Chapter 1

The Basic Hardware Components
·	one or more servers
The minimum is a Pentium266. The purpose of a server is to provide network services to Clients (printers; servers; workstations). 
·	workstations
A workstation is a standalone PC that can be used independently of the network (local applications, files and connected devices). You can receive additional services from the network by connecting to and logging in. Novell supports DOS; all versions of Windows; Macintosh; UNIX and Linux workstations. As an Administrator, you will need either a DOS or Windows workstation to use the utilities to manage the network. 
·	network boards
Also known as NIC’s or network cards. This is a circuit board that is installed in all workstations and servers to allow connection to transmit data. 
·	communication media 
This is the cable that connects to the network cards to allow communication between servers and workstations. The types of cable can vary to the installation (e.g., token-ring, Ethernet) 
·	peripheral devices 
Peripheral devices are the additional hardware that you connect to a network (e.g., printers, CD towers)
NetWare
NetWare is the operating system developed by Novell. It is a series of programs installed on a server that work together to provide services that allow you to connect, manage and maintain the resources and services that have been setup on your network. 
Basic Areas of Administrator Responsibilities
Before you even begin installation, you have to plan and decide on how you will set up your network. This includes organizing the Novell Directory Services (NDS) design and the file system design. Once it is place you will have to manage it. How will you protect it? There are several areas of security that can be applied. You will need to come up with a backup strategy for recovery. Also consider documenting information of the network, including servers, tree structure and file system layout.
Network Resources and Network Services
A resource is something you use, such as a printer.
A service is the system or method of accessing the resource (how to get your job from your workstation to a network printer).
The services that are provided by NetWare are:
·	Novell Directory Services (NDS) This is the brain of the network. It is a database that contains all resources set up in the network (user accounts, printers, servers, etc.). 
·	Security There are different levels of security that can be applied on the network. Login security; file system security; NDS security; physical security. 
·	File System The file system can be implemented for data to be stored on a server instead of the local hard drive of a workstation. 
·	Network Printing Printers can be attached to the network and shared to users who are connected to the network. 
·	Application Access Applications can be installed on a server and shared out to user accounts or downloaded and installed on their workstations using Application Launcher. 
·	ZenWorks Starter Pack. ZenWorks is a product that can be installed to import workstations in to the NDS and to manage and maintain network applications. 
·	Storage Management Services (SMS) This is Novell’s terminology for backup. Most installations will purchase third party software to backup and recover the file system and NDS. 
NetWare 5.1 also provides a series of back-end services to support client WEB applications and development including Open standards support; i.e., development tool support for Microsoft, Java and third-party authoring. 

CHAPTER 2

Using a Workstation
A workstation is a combination of hardware and software that allows you to communicate with the network. A workstation requires a network card and connection via communications media to be part of a network. It also requires a supported operating system such as Windows. 
The hardware is responsible for:
·	Connecting the workstation to the network 
·	Providing a communication path to the network 
·	Helping ensure data is successfully sent to and from the workstation.
The software is responsible for:
·	Data content 
·	Data usage 
·	Data access on the network
Workstation software includes:
·	A supported operating system (Windows, Linux, UNIX) 
·	Novell Client 
·	Workstation applications (email, word processor)
Workstation Layers
Network Board Layer
Because all workstations require a network card to transmit and receive data a file is required that corresponds to the network card installed. This file acts as an interface between the physical card and the workstation. 
LSL (Link Support Layer)
Because a network can receive data packets in different protocols, it passes the packet to the LSL. This acts as a switchboard that recognizes the type of packet (IPX or TCP/IP) and passes it to the appropriate protocol.
Communications Protocol
A Communications protocol is a set of rules that a network uses to communicate – or put another way, a language. Pre-NetWare 5, the language is IPX. To speak to the Internet the language is TCP/IP. NetWare 5 now uses TCP/IP as its language but can also be configured to communicate in IPX. 
Novell Client Layer
The Novell Client is the top layer that integrates with the operating system. Novell provides software that is installed on a workstation to integrate with an existing operating system (Windows 98, NT, 2000) to provide extra functionality including the login process, using Windows Explorer and Network Neighborhood to manage network resources. It cannot run on its own. The setup program is WINSETUP.EXE which copies the client files to the local hard drive. It maintains information about redirection to network resources such as printers or directories on the network as well as configuration parameters of login, protocols and services to a network. 
Browsers 
A browser is an application (Netscape, Internet Explorer) that lets you access Web servers, Web pages and other TCP/IP resources and programs such as Java.
Login
Gaining access to the network resources and services is done through the login process. It is mandatory and a security issue. A valid user account is required. A password is optional. 
Once the Client software is installed on a workstation, the options to gain access to the login are:
·	The Novell Client login window, which appears after the workstation, boots up 
·	Choose Start | Programs | Novell | NetWare Login 
·	Right click the red ‘N’ in the system tray and select NetWare Login 
·	Run C:\Novell\Client32\LoginW95.exe (95/98) or WINNT\System32\LoginWNT.exe (NT/2000)

