The HCLSoftware U Certified Professional-BigFix Platform 1 (HCL-BF-PRO-10)

To upgrade a stand-alone WebUI server, the following steps are required:

Copy the BigFix WebUI installer (default location is %PROGRAM FILES%\BigFix Enterprise\BES Installers\WebUI) to the client computer that is running the BigFix WebUI.

Stop the WebUI service.

Run the installer on the computer that is running the WebUI. The installer detects the WebUI and offers to upgrade it for you. Follow the installer instructions to upgrade the BigFix WebUI.

Start the WebUI service.

References:

Upgrading the WebUI

Stand-alone Web Reports upgrade? - Platform - BigFix Forum

Here is a step by step comprehensive explanation of why this is the case:

The Action Script you are testing is trying to stop, start, and execute a service using batch commands.

The first line of the script uses the “appendfile” command to create a new file with the content “net stop myService”.

The second line of the script uses the “move” command to rename the file created by “appendfile” to “c:\runme.bat”.

The third line of the script uses the “waithidden” command to execute the file “c:\runme.bat” and wait for it to finish.

The fourth line of the script uses the “appendfile” command again to create a new file with the content “net start myService”.

The fifth line of the script uses the “move” command again to rename the file created by “appendfile” to “c:\runme.bat”.

The sixth line of the script uses the “waithidden” command again to execute the file “c:\runme.bat” and wait for it to finish.

The error occurs at the fifth line of the script because “appendfile” is trying to copy content to “c:\runme.bat” which already exists due to the previous actions in the script. In BigFix Action Script, “appendfile” is used to create a new file or append to an existing one, but it seems there’s an issue with overwriting or permissions that causes this line to fail.

To fix this error, you can either delete the file “c:\runme.bat” before using “appendfile” again, or use a different file name for the second “appendfile” command.

Some references that support this explanation are:

BigFix Action Script guide:  1

BigFix Action Script reference:  2

BigFix Action Script examples:  3

BigFix Action Script best practices: 4

According to the BigFix Platform documentation, the Site Administrator is responsible for installing and maintaining the BigFix software, and to run administrative tasks that globally affect the environment such as site-level signing keys management.  There is only one Site Administrator for a BigFix environment 1 .

Some of the global system options that the Site Administrator can set and modify are:

The default masthead file and license certificate

The default site subscription policy

The default client settings

The default relay settings

The default server settings

The default Web Reports settings

The default WebUI settings

The default LDAP settings

The default SAML settings

The default audit log settings

The default DSA settings

The default proxy settings

The default encryption settings

The default caching settings

The default logging settings

The default performance settings

The default security settings

The default diagnostic settings

To set and modify these global system options, the Site Administrator must use the BigFix Administration Tool, which is a separate application from the BigFix Console. The Site Administrator must also have the Action Site Credentials, which are a special key generated during the installation process.

The other options (A, B, and D) are not exclusive to the Site Administrator, and can be performed by other Console Operators, depending on their permissions and roles.

References:

BigFix Site Administrator and Console Operators

Site administrator responsibilities

Global system options

[BigFix Administration Tool]

The default port used by BigFix for communication between servers, relays, and clients is  52311 1 2 .  This port must be unblocked for TCP/IP and UDP traffic on all internal routers and firewalls 1 . Therefore, option D is correct.

The default port used by BigFix WebUI for communication on HTTPS is  9031 3 . This port must be opened to allow access to the WebUI from a web browser. Therefore, option E is correct.

The other ports listed are not used by BigFix by default, and can be ignored or changed during installation. Therefore, options A, B, and C are incorrect.  References:

Network configuration requirements

Modifying port numbers

Network Port Conflicts

A Non-Master operator can create a Retrieved Property by creating an Analysis, which is a collection of properties and relevance expressions that can be evaluated on a set of computers 1 .

To create an Analysis, the operator needs to have the  Create Custom Content  permission and the  Read  permission on the site where the Analysis will be created 2 .

To create an Analysis, the operator can follow these steps 3 :

Choose  Tools > Create New Analysis . The Create Analysis dialog is displayed.

Type in the name and description of the Analysis and select the site where it will be stored.

Click the  Properties  tab and then click the  Add Property  button. The Add Property dialog is displayed.

Type in the name of the new Retrieved Property and create a Relevance Expression to evaluate. This can access hardware characteristics, registry entries, and even data in specific files on the client computers.

Optionally, select the  Reported in  option and specify how often the property value should be reported to the server.

Click the  OK  button to add the property to the Analysis.

Repeat steps 3 to 6 to add more properties if needed.

Click the  Relevance  tab and then click the  Edit  button. The Relevance Expression dialog is displayed.

