** start the WAPT Console with elevated privileges. :menuselection:`Right-click on the WAPT Console binary --> Start as Local Administrator`. Certificate affectation ^^^^^^^^^^^^^^^^^^^^^^^ .. note:: A message may appear indicating that no personal certificate has been defined. .. figure:: wapt-resources/wapt_console_no-certificate_dialog-box.png :align: center :alt: WAPT personal certificate not found in the WAPT Console WAPT personal certificate not found in the WAPT Console * Select :guilabel:`Yes` .. figure:: wapt-resources/wapt_console_basic-configuration-tab_container-window.png :align: center :alt: Window for the basic configuration of the WAPT Console Window for the basic configuration of the WAPT Console * Click on :guilabel:`New private key and certicate` and see :ref:`create your certificate. ` Packet prefix definition ^^^^^^^^^^^^^^^^^^^^^^^^ .. note:: A message may appear indicating that no package prefix has been defined. .. figure:: wapt-resources/wapt_console_no-prefix_dialog-box.png :align: center :alt: Dialog box informing that no prefix has been set in the WAPT configuration Dialog box informing that no prefix has been set in the WAPT configuration * Select :guilabel:`Yes` * Set your packages prefix on :guilabel:`WAPT packages prefix` .. figure:: wapt-resources/wapt_console_basic-configuration-tab_container-window.png :align: center :alt: Window for the basic configuration of the WAPT Console Window for the basic configuration of the WAPT Console waptagent.exe errors ^^^^^^^^^^^^^^^^^^^^ .. note:: A message may appear indicating that your WAPT Agent version is obsolete or not yet present. .. figure:: wapt-resources/wapt_console_waptagent-not-present_dialog-box.png :align: center :alt: Dialog box informing that the WAPT Agent is not present on the WAPT Server Dialog box informing that the WAPT Agent is not present on the WAPT Server If the :ref:`administrator's certicate ` existing, it's possible to :ref:`generating new WAPT Agent ` by clicking on :guilabel:`Yes`. Also click on :guilabel:`No` and generate the :ref:`administrator's certicate `. .. _licence_activation: ************************* Activating a WAPT licence ************************* .. note:: With WAPT, **Discovery** and **Enterprise** versions have different licences. .. hint:: To activate the licence, use the :file:`licence.lic` file provided by our sales department. * In the WAPT Console, click on the :guilabel:`?` tab: .. image:: wapt-resources/wapt_console-more-info-tab_menu-list.png :align: center :alt: More information tab in the WAPT Console * Then choose :guilabel:`Licences`: .. figure:: wapt-resources/wapt_console_licence-no-licence_container-window.png :align: center :alt: Window listing no subscribed WAPT licences in the WAPT Console Window listing no subscribed WAPT licences in the WAPT Console * Finally, select your :file:`licence.lic` and click :guilabel:`Open`: .. figure:: wapt-resources/wapt_console_licence-ok_container-window.png :align: center :alt: Window showing an activated licence in the WAPT Console Window showing an activated licence in the WAPT Console Removing a WAPT licence ======================= * In the WAPT Console, click on the :guilabel:`?` tab: .. image:: wapt-resources/wapt_console-more-info-tab_menu-list.png :align: center :alt: More information tab in the WAPT Console * Then choose :guilabel:`Licences`: .. figure:: wapt-resources/wapt_console_licence-no-licence_container-window.png :align: center :alt: Window listing no subscribed WAPT licences in the WAPT Console Window listing no subscribed WAPT licences in the WAPT Console * Finally, select the row and click :guilabel:`Remove License`: .. figure:: wapt-resources/wapt_console_licence-remove-confirm_dialog-box.png :align: center :alt: Confirmation window to remove a licence from the WAPT Console Confirmation window to remove a licence from the WAPT Console * When confirmed, the selected licences are removed: .. figure:: wapt-resources/wapt_console_licence-no-licence_container-window.png :align: center :alt: Window listing no subscribed WAPT licences in the WAPT Console Window listing no subscribed WAPT licences in the WAPT Console License location ================ :file:`licence.json` are stocked on the WAPT Server in the following location: .. tabs:: .. code-tab:: ini Debian / Ubuntu /var/www/licences.json .. code-tab:: ini RedHat and derivatives /var/www/html/licences.json .. code-tab:: ini Windows C:\wapt\waptserver\repository\licences.json License error ============= Expired licence --------------- If a licence has expired, then its status displays :guilabel:`Expired`. .. figure:: wapt-resources/wapt_console_licence-expired_container-window.png :align: center :alt: Window showing an expired licence in the WAPT Console Window showing an expired licence in the WAPT Console Old licence location -------------------- When installaing the WAPT Console, if licence is located in an old location, this error appear will show: .. figure:: wapt-resources/wapt_console_licence-error-old-location_dialog-box.png :align: center :alt: WAPT licence error message when upgrading WAPT to 2.1 WAPT licence error message when upgrading WAPT to 2.1 Error activating a WAPT licence ------------------------------- This error is due to a problem with the post-configuration script and a special configuration of NGINX. .. figure:: wapt-resources/wapt_console_licence-error-added_dialog-box.png :align: center :alt: Dialog box informing an error occured while activating a WAPT licence Dialog box informing an error occured while activating a WAPT licence **3 points** are to be checked. 1. Check whether :file:`/etc/nginx/sites-enabled/wapt.conf` is a symbolic link of :file:`/etc/nginx/sites-available/wapt.conf`, using this command: .. code-block:: bash ls -l /etc/nginx/sites-enabled/wapt.conf * If the symbolic link exists, the output should be: .. code-block:: bash lrwxrwxrwx 1 root root 36 Jun 9 09:35 /etc/nginx/sites-enabled/wapt.conf --> /etc/nginx/sites-available/wapt.conf * If the symbolic link does not exist, then remove :file:`/etc/nginx/sites-enabled/wapt.conf` and create a new symbolic link: .. code-block:: bash rm /etc/nginx/sites-enabled/wapt.conf ln -s /etc/nginx/sites-available/wapt.conf /etc/nginx/sites-enabled/wapt.conf 2. Check whether the file :file:`licences.json` is present in :guilabel:`location` section of :file:`/etc/nginx/sites-enabled/wapt.conf`: .. code-block:: bash location ~ ^/(wapt/waptsetup-tis.exe|wapt/waptagent.exe|wapt/waptdeploy.exe|sync.json|rules.json|licences.json)$ { add_header Cache-Control "store, no-cache, must-revalidate, post-check=0, pre-check=0"; add_header Pragma "no-cache"; root "/var/www"; } * If the :file:`licences.json` file exist, then restart :program:`Nginx`: .. code-block:: bash systemctl restart nginx * Then, add the :file:`licences.json` file in :guilabel:`location` section of :file:`/etc/nginx/sites-enabled/wapt.conf` and restart NGINX. .. code-block:: bash systemctl restart nginx 3. If you get an error, empty :file:`/var/www/licences.json`: .. code-block:: bash > /var/www/licences.json * Then, retry :ref:`activating the WAPT licence `. .. _create_certificate: ******************************************************************** Generating the Administrator's certificate for signing WAPT packages ******************************************************************** .. hint:: * The name of the private key is :file:`wapt-private.pem`. * The name of the public certificate signed with the private key is :file:`wapt-private.crt`. Private key *wapt-private.pem* ============================== .. attention:: The :file:`wapt-private.pem` file is **fundamental for security**. It **MUST** be stored in a safe place and correctly protected. The :file:`wapt-private.pem` file is the private key, it is located by default in the :file:`C:\\private` folder of the :term:`Administrator` workstation and is password protected. This private key will be used along with the certificate to sign packages before uploading them onto the WAPT repository. .. danger:: The :file:`wapt-private.pem` file **MUST NOT** be stored on the WAPT Server. Public certificate : *wapt-private.crt* ======================================= The :file:`wapt-private.crt` file is the public certificate that is used along with the private key. It is by default created in the :file:`C:\\private` folder