CHAPTER 3

Novell Directory Services (NDS)
The NDS is a hierarchical database. It resides on a server on the SYS volume. It contains objects that represent the resources that are on the network (users, printers, servers).
All network requests go through the NDS.
When you login to the network – you login once through a process called authentication. Once successfully logged in you have access to any NDS resource or file system where you have been granted rights or privileges.
The NDS is composed of 3 components: Objects; Properties; Values
An object represents a resource (user, printer, server, group, etc.).
Each object has properties. These are fields of information about the object. 
The entry to the property is called the value. 
An example is a user. A user is an object created in the NDS. A user object has properties such as title, first name, telephone number. The entry against that property, such as, Manager, Bob, 234-0987 are the values. 
The NDS is hierarchical, or a tree design. Think of the file system on your hard drive. 
C: is the top of the file system, also known at the root. Under the root of C: you can create directories, under those directories you can create sub-directories and decide where the individual files are placed. 
The NDS structure is similar.
[ROOT] 
At the top of the tree is [ROOT], always referenced with the square brackets. You can have only one [Root] per tree. It is a placeholder and the only object that does not have properties or values. 
Containers
Containers are similar to directories. There are three:
·	Country container
A Country container can only exist directly below the [Root]. It must be a valid X500 country code. (UK for United Kingdom, US for United States). It is optional. It is also limiting in that it can only have an Organization container or Alias leaf object under it. You could not place user accounts, servers or any other leaf objects under a Country container. You can have multiple Country containers, but all must be under [Root]. 
·	Organization container
An Organization container is created under [Root] or if there is a Country container it would be created under it. An Organizational Unit container or any leaf object can be created under an Organization container. At least one Organization container is required. It is usually named after the Company. 
·	Organizational Unit container
An Organizational Unit container can be created under an Organization or an Organizational Unit container. It can contain all leaf objects. It is an optional container. 
Leaf object
A Leaf object represents a resource such as a user, printer, server, or group. It is the end-most object like a file in the file system. You cannot create a file under a file and you cannot create anything under a leaf. Leaf objects (other than an Alias) can be created under an Organization or Organizational Unit container.
Commands and Utilities to Manage the NDS
·	CX – is for context. It is a command line utility to display or navigate through the NDS. 
·	NetWare Administrator – this is a GUI (Graphic User Interface) utility that requires a Windows workstation to run. The F1 key = Help. 
·	ConsoleOne – is a Java utility that is platform independent and can also be run on a server console. 

