Impero Knowledge Base

Training Guides, Slides & Follow Up Material From 3.5 Event

rdyas — Fri, 04 May 2012 11:27:18 GMT

This article contains the training guides, slides and any follow up material from From Impero 3.5 Event held at the Leicester Space Centre 3rd May 2012.

09:50 Jon Bentley - Welcome

10:00 - Daniel Woodcock (Impero) & Julian.W.Waits Sr (GFI) - Return On Investment & Patch Management

Download Slides

11:00 - Coffee & Networking

11:30 - Jon Bentley (GadgetShow) on Impero Today

Download Slides

12:00 Lunch

1:00 Russell Dyas - Protecting Children In The Classroom

Download Slides

1:30 Coffee & Networking

2:00 Jon Valentine - The Future Of Impero

Download Slides

2:30 Open Question & Answer Panel Session

Training Guides

Quick Install Guide

Quick Teacher Guide

Teacher Guide

Podcast Of Tiger Radio Show That Went Out Live From The Event -

Listen To The Show

Quick Install Guide

rdyas — Fri, 04 May 2012 11:19:49 GMT

Quick Teacher Guide

rdyas — Fri, 04 May 2012 11:19:09 GMT

Teacher Guide

rdyas — Fri, 04 May 2012 11:17:40 GMT

Presentation Files From Jon Bentley

rdyas — Fri, 04 May 2012 10:15:21 GMT

Presentation Files From Jon Bentley

Presentation Files From Jon Valentine

rdyas — Fri, 04 May 2012 09:56:11 GMT

Presentation Files From Jon Valentine

Presentation Files From Russell Dyas E-Safety

rdyas — Fri, 04 May 2012 09:55:23 GMT

Presentation Files From Russell Dyas E-Safety

Presentation Files From Dan Woodcock & Julian W Waits Sr

rdyas — Fri, 04 May 2012 09:49:57 GMT

Presentation Files From Dan Woodcock & Julian W Waits Sr.

How To - Advanced Polices (The Basics)

mpayne — Tue, 10 Apr 2012 09:22:26 GMT

Impero has a very advanced Policy system, allowing you to perform numerous functions according to a schedule.

To add a new Policy to Impero:

1. Select 'Access' from the main toolbar and choose 'Advanced Policies':

2. In the Advanced Policy window, select 'Add' or click the link in the list to create a new policy:

3. Type a name for the new policy and select the appropriate type of policy then click OK:

4. The new policy will appear in the main policy list, but disabled, so we must enable it:

5. Once it is enabled it will change position in the list but still in alphabetical order. You can now add new items to this policy. Select your new policy on the left and choose 'Add new policy item' on the right side of the Advanced Policy window or click the link in the list:

6. The Add/Edit policy item window will appear, where you can add banned resources and the appropriate detection context. This window will change in appearance depending on the type of policy you selected, as explained in subsequent sections.

Block Policy Item screen

The block policy type is the most common type of blocked resource and the screen is shown below:

How to enable Internet Explorer 9 (IE9) Browser Helper Object (BHO)

mpayne — Tue, 27 Mar 2012 17:44:44 GMT

This article tells you how to enable Internet Explorer 9 (IE9) Browser Helper Object (BHO)

Enabling this feature ensures that the students cannot use IE9 to disable the Impero software internet restrictions. Without enabling this feature any student could go into internet explorer tools>manage options or manage add-ons and disable the Impero BHO which would then allow the student full access to the internet and Impero would not be able to protect/restrict them. In IE9 the student may also see a pop up that asks them to enable or disable the BHO so without enabling this feature the student could have full access to the internet and Impero would not be able to protect/restrict them.

How to make these changes through Group Policy

1. How to make these changes through Group Policy to keep this from happening:

In your group policy object, for either "Computer Configuration" or "User Configuration" browse to the following three options:

•Administrative Templates -> Windows Components -> Internet Explorer ->

Disable add-on performance notifications

•ENABLE this policy

•span>Administrative Templates -> Windows Components -> Internet

Explorer -> Turn off Managing SmartScreen Filter for Internet Explorer 9

•ENABLE this policy and in the options choose to turn the filter OFF.

