Endpoint Security Complete

 View Only

MDM Device Ownership 

Mar 26, 2012 03:22 PM

Note: Updated for MMS 7.2

In your environment you may wish to do more with the information that's sent from the MDM agent to the CMDB.

This article describes one possible method of associating the mobile device with it's owner. This is especially useful as the device names for iOS devices won't always give you an indication of who uses that device.

This method uses a report that lists the enrollment user ID and matches it with the windows user ID, in addition to listing the guid's of the Mobile device and windows user. I've attached the xml for both the report and the CMDB rule but I'll do my best to arm you with the required knowledge as well.

Creating the report: (Report is attached)

  • Create a new report called Mobile Ownership, then in the Query tab, change the base query to mobile.
  • Click on 'Use Fields & Data Class Attributes' and add the following (It's not essential to add all of these but we're using this report for multiple purposes). Mobile.Name, Mobile_Device.UserId and Mobile.Guid. Give Mobile.Guid the alias of "ResourceGuid".
  • From Mobile_device, create a join and add Inv_Global_Windows_Users. On the left side entry box, add Mobile_Device.UserId and on the right side entry box, add UserId.
  • In the 'Fields" tab, make sure that the following are listed. Mobile.Name, Mobile_Device.UserId, Inv_Global_Windows_Users.UserId, Inv_Global_Windows_Users._resourceGuid and Inv_Global_Windows_Users.Domain
  • Set the Inv_Global_Windows_Users._resourceGuid's alias to "Resource Guid" (Note: As far as I'm aware, this should work as long as the Alias contains the word "Guid" in sentance case as shown, however I had to name both the mobile and user guids some combination of Resource Guid to get the rule to save properly).
  • Save the report. You should see the device name, the enrolled userID, guid for the mobile asset, the windows userID, guid for the windows userID and the user's domain.

Creating the rule: (Rule is attached)

  • Click on Settings, All Settings. Then navigate to Notification Server, Connector, CMDB Rules. Right-click and create a CMDB Rule called Mobile Ownership.
  • Select Mobile as the Resource type and target using a report. select the Mobile Ownership report we created earler.
  • This process may add data classes and associations. Add or remove data classes and resources so that you are only left with the 'Ownership Details' Data Class, and the 'Asset User Owners' forward association (Both are found under 'CMDB Data Classes').
  • In the 'Ownership Details' dataclass, select Update for Update Mode, set the Owner Source to Resource Guid, then set the Ownership Percentage as a value, which will be 100.
  • Set the Lookup Key for the Asset User Owner as User UserId/Domain, then in the Key column mappings, set the UserId to the MDM enrollment User, and set the domain to domain.
  • Test the rule, as long as there's no null values for UserID's, you should get a success.
  • Set a schedule for your rule.

 That should be all you need to do in order to bind a mobile device to an owner, which you can then leverage for asset management, MDM profiles, etc.

Sample report and rule for Mobile Ownership are attached.

Also, please leave feedback as this is my first article on Connect. Thanks!

Statistics
0 Favorited
0 Views
2 Files
0 Shares
0 Downloads
Attachment(s)
xml file
Mobile Ownership CMDB Rule.xml   8 KB   1 version
Uploaded - Feb 25, 2020
xml file
Mobile Ownership Report.xml   9 KB   1 version
Uploaded - Feb 25, 2020

Tags and Keywords

Comments

Jul 17, 2013 01:58 AM

Hi Kevin,

Wow I feel incredibly slack, I've only just seen your reply that was posted way back in Nov 2012. I only noticed it cos I needed some info in this article myself.

Do you still need an answer to the above? It's fairly simple, you just want to do the following:

1) Import the users in that security group to a filter using the AD import Tool
2) Use that user filter as a basis to get the mobile device they're owners of
3) Use Automation Policy to set their Organisational group.


1) If you use AD import already, you can create an import rule for Users and set the Resource to Security Groups. Tick the check box for "Create security group filters" and you should see a filter named after your security group under Filters/Notification Server Filters/Directory Filters/domain.com.au/Security Groups.
 
2) Now this obviously gives you the users, but you want to move their mobile devices. I posted an article recently where you can use a filter to reference a user based filter and give you a list of managed mobile devices they are owners of That is here: https://www-secure.symantec.com/connect/articles/mobile-user

If you follow that article, just make sure that the results of the report (or just steal the raw SQL if you want) only list the mobile devices. If it lists the Usernames or anything else, the Automation Policy probably won't know the difference and will move the lot.


3) Go into Automation Policy and create a new policy. Change the data source to Report and select the report that displays the mobiles owned by users in your security group. Change the Evaluation rule to "Run for non-empty data" and under Actions, select "Assign to Organisational Group" (You will need to create this somewhere under jobs and tasks, although I think there is one out of the box under Tasks/Jobs and Tasks/System Jobs and Tasks/Notification Server/Automation Policy Tasks).

Then click "Edit Input Parameters" (if the info doesn't load, save the policy and refresh the page), change the Organisational Group to Custom and select your Org Group from the dropdown menu, select Custom for Action and clik "Must at least contain", then next to Resources, select "Results as CSV".

Test that and you should see the mobile devices listed in the filter for step 2 in your Organisational Group.


I'm really hoping the above makes sense. If not, please feel free to message me.

Cheers.

Nov 28, 2012 06:15 PM

This is very helpful and I was wondering if you could help us take it a step further....

We are trying to create an automation policy to move the mobile devices to a specific organization view/group based on the user's AD security group membership.  Can you please help with the query we would use in the automation policy?

Thanks,

Kevin

Aug 29, 2012 09:49 PM

I've updated this article for use with MMS 7.2

Related Entries and Links

No Related Resource entered.