Limiting enterprise applications and settings on devices

• US 9,805,189 B2
• Filed: 01/25/2016
• Issued: 10/31/2017
• Est. Priority Date: 03/06/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Karaa, Hassen, Healy, Michael, Flegg, Brett D. A., Dhawan, Gaurav, Sutherland, Jeffrey
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): TENG, LOUIS C
• Application Number:
  US15/005,257
• Publication Number:
  US 20160300055A1
• Time in Patent Office: 645 Days
• Field of Search: None
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Registering a computer system for use in an enterprise. A method includes receiving, from a device management infrastructure of the enterprise, an executable system management component (SMC), and installing the SMC at a storage device. The method also includes executing the SMC, causing the computer system to register with the device management infrastructure, including applying a device settings policy to a configuration of the computer system. Executing the SMC also causes the computer system to configure itself to periodically execute a maintenance task received from the device management infrastructure. The method also includes periodically executing the maintenance task, causing the computer system to receive updated device settings policies from the device management infrastructure and apply the updated device settings policies to the configuration of the computer system, and to receive an updated application from the device management infrastructure and install the updated application at the computer system.

Claims

1. A computer system, comprising:

one or more processors; and

one or more computer-readable media having stored thereon computer-executable instructions that are executable by the one or more processors to cause the computer system to register for use in an enterprise, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following;

receive, from a device management infrastructure of the enterprise, an executable system management component;

install the executable system management component at one or more storage devices of the computer system;

execute the system management component at the one or more processors, wherein executing the system management component causes the computer system to perform at least the following;

register the computer system with the device management infrastructure, including applying at least one user-selectable device settings policy from a plurality of user-selectable device settings policies received from the device management infrastructure to a configuration of the computer system, applying the at least one device settings policy comprising at least;

receiving a selection of the at least one device settings policy from a user of the computer system; and

configuring the computer system in accordance with the at least one selected device settings policy, wherein configuring the computer system in accordance with the at least one device settings policy comprises implementing one or more device restrictions that correspond to the computer system based on the at least one selected device settings policy; and

configure the computer system to initiate execution of scheduled maintenance tasks received from the device management infrastructure according to a preset schedule of one or more scheduled maintenance tasks; and

execute at least one of the one or more scheduled maintenance tasks at the one or more processors based on the preset schedule, at least one execution of the at least one maintenance task causing the computer system to perform at least the following;

receive one or more updated device settings policies from the device management infrastructure, and apply the one or more updated device settings policies to the configuration of the computer system;

receive at least one updated application from the device management infrastructure, and install the at least one updated application at the computer system.

2. The computer system of claim 1, wherein execution of the at least one scheduled maintenance task also causes the computer system to perform one or more of the following:

report updated hardware information to the device management infrastructure;

or

report compliance information to the device management infrastructure.

3. The computer system of claim 1, wherein registering the computer system with the device management infrastructure also includes one or more of the following:

authenticating with the device management infrastructure using an enterprise credential;

configuring the system management component for ongoing communications with the device management infrastructure;

supplying device information to the device management infrastructure;

configuring one or more network settings;

or

installing a side loading key of the enterprise on the computer system, which authorizes the computer system to install applications not generally offered in a closed application marketplace.

4. The computer system of claim 3, wherein the device information comprises one or more of device manufacturer, device model, an operating system version, or device capabilities.

5. The computer system of claim 3, wherein configuring one or more network settings comprises one or more of configuring a virtual private network connection or configuring a wireless network.

6. The computer system of claim 1, wherein a time for execution of the at least one scheduled maintenance task is based, at least in part, on one or more of a battery state or current network conditions.

7. The computer system of claim 1, wherein applying the at least one device settings policy to the configuration of the computer system comprises one or more of enforcing a password policy or turning off a peripheral.

8. The computer system of claim 1, wherein the system management component is executed to communicate with the device management infrastructure based on a user initiation of an application installation.

9. The computer system of claim 1, wherein the one or more device restrictions comprise one or more of what configuration settings the system management component configures, or what enterprise applications are permitted to be installed on the computer system.

10. The computer system of claim 1, wherein the system management component is also configured to deregister the computer system with the device management infrastructure.

