Attachment 3a- ESC CSCS Task Performance Work Statement Level 2 Desktop Support_reference documents.pdf

MATERIAL REQUISITION/ISSUE/RECEIPT

Type of Transaction Project Materiel X

Other (specify) ("X" one) Operating Materiel In Use Personal Property

PART A -- REQUISITION/TRANSFER

Trans Voucher Number Supply Support Code Cost Center

Requisition Number Cond Code Job Order Number Date Required PRI Facility Type

Approved By/Title Outgoing No. Incoming No. Date

Method of Shipment (Include final carrier, if known) Batch No.

Mark For Date Prepared GBL Number No. of Packages

S H I P

T O

C o n s i g n e e

Technician:

AMK-223B

MPB B9

405-954-xxxx Incident #:

F R O M

C o n s i g n o r

Technician:

AMK-223B

MPB B9

405-954-xxxx Incident #:

PART B -- PROJECT MATERIEL KEY PUNCH SOURCE DATA

R G

AR Cost Center MC Cost Code Job Order GSA Address WH FS Trans T R

Contract/Document No. P C

PART C -- UNIT IDENTIFICATION

Item No.

National Stock No.

Equipment Type

Item Description

Asset

Quantity

UI

Unit Price

Total Cost

PART D -- IN USE PERSONAL PROPERTY KEY PUNCH SOURCE DATA

ATS Loc Std. Fac. Ident. OW R A Cost Center Act'n Date Document No. Trans.

Accounting Classification Reimbursement Required Total Yes No

All Items Received, Except As Noted (Signature) Title

Date

Computer Specialist/Office Automation

FAA Form 4650-12 (7/87) Page No. 1 o

1 pages This is a computer generated facsimile

UNCONTROLLED COPY WHEN DOWNLOADED

Check the Master List to Verify That This is the Correct Revision Before Use

AMKFM-262-60204 Revision 0 09/03/20

AMK-262 PC SETUP CHECKLIST

Imaging ID: ProcessID Date: TodayDate Tech: TechName Task ID: TaskID Customer: EmpFirst EmpLast Routing Symbol: EmpOrg Ext: EmpPhone Bldg: EmpBldg Room: EmpRoom New Machine Name: PCName Service Tag: PCTag Image Name: ImageName

INITIALIZE

☐NEW EMPLOYEE ☐EXISTING EMPLOYEE ☐SHARED ☐CLASSROOM

CUSTOMER SIGN OFF ☐REMOTE CUSTOMER SIGN DATE

TECHNICIAN SIGN OFF TECHNICIAN SIGN DATE

PREPARE TWO COPIES FAA 4650-12 FORM > COMPLETE BOTH > LEAVE ONE WITH CUSTOMER & ONE REMAINS WITH SETUP DEVICE ☐YES ☐N/A ON SITE ☐VERIFIED BAR CODE/SERIAL NUMBER AT CUSTOMER SITE ☐CHANGED BAR CODE/SERIAL NUMBER AT CUSTOMER SITE > ON FORM DOES CUSTOMER NEED SPECIAL VPN FIREWALL GROUP? ☐ YES ☐ NO > IF YES, LIST GROUP & POC:

☐MOVED EXISTING AD MACHINE ACCOUNT TO AMC-WDS OU ☐CREATED AD MACHINE ACCOUNT IN AMC-WDS OU

NEW EMPLOYEE IMAGE MACHINE DONE

UPDATE BIOS

INSTALL IMAGE

RUN NEWPCSETUPMANUAL SCRIPT

INSTALL DISPLAY LINK

INSTALL DELL SUPPORT ASSIST TOOL

RUN DRIVER UPDATES

UNINSTALL DELL SUPPORT ASSIST TOOL

CONFIRM MACHINE ACCOUNT IN CORRECT OU (OUT OF AMC-WDS OU)

DELIVERY & CONFIGURATION WITH CUSTOMER DONE

USER LOG ON TO NETWORK

NOTATE MAPPED PRINTERS BELOW & VERIFY FUNCTIONALITY OF EACH ONE LISTED:

MAPPED PRINTER 1:

