LIMITING ENTERPRISE APPLICATIONS AND SETTINGS ON DEVICES

• US 20160300055A1
• Filed: 01/25/2016
• Published: 10/13/2016
• Est. Priority Date: 03/06/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Karaa, Hassen, Healy, Michael, Flegg, Brett D.A., Dhawan, Gaurav, Sutherland, Jeffrey
• Granted Patent: US 9,805,189 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Registering a computer system for use in an enterprise. A method includes receiving, from a device management infrastructure of the enterprise, an executable system management component (SMC), and installing the SMC at a storage device. The method also includes executing the SMC, causing the computer system to register with the device management infrastructure, including applying a device settings policy to a configuration of the computer system. Executing the SMC also causes the computer system to configure itself to periodically execute a maintenance task received from the device management infrastructure. The method also includes periodically executing the maintenance task, causing the computer system to receive updated device settings policies from the device management infrastructure and apply the updated device settings policies to the configuration of the computer system, and to receive an updated application from the device management infrastructure and install the updated application at the computer system.

Claims

1. (canceled)

2. A computer system, comprising:

one or more processors; and

one or more computer-readable media having stored thereon computer-executable instructions that are executable by the one or more processors to cause the computer system to register for use in an enterprise, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following;

receive, from a device management infrastructure of the enterprise, an executable system management component;

install the executable system management component at one or more storage devices of the computer system;

execute the system management component at the one or more processors, wherein executing the system management component causes the computer system to perform at least the following;

register the computer system with the device management infrastructure, including applying at least one device settings policy received from the device management infrastructure to a configuration of the computer system; and

configure the computer system to execute a maintenance task received from the device management infrastructure on a periodic basis; and

execute the maintenance task at the one or more processors on a periodic basis, periodic execution of the maintenance task causing the computer system to perform at least the following;

receive one or more updated device settings policies from the device management infrastructure, and apply the one or more updated device settings policies to the configuration of the computer system; and

receive at least one updated application from the device management infrastructure, and install the at least one updated application at the computer system.

3. The computer system of claim 2, wherein periodic execution of the maintenance task also causes the computer system to perform one or more of the following:

report updated hardware information to the device management infrastructure;

or

report compliance information to the device management infrastructure.

4. The computer system of claim 2, wherein registering the computer system with the device management infrastructure also includes one or more of the following:

authenticating with the device management infrastructure using an enterprise credential;

configuring the system management component for ongoing communications with the device management infrastructure;

supplying device information to the device management infrastructure;

configuring one or more network settings;

or

installing a sideloading key of the enterprise on the computer system, which authorizes the computer system to install applications not generally offered in a closed application marketplace.

5. The computer system of claim 4, wherein the device information comprises one or more of device manufacturer, device model, an operating system version, or device capabilities.

6. The computer system of claim 4, wherein configuring one or more network settings comprises one or more of configuring a virtual private network connection or configuring a wireless network.

7. The computer system of claim 2, wherein a time for execution of the maintenance task is based, at least in part, on one or more of a battery state or current network conditions.

8. The computer system of claim 2, wherein applying the at least one device settings policy to the configuration of the computer system comprises one or more of enforcing a password policy or turning off a peripheral.

9. The computer system of claim 2, wherein the system management component is executed to communicate with the device management infrastructure based on a user initiation of an application installation.

10. The computer system of claim 2, wherein registering the computer system with the device management infrastructure also includes presenting a plurality of policies an enterprise administrator would like to enforce, and receiving a user selection of one or more of the plurality of policies that the user is willing to accept.

11. The computer system of claim 10, wherein the user selection affects one or more of what configuration settings the system management component configures, or what enterprise applications are permitted to be installed on the computer system.

12. The computer system of claim 2, wherein system management component is also configured to deregister the computer system with the device management infrastructure.

13. A method, implemented at a computer system that includes one or more processors, for registering the computer system for use in an enterprise, the method comprising:

receiving, from a device management infrastructure of the enterprise, an executable system management component;

installing the executable system management component at one or more storage devices of the computer system;

executing the system management component at the one or more processors, wherein executing the system management component causes the computer system to perform at least the following;

register the computer system with the device management infrastructure, including applying at least one device settings policy received from the device management infrastructure to a configuration of the computer system; and

configure the computer system to execute a maintenance task received from the device management infrastructure on a periodic basis; and

executing the maintenance task at the one or more processors on a periodic basis, periodic execution of the maintenance task causing the computer system to perform at least the following;

receive one or more updated device settings policies from the device management infrastructure, and apply the one or more updated device settings policies to the configuration of the computer system; and

receive at least one updated application from the device management infrastructure, and install the at least one updated application at the computer system.

14. The method of claim 13, wherein periodic execution of the maintenance task also causes the computer system to perform one or more of the following:

report updated hardware information to the device management infrastructure;

or

report compliance information to the device management infrastructure.

15. The method of claim 13, wherein registering the computer system with the device management infrastructure also includes one or more of the following:

authenticating with the device management infrastructure using an enterprise credential;

configuring the system management component for ongoing communications with the device management infrastructure;

supplying device information to the device management infrastructure;

configuring one or more network settings;

or

installing a sideloading key of the enterprise on the computer system, which authorizes the computer system to install applications not generally offered in a closed application marketplace.

16. The method of claim 13, wherein a time for execution of the maintenance task is based, at least in part, on one or more of a battery state or current network conditions.

17. The method of claim 13, wherein applying the at least one device settings policy to the configuration of the computer system comprises one or more of enforcing a password policy or turning off a peripheral.

18. The method of claim 13, wherein registering the computer system with the device management infrastructure also includes presenting a plurality of policies an enterprise administrator would like to enforce, and receiving a user selection of one or more of the plurality of policies that the user is willing to accept.

19. The method of claim 18, wherein the user selection affects one or more of what configuration settings the system management component configures, or what enterprise applications are permitted to be installed on the computer system.

20. The method of claim 13, wherein system management component is also configured to deregister the computer system with the device management infrastructure.

21. A computer program product comprising one or more hardware storage devices having stored thereon computer-executable instructions that are executable by one or more processors of a computer system to cause the computer system to register for use in an enterprise, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following:

receive, from a device management infrastructure of the enterprise, an executable system management component;

install the executable system management component at one or more storage devices of the computer system;

execute the system management component at the one or more processors, wherein executing the system management component causes the computer system to perform at least the following;

register the computer system with the device management infrastructure, including applying at least one device settings policy received from the device management infrastructure to a configuration of the computer system; and

configure the computer system to execute a maintenance task received from the device management infrastructure on a periodic basis; and

execute the maintenance task at the one or more processors on a periodic basis, periodic execution of the maintenance task causing the computer system to perform at least the following;

receive one or more updated device settings policies from the device management infrastructure, and apply the one or more updated device settings policies to the configuration of the computer system; and

receive at least one updated application from the device management infrastructure, and install the at least one updated application at the computer system.