Full Walkthrough

More KeyConfigure

Having covered the main four windows and some important configuration items, we'll now dive into other aspects of KeyConfigure and the associated capabilities. Again this is not intended to be an exhaustive list of every button as the main documentation serves that purpose. Instead this is an overview of concepts and typical uses. The majority of what follows are items found under the Window menu in KeyConfigure.

Admin Alerts

One item not yet covered that you may have already seen is the Admin Alerts window. This pops up when you log in to KeyConfigure if there are any unresolved alert items. These can include reports of new Product imports from a PRS check, failed logins, or the availability of new client installers. The intent is that you review these alerts and Resolve them so the list is only those new alerts from the last time an admin took action to review them. The tops items will also be included in the daily status emails.

Connected Clients

While the bi-directional session arrows in the Last User Column of the Computers Window give a quick way to see which computers are active, idle or available, more information can be found in the Connected Clients window. This has a couple of benefits. One is that you can see the number Policies being accessed by each session. Another is that in the case of multi user logins, you can see not just the last user, but all users. There will also be an icon based indication on the connection arrows if there is an audit in progress (little red check in a box), or if there is a lost connection issue (yellow triangle). The latter should revert once the audit is complete, and the former should resolve when the connection is restored. Connection alerts are not uncommon when thinking about laptops that get closed or a VM that suspends, but if you see this frequently on desktop systems it could indicate a network issue.

Devices

While not one of the main 4 windows, this is a close 5th for many customers. Very much like the Computers window, you can store a list of Devices and their associated details, and link them to Purchases and Computers. Because there is no active agent these records are mostly manually populated, but there are a few exceptions. We have an integration with Papercut that will pull in all your queues from that system. If our agent discovers any storage drive or Display with a serial number, it will auto create that record and link it to the Computer record. Divisions must be made in the Computers window but can be used here to organize the Devices. They will follow the computer they are linked to unless you anchor them, much like Computers and automatic Division allocations. And of course you can import from CSV, and create custom categories for your Other "stuff".

Programs

We talked about Products which are the important lynchpin between normalized Programs, tracking use in Policies, and Purchase information. But some times we may not have a Product that covers a Program you have in your environment. The Programs window lists everything discovered on all machines. This is a very bulky list which is why it's more under the hood normally.

Before rooting through this window, it's usually good to ensure we actually don't have a Product in our catalogue. Use the Tasks menu -> Find Product Definitions function to search for a product name, manufacturer, or other keywords. The resulting list will hopefully contain the item you're looking for, which you can then import and work with. If not, or if the Product seems to not be picking up the expected installs, then looking for the Program is prudent.

Rather than use the Programs window, it can be easier to find a Computer that has the installed software in question and right click to Show Installs. This window will show all items found on the machine, and you can Arrange Columns (right click header row) to show the Path it is found in on that machine. If you located the Progam you need here, great! Otherwise, you can continue the hunt in the Programs window.

A good tip to hunting for a Program if you can't find it alphabetically is to use a Filter. Making a filter where Path Contains a string you know is in the software install location will greatly narrow results. We have documentation and blog posts on using this window to find Programs and make Products.

Keep in mind you can choose to mask versions so that a Product covers all Variants, or you can break them out by version as we do in our definitions for greater detail. In either case, we'll have granular Program reporting data, so this is a question of what detail you want (or need in the case of compliance) at the Product level.

Note that we track the plugins for certain Windows programs and those items will show as .dlls in the Programs Window once the host application has loaded the plugin and a subsequent audit is submitted. Some dll type plugins will also be detected like .arx files. If you want to track a plugin but do not see it, support is happy to assist in determining if it's a type that can be seen and helping you find it.

Lastly, you can right click any Program and Show Installs to see the Computers where it is found.

Users

The Users window will list all user names that have been seen in connected sessions. This is the name the OS reports by default. Some options exist to customize this per client install if needed. Right clicking a user will show which reports are relevant at the user object level. Users can be put into Folders and Tagged which can in some cases be useful for creating Scopes on Policies. You can also drag and drop the Users into things like a Policy user list when assigning a user based metric. If you leverage the Install Codes in Purchases you can easily see and recover software allocations when a user leaves the organization.

Groups

The Groups window has a dual function. By default, you can create a group which is an ad hoc list of Computers. This can be based on simple drag and drop addition, filter criteria, Division, network Location, or a combination of these things. You can not manually create a group that contains Users, only Computers.

If you are using Client Authentication tied to Active Directory for example, a list of AD user groups will be populated in this window. Again, while you can't make a User based group, we pull down user groups from AD. You can not view the members or modify the AD groups here. They are a convenience for setting the Scope of a Policy to select users based on the directory service.

Authentication

This is an extensive topic, and we'll try to keep it simple in this overview. To again be clear, we're talking about Admin Authentication in this section (logging in to KeyConfigure or the Web UI), as compared to Client Authentication (which is mentioned previously and is mostly used for mapping computers to Divisions based on AD structure). Know that you can have internal accounts, or external authentication. You can in standard AD environments simply turn on an option to leverage domain logins. We have a selection of other authentication modules as well. All authentication is handled by the Admin Authentication configuration as a starting point. Wether or not a given user has admin rights or guest rights or something else depends on the permissions configuration.