•Administrative Templates -> Windows Components -> Internet Explorer -> Turn off Managing SmartScreen Filter for Internet Explorer 8

•ENABLE this policy and in the options choose to turn the filter OFF.

Additional Information:

If you have already deployed IE9 and you have roaming profiles, your users may have already disabled the Impero Browser Helper Object. Setting the group policy action above will stop them from disabling it in the future but you will need to delete a registry entry which was made by IE9 when the user disabled the Impero BHO.

Using a logon script (please do not use the Impero Remote Command Prompt as this will not work) type the following:

Reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{220A4F50-B00B-484B-8CB3-E8C9032CFAE9} /f

.... this will work on Windows XP, Vista and 7.

2. Impero Block Policies

•You can use Impero to stop the students from disabling the BHO, although it is

limited as IE9 will still pop up to ask to enable or disable BHO’s. The message is called performance notifications and can only be disabled in Group Policy.

•Advance policy; create 2 block policies;

•windows caption only *manage add-ons*

•windows caption only *Choose add-ons*

3. Use Impero Proxy

The third way to combat this issue is to enable the Impero Proxy which can be done by:

•Right clicking the group “Entire Network”, Group settings tab,Computer security and UN TICK USE INTERNET EXPLORER ONLY

Note: If your current proxy uses NTLM authentication then the Impero Proxy may not work as it cannot pass two sets of different credentials.

How to Create Groups

mpayne — Thu, 01 Mar 2012 16:45:57 GMT

Click the + Icon above My Groups

Note: You will notice that the icon under My Groups will show either a person or a computer to indicate the type of group it is.

1. Enter a name for the new group

2. Leave the default priority set to low

3. Pick the “Type of Group”: Computer or User

4. Adding New Members: You have many ways to add new members to a group.

Note: You have a number of search types you can pick from.

Field Type	Valid Group Types	Description
Computer Name	Group Type	Impero will search based on the name that the computer OS reports back to Impero.
AD Group	Computer/User	This will check to see what computer active directory groups are assigned to that computer and show in that group if AD group in Member name matches an assigned AD group.
IP Address	Computer	This will check all the IP addresses of the computer .
MAC Address	Computer	This will check all the MAC addresses of the computer. This should be static and not change unless you change the physical hardware in the workstation.
Operating System	Computer	This will check version of the OS being reported back to Impero
Impero Version	Computer	You filter membership of group based on what version of the Impero client installed.
Host Name	Computer	This will filter based on host name of the session for example host of the thin client server.
Windows Session ID	Computer/User	Unique ID of the windows session.
Type Of Client	Computer/User	Console - Shows all console users Workstation - shows all non console users
Username	User	This will put users into group based on the username of the session that has logged in.
Full Name	User

- Drag and drop users/computers into a group

- Using Wildcards: First you must click the [Add New Member] link

Example: ICT1-* or Year8-*

Typing the actual name of the user, pc or ….

Active Directory Import

Once you click on Directory Import you will get the following box:

Note: You must have Impero configured to work with your Active Directory First.

View Groups: These groups are security groups within your Active Directory and will be dynamic with Impero. Any changes you make in Active Directory will also be changed within you Impero Group.

View Containers: These groups are Organizational Units (OU’s) and these are static imports and any changes you make within Active Directory would not update Impero. You will need to manually update Impero to reflect your changes in Active Directory. This is a limitation of Active Directory.

Migrate Impero To A New Server

rdyas — Wed, 21 Dec 2011 16:45:12 GMT

If you need to move Impero server then you need to do the following steps as you can only run one Impero server at anyone time.

On The Old Impero Server.

Make a copy of the following folders from the old Impero server
c:\Program Files\Impero Solutions Ltd\Impero Server\Data
c:\Program Files\Impero Solutions Ltd\Impero Server\Recordings
c:\Program Files\Impero Solutions Ltd\Impero Server\ConsoleLogs
c:\Program Files\Impero Solutions Ltd\Impero Server\Inventory
On Impero server go to Tools - Reactivate my license.
Next stop the Impero server service
Right click the service and choose properties and make sure start-up is set to disabled.