of the Administrator, copied and deployed in :file:`C:\\Program Files (x86)\\wapt\\ssl` on the Windows desktops or in :file:`/opt/wapt/ssl` on the Linux and MacOS devices managed by the Administrator via a WAPT package, a GPO or an Ansible role. This certificate is used to validate the signature of packages before installation. .. attention:: * If the public certificate used on the WAPT Console is not derived from the private key used for generating the WAPT Agents, the WAPT Console will not see the WAPT Agents and you will not be able to perform any action on any WAPT Agent. * The child certificates of private keys are functional for interactions. .. CLARIFY above .. _building_certificate: Generating a certificate to use with WAPT ========================================= In the WAPT Console go to :menuselection:`Tools --> Build certificate`. .. figure:: wapt-resources/wapt_console_tools_menu-list.png :align: center :alt: Building a self-signed certificate Building a self-signed certificate .. note:: The WAPT Enterprise version features additional options With WAPT Enterprise, you can create a Master key with a Certificate Authority flag that can both sign packages and sign new certificates. .. hint:: In order to create new signed certificates for delegated users, please refer to :ref:`creating a new certificate `. .. figure:: wapt-resources/wapt_console_certificate-generate_dialog-box.png :align: center :alt: Creating a self-signed certificate for the WAPT Enterprise version Creating a self-signed certificate for the WAPT Enterprise version .. list-table:: Certificate informations :header-rows: 1 :widths: auto :align: center * - Value - Description - Required - Enterprise * - :guilabel:`Target key directory` - Defines the folder where the private key and the public certificate will be stored. - |ok| - * - :guilabel:`Key filename` - Defines the name of the :mimetype:`.pem` private key. - |ok| - * - :guilabel:`Private key password` - Defines the password for unlocking the key. - |ok| - * - :guilabel:`Confirm password` - Confirms the password for unlocking the key. - |ok| - * - :guilabel:`Certificate name` - Defines the name of the :mimetype:`.crt` certificate. - |ok| - * - :guilabel:`Tag as code signing` - Defines whether the certificate/ key pair will be allowed to sign software packages. - |ok| - |add| * - :guilabel:`Tag as CA certificate` - Defines whether the certificate can be used to sign other certificates (main or intermediate Certificate Authority). - |ok| - |add| * - :guilabel:`Common Name (CN)` - Defines the Common Name to register in the certificate. - |ok| - * - :guilabel:`City` - Defines the name of the certificate holder's city to register in the certificate. - |nok| - * - :guilabel:`Country (2 chars. E.g : FR)` - Defines the name of the certificate holder's country (FR, EN, ES, DE ...) to register in the certificate. - |nok| - * - :guilabel:`Service` - Defines the name of certificate holder's service or organizational department to register in the certificate. - |nok| - * - :guilabel:`Organization` - Defines the name of the certificate holder's Organization to register in the certificate. - |nok| - * - :guilabel:`E-mail address` - Defines the email address of the certificate holder to register in the certificate. - |nok| - * - :guilabel:`Authority Signing Key` - Defines the key (:mimetype:`.pem`) of the :abbr:`CA (Certificate Authority)`. - |nok| - |add| * - :guilabel:`Authority Signing Certificate` - Defines the certicate (:mimetype:`.crt`) of the :abbr:`CA (Certificate Authority)`. - |nok| - |add| * - :guilabel:`Export PKCS12` - Forces the creation of the :file:`*.p12` certicate in the :guilabel:`Targets keys directory` - |nok| (recommended) - Additional details are stored in the private key. This information will help with identifying the origin of the certificate and the origin of the WAPT package. .. hint:: The password complexity **MUST** comply with your :term:`Organization`'s security requirements (visit the `ANSSI website `_ for recommendations on passwords). .. INCLUDE START .. danger:: * The path to your private key **MUST NOT** be in the installation path of WAPT (:file:`C:\\Program Files (x86)\\wapt`). * If your key is stored in :file:`C:\\Program Files (x86)\\wapt`, your Administrator's private key will be deployed on your clients, **ABSOLUTELY A NO GO!