MAPPED PRINTER 2:

CONFIRM CORRECT NETWORK SCRIPT RUNS AT LOG ON

CONFIRM NETWORK DRIVES ARE MAPPED & WORKING

CONFIGURE STARTNET.BAT & VERIFY WORKING

SET PHOTO VIEWER AS DEFAULT PHOTO APP

SET INTERNET EXPLORER AS DEFAULT WEB BROWSER

SET ADOBE READER (PRO) AS DEFAULT PDF APP

VERIFY FUNCTIONALITY OF SOFTWARE ITEMS SHOWN BELOW:

☐ VPN/FRAC ☐ OUTLOOK ☐ ADOBE ☐ TEAMS ☐ WIN/TEMP PERMS ☐ AVAYA ☐ ZOOM

☐ CELLULAR CHIP? IMEI: SIM ID: ☐ AMK-270

OBTAIN CUSTOMER SIGNATURE/DATE ON FAA 4650-12 FORM & CUSTOMER SIGN OFF/DATE FOR CHECKLIST > OR REMOTE CHECKED

SOFTWARE INSTALLATION & CONFIGURATION WITH VERIFIED LICENSE KEY DONE

DID CUSTOMER REQUEST ADDITIONAL SOFTWARE ITEMS OR CHANGES? ☐ YES ☐ NO > IF YES, LIST ANY ADDITIONAL SOFTWARE INSTALLED BELOW:

☐ VERIFIED LICENSE ☐ VERIFIED LICENSE

☐ VERIFIED LICENSE ☐ VERIFIED LICENSE

☐ VERIFIED LICENSE ☐ VERIFIED LICENSE

☐ VERIFIED LICENSE ☐ VERIFIED LICENSE

COMMENTS:

AMKFM-262-60204 Revision 0 09/03/20

AMK-262 PC SETUP CHECKLIST

EXISTING EMPLOYEE IMAGE MACHINE DONE

UPDATE BIOS

INSTALL IMAGE

RUN NEWPCSETUPMANUAL SCRIPT

INSTALL DISPLAY LINK

INSTALL DELL SUPPORT ASSIST TOOL

RUN DRIVER UPDATES

UNINSTALL DELL SUPPORT ASSIST TOOL

CONFIRM MACHINE ACCOUNT IN CORRECT OU (OUT OF AMC-WDS OU)

REPLACED COMPUTER ITEMS DONE

TRANSFER CUSTOMER DATA FROM OLD MACHINE TO NEW MACHINE

REVIEW EXISTING BELARC PROFILE (NETWORK DRIVES, PRINTERS & ALL SOFTWARE)

DOES CUSTOMER HAVE EXISTING SOFTWARE OR ADMIN WAIVER? ☐ YES ☐ NO > IF YES, CHECK ☐ SOFTWARE ☐ ADMIN IF YES, SEND WAIVER EMAIL TO 9-NATL-CSC-CUSTOMER-SUPPORT-CENTER@FAA.GOV & ESC-PROCESS-AUTOMATION@FAA.GOV

DELIVERY & CONFIGURATION WITH CUSTOMER DONE

USER LOG ON TO NETWORK

NOTATE MAPPED PRINTERS BELOW & VERIFY FUNCTIONALITY OF EACH ONE LISTED:

MAPPED PRINTER 1:

MAPPED PRINTER 2:

CONFIRM CORRECT NETWORK SCRIPT RUNS AT LOG ON

CONFIRM NETWORK DRIVES ARE MAPPED & WORKING

CONFIGURE STARTNET.BAT & VERIFY WORKING

SET PHOTO VIEWER AS DEFAULT PHOTO APP

SET INTERNET EXPLORER AS DEFAULT WEB BROWSER

SET ADOBE READER (PRO) AS DEFAULT PDF APP

VERIFY FUNCTIONALITY OF SOFTWARE ITEMS SHOWN BELOW:

☐ VPN/FRAC ☐ OUTLOOK ☐ ADOBE ☐ TEAMS ☐ WIN/TEMP PERMS ☐ AVAYA ☐ ZOOM

☐ CELLULAR CHIP? IMEI: SIM ID: ☐ AMK-270

OBTAIN CUSTOMER SIGNATURE/DATE ON FAA 4650-12 FORM & CUSTOMER SIGN OFF/DATE FOR CHECKLIST > OR REMOTE CHECKED

SOFTWARE INSTALLATION & CONFIGURATION WITH VERIFIED LICENSE KEY DONE

DID CUSTOMER REQUEST ADDITIONAL SOFTWARE ITEMS OR CHANGES? ☐ YES ☐ NO > IF YES, LIST ANY ADDITIONAL SOFTWARE INSTALLED BELOW:

☐ VERIFIED LICENSE ☐ VERIFIED LICENSE

☐ VERIFIED LICENSE ☐ VERIFIED LICENSE

☐ VERIFIED LICENSE ☐ VERIFIED LICENSE

☐ VERIFIED LICENSE ☐ VERIFIED LICENSE

POST DELIVERY/CONFIGURATION ITEMS DONE

REMOVE OLD AD MACHINE ACCOUNT & NOTATE IN TICKET

IF OLD MACHINE REMAINS IN USE BY CUSTOMER, REVIEW/UPDATE AD ACCOUNT DESCRIPTION & NOTATE IN TICKET DID YOU RETRIEVE OLD ESC DEVICE & RETURN TO HAM FOR STOCK CHECK IN? ☐ YES ☐ NO ☐ N/A > NOTATE IN TICKET

COMMENTS:

mailto:9-NATL-CSC-Customer-Support-Center@faa.gov mailto:ESC-Process-Automation@faa.gov

Active Directory Accounts

AMKJG-223B-60164 Date: 12/13/2021 Revision 2

Process Owner: Lance Smiley Approved By: Phillip Hales

ACTIVE DIRECTORY ACCOUNTS PROCESS

1. Overview Active Directory (AD) is a directory service that Microsoft developed for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. AD domain controller authenticates and authorizes all users and computers in a Windows domain type network—assigning and enforcing security policies for all computers, and installing or updating software. This process covers account creation, move and deletion.

This process is equally suited for use in the following imaging and deployment scenarios:

• New Employee (new computer)

• Existing relocating employee (changing computers)

• Existing employee reimage (keeping same computer)

2. Process

2.1 COMPUTER ACCOUNT CREATION

This process is to be used when creating a new computer account. The process stems from a New Employee, Transferring Employee, or Relocating Request initiated when a new, or replacement computer is assigned.

2.1.1 Computer Account

1. Open AD and perform a search for existing machine using the barcode of the PC.

2. Go to Action > Click Find to open the Search window.

file://AMC000VS8.amc.faa.gov/wiki/Directory_service file://AMC000VS8.amc.faa.gov/wiki/Microsoft file://AMC000VS8.amc.faa.gov/wiki/Windows_domain file://AMC000VS8.amc.faa.gov/wiki/Windows_Server file://AMC000VS8.amc.faa.gov/wiki/Process_(computing) file://AMC000VS8.amc.faa.gov/wiki/Windows_service file://AMC000VS8.amc.faa.gov/wiki/Domain_controller file://AMC000VS8.amc.faa.gov/wiki/Authentication file://AMC000VS8.amc.faa.gov/wiki/Authorization

3. Click on the drop-down menu under Find to select Computers.

• Use a wildcard with a * (asterisk) in the search before the barcode if you do not have the full name of the PC.

• After each action, click the Refresh button on the AD Management Console.

NOTE: Any new machine, or any machine being reimaged, must go in the AMC WDS OU for imaging. The machine account will be moved prior to the closing of the imaging task.

• If reimaging a PC for resolution of a deskside support issue, move the PC to AMC WDS OU (faa.gov/Win7 LOB/ARC/AMC/GPO Deviations/USGCB Off/AMC WDS) prior to reimaging.

• If an existing PC is found from a query, ensure the correct machine is selected by verifying the full machine name and description information.

• If this is an existing PC, then skip to steps for Account Move Instructions. Otherwise, for new PCs, proceed to the next step.