Type in or edit the relevance expression that defines the applicability of the Analysis to the computers. This can be based on operating system, installed software, or any other criteria.

Click the  OK  button to save the relevance expression.

Click the  OK  button to create the Analysis.

After creating the Analysis, the operator can activate it by right-clicking on it and choosing  Activate  from the context menu.  The Analysis will then be evaluated on the computers that match the relevance expression and the property values will be reported to the server 4 .

The operator can view the property values by selecting the Analysis from the  Analyses  list area in the Console and then selecting the  Results  tab. The property values will be displayed in the columns corresponding to the property names.

The operator can also use the property values as filters, sorts, or targets in other Console features, such as computer listings, Fixlet actions, or Web Reports.

References:

1 :  What is an Analysis?

2 :  Creating an Analysis

3 :  Creating an Analysis

4 : [Activating an Analysis]

: [Viewing Analysis Results]

: [Using Analysis Properties]

The BigFix Console is a graphical user interface that allows you to interact with the BigFix Platform and perform various tasks, such as deploying actions, creating content, managing sites, and viewing reports 1 .

The BigFix Console operators are the users who can access the BigFix Console and perform different activities based on their permissions and roles 2 .

There are two types of Console operators: Master Operators (MO) and Non-Master Operators (NMO) 2 .

Master Operators are the administrative users of the BigFix Console.  They have access to all the computers defined in the BigFix environment and the authority to create and manage other Console operators 2 .

Non-Master Operators are the users who manage the day-to-day BigFix operations, including Fixlet management and action deployment, against a subset of computers they are allowed to manage by the Master Operator 2 .

Some of the activities that can only be performed by a Master Operator are 2 3 :

To create and manage other Console operators, including assigning them permissions, roles, and administered computers.

To create a custom site, which is a collection of custom content that can be subscribed to by other operators and computers.

Some of the activities that can be performed by both Master Operators and Non-Master Operators are 2 3 :

To create and deploy Baselines, which are groups of Fixlets and Tasks that can be applied together as a single action.

To create custom Fixlets and Tasks in an external site, which is a site that is not created or managed by BigFix, such as a vendor site or a partner site.

To activate local analyses, which are analyses that are only relevant to the computers that the operator manages, and can be used to collect additional information from those computers.

References:

The BigFix Console

The Console Operators

Accessing the console

When installing the BigFix agent on a Windows endpoint, you can optionally include a pre-defined settings file in the same directory as the setup.exe file, to create custom settings for the Windows client at installation time, for example to assign the new client to a specific parent relay 1 .

The name of this file must be  clientsettings.cfg 1 2 .  This file should contain one setting per line, in the format  SETTING_NAME=SETTING_VALUE 2 3 .

The other options are incorrect because:

A, C, and D are not valid names for the settings file.  The BigFix agent will ignore them and use the default settings instead 1 2 .

For more information on how to use the clientsettings.cfg file and what settings can be defined, see the following references.  References:

1 :  Installing the Client using the .exe setup

2 :  Clientsettings.cfg question

3 :  Unix/Linux/Mac Client Deploy Tool

A BigFix Enterprise Server (BES) is the central component of the BigFix architecture that manages and communicates with the BigFix agents and relays 1 .

The BES consists of several subcomponents, such as the root server, the console, the web reports, the web UI, and the server API 1 .

The BES can support up to  300,000 endpoints  in a single deployment, depending on the hardware configuration, network bandwidth, and workload 2 .

The BES capacity planning document provides guidelines and recommendations for sizing and scaling the BES components based on various factors, such as cores, memory, network, storage, cloud, and concurrent users 2 .

The BES capacity planning document also provides examples of typical deployments and best practices for optimizing the BES performance and stability 2 .  References:

BigFix Platform Overview

BigFix Capacity Planning

The Four Eyes Approval feature is a security mechanism that requires the approval of another console operator who is a member of a specified role before an action can be executed. This feature is useful for preventing unauthorized or accidental actions that could affect the endpoints in the BigFix deployment. To enable this feature, you need to follow these steps:

Use the BigFix Administration Tool to add the useFourEyesAuthentication advanced option and set its value to true.

Restart the BES Root Server service and the BigFix Console.

Create a role for the approvers and add one or more operators to it.

Select the Actions Require Approval option for the operators who need to get approval for their actions and choose the approvers role from the drop-down list.

When an operator takes an action that requires approval, they will see a dialog box asking them to enter the credentials of an approver. The action will be pending until an approver logs in and approves it.  References:

Four Eyes Approval Capability

Has anyone tried SAML Authentication with Four-Eyes authentication?

BigFix Platform Security Configuration Guide