**. * Finally, the :file:`wapt-private.pem` file **MUST NOT** be stored on the WAPT Server. .. INCLUDE STOP * Click on :guilabel:`OK` to go on to the next step. If everything has gone well the following message will appear: .. figure:: wapt-resources/wapt_console_certificate-successfully-generated_dialog-box.png :align: center :alt: Dialog box informing the certificate has been generated successfully Dialog box informing the certificate has been generated successfully * Click on :guilabel:`OK`. .. figure:: wapt-resources/wapt_console_certificate-confirm-copy-into-ssl-folder_dialog-box.png :align: center :alt: Dialog box requesting confirmation of the copy of the certificate in the ssl folder in the WAPT Console Dialog box requesting confirmation of the copy of the certificate in the ssl folder in the WAPT Console * Click on :guilabel:`Yes` to copy the newly generated certificate in the folder :file:`C:\\Program Files (x86)\\wapt\\ssl` on Windows or :file:`/opt/wapt/ssl` on Linux or macOS. This certificate will be picked up during the compilation of the WAPT Agent and deployed on the client computers. You may go on to the next step and :ref:`Building the WAPT Agent installer `. .. _create_WAPT_agent: ********************************* Building the WAPT Agent installer ********************************* The :program:`waptagent` binary is an `InnoSetup `_ installer. Once the WAPT Console has been installed on the :term:`Administrator` computer, we have all files required to build the WAPT Agent installer: * Files that will be used during building of the WAPT Agent are located in :file:`C:\\Program Files (x86)\\wapt`. * Installer source files (:file:`.iss` files) are located in :file:`C:\\Program Files (x86)\\wapt\\waptsetup`. .. hint:: Before building the WAPT Agent, please verify the public certificate(s) in :file:`C:\\Program Files (x86)\\wapt\\ssl`. If you wish to deploy other public certificates on your :term:`Organization`'s computers that are equipped with WAPT, you will have to copy them in that folder. .. danger:: **DO NOT COPY the private key** of any :term:`Administrator` in :file:`C:\\Program Files (x86)\\wapt`. This folder is used when building the WAPT Agent and the private keys would then be deployed on all the computers. * In the WAPT Console, go to :menuselection:`Tools --> Build WAPT Agent` .. figure:: wapt-resources/wapt_console_waptagent-build_menu-item.png :align: center :alt: Generating the WAPT Agent from the WAPT Console Generating the WAPT Agent from the WAPT Console .. _agent_identify: .. hint:: Before building the WAPT Agent, you need to choose how it will identify itself with the WAPT Server. Choosing the mode to uniquely identify the WAPT Agents ====================================================== In WAPT you can choose the unique identification mode of the WAPT Agents. When a WAPT Agent registers the WAPT Server **MUST** know if it is a new host or if it is a host that has already been registered. For this, the WAPT Server looks at the :abbr:`UUID (Universal Unique IDentifier)` in the inventory. WAPT offers 3 modes to help you distinguish between hosts, it is up to you to choose the mode that best suits you. .. attention:: After choosing a mode of operation it is difficult to change it, think carefully! .. tabs:: .. tab:: BIOS UUID (serial number) This mode of operation makes it possible to identify the hosts in the WAPT Console in a physical manner. If you replace a computer and give the new computer the same name as the previous one, you will have two computers that will appear in the WAPT Console since you will have physically two different computers. .. note:: Some vendors do inadequate work and assign the same BIOS UUIDs to entire batches of computers. In this case, WAPT will only see one computer!!! .. tab:: host name This mode of operation is similar to that in Active Directory. The hosts are identified by their :abbr:`FQDN (Fully Qualified Domain Name)`. .. note:: This mode does not work if several hosts in your