2.1.2 Add PC to WDS

1. Go to faa.gov/Win7 LOB/ARC/AMC/GPO Deviations/USGCB Off/AMC WDS.

2. Click the AMC WDS OU.

3. Right click in a blank section of the right side of the console, select New > Computer.

4. Enter the full machine name, including the barcode.

• Use “W” for desktop PCs and “N” for laptop.

• Adhere to the AD naming convention standards.

• Use capital letters.

• Example: ARCACN100044295.

• Under the field for entering the authorized user or group to join the computer to the domain, click Change. Enter “ARCMCACAMIGRP Tier1.” Click OK.

• DO NOT check boxes to assign the computer as a pre-Windows 2000 computer, or as a backup domain controller.

5. Click Next. DO NOT check the box to make the computer a managed computer.

6. Click Next > Finish.

7. Double-click the newly-created machine account. Change the description information to reflect the following:

• Name of technician performing the move/creation between ** **

• User assigned to PC

• Building and Room Number

• Routing Organization (minimum of six characters, such as AMK-001)

See examples provided further below.

8. Click OK to finish.

Examples of machine account descriptions:

• New Account Added to WDS: **Jim** Jane Doe ANF-1 240 AMA-009

• In WDS permanently: **Lance Smiley** Do Not Remove** Lance Smiley MPB B8 AMK- 223B

• Items in WDS for short duration: **Lance Remove By 9-1-2016** Lance Smiley MPB B8

AMK-223B

• Classroom PC POC: Jane Doe ANF-1 240 AMA-009

• Podium PC POC: Jane Doe ANF-1 240 AMA-009

• Shared PC POC: Jane Doe ANF-1 240 AMA-009

• Laptop Pool POC: Jane Doe ANF-1 240 AMA-009

2.2 ACCOUNT MOVE

1. Open AD and perform a search for existing machine using the barcode of the PC.

2. Go to Action > Click Find to open the Search window. Click on the drop-down menu under Find to select Computers.

3. Enter the computer name to be moved. Click Find Now.

4. Right-click on the PC, and select Reset Account.

5. Rename Account using the naming convention standard. Remove technician name.

6. Right-click on the PC. Select Move.

7. Navigate to the desired OU. Ensure you browse to the correct line of business.

Example: faa.gov/Win7 LOB/ARC/AMC/Laptops/AMK/AMK-200/AMK-220/AMK-223/AMK-223B.

The example is based on the routing symbol located in the description above. If unable to locate the user’s routing, such as AMK-223B, move the machine account to the closest OU, such as

AMK-220.

8. Click OK to perform the move.

9. Refresh screen, then close box.

NOTE: If you are replacing a computer, remember to go back and delete the old computer name no longer being used, or connected to the network.

2.3 ACCOUNT DELETION

1. Open AD and perform a search for an existing machine using the barcode of the PC.

2. Go to Action > Click Find to open the Search window. Click on the drop-down menu under Find to select Computers.

3. Enter the computer name and perform a search for the existing machine using the barcode of the PC. To perform a wildcard search when you do not know the full name of the PC, place an * (asterisk) in the search before the barcode.

4. Right-click the machine account, select Delete from the menu, and then select Yes to complete deletion.

3. Document Control

3.1 DOCUMENT HISTORY

Rev Description of Change Effective Date

0 Initial Release. 09/09/2015

1 Changed RIS locations and wording to WDS. Updated old machine account description examples with new date & removed Tyson Hiner name for example.

Removed old routing example for AMI. Updated info on page 2 about moving out of WDS OU on completion of imaging or reimaging.

07/06/2016

2 Changed 2.1 and 2.11 from user to computer accounts

Changed Process Owner to Lance Smiley and Approved By to Phillip Hales

12/13/2021

Administrative Access

AMKJG-223B-60175 Date: 12/21/2021 Revision 1

Process Owner: Brandy Rico Approved By: Phillip Hales

IDENTIFYING ADMINISTRATIVE ACCESS

1. Overview This procedure addresses maintenance of users who have obtained an administrative waiver for administrative privileges to their individual PCs, or a group of machines, at the Mike Monroney Aeronautical Center (AMC) for ARC and ARC-supported customers.