CHAPTER 4

NDS STRUCTURE
Context versus Current Context
·	Context is the container where the object has been created. 
·	Current Context is the location where you are ‘currently’ sitting in the tree. In a comparison to the file system, a file is created in a directory – which would be the file’s context. You could be pointing to a directory somewhere else in the file system or right at the root of the volume – which would be the current context. 
Naming Conventions
There are two naming conventions for NDS:
·	Distinguished Name 
A Distinguished Name is the fully qualified name of an object in the NDS. Put another way, it is the full path of where the object resides starting from the object and walking up the tree to (not including) [Root]. When sending this information to NDS, you identify that it is the full path by starting the name with a period. Example: .ADMIN.CORP.NYC.EMA. NDS identifies the leading period and will not do any further name resolution. 
·	Relative Distinguished Name 
A Relative Distinguished Name is relative to where your current context is or where you are currently sitting in the tree. The difference to NDS is that you do not start the relative name with a leading period. NDS takes the information provided and adds on the current context to build a distinguished name. NDS only uses distinguished names. Example: If your current context is .CORP.NYC.EMA, you would use ADMIN. NDS identifies that there is no leading period, takes ADMIN + .CORP.NYC.EMA to build a distinguished name of .ADMIN.CORP.NYC.EMA If your current context was higher, then you would provide more information to walk up to the current context.
Trailing periods can be used with Relative names. It works like the CD.. command in DOS. Each trailing period is the equivalent of moving up one level in the tree or removing an item from left side of the current context. 
Typeful versus Typeless
The NDS design was based on the X500 International standard. With that come attributes that can be used to fully qualify the object type. Using the attribute is typeful, no attribute is typeless.
The attributes are: 
C Country container
O Organization container
OU Organizational Unit container
CN Common Name (Leaf objects)
These can be used with Distinguished or Relative Distinguished names. 
Example .CN=Admin.OU=Corp.OU=NYC.O=EMA is a typeful distinguished name.
.Admin.Corp.NYC.EMA is a typeless distinguished name.
Setting Up Network Access for Users
When creating a User Account you must provide a Login Name and a Lastname
The TEMPLATE object can be created to set common values applied when creating a new user.
Details on Multiple Users allows you to make changes to values of existing users. You can highlight individual users, groups, containers and templates. This will change any individual user or any user account on the membership or occupant lists. 
BulkLoad
BulkLoad is a new utility for NDS8 that can be used to create objects, including user accounts.
LOGIN SECURITY
Restrictions that can be placed against a user during login are:
User Account Restrictions
·	Time of Day (when you can/can not login) 
·	Account Balance (charging for specific resources) 
·	Address Restriction (details specific workstation address where account can log in)
Intruder Detection
This is set on a container and has two parts. The first setting is the number of incorrect login attempts within a certain amount of time. This information will be recorded against the user account. The second setting works as follows: if the first setting occurs the account will become locked for a specified amount of time. You can unlock the account from the user Intruder Lockout page. 
Passwords
Passwords are optional on all user accounts except the first ADMIN account when the tree was initially created. Password settings are:
·	Minimum number of characters 
·	Number of days to expire a password 
·	Unique passwords (remembers the last 8 used) 
·	Grace logins (allows old password to be used for a specified number of times after it expired) 
·	Disable the account