11. The computer system of claim 1, wherein the system management component is also configured to deregister the computer system with the device management infrastructure upon determining that the computer system has not communicated with the device management infrastructure for a particular period of time.

12. A method, implemented at a computer system that includes one or more processors, for registering the computer system for use in an enterprise, the method comprising:

receiving, from a device management infrastructure of the enterprise, an executable system management component;

installing the executable system management component at one or more storage devices of the computer system;

executing the system management component at the one or more processors, wherein executing the system management component causes the computer system to perform at least the following;

register the computer system with the device management infrastructure, including applying at least one user-selectable device settings policy from a plurality of user-selectable device settings policies received from the device management infrastructure to a configuration of the computer system, applying the at least one device settings policy comprising at least;

receiving a selection of the at least one device settings policy from a user of the computer system; and

configuring the computer system in accordance with the at least one selected device settings policy, wherein configuring the computer system in accordance with the at least one device settings policy comprises implementing one or more device restrictions that correspond to the computer system based on the at least one selected device settings policy; and

configure the computer system to initiate execution of scheduled maintenance tasks received from the device management infrastructure according to a preset schedule of one or more scheduled maintenance tasks; and

executing at least one of the one or more scheduled maintenance tasks at the one or more processors based on the preset schedule, at least one execution of the at least one maintenance task causing the computer system to perform at least the following;

receive one or more updated device settings policies from the device management infrastructure, and apply the one or more updated device settings policies to the configuration of the computer system; and

receive at least one updated application from the device management infrastructure, and install the at least one updated application at the computer system.

13. The method of claim 12, wherein execution of the at least one scheduled maintenance task also causes the computer system to perform one or more of the following:

report updated hardware information to the device management infrastructure;

or

report compliance information to the device management infrastructure.

14. The method of claim 12, wherein registering the computer system with the device management infrastructure also includes one or more of the following:

authenticating with the device management infrastructure using an enterprise credential;

configuring the system management component for ongoing communications with the device management infrastructure;

supplying device information to the device management infrastructure;

configuring one or more network settings;

or

installing a side loading key of the enterprise on the computer system, which authorizes the computer system to install applications not generally offered in a closed application marketplace.

15. The method of claim 12, wherein a time for execution of the at least one scheduled maintenance task is based, at least in part, on one or more of a battery state or current network conditions.

16. The method of claim 12, wherein applying the at least one device settings policy to the configuration of the computer system comprises one or more of enforcing a password policy or turning off a peripheral.

17. The method of claim 12, wherein the one or more device restrictions comprise one or more of what configuration settings the system management component configures, or what enterprise applications are permitted to be installed on the computer system.

18. The method of claim 12, wherein the system management component is also configured to deregister the computer system with the device management infrastructure.

19. The method of claim 12, wherein the system management component is also configured to deregister the computer system with the device management infrastructure upon determining that the computer system has not communicated with the device management infrastructure for a particular period of time.

20. A computer program product comprising one or more hardware storage devices having stored thereon computer-executable instructions that are executable by one or more processors of a computer system to cause the computer system to register for use in an enterprise, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following:

receive, from a device management infrastructure of the enterprise, an executable system management component;

install the executable system management component at one or more storage devices of the computer system;

execute the system management component at the one or more processors, wherein executing the system management component causes the computer system to perform at least the following;

register the computer system with the device management infrastructure, including applying at least one user-selectable device settings policy from a plurality of user-selectable device settings policies received from the device management infrastructure to a configuration of the computer system, applying the at least one device settings policy comprising at least;

receiving a selection of the at least one device settings policy from a user of the computer system; and

configuring the computer system in accordance with the at least one selected device settings policy, wherein configuring the computer system in accordance with the at least one device settings policy comprises implementing one or more device restrictions that correspond to the computer system based on the at least one selected device settings policy; and

configure the computer system to initiate execution of scheduled maintenance tasks received from the device management infrastructure according to a preset schedule of one or more scheduled maintenance tasks; and

execute at least one of the one or more scheduled maintenance tasks at the one or more processors based on the preset schedule, at least one execution of the at least one maintenance task causing the computer system to perform at least the following;

receive one or more updated device settings policies from the device management infrastructure, and apply the one or more updated device settings policies to the configuration of the computer system; and

receive at least one updated application from the device management infrastructure, and install the at least one updated application at the computer system.