Administrative privileges may be provided directly to a computer or through a Group Policy Object (GPO).

2. Process

2.1 ADMINISTRATIVE WAIVER VERIFICATION

Administrative Waivers are granted to individuals or groups that obtain administrative privileges, either directly to their individual computers, or to groups of computers.

1. When providing a customer administrative privileges, first check to see if the customer has a waiver in place, or one being updated. If no waiver exists, follow the AMC Administrative Waiver Process.

• Active Waivers: \\AMC000vs8\AMI600$ \Special_Projects\FDCC Reporting\FDCC_Admin_Waivers\Active

• Pending Waivers: \\AMC000vs8\AMI600$ \Special_Projects\FDCC Reporting\FDCC_Admin_Waivers\In Process

2. Once a waiver has been identified, ensure that the corresponding barcode is listed in the waiver. If not, then the waiver must be updated. You can apply temporary administrative privileges for a short period of time to allow the waiver to be updated.

3. Assign an Incident in the Service Management Tool (SMT) to the Special Projects (SP) Team to follow up on completion of a waiver. If no Incident exists, send an email to the HelpDesk to create one for tracking purposes.

2.2 ORGANIZATIONAL UNIT STRUCTURE

If administrative privileges are granted through a GPO and Group, the computer can reside in any Organizational Unit (OU) as long as the GPO is applied to that OU structure. Groups utilizing a GPO will preside over the OU structure based on the description within the waiver. There are two primary locations utilized to maintain administrative privileges:

• Win7 LOB/ARC/AMC/GPO Deviations/USGCB On/Admin Allowed

NOTE: Allows for the user to maintain administrative access on the system, unless it is utilizing a GPO for a group rather than an individual.

• Win7 LOB/ARC/AMC/GPO Deviations/USGCB Off NOTE: Allows for deviation from policies. (ie. Screen Saver)

2.3 UNDERSTANDING ADMINISTRATIVE PRIVILEGES

Administrative Privileges can be applied directly to the system, or through a GPO and at the OU.

2.3.1 Temporary Privileges

Temporary individual privileges can be applied directly to the system in any OU outside of GPO Deviations. Upon reboot, the privileges will be removed from the system.

Individuals that obtain a waiver and require administrative privileges for a period of time can be placed faa.gov/Win7 LOB/ARC/AMC/GPO Deviations/USGCB On/Admin Allowed/Temp. The PC description should include the remove date as shown below:

• Brandy Rico MPB B9 AMK-223B *** Remove 8/15/2015

2.3.2 Individual Privileges

Individual privileges are applied directly to the system when the machine is located in faa.gov/Win7 LOB/ARC/AMC/GPO Deviations/USGCB On/Admin Allowed/…

”Organization.”

The user will retain admin privileges to the system as long as it sits in the OU. If the system is moved to a standard OU, then administrative privileges will be removed.

2.3.3 Group Privileges

Group Privileges are applied through a GPO and at the location determined. The user must be added to the associated group to maintain administrative privileges. Refer to the articles in the SMT (Remedy Knowledge Management) that contain “Admin Rights” in the title to understand GPOs and Groups.

0 Initial Release. 09/04/2015

0 Reviewed – no changes. 07/06/2016

1 Reviewed – updated Process Owner and Approve By 12/21/2021

BelArc System Profile

AMKJG-223B-60177 Date: 07/06/2016 Revision 1

Process Owner: Derrick Fields Approved By: Christopher G. Lee

BELARC SYSTEM PROFILE

1. Overview BelArc's wide-area-network architecture allows users to simplify and automate the management of their desktops, servers and laptops using a single database and Intranet server.

BelManage automatically creates an accurate and up-to-date report of software license and usage, hardware specifics and security configurations for a system on which the client has been installed.

2. Process

2.1 BELARC BELMONITOR REPORT

This process is the local client installation to provide a BelArc Analysis report. The report will generate a computer profile summary, which includes information such as licensed software, printers and network drives. The software is loaded as part of the imaging process.

2.1.1 Monitor Software

1. Go to Start > All Programs > BelArc BelMