Lab 2: Troubleshooting in the Workspace ONE UEM console

Objective and Tasks

Resolve issue using the Workspace ONE UEM administration console:

  1. Troubleshoot a Smart Group Configuration

Task 1: Troubleshoot a Smart Group Configuration

Scenario: After a new Windows endpoint was enrolled, a profile did not deploy to the new endpoint, even after waiting a day.


Root cause: The profile is assigned to the NA Sales smart group. When the smart group was first created, the Craig account was excluded. As a result, the profile and application are not assigned to the Craig account.


You help the UEM administrator remove the exclusion from the NA Sales smart group and restore profile assignment.

  1. From the lab environment interface, make sure that uem-01a is selected from the dropdown at the top-left of the screen.
    • Username: techseals\administrator
    • Password: Pa$$w0rd
  2. If not already opened, open the Workspace ONE UEM administration console.
    1. On the uem-01a Windows taskbar, click the Google Chrome icon and click UEM from the bookmark toolbar
      You can also enter https://wsone.techseals.co/AirWatch in the address bar.
    2. Log into Workspace ONE UEM.
      • Username: admin
      • Password: Omnissa123!
  3. On the Workspace ONE UEM console menu bar, verify that Techseals is selected from the Organization Group drop-down menu.
    Techseals is the top-level organization group.
  4. In the navigation pane on the left, select Resources > Profiles & Baselines > Profiles.
  5. Review the profiles that appear in the Profile list.
    • iOS Exchange Email
    • iOS Passcode
    • iOS Restrictions
    • Windows Device Encryption
    • Windows Exchange Email
    • Windows User Auth
    • Windows Wallpaper
NOTE
The profiles have different assignment groups. The relevant profile in this scenario is the Windows Device Encryption profile.
  1. In the Windows Device Encryption profile row, click View under Installed Status. The number of assigned devices is 1 and the number of installed devices is also 1. However, the correct number for each should be 2 because there is a Windows Desktop device enrolled in this environment.
  2. In the navigation pane on the left, select Groups & Settings > Groups > Assignment Groups.
  3. Click the NA Sales smart group hyperlink. The Edit Smart Group dialog box appears.
  4. Next to Device Preview, click Enabled. The smart group does not include the device for user Craig.
  5. Scroll down to the bottom of the navigation pane on the left and expand Exclusions. The user Craig is selected as an excluded user.
  6. Deselect the Craig user check box.
  7. Verify that the Windows endpoint enrolled with the Craig user account now appears under Device Preview.
  8. Click Next. The View Assignments window appears.
  9. Click Publish.
  10. In the Workspace ONE UEM console, select Resources > Profiles & Baselines > Profiles in the navigation pane on the left.
  11. In the Windows Device Encryption profile row, click View under Installed Status.
  12. Verify that the number of assigned devices now shows 2.
  13. In the navigation pane on the left, select Devices > Devices. This brings you to Devices List View page.
  14. To access the Device Details page for Craig's device, click the device name hyperlink under General Info.
  15. Select the Profiles tab.
  16. Hover over the Status icon (greyed out checkmark) for the Windows Device Encryption profile and verify that the status of the Windows Device Encryption profile is now Pending Install.
NOTE
Profiles take up to two minutes to install. You can try refreshing the browser to update the installation status.
  1. The encryption profile requires a password to be set if no TPM is available in the device. Connect to the device and provide the input.
    1. From the lab environment interface, click on the dropdown at the top-left of the screen, where it probably says, "uem-01a", and select w11Client-01a.
    2. A screen, showing the time, appears. Click anywhere on that screen.
    3. Log into w11Client-01a:
      • Username: Techseals\Craig
      • Password: Pa$$w0rd
    4. Open the Intelligent Hub app. It may also open on its own.
    5. When the BitLocker Encryption screen appears, enter Pa$$w0rd in the Password box and the Confirm Password box.
    6. Click Encrypt
    7. At the bottom-left side of the Intelligent Hub screen, click on Craig Stroser.
    8. Click Sync Device. In about 15 seconds, it will say, "Sync has completed".
    9. Return to the Workspace ONE UEM console on the uem-01a VM. (Note: You may have to go through the login steps again.)
    10. Verify that the status of the Windows Device Encryption profile is now Installed (Green checkmark). (Note: You may have to refresh the browser.)

0 Comments

Add your comment

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.