On The New Server.

Next install the Impero server on the new server and then before starting the Impero server program
Disable Impero server service.
Copy your old folders across to the same place on your new server
c:\Program Files\Impero Solutions Ltd\Impero Server\Data
c:\Program Files\Impero Solutions Ltd\Impero Server\Recordings
c:\Program Files\Impero Solutions Ltd\Impero Server\ConsoleLogs
c:\Program Files\Impero Solutions Ltd\Impero Server\Inventory
Restart the Impero Server service
Open the Impero server software.
It will ask you to reactivate using your activation code as it is install on a new server.

Server Installation

mpayne — Fri, 16 Dec 2011 11:55:37 GMT

Installing Impero is quite straightforward and we have endeavoured to make the process quick and easy.

After you download the Setup files on to a Server or a computer that will remain powered on during Impero use, please extract the zip file to a local folder then locate the ImperoServerSetup file and run this file.

The Impero Server installation will begin and you must simply follow the on-screen instructions, clicking Next where applicable.

After the Impero Server installation, the Impero Server application will automatically start, presenting you with a Registration Wizard:

Click Next to each screen on the Registration Wizard, filling in the details where applicable.

If you use a Proxy Server to access the Internet, the wizard will automatically use the Internet Explorer proxy settings, and you can therefore leave the Proxy Settings empty. If the wizard fails to register, please try again first filling in the Proxy Details.

Once the Registration Wizard is Complete, the Impero Server application will start.

The first screen you see is the Licence Tab where you can see details of your trial or full licence.

Please browse through the various Tabs and enter any settings you believe are necessary.

Mac Icon Appearing However The Client Is Not Connecting To Impero Server

mpayne — Fri, 09 Dec 2011 11:17:34 GMT

Mac Icon Appear However The Client Is Not Connecting To Impero Server.

If after you install the Mac client and the Impero icon appears in the task tray then load up the Impero log files (see related knowledge base articles below).

In the error log output look for following every error 30seconds:

Feb 4 09:48:30 DT-S-WS10-023com.imperosoftware.imperoclientsrv[54]: CServerConnection::DoBroadCast

Feb 4 09:49:00 DT-S-WS10-023com.imperosoftware.imperoclientsrv[54]: CServerConnection::DoBroadCast

Feb 4 09:49:30 DT-S-WS10-023com.imperosoftware.imperoclientsrv[54]: CServerConnection::DoBroadCast

This means that the client cannot find the Impero via a UDP broadcast. This is often seen on networks where vlans are setup.

You can force the client to use a fixed IP address (see related knowledge base articles below).

Related Knowledge Base Articles

Getting The Troubleshooting Logs From the Mac Client
Setting Impero On A Mac Client To Use Fixed IP Address

Using Impero Solutions Software with Sophos Endpoint Protection 9.5 with Firewall Enabled

mpayne — Fri, 09 Dec 2011 11:16:34 GMT

Download a Sophos Firewall configuration file that works with Impero Software. This file is just for test purposes only, please use caution when using this file.

How to Import Configuration File

Open Sophos End point Server
Double click on Default Firewall Policy and select “Advanced firewall policy…”
Click on General Tab, Export and save a backup of your configuration
Click on General Tab, Import, Select configuration file you have download from our website
Either pick merge into existing configuration or Overwrite existing configuration.
You will need to add the checksum of the current version of Impero Client you are using. Open Checksums tab on Firewall-Policy, Add, Change Event type to New Application, Search, Add IMPEROUTILITIES.EXE

Interactively adding Impero Software to your Sophos Firewall

Open Sophos End point ServerDouble click on Default Firewall Policy and select “Advanced firewall policy…”
Click on General Tab, Primary location, click Configure
Pick Interactive, Click OK
Update firewall policy to client
Copy the imperoclientsetup.msi to the pc and then run program
You will get a series of pop up boxes asking your input, Allow all hidden processes launched by ImperoclientSVC to access the network, Add the checksum to existing checksums for this application (2-3 times), Remote Server: 30015 -Allow all activity for this application
You will also need to run Impero console and select Activity, Send a file, Request a file
This should prompt Sophos to ask for your permission, again allow program to run.
You will need to add the checksum of the current version of Impero Client you are using.
Open Checksums tab on Firewall-Policy, Add, Change Event type to New Application, Search, Add IMPEROUTILITIES.EXE

