Vmware, Inc.

Airwatch LLC

Omnissa, LLC

Shravan Shantharam

Kalyan Regula

Varun Murthy

Jason Roszak

Blake Ryan Watts

Xueliang Hua

Nitin Rao

Craig Farley Newell

Nikhil Ravishankar

Alexey A Polyakov

Ondrej Stastny

Brooks Peppin

Yogesh Govind Hande

Bhuvanesh Shanmuga Sundaram

Jonathon Deriso

Neeraj Saluja

Nigitha Alugubelli

Saransh Bhatnagar

Sharath Chowdary Gude

Vijay Chari Narayan

Mohan Guttikonda

Kevin B Sheehan

Nishita Manjunath

Joshua Dobelstein

Achyutha Bharadwaj

Abheesh Kumar Thaleppady

Eugene Sayapin

Haroon Barlas

Rahul Parwani

Scott Harlow Kelley

Sagar Date

Evgeniy Sayapin

Senthil Parthasarathy

Ishan Srivastava

Rene Jesus Olivera

Akhil Parasa

Nitin Radhakrishna Rao

Jinsong Liu

Scott Kelley

Greg Westerfield

Veeraiah Gorantla

Raymond Welch

Disclosed are various embodiments for securely distributing certificates or encryption keys. A management service can receive an enrollment request from a client device. The management service can then send a key request to a certificate provider, the key request comprising a user identifier. The management service can also send a skeleton payload to an enterprise gateway. In response, the management service can receive an encrypted profile from the enterprise gateway, the encrypted profile comprising the skeleton payload with an encryption key inserted by the enterprise gateway into the skeleton payload. Finally, the management service can send the encrypted profile to the client device.

Secure certificate or key distribution for synchronous mobile device management (MDM) clients

A management service manages recovery keys. The management service receives a removable drive recovery key, a recovery key identifier, and a removable drive identifier from a management agent executed on a client device. The management service stores the information, reads the removable drive recovery key from the removable drive recovery key escrow, and transmits this to the management agent as a verification of accurate storage of the removable drive recovery key within the removable drive recovery key escrow.

Secure recovery key management for removable drive encryption enforcement

Disclosed are various approaches for enforcing policies for unmanaged applications. A user supplied script can be evaluated to determine whether an application is installed on a computing device. In response to a determination that the application is installed on the computing device, a request can be sent to a management service for at least one policy applicable to the application. The policy can be evaluated to determine whether the application complies with the policy.

Enforcing policies for unmanaged applications

Disclosed are various implementations for distributing and installing packages in response to user logon events. A logon event associated with a user account is detected for a client device. A query containing a respective user account identifier is sent to a provisioning service to retrieve a set of packages to install on the client device. The set of packages are received from the provisioning service and installed on the client device.

Package distribution and installation in response to user logon

Various examples are described for operating system update management. In some examples, an OS update schedule is generated. The OS update schedule specifies an OS update for a plurality of client devices. A command to deploy the OS update is transmitted to a subset of the client devices. Behavior data is received from the client devices that have applied the OS update. An update incompatibility identified using the behavior data. Instructions to fix the update incompatibility are transmitted to certain client devices.

Operating system update management

Various examples for managing a client device having multiple enrolled user accounts thereon are described. A computing device is directed to store a mapping of a client device to a plurality of user accounts active. The computing device communicates remotely with a management application on the client device to identify an active one of the user accounts from an operating system of the client device. In response to receipt of information associated with a first one of the user accounts active on the client device, the computing device enrolls the first one of the user accounts with a management service in association with the client device. In response to receipt of information associated with a second one of the user accounts active on the client device, the computing device enrolls the second one of the user accounts with the management service in association with the client device.

Co-existence of management applications and multiple user device management

Disclosed are approaches for enforcement of updates for devices unassociated with a domain or directory service. An application executing on a client device can determine that the client device is to use a locator specified in a policy to receive and install updates to software installed on the client device. The application determines whether the client device complies with the policy based at least in part on a value of a registry key stored on the client device. The application then modifies a value of a registry key stored on the client device in an instance in which it is determined that the client device is to use the locator and that the client device does not comply with the policy.

Enforcement of updates for devices unassociated with a directory service

Disclosed are various examples for enrolling a client device and synchronizing user attributes for the client device across multiple directory services. A search request for user attributes can be sent to a first directory service with an identifier for a user account. The first directory service can query for the identifier and send back user attributes. If a global identifier is included in the attributes, another search request for user attributes can be sent to a second directory service with the global identifier. The second directory service can query for the global identifier and send back user attributes.

Directory service user synchronization

Examples of scheduled and on-demand volume encryption suspension are described. In some examples, volume encryption is to be suspended for a client device. A suspension limit is identified for a volume encryption suspension for the client device. A suspend encryption command is generated to include instructions for the client device to apply the volume encryption suspension according to the suspension limit. The suspend encryption command is transmitted to the client device for execution.

Secure volume encryption suspension for managed client device updates

Systems and methods are described for managing a user device in multiple management modes. In an example, an agent executing on the user device can enroll the user device with a Unified Endpoint Management ('UEM') system in a limited management mode. The agent can receive and install a first configuration profile from a server that configures the agent to operate on an unmanaged channel of the user device. In one example, the user device can have a third-party management client that manages the user device on a managed channel. The third-party management client can be removed. The agent can enroll the user device with the UEM in a full management mode. The agent can receive and install a second configuration profile that configures the agent to operate on the managed channel of the user device.

Implementing management modes for user device management

Systems and methods are included for causing a computing device to assemble and boot from a managed operating system. When the computing device is powered on, it can execute firmware that specifies a server to contact. The server can identify an operating system (OS) to boot, and the location of a pre-enrollment installer for assembling the OS image. The pre-enrollment installer can download base OS images in one or more pieces from multiple locations determined based on ownership information of the computing device. The multiple OS images can relate to enterprise management and company-specific applications and drivers. Once the pre-enrollment installer has combined the base OS images, the computing device reboots using the combined OS image.

Configuring a computing device using managed operating system images

Various examples are described for operating system update management. In some examples, an OS update schedule is generated. The OS update schedule specifies an OS update for a plurality of client devices. A command to deploy the OS update is transmitted to a subset of the client devices. Update behavior data is received from the client devices that have applied the OS update. An analysis of the update behavior data correlates an update incompatibility with the OS update. The OS update is prevented from being deployed to additional client devices specified in the OS update schedule.

Growing community of inventors

Cumming, GA, United States of America

Shravan Shantharam