Creating Device Profiles that Allow Unregistered Devices

To collect equipment IDs from unregistered devices by using a device identity variable with device profiles

1. Identify or set up the AD or LDAP authentication server and realm you want users with unregistered devices to log in to. If you’re starting from scratch, see Creating Realms for more information. In this example, the realm is named Employees.

2. Create a variable named device_identity that points to an attribute in the directory server specified in Step 1 (you can create the variable and capture data even if the attribute it points to doesn’t exist yet):

   1. In the AMC, navigate to Security Administration > Resources.

   2. Click on the Variables tab.

   3. Click the + (New) icon.

   4. In the Name field, enter the name for the variable; for example, device_identity.

   5. Select User attribute from the Type list, and then make sure Employees is selected in the Realm list.

   6. If the user attribute that holds device ID data already exists, enter a valid user name in the User field, and then select the attribute from the Attribute list. If it doesn’t exist yet, just enter its name in the Attribute field.

   7. If it’s possible that some users will be associated with more than one device (for example, a desktop computer and a laptop), select Multiple results in the Output list.

3. Now create device profiles and a zone for unregistered devices. If you are collecting data from all three types of devices, you’ll need one device profile for each one:

   1. In the AMC, navigate to User Access > End Point Control.

      The End Point Control page displays.

   2. Make sure that End Point Control is enabled.

   3. In the Zones and Profiles section, click Edit next to Profiles.

      The Zones and Profiles page displays.

   4. Click the + (New) icon.

   5. Select the platform for which you want to create the new device profile.

   6. Give the device profile a name (for example, Unregistered - Windows), and then select Equipment ID in the attribute Type list.

   7. Select Matches as the Value. You’ll create a Standard zone later in this procedure.

   8. Click the {variable} button next to the Device identifier field, select the variable you created in step 2, and then click Insert. Click {variable} again to close the list.

   9. In the Unregistered devices area, select the Match profile if user has no registered devices check box. Devices that are not already registered on the external AD/LDAP server will be a match for this profile and their identifiers will be recorded in the Unregistered device log. If you haven't already defined the variable, you'll see a warning (Undefined: {device_identity}), which can be ignored for now.

   10. Click the Add to Current Attributes button, and then click Save.

   11. Add a device profile for each of the other types of devices you want to accommodate. For example, Unregistered - WinMobile, or Unregistered - ActiveSync.
4. Create a Standard zone named Data collection that uses the device profiles that you created. See Creating a Device Zone for more information.
5. Now create a community named New devices in the Employees realm. On the End Point Control Restrictions page for that community, move the Data collection zone to the In use list. See Creating and Configuring Communities if you need help setting up a community.

6. When you apply and save your changes, click End Point Control in the main navigation menu.

7. When an unregistered device is detected during login, the user is placed in the Data collection zone because the device matches the Unregistered profile. To see device identity details, select Unregistered device log on the Logging page in AMC.
8. Select No devices in the Device count list, and then click Refresh, so that you're sure to capture all new users.
9. If you need to do any additional analysis of the logged data, export it to an XML file. You can reduce the size of the exported file by first applying filter or search criteria. The Show last <n> messages setting determines the maximum number of messages included in the exported log file.