Manually add Impero Software to your Sophos Firewall

If you try to manually install ImperoClientSetup.MSI on a pc before opening Sophos. You will then be able to use the search function within Sophos Firewall to add the Impero files.
Double click on Default Firewall Policy and select “Advanced firewall policy…”
Click on General Tab, Primary location, click Configure,
General Tab, Tick Allow by default-outbound traffic which has no matching rule is allowed
Click on Applications Tab, Add, Search, change to new application
Add “IMPEROCLIENT.EXE” and “IMPEROUTILITIES.EXE”
Click on Processes Tab, Add, Search for hidden processes
Add “IMPEROCLIENT.EXE”
Click OK
Click on Checksum Tab, Add “IMPEROUTILITIES.EXE”
Save and exit Firewall Policy
Update clients pc to new firewall policy.

Impero Client won't uninstall.

mpayne — Fri, 09 Dec 2011 11:09:41 GMT

If your having a problem where an out of date Impero Client won't uninstall, or if a group policy object deploying the Impero Client has gone bad and won't allow you to uninstall or update the client then you will need to follow the following steps:

On the bad client download and install Microsofts MSI Cleanup tool (www.imperosoftware.com/files/specialbuild/microsoftwindowscleanuptool.exe)
Launch Windows Installer Clean Up from the start menu
From the interface scroll to find Impero Client
Select Remove
Then Ok
Impero will now allow you to install the latest available client.

Impero Client doesn't connect to the Impero Server

mpayne — Fri, 09 Dec 2011 11:05:29 GMT

When the Impero Client starts but can't connect it means that the client has tried to scan the local network but can't find the Impero Server. This could be because the Impero Server is located in a different network segment, separated either via VLan or subnet which will cause the Impero Client UDP broadcast to be unsuccesfull.

To fix this a configuration file needs to be written to point the client to the server. This configuration file is called serverip.txt and contains the ipv4 address of the primary network adaptor of the Impero Server. This resides in the 'Impero Client' directory so the path reads: c:\Program Files\Impero Solutions Ltd\Impero Client\serverip.txt

This can be done with a login script by running a batch file that contains:

echo 10.0.0.1>"C:\Program Files\Impero Solutions Ltd\ImperoClient\ServerIP.txt"

Replacing 10.0.0.1 with the IP address of your server.

However this can be avoided if the client has been deployed using the Impero 'Deploy MSI' tool found on the console, see here.

Installation - Cannot Uninstall Older Version

mpayne — Fri, 09 Dec 2011 11:03:33 GMT

When you update from an older version of the client or server part of the process involves first, uninstalling previous versions.

Programs installed with MSIs require that same MSI package to be available when uninstalling.

Occasionally the MD5 refferal in the MSI package can become corrupt, thus no matter what msi file you point to, the package will refuse to uninstall.

The solution is to use the 'Windows Installer Cleanup Utility' - Note this was originally created to assist with removals of older versions of MS Office. However, the tool can be used to force removal of any MSI based installation.

Download the installer clean up

Run and Install

Go to - Start - Programs - 'Windows Installer Cleanup'

You will be presented with a dialog box of msi based installed products.

Highlight the Impero Client / Server

Click Remove

Impero will disappear from the list

Go to - Add/Remove Programs

You will see that Impero has now been removed.

You can now install your new MSI package (Located in Impero server directory: Program Files/Impero Solutions Ltd/Impero Server/Updates)

How To - Remote Monitoring (The Basics)

mpayne — Mon, 21 Nov 2011 14:44:54 GMT

Impero is a powerful monitoring tool, giving you a high level of control over what happens on your network.