CHAPTER 5

Managing Resources in a Multi-context Environment
Multi-context means managing resources in multiple containers and how to point to the resources that exist in other containers. 
Using distinguished names versus relative distinguished names will always work because you are providing the full path to the object. Relative is ‘relative to where you are executing the command from’. 
Setting Context 
Ways to set the context include:
·	during login through the workstation Network settings (this is workstation specific) 
·	from a login script with the Context command (this is not workstation specific)
Shortcuts
Alias object
An Alias is an object that can be created to point to another NDS object.
Directory Map object
A Directory Map object is an object that can be created to point to a volume and directory path in the file system.
Application object
An Application object is an object that can be created to point to an executable in the file system. 
Global Group
A ‘Global Group’ is a Group object where users have been assigned from different containers. It is not important where you create the Global Group – the important point is where you assign rights to the group object. All Members of that group will receive the rights wherever assigned. 
NDS and File System Rights
The following concepts apply to both NDS security and the file system security.
Trustees
A Trustee is used for assigning rights to a specific object, directory or file. The Trustee is the ‘who’ that is added to the Access Control List (ACL) of the object, directory or file and the ‘what’ are the rights assigned to the Trustee. The objects that can be used for assigning rights are Users, Groups, Organizational Roles, Containers, [Root] and [Public]. Accounts who belongs to any of these will receive the rights assigned at that level and carry them from that point down in either the file system or NDS. This is known as Inheritance.
Inheritance
When rights are granted to a directory in the file system or a container in the NDS the rights from that point will flow down to all files and sub-directories or all containers and leaf objects below. This is called Inheritance. 
There are two ways to stop the flow of inheritance.
1.	Make a new assignment to the object that was granted the rights from above. This new assignment will over-write the old assignment. This can grant more or less rights. If you want the rights to be maintained from the assignment above, you must grant them those rights in the new assignment. 
2.	The second way is to place an Inheritance Rights Filter (IRF). Think of the filter sitting on top of the object, directory or file – filtering out rights flowing in to it. This filter affects everyone who may have rights – it cannot be selective as to who you filter rights from. 
An exception here is within the file system. If you grant the supervisor right in the file system, it cannot be taken away at a lower level with either a new assignment or a filter. This does not apply in the NDS. 
Effective Rights
The rights can be coming from other objects that the user belongs to where additional rights have been assigned. An individual assignment will only overwrite a previous individual assignment. If this user belongs to groups, organizational roles, containers or has been granted security equivalence where any of these have been granted additional rights, they are additive. 
This is called Effective Rights. Check the ‘Effective Rights’ to see the total sum of rights the user has and then check the user’s ‘Security Equal To’ page as to where rights may come from. 
Security Equivalence 
Users can also be made security equal to another user. They will obtain any additional rights that users may have. It should be used as a temporary assignment – if a user needs the rights on a permanent basis, make a trustee assignment. Security equivalence is set at the user object.
[ROOT] versus [PUBLIC]
[ROOT] is represented as an object at the top of the NDS tree. The [PUBLIC] trustee does not have an NDS object and is only available as a trustee assignment. [PUBLIC] has the same position in the tree as [ROOT]. Every object is a member of both [ROOT] and [PUBLIC]. The difference is that rights assigned to [ROOT] can be received once you are authenticated (logged in). [PUBLIC] means you are ‘connected’ to, but not logged in to the network. 

CHAPTER 6

NDS Security
NDS versus File Rights
Rights never flow from the file system into the NDS. Rights will flow from the NDS in to the file system when someone has the Supervisor object right to the Server object. They will have all file rights including Supervisor to all volumes that belong to that server. Also, if they obtain the Write property right to the Object Trustee (ACL) property of the server object, they will also receive all rights including supervisor to all volumes on that server. The Supervisor right in the NDS can be removed with an IRF (Inheritable Rights Filter) and can be removed at a lower level with a new trustee assignment.
Default NDS Rights
Users will receive the Browse object right to all objects in the Tree from the trustee assignment of [Public] to [Root]. Users also receive the Read Property right to All Properties of their user account. This means they can Read any setting made to any property of themselves. They also receive Selected Property assignments of Read and Write to the Login Script and Printer Configuration properties. [ROOT] is made a trustee of a user and granted Read to Group Membership and Network address selected properties. [Public] is made a trustee of a user and granted Read to the Default Server selected property.
NDS has two sets of rights. Rights against the object itself, and rights to what you can do the values of the properties that belong to that object. 
OBJECT RIGHTS
Supervisor
The Supervisor object right implies all object rights. By granting the Supervisor Object right also implies granting the Supervisor right to All Properties.
Browse
Allows you to see objects in the NDS.
Create
Allows you to create an other object. You will only see Create on a container, not on a leaf object.
Delete
Allows you to delete an object.
Rename
Allows you to change the name of the object. 
Inheritable
Allows you to decide whether the assignment will flow from the container down. You will not see the inheritable option on a leaf object.
PROPERTY RIGHTS
Supervisor
The Supervisor Property right implies all other property rights.
Compare
Compare allows a comparison to be run against the value and receive a True or False response. If you have the Read right, Compare is implied.
Read
Allows you to see the value.
Write
Allows changes to be made to the value. If you have the Write property right to the ‘Object Trustees (ACL)’ property of any object, this will allow you to make a trustee assignment to anyone and grant all rights including Supervisor.
Add/Remove Self
Allows you to add or remove yourself as a value of the property, but you cannot change any other value of the property. If you have the Write right, Add/Remove Self is implied. 
Inheritable
Allows you to decide whether the assignment will flow from the container down. You will not see inheritable on a leaf object.
All Properties versus Selected Properties
An assignment of rights to All Properties will grant those rights to every property of that object. An assignment to Selected Properties will grant rights only to the properties selected where more or less rights were granted. An assignment to a selected property will overwrite rights granted to All Properties for that particular property. 
In NetWare 5 at a container’s Selected Properties – all properties of all objects, container and leaf, are available for selection. Therefore if an assignment is made to a selected property at a container that applies to a leaf or container object and the inheritable right is checked, that assignment will inherit to any object that has that property. 
Selected Properties overwrite All Properties - both can be inherited.
To use a Directory Map object, a trustee assignment is required with a minimum of Read to the Path property. 
To use a Profile object, a trustee assignment is required with a minimum of Read to the Login Script property. 