fleet share the same name. We all know this should never happen. .. tab:: randomly generated UUID This mode of operation allows PCs to be identified by their WAPT installation. Each installation of WAPT generates a unique random number. If you uninstall WAPT and then reinstall it, you will see a new device appear in your WAPT Console. .. note:: In this mode, the UUIDs have the prefix RMD Build ===== * In the WAPT Console, go to :menuselection:`Tools --> Build WAPT Agent` .. figure:: wapt-resources/wapt_console_waptagent-build_menu-item.png :align: center :alt: Generating the WAPT Agent from the WAPT Console Generating the WAPT Agent from the WAPT Console * Fill in the informations that are necessary for the installer. .. figure:: wapt-resources/wapt_console_waptagent-configuration_container-window.png :align: center :alt: Filling in the informations on your Organization Filling in the informations on your Organization .. list-table:: WAPT Agent informations :header-rows: 1 :widths: auto :align: center * - Value - Description - Required - Enterprise * - :guilabel:`Authorized packages certificates bundle` - Defines the folder of trusted certificates. - |ok| - * - :guilabel:`Include non CA too` - Defines whether to include local WAPT certificate. - |nok| - * - :guilabel:`Main WAPT repository address` - Defines the URL of the main WAPT repository. - |ok| - * - :guilabel:`WAPT Server address` - Defines the URL of the WAPT Server. - |ok| - * - :guilabel:`Verify https server certificate` - Defines whether the :ref:`HTTPS certificate client authentication ` is activated on the WAPT Server. - |nok| - * - :guilabel:`Use repository access rules` - Defines whether repository access rules are to be used for :ref:`replicating remote repositories `. - |nok| - |add| * - :guilabel:`Path to the WAPT https Servers CA certificates bundle` - Defines the path to the certificates used for HTTPS verification. - |nok| - * - :guilabel:`Use Kerberos for initial registration` - Defines whether :ref:`Kerberos authentication ` of the WAPT Agents is to be used with the WAPT Server. - |nok| - * - :guilabel:`Organization` - Defines the name of the Organization to identify the origin of WAPT packages. - |nok| - * - :guilabel:`Use computer FQDN for UUID` - Defines whether :abbr:`FQDNs (Fully Qualified Domain Names)` are to be used for :ref:`identifying WAPT Agents `. - |nok| - * - :guilabel:`Use random host UUID (for buggy BIOS)` - Defines whether random :abbr:`UUIDs (Universally Unique IDentifiers)` are to be used for :ref:`identifying WAPT Agents `. - |nok| - * - :guilabel:`Always install these packages` - Defines whether to automatically install :ref:`group packages ` upon WAPT Agent installation. - |nok| - |add| * - :guilabel:`Enable automatic install of packages based on AD Groups` - Enables the installation of :ref:`profile packages `. **This feature can degrade the performance of WAPT**. - |nok| - |add| * - :guilabel:`Allow remote reboot` - Defines whether to allow remote reboots from the WAPT Console. - |nok| - |add| * - :guilabel:`Allow remote shutdown` - Defines whether to allow remote shutdowns from the WAPT Console. - |nok| - |add| * - :guilabel:`Manage Windows updates with WAPT` | :guilabel:`Disable WAPT WUA` | :guilabel:`Don't set anything` - Enables or disables :ref:`WAPT WUA `. - |ok| - |add| * - :guilabel:`Allow all updates by default unless explicitely forbidden by rules` - Defines whether to allow all Windows Updates if not forbidden by WUA rule packages. - |nok| - |add| * - :guilabel:`Scan / download scheduling` - Sets the Windows Update scan periodicity. - |nok| - |add| * - :guilabel:`Minimum delay before installation (days after publish date)` - Sets a deferred installation delay before publication. - |nok| - |add| * - :guilabel:`Install pending Windows updates at shutdown` - Forces updates to install when the host shuts down. - |nok| - |add| * - :guilabel:`Waptupgrade package maturity` - Allows to choose the maturity of the waptupgrade package. - |nok| - |add| .. hint:: For more information to Windows update section, refer to :ref:`this article on configuring WAPTWUA on the WAPT Agent ` .. danger:: * The checkbox **Use kerberos for