3.1 Viewing Live Thumbnails

To view Live Thumbnails, simply select the 'Layout' button on the main Console window and select 'Live Thumbnails'. This will display the current group you are viewing in a 'thumbnail' view.

The various controls above the thumbnail view give you greater control of the thumbnails, for example, to resize the thumbnails or take remote control of them.

3.2 Checking recent computer usage history

If the user is still logged on:

a) Change Layout to Treeview by selecting the 'Layout' button at the top of the Console then choosing 'Tree View'.

b) Find the user you wish to see history for and click the + button to the left of list entry, this will expand the user, showing a preview thumbnail to the right

c) Find the node that says 'Recent History' and click the + button to its left to expand this node

d) You will be presented with several history nodes, representing Windows, Websites, Applications, Printed documents and Deleted Files. Expand the appropriate node to see the history for that category.

If the user is no longer logged on or you wish to review usage history for previous days:

a) Click the 'Admin' button on the main Console window

b) Choose 'Log Viewer' and the log viewer should open

c) Click the + (expand) the Date you wish to see history logs for.

d) You will see various usernames who were logged on that day, expand the node of the username you wish to see logs for.

e) You will now be presented with all the computers this user logged onto that day, expand the computer that the user was using which you wish to see logs for.

f) Now you will see all the times this user logged onto this computer during the day you are interested in, click one of these times/sessions to see computer usage logs.

g) Various tabs will be populated with computer usage history and the first tab will show any violations that this user raised.

Remove / Hide Impero Console Icons

mpayne — Thu, 17 Nov 2011 11:45:19 GMT

An installed instance of the Impero Client places an icon in the system tray as well as a public user desktop icon.

Hide System Tray Icon

Right click on a group - Click 'Properties' -> Click 'Group Settings' -> Click 'Workstation Settings' -> Tick 'Hide Impero Workstation tasktray icon'

This will hide the icon for any user in that group but Impero Workstation will still run as normal.

Delete Desktop Icon

The Impero desktop icon is stored in the public desktop directory

The best way to remove this is with the Impero's Find Search, see http://www.imperosoftware.com/knowledgebase/Knowledgebase/Article/50066

Select the computers you wish to remove the icon from and using File Search with the delete option selected in search criteria type:

Windows XP -
C:\Documents and Settings\All Users\Desktop\Impero Console.lnk

Windows 7 -
C:\Users\Public\Desktop\Impero Console.lnk

Click 'Begin Search' to delete files.

Setting Impero On A Mac Client To Use Fixed IP Address

rdyas — Mon, 31 Oct 2011 10:40:53 GMT

To force the Impero client on the Mac OS to automatically find a server instead of doing a UDP broadcast then run the following two commands in a terminal session.

sudo defaults write /Library/Preferences/com.impero-solutions-ltd.ImperoClientSrv host 192.168.1.1

sudo defaults write /Library/Preferences/com.impero-solutions-ltd.ImperoClientSrv port 30015

Replace the 192.168.1.1 for your Impero server address.

Impero Proxy vs Impero BHO

mpayne — Mon, 31 Oct 2011 09:55:32 GMT

Impero can use two different methods of filtering internet traffic; BHO or Proxy and each one has its advantages and disadvantages.

Impero BHO

The standard method out of the box for Impero is to use the BHO (Browser Helper Object) with Internet Explorer only.

Advantage:

Works with existing proxies using NTLM authentication
Ease of blocking HTTPS sites
Logs HTTPS sites in log viewer

Disadvantage:

Loads entire webpage first before any blocks can be applied
Does not block other browsers i.e. Chrome, Firefox…
Group policy changes can stop the BHO from working

Impero proxy:

Advantage:

Blocks work in Chrome, Firefox…..
Blocks are applied before the page browser page loads
Logs HTTPS site in IE only after version 3.010

Disadvantage:

Does not work with other proxies using NTLM authentication
A different set of block policies are needed to block https sites
When using Chrome, Firefox….. HTTPS sites are not recorded in the Log Viewer (Work around is to disable port 443 for Chrome, Firefox… and force users to use Internet Explorer for HTTPS sites).