CHAPTER 7

Managing File System Security
Directory & File Rights
Supervisor – Implies all rights.
Read – Read the contents of an existing file and launch executables.
Write – Write to an existing file.
Create – Create new files and directories. 
Erase – Erase existing files and directories.
Modify – Set attributes and change the name of files and directories.
File Scan – See files and directories.
Access Control – Set Inheritance Rights Filters and make trustee assignments – granting all rights except Supervisor.
Default Rights 
·	When a user account and home directory are created at the same time, the user is made a trustee of the directory and granted all rights except Supervisor. 
·	The container where the SYS volume resides is made a trustee of the SYS:Public directory and granted Read and File Scan. 
Attributes 
Attributes can be described as another level of security for files and directories. They can potentially overwrite the ability to perform an action that the rights allow you to do without them. If you have applied a read-only attribute on a file, you cannot erase it even though you have the erase right. The Modify right allows you to change the attribute to a read-write and then you could erase it. Utilities to set attributes are:
NetWare Administrator; Filer; Flag
Managing the File System
Novell Utilities
FILER- a DOS Menu utility to manage the files and directories. 
FLAG- a DOS command to apply or remove attributes.
NDIR- a DOS command that allows you to view file system information.
NCOPY- an enhanced copy command that will preserve Novell attributes and use volume object names. 
Salvaging Deleted Files
Files can be recovered through the Salvage utility in Filer, NetWare Administrator and Explorer. Files cannot be recovered when:
·	disk space begins to run out. The oldest erased file will be written over first. 
·	a file is purged – with the purge attribute, it cannot be recovered. 
DELETED.SAV
Is a system created directory to recover deleted files when its directory has been deleted.
Managing Volume Space Usage
There are two ways to restrict user accounts on how much data they can store on the network:
1.	by the total amount of data in a directory; 
2.	by the total amount of data on an entire volume. 
If you restrict the amount of data that can be placed in a directory –the limit is set at the directory and will include all data and sub-directories created within it, regardless of who places data in it.
If you restrict by volume, you are charging a user account by the amount of the size of each file that the user creates (the owner property), regardless of where that file is stored on the volume. This restriction is placed on the volume specifying the user account. 
Compression
Netware compression is analogous to ZIP file compression. It is enabled on every volume by default and can save an average of 63% of disk space.
Attributes to override compression settings are:
DC – Don’t compress 
IC – Immediate compress
Block Sub-allocation
Block Sub-allocation optimizes disk space by taking the last piece of the file that does not require a full block and writing it to an unused portion of another block. 
Migration
Migration is where you can purchase a device known as a jukebox. This is a readable/writeable optical device that can be configured through Novell’s High Capacity Storage System or through third party software that allows you ‘migrate’ data off a volume to this jukebox which is ‘nearline’ storage instead of ‘offline’ storage (back-up tape). It looks to the user like the data is still on the volume. The attribute to keep files from being migrated is DM – Don’t Migrate. 