The Admin Access window is the first stop in determining permissions in most cases. While the Admin Authentication window (under Config) has some simple options for granting quick access, these pre-packaged options are often not specific enough. That said, in a small environment where you simply need to grant a few individuals full admin rights, adding a group that is mapped to the Manager account may be sufficient. For those that need more, we move on to Roles. Again starting easy, you may be able to simply add the AD group with your admins to the Administrator Role, and set the default for unknown accounts in the Admin Authentication to Create as Needed. Past that, things get more complicated and support is happy to assist.

The take away here in looking at any given Role, is there are a ton of privileges that can be managed to ensure granular access as needed in a federated environment. When a person logs in that gets an account created automatically, that account appears here as an External with the last time they logged in. By leveraging AD groups, you can manage who can log in and with what access via those groups, and they can use their existing passwords.

Permissions are complex however, and the Privilege granted by a Role is only half the story. The other half is Access. At the simple level this is globally controlled in Config -> Edit Server ACLs. By adding a Role to this window and checking the proper access rights, you set what can be accessed. The combination of Access and Privilege determines in the end if the person has Permission. So, if you give access to view but not create, but then you give create privilege for Purchases, the person can NOT create a purchase because the rights don't line up. If however you grant full access, but then privilege to modify only computers but not policies, purchases, etc., the end result is what the privileges dictate as the constraining factor.

Again, this is a complex topic so support is happy to assist. The take away is that you can grant permissions to a very granular level. This allows for techs that can see everything and do nothing, purchasing agents that can create purchases but not policies, section managers who can modify some computers but not even see others, etc.

Time Sets

In most cases this functionality is easier to manage in the Web UI. Any Schedules you make in the web will appear in this window however and can be managed here. The link between a time set and division is name based which is why making them via the Web is easier than the manual UI in KeyConfigure. But what are these time sets good for?

The primary use these days is for setting lab schedules. You can put in open and closed hours, as well as reservations for classes. These time periods can then be applied in Reports so that you exclude closed hours or only report on class utilization.

The Date Range pane of this window however can be very useful. Say you need to report on a given semester time range regularly. By creating a date range for that semester, it will appear as an option when running reports so you don't have to custom enter it every time. A date range can also then be applied to a time period, so you have a time set that has periods that are only valid for that range. That is, the reservation for a class was only for one semester or a given month or the like.

Reports

Finally we reach what to many is the end goal! We have gone through configuration and data collection, now how about doing something with all that data? The Web Dashboard is great for visualizing a lot of information, but for a deep dive into details we turn to Reports. There are many report modules in the product, and we'll only review a few of the common ones here along with a few specific examples. Many new administrators want to know about their inventory (Audit reports tell you what is installed where) and Usage (who ran what when where for how long based on your Policies collecting data). Choosing a Report from the main menu opens the Report Builder window to choose options before saving or running the report.

Audit Reports

These reports deal with your inventory of software. You can report as broadly as what Products are installed in which divisions, or as specific as the full breakdown of every version of every program and the computers that have it installed. If you're looking to manage your deployments and ensure upgrades are in place, these are the reports you're looking for.

Login Reports

Being informed of computer use can be as important as software use. Login reports can show you how much your hardware resources are being used in a variety of ways. At the Division level, is a lab being maxed out, or is peak use routinely no higher than half? This could help save budget by reducing computer purchase costs in a refresh. Even for a given computer, is it being used 10 hours a day, or was someone on it for 10 minutes to check email? Further, even if a login was many hours, was that all active time, or did the person use it for 2 hours then walk away without signing out and cause 38 additional hours of "use" that was all idle time? We even have reports for multiboot systems so you can see how much time is spent in each OS.

Usage Reports

Often these are seen as the core of the product. By monitoring usage of products in policies, you can then report on the usage. This can be broad at the Policy level so you see an aggregation of all Adobe Creative Cloud use. It can be finite so you can see every Adobe Program of every version broken out individually. Those two alone can inform if you should be purchasing the suite, or if really 90% of your use is Photoshop and that would be the cheaper option at renewal. If you purchase a few licenses of something very expensive, you'd like to know not only that it's being used, but if it's being used a few hours a year or constantly every day. Also, if you bought 100 seats and your peak is 70, there is a big opportunity to save when the renewal comes up for the following year. As with other reports, you can include your entire fleet, target one division of computers, or target one user. There is great flexibility in the variety of reports, and the ability to target to a subset of objects.

Charts

Where the above reports are great for a list of data, some times you want to see the data over time. The Chart reports produce histograms of things like logins and usage of software over time. Note that these are best used in the Web UI where these reports are beautifully rendered smooth line charts with mouse over and zoom detail interaction. If you want to see the peaks and valleys of use of Photoshop or a specific lab for a period of time, these are the answer.

Others

The Hardware report under Miscellaneous can be useful for pulling your hardware inventory information. You can always customize the columns in the Computers window, but then save formats are limited. With this report, you can save out to Excel or PDF as desired. You can target a specific Division or a Filter or Tag if you want just a subset of systems. There are over 75 data fields for computers so you can pick what columns you need. This may be a report to see what systems have an old OS, too little RAM, an old BIOS version, a specific brand of graphics card, too little drive space, or any number of other criteria. You could for example schedule a hardware report for weekly based on a filter for drive space less than 10gb so you'd be alerted to systems running out of space regularly.