the initial registration** may be checked **ONLY IF** you have followed the documentation on :ref:`Configuring the kerberos authentication `. * The checkbox **Verify the WAPT Server HTTPS certificate** may be checked **ONLY IF** you have followed the documentation on :ref:`Activating the verification of the SSL / TLS certificate `. * Provide the password for unlocking the private key. .. figure:: wapt-resources/wapt_console_enter-certificate-password_dialog-box.png :align: center :alt: Providing the password for unlocking the private key Providing the password for unlocking the private key .. figure:: wapt-resources/wapt_console_waptagent-creation-in-progress_dialog-box.png :align: center :alt: Progression of WAPT Agent installer building Progression of WAPT Agent installer building Once the WAPT Agent installer has finished building, a confirmation dialog pops up indicating that the :program:`waptagent` binary has been successfully uploaded to https://srvwapt.mydomain.lan/wapt/. .. figure:: wapt-resources/wapt_console_waptagent-upload-confirmation_dialog-box.png :align: center :alt: Confirmation of the WAPT Agent loading onto WAPT repository Confirmation of the WAPT Agent loading onto WAPT repository .. note:: A warning shows up indicating that the GPO hash value should be changed. GPOs may be used to deploy the WAPT Agent on your Organization's computer. .. attention:: After building the Agent on your management PC, quit the WAPT Console and :ref:`install ` the **new WAPT Agent** that has been generated on your WAPT management computer. ********************* Initial Configuration ********************* |enterprise_feature| It is possible to configure the agent for standard and advanced options via a GUI. * In the WAPT Console, go to :menuselection:`Tools --> Edit initial configurations` .. figure:: wapt-resources/wapt_console_edit-initial-configuration_menu-item.png :align: center :alt: Creating the initial configuration Creating the initial configuration * Fill in the informations that are necessary for the configuration .. figure:: wapt-resources/wapt_console_initial-configuration_container-window.png :align: center :alt: Edit Initial Configuration Edit Initial Configuration .. list-table:: Header :header-rows: 1 :widths: auto :align: center * - Value - Description * - :guilabel:`Advanced Editing` - Use to display :ref:`the options ` as in :file:`wapt-get.ini`. * - :guilabel:`Add certificate` - Add the deployed :ref:`certificate ` with the configuration. * - :guilabel:`Load Json` - Load a previously created configuration * - :guilabel:`Refresh Server Configuration` - Refreshes the list of available configurations * - :guilabel:`+` - Create a new configuration * - :guilabel:`-` - Delete a configuration .. tabs:: .. tab:: global .. list-table:: :header-rows: 1 :widths: auto :align: center * - Value - Description - Required - Enterprise * - :guilabel:`Main WAPT Repository URL` - Defines the URL of the main WAPT repository. - |ok| - * - :guilabel:`WAPT Server URL` - Defines the URL of the WAPT Server. - |ok| - * - :guilabel:`Verify https server certificate` - Defines whether the :ref:`HTTPS certificate client authentication ` is activated on the WAPT Server. - |nok| - * - :guilabel:`Path to certificate authority for https servers` - Defines the path to the certificates used for HTTPS verification. - |nok| - * - :guilabel:`Allow remote reboot` - Defines whether to allow remote reboots from the WAPT Console. - |nok| - |add| * - :guilabel:`Allow remote shutdown` - Defines whether to allow remote shutdowns from the WAPT Console. - |nok| - |add| * - :guilabel:`Wake On Lan Relay` - Activates the :abbr:`WoL (Wake-on-Lan)` functionality on secondary repositories. - |nok| - |add| * - :guilabel:`Use computer FQDN for UUID` - Defines whether :abbr:`FQDNs (Fully Qualified Domain Names)` are to be used for :ref:`identifying WAPT Agents `. - |nok| - * - :guilabel:`Always install these packages` - Defines whether to automatically install :ref:`group packages ` upon WAPT Agent installation. - |nok| - |add| * - :guilabel:`Use repository rules` - Defines whether :ref:`repositories are replicated `. - |nok| - |add| * - :guilabel:`Use