CHAPTER 8

Creating and Managing Login Scripts
MAP Commands
MAP commands are the most common commands in login scripts. 
There are two types of map commands: Regular (or Network) and Search.
·	Regular drive mappings are pointers to directories in the file system that contain data, such as home directories. The regular drive mappings point specific drive letters to directories where users point to where they store and retrieve data with some sort of logic. H: points to your Home directory; S: points to the Shared directory. 
Syntax: MAP (options) d:=volume:path where d is the drive letter. 
·	Search drive mappings point to directories that contain executables, such as application directories. You don’t want the user to have to change locations to execute them. The search drive pointers are placed in the Path statement. This is searched if an executable cannot be found in the current directory. Example: if the user is in her home directory and launches WORD.EXE the system will search for the EXE in the current directory. If it is not found the system will search the Path statement and all the pointers to directories. If found, the system launches the application.
Syntax: MAP (options) s#:=volume:path where s# is the position for the assigned letter to appear in the path statement. 
Regular drive letters are assigned from the top of the alphabet down; search drives start from the bottom up. Novell will support 16 search drives. 
Directory Map Object
A Directory Map Object can be created in the NDS as a shortcut to be used with a MAP statement. The volume and path are placed as values inside the object. 
Example: MAP S16:=WPAPP
This will map the last search drive to the contents of the Directory Map object WPAPP. 
Login Scripts
There are four login scripts and they execute in the following order:
1.	Container
The commands written in a container login script will execute for the users logging in that belong to that container. 
2.	Profile
A profile is an NDS object which contains login script commands written as values to the login script property. The profile must be assigned to the user (one profile per user) and the user must have rights to the profile. 
3.	User
A user login script can be written for an individual at the login script property of that user. 
4.	Default
The default login script will only run if there is no user login script. It has essential commands such as a mapping to the SYS:Public directory. It cannot be edited. It is hardcoded in the LOGIN.EXE that is found in SYS:Public and SYS:Login directories. 
Login scripts have two components: commands and identifier variables.
Commands
MAP Creates drive letters to point to directories in the file system. 
REM REMARK * ; Commenting out a line – the login script ignores anything after a remark. 
NO_DEFAULT Turns off the execution of the Default login script.
# or @ Runs an external command from the login script. # means go execute the command and stops. @ means go execute the command and the login script keeps processing.
FDISPLAY Displays the contents of a text file. ‘F’ is for filtering reveal codes from the word processor. 
INCLUDE Calls in and executes additional login script commands in either a text file or another login script. 
WRITE Writes the line to the screen. Double quotes encapsulate the line.
Identifier Variables
Identifier variables allow you to enter a variable (such as LAST_NAME) rather than a specific name (such as Jones) in a login script command. When the login script executes, it substitutes real values for the identifier variables. Variables must be typed in upper case (capitals). When using identifier variables with the WRITE statement or MAP commands they need to be preceded with a %.

CHAPTER 9

Novell Distributed Print Services (NDPS)
NDPS Broker
An NDPS Broker is an object created in the NDS when the NDPS product is installed on a server and when no other broker exists within three hops of another server. It will be created in the same container as the server and will reside on that server. It maintains three services:
·	SRS - Service Registry Services - registers information of Public Access Printers. 
·	ENS -Event Notification Services - configurations for print job and printer notification. Notification can be configured for email, pop-up menus, and creation of log-files. 
·	RMS - Resource Management Services – A database of printer drivers, banners, printer definitions and fonts.
NDPS Manager
An NDPS Manager is an object created in the NDS and can support unlimited number of printer agents. (A printer agent represents a printer.). Multiple NDPS Managers can be created in NDS, but only one NDPS Manager can be loaded and running on a server at a time. The NDPS Manager would support all printer agents assigned to it. If you have multiple servers, you can run multiple NDPS Managers, one per server. 
Printer Agent
A Printer Agent is created for each printer. A Printer Agent can be a software entity running on a server representing a local, remote, or network-attached printer, or a Printer Agent can be a software entity embedded within a network-attached printer.
NDPS Printers
Two types of printers can be configured for NDPS: 
·	Public Access Printer 
The Public Access printer is created through the NDPS Manager. It does not have an object in the NDS; therefore little security can be place on it. It is available to everyone logged in to the network. The information configured for this printer is stored in the Service Registry Services of the NDPS Broker object. 
·	Controlled Access Printer 
A Controlled Access Printer gives you control of the printer. It is configured by creating an object in NDS. You can specify who can print to it, who has control of the jobs and who can configure access to print queues. When creating the NDPS Printer object you specify the NDPS Manager who supports it.
Gateway
A gateway translates NDPS queries to printer specific language. Third-party gateways provide bi-directional feedback and control between the client and the physical printer.
Novell Printer Manager
SYS:Public\Win32\NWPMW32.exe
The Novell Printer Manager allows you to:
·	Manually configure printers on a workstation 
·	Maintain and update the printer list 
·	View a list of all print jobs 
·	Receive information and event notification for jobs and printers 
·	Change job order