To disable the Impero Proxy follow this knowledge base article

http://www.imperosoftware.com/knowledgebase/Knowledgebase/Article/50089

My Personal Groups

rdyas — Wed, 26 Oct 2011 08:16:03 GMT

This applies to Version 3114 and above.

Enable My Personal Groups

After a site has been upgraded to 3114 you access a new feature called My Personal Groups however this feature is disabled by default to enable follow the steps below.

1) Open the Impero Server Software.
2) Select the Settings tab.
3) Select the Console Access Rights tab.
4) Click the user, computer or Active directory group that you wish to change the access to.
5) On the right hand side under the access tab if you click the cross next to Personal Groups this will provide three options.

No Access To ‘My Personal Group’	This will disable the feature for the selected access right.
Full Access To ‘My Personal Group’	This will give full Access to their group but nobody else’s.
Full Access To EVERY ‘My Personal Group’	This will give full access to everyone’s group.

6) Then click Apply
7) Click OK

Using My Personal Groups
Each user of the console gets their own personal group and this independent of all other groups including other console users personal groups. The console user can set their own filters against the group and not affect other users within the network as the settings will be disabled once you close the console down.

What Would I Use Them For?
We have designed the My Personal Groups for two main reasons to help support where you have one-to-one and Bring Your Own Device initiatives and also provide console users with their own independent group which they can create their own policies on.

Using A Personal Group

To access the functions to control your My Personal Group you need to right click on My Personal Group and choose the Action Menu.

Make Public/Make Private
This option will allow users to enable and disable access to students from joining your group.

Disable/Enable Group
You can disable and reenble your group when disabled any policies that you have set will not take effect.

Broadcast for Group Members
This will send a message to all Impero clients and ask them if they wish to join your personal group.

Load User List
You can select a text file that has a list of all users (one username on each line) and this will add those users into the group.

Remove All Group Members
This will remove all usernames from your group and leave the membership as blank.

Remove Selected Users From A Personal Group?
To remove a selected user wither right click the user in your Personal group and choose remove from the group or alternatively right click the My Personal Group and choose properties and then select the user under Existing Group members and click the delete link next to the username.

Asking Students To Join Your Group

To get a student into your group you can get them in one of three ways via a user text file, announcing to all clients or asking the user to use Impero task try icon to select a group to join. First enable your group by right clicking and select Actions >Make Public and then follow one of steps below depending on how you wish to load the users into your group.

Load Users Via A Text File
1) Right click your My Personal Group and choose Actions>Load User List..
2) Open a text file which contains a list of users (one username per line).

Entering User Name Manually
1) Right Click My Personal Group and choose Properties.
2) Click Add A New Member and under Member name type the first username. Repeat until you have added all your users in.

Announcing To All Clients
1) Right click your My Personal Group and choose Actions>Broadcast For Group Members.
This will send a message to all Impero Clients on the network.

Students Manually Joining A Group
1) Ask the student to right click the Impero system tray icon and select the following.
2) My Personal Groups > Join Group.
3) Select the group you wish to join and then click the Join button.

Once you have got all your students in you may wish to Right click My Personal Group and select Action>Make Private and disallow anymore students from joining.

Quick Question: How it works

mpayne — Fri, 21 Oct 2011 13:43:20 GMT

Under the Actions Icon you will a see a Quick Question icon.

You can type the question you want to ask the students then click send question at the bottom right.

Note: You can tick the students first or just move / minimize the Impero-Ask Question window and tick the students. Then return to Impero-Ask Question window and click send question.

Example: Question sent to a student

When the student answers the question it will update the Impero console.

Computer Availability: How it works

mpayne — Fri, 21 Oct 2011 11:19:19 GMT

How to enable Computer Availability on your network

Open your Impero server; select the Settings tab, Select Computer Availability tab, Then tick Enable Computer availability service.

Note: The default port is 8181 but you must make sure you are not currently using this port. You may change the port number to any free port and then click apply at the bottom right.

When you open your webpage and go to Http://127.0.0.0:8181 you will get a list of computers that are not in use on your network.