Kerberos` - Defines whether :ref:`Kerberos authentication ` of the WAPT Agents is to be used with the WAPT Server. - |nok| - * - :guilabel:`Enable automatic install of packages based on AD Groups` - Enables the installation of :ref:`profile packages `. **This feature can degrade the performance of WAPT**. - |nok| - |add| * - :guilabel:`Maturities` - List of package maturities than can be viewed and installed by WAPT Agent. Default value is ``PROD``. Only ``DEV``, ``PREPROD`` and ``PROD`` values are used by Tranquil IT, however any value can be used to suit your internal processes. - |nok| - * - :guilabel:`Authentification type` - Sets how the self service authentication works. Possible values are: ``system``, ``waptserver-ldap`` or ``waptagent-ldap``. - |ok| - * - :guilabel:`Packages Audit Period` - Defines the frequency at which audits are triggered. - |ok| - .. tab:: waptwua |enterprise_feature| .. list-table:: :header-rows: 1 :widths: auto :align: center * - Value - Description - Required * - :guilabel:`Manage Windows updates with WAPT` - Enables or disables :ref:`WAPT WUA `. - |ok| * - :guilabel:`Allow all updates by default unless explicitely forbidden by rules` - Defines whether to allow all Windows Updates if not forbidden by WUA rule packages. - |nok| * - :guilabel:`Allowed Severities` - Defines a severity list that will be automatically accepted during a WAPT windows update scan. ex: *Important*, *Critical*, *Moderate*. - |nok| * - :guilabel:`Download updates from Microsoft Servers` - Defines whether updates are downloaded directly from Microsoft servers. - |nok| * - :guilabel:`Scan / download scheduling` - Defines the Windows Update scan recurrence (Will not do anything if *waptwua* package rule or :file:`wsusscn2.cab` file have not changed). - |nok| * - :guilabel:`Install pending Windows updates at shutdown` - Forces updates to install when the host shuts down. - |nok| * - :guilabel:`Installation scheduling` - Defines the Windows Update install recurrence (Will do nothing if no update is pending). - |nok| * - :guilabel:`Minimum delay before installation (days after publish date)` - Sets a deferred installation delay before publication. - |nok| .. tab:: repo-sync |enterprise_feature| .. attention:: These options should only be used on a secondary repository. .. list-table:: :header-rows: 1 :widths: auto :align: center * - Value - Description - Required * - :guilabel:`Use remote repo` - Enables the WAPT Server to serve as a repository. - |ok| * - :guilabel:`Remote repository directories` - Defines folders to synchronize - |ok| * - :guilabel:`Synchronize only when asked` - Enable or disable automatic synchronization - |nok| * - :guilabel:`Synchronize task period` - Sets synchronization periodicity - |ok| * - :guilabel:`Local repository time for synchronization start` - Sets synchronization start time (HH:MM / 24h format) - |nok| * - :guilabel:`Local repository time for synchronization end` - Sets synchronization start stop (HH:MM / 24h format) - |nok| .. list-table:: Column :header-rows: 1 :widths: auto :align: center * - Value - Description * - :guilabel:`Saved Properties` - List of :ref:`options ` with the configuration. * - :guilabel:`Certificate` - List of :ref:`certificate ` with the configuration. .. list-table:: Footer :header-rows: 1 :widths: auto :align: center * - Value - Description * - :guilabel:`Save on server` - Save the configuration on the server * - :guilabel:`Export As Json File` - Export the configuration in JSON * - :guilabel:`Close` - Close the window * After configuration it is possible to copy commands by right clicking on the configuration .. figure:: wapt-resources/wapt_console_initial-configuration_windows-copy-menu.png :align: center :alt: Copy command Copy command .. list-table:: Copy options :header-rows: 1 :widths: auto :align: center * - Value - Description * - :guilabel:`Copy URL` - Gives a download URL to retrieve the :mimetype:`.json` from the server. * - :guilabel:`Copy installation command` - Gives a command to install the configuration for a WAPT agent. .. note:: It is possible to install a blank agent and give it the copied installation command to provide the configuration.