CHAPTER 10

Zenworks
Design Guidelines
·	Create groups in the same container as the associated application. 
·	Limit a group to 1,500 members. 
·	Never span group members in containers over WAN links. 
·	Keep groups and users in the same partition. 
·	Do not place users in more than 64 groups.
Installation of ZENworks Starter Pack
Requirements:
Server: 175MB free disk space 7MB free of 128MB RAM
(NetWare 5)
Workstation: 5MB disk space Pentium with 16MB RAM
Supervisor right to [Root]
Workstation Manager
The workstation manager component is installed on servers and workstations with the installation of ZENworks (server) and the Novell Client (workstation). This allows you to configure Microsoft policies through NetWare Administrator (NWAdmin32). It is made up of modules on the workstation and provides a NetWare Administrator snap-in. 
Registering Workstations
A workstation must first be registered before it can be imported into the NDS. This is done through the workstation registration program. 
There are three methods available for Workstation Registration:
1.	Application Launcher – ZenWorks automatically creates two application objects pointing to WSREG32.EXE and WSREG16.EXE. 
2.	Scheduler – A Scheduler program is available from the Novell Client (WSREG32.EXE) and runs each time a user logs in. An icon is placed in the System Tray. 
3.	Login Script – The WSREG32.EXE and WSREG16.EXE can be placed in a login script as commands to run at each login. 
Log File
A registration log file is created on the workstation: C:\WSREG32.LOG
Importing Workstations
·	Registered workstations have to imported into the NDS to become workstation objects. 
·	A User Policy Package is required where the Workstation Import Policy has been enabled and associated with a container. 
·	Workstations can be manually imported through Tools in NetWare Administrator 
Policy Packages
There are three types of policy package objects that can be created:
·	Container 
·	User 
·	Workstation 
The User and Workstation packages are platform specific (they must match the operating system they will be used on – Windows 3.1, 95/98, NT/2000)
Container Package
·	Can only be associated with a container. 
·	Contains a search policy to determine how far up the tree to search for policies. (Default is up to [Root])
User Policy Package
A user policy allows you to define ‘rules’ against a user account regardless of which workstation they log in to.
Workstation Policy Package
A workstation policy package is applied to a workstation object that has been imported into the NDS, regardless of who logs in at the workstation. 
Some policies, such as Remote Management, appear in both the workstation and user policies. These can be configured to be applied to either the workstation or the user. 
When a User authenticates to the network, the Workstation Manager checks for any policies assigned to the User and checks for policies assigned to any groups the user belongs to.

