SINGLE USER DEVICE STAGING

• US 20160285690A1
• Filed: 03/25/2015
• Published: 09/29/2016
• Est. Priority Date: 03/25/2015
• Status: Active Grant

• Current Assignee: Omnissa, LLC
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Hardy, Adam
• Granted Patent: US 10,862,747 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/808 User-type aware
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Disclosed are various examples for staging client devices. A computing device assigns a first policy to a client device. The computing device later authenticates a user account based at least in part on receipt of a user authentication message from the client device. The computing device then selects a second policy to assign to the client device based at least in part on authentication of the user account. The computing device then assigns the second policy to the client device.

Claims

1. A non-transitory computer-readable medium embodying a program executable in a computing device, wherein the program is configured to cause the computing device to at least:

send a first policy to a client device in response to a connection by the client device to the program executing on the computing device;

authenticate a user account based at least in part on a user authentication message from the client device;

select a second policy to assign to the client device based at least in part on an authentication of the user account; and

assign the second policy to the client device.

2. The non-transitory computer-readable medium of claim 1, wherein the first policy enforces restrictions associated with a staging account.

3. The non-transitory computer-readable medium of claim 1, wherein the program is further configured to bind the client device to a directory service, wherein the user account corresponds to a network account provided by the directory service.

4. The non-transitory computer-readable medium of claim 1, wherein the user authentication message comprises a message for a first login to the client device with the user account.

5. The non-transitory computer-readable medium of claim 1, wherein the first policy identifies an application to be installed on the client device.

6. The non-transitory computer-readable medium of claim 5, wherein the application is configured to implement a policy transmitted from a management server.

7. The non-transitory computer-readable medium of claim 1, wherein the second policy comprises a setting for an application installed on the client device.

8. A system, comprising:

A computing device; and

an application executable in the computing device, wherein the application comprises;

logic that determines that a first user profile corresponding to a first user logged into a client device is a staging user profile;

logic that sends at least one device policy to the client device;

logic that determines that a second user profile corresponding to a second user logged into the client device is a nonstaging user profile;

logic that associates the second user profile with the client device; and

logic that sends at least one user policy to the client device based at least in part on the second user profile.

9. The system of claim 8, wherein the application further comprises logic that marks the second user profile as a managed user profile for the client device based at least in part on an initial logon to the client device with the second user profile.

10. The system of claim 8, wherein the application further comprises logic that binds the client device to a directory service, wherein at least one of the first user profile or the second user profile corresponds to a network account provided by the directory service.

11. The system of claim 8, wherein the at least one device policy is sent based at least in part on a device profile for the client device.

12. The system of claim 8, wherein the at least one user policy comprises a security policy for the client device.

13. The system of claim 8, wherein the at least one user policy comprises a policy to download at least one file owned by the second user profile to the client device.

14. The system of claim 8, wherein the at least one device policy comprises an encryption policy for the client device.

15. A method, comprising:

determining, by a computing device, that a first user profile corresponding to a first user logged into a client device is a staging user profile;

sending, by the computing device, at least one device policy to the client device;

determining, by the computing device, that a second user profile corresponding to a second user logged into the client device is a nonstaging user profile;

associating, by the computing device, the second user profile with the client device; and

sending, by the computing device, at least one user policy to the client device based at least in part on the second user profile.

16. The method of claim 15, further comprising:

determining, by the computing device, that the second user profile is currently an unmanaged user profile; and

marking, by the computing device, the second user profile as a managed user profile.

17. The method of claim 15, wherein the at least one device policy comprises an encryption policy for the client device.

18. The method of claim 15, wherein the at least one user policy specifies at least one application to be installed on the client device.

19. The method of claim 15, wherein the at least one user policy is specified by the second user profile.

20. The method of claim 15, wherein at least one of the first user profile or the second user profile corresponds to a network user account provided by a directory service.