CHAPTER 11

Associating Objects with Policy Packages
An enabled policy in a policy package is not effective unless the policy package is associated with an object. You can associate policy packages with Users, Groups, Workstations, Workstation Groups, or containers, depending on the type of policy package. 
Just like assigning different rights for different users in NDS, you can set a general policy for most users, and a unique policy for a unique user. Unless otherwise specified in a Search policy, when the system starts searching for the associated policy packages for an object, it starts at the object and works its way up the tree. Any enabled policy in a policy package associated directly with an object (user or workstation) takes control, even if a contradicting policy in a policy package is higher in the tree (group or container).
If the user has both workstation and user policy packages associated with it, the user policy packages apply first. Within the user policy packages, individual policies are applied based on the following criteria: 
Search Order
Policies are applied in this default search order:
1.	User policy packages (Policy packages associated directly with the user) 
2.	Group policy packages 
3.	Container policy packages
Enabling a search policy and configuring that policy can change this search order. 
Effective Policies
Effective policies are the total sum of all enabled policies in all policy packages associated directly or indirectly to an object. Just as the effective rights in NDS flow down the tree, policy package associations flow down the tree, unless there is an explicit association for an object with a policy package.
When the system calculates the effective policies for an object, it starts with all policy packages assigned to that object. It then looks up the tree (assuming that the search order starts at the leaf objects and goes up towards the root of the tree) for associations made to parent containers. The first enabled policy it finds is the one it uses, just as the system looks up the tree for effective rights.
Policy Associations and Inheritance
You can associate policies to the object itself (User or Workstation), to the group the object is a member of (Group or Workstation Group), or to any container specified in the distinguished name of the object up to the root of the tree. A policy associated to an object takes precedence over a policy associated to a group, which takes precedence over a policy associated to a container. This is according to the default search policy.
For example, suppose the Remote Management policy is not enabled in a User Policy Package associated with the User object. However, the Remote Management policy is enabled in the User Policy Package associated with the container where User objects reside. The result is that the enabled Remote Management policy is the effective policy for the user.
ZENworks looks up the tree for effective policies (assuming that the search order starts at the leaf objects and goes up towards the root of the tree). The first enabled policy it finds wins.
Cumulative Policies
These policies allow multiple policy packages to be in effect from different associated policies. The cumulative policies include:
·	Enabled User/Computer System Policies 
·	Enabled User/Computer Extensible Policies 
·	Scheduled Action Policies
Application Launcher
The Application Launcher component of ZENworks allows you to create objects to distribute applications.
Benefits
·	Single point of application administration 
·	Location Independent (your applications goes with you) 
·	Push and Pull software distribution to workstations
Push = automatic install or forced run
Pull = user initiated 
·	Application Fault Tolerance and Load Balancing – it can be configured such that users have access to applications on multiple servers in case one becomes unavailable 
·	File Rights Assignment through the Application object 
·	Roaming Profile support

CHAPTER 12

Application Launcher Components
Administrator Components
·	Application Launcher snap-in for NetWare Administrator 
·	SnAppShot
User Components
·	Application Launcher window
SYS:\PUBLIC\NAL.EXE 
·	Application Explorer
SYS:\PUBLIC\NALEXPLD.EXE
Application Explorer can only be run on Windows 95/98, NT/2000. 
The icons can be placed in the:
·	Application Explorer Window 
·	Windows Explorer 
·	Start Menu 
·	System Tray 
·	Desktop
Shortcuts on the Desktop have a red arrow. 
Simple versus Complex Applications
Simple
A simple application points to the executable and is run from the server. A simple application is created with an Application object in the NDS pointing to the executable and associating who can use it. There are additional configurations that can be applied that define how the object will be used. 
Complex
A complex application contains the application itself plus configurations such as registry settings. This is done by creating an NDS object after using the snAppShot utility.
snAppShot Utility
An Application Object template (AOT) is created with a utility called snAppShot (Snapshot.exe). It takes a snapshot (the before picture) of the workstation operating system including registry settings. Once complete, it pauses so you can install the application. Once the installation is complete, you take the ‘after’ snapshot. Once complete, it takes the difference between the before and after picture and bundles the difference in the AOT. It also creates an AXT file – Application Object Text Template. The AOT is in binary format and cannot be edited. The AXT can be edited. This AOT can be configured in an Application object and rolled out to workstations where the application will be installed. It also has a verification process so that if a file associated with the application becomes deleted or corrupt it will re-install the AOT files. 
Configuring Application Objects
Environment Page
Allows you to:
·	Set the working directory 
·	Define how the application will be run (minimized, hidden, maximized) 
·	Provide 16-bit Windows-On-Windows support 
·	Clean up resources such as mapped drives or other connections 
·	Use a wrapper executable to launch the appropriate operating system file.
System Requirements
You can specify the requirements needed for the application to run or be installed such as:
·	The specific version of the operating system (98, NT) 
·	Processor (486, Pentium II) 
·	The amount of RAM 
·	The amount of free disk space
Distribution Schedules and Availability
You can schedule when applications are delivered or available.
Load Balancing and Fault Tolerance
Load balancing allows you to have copies of the same application on multiple servers to balance access to the applications. Fault tolerance allows you to set up primary and alternate sources of application access in case of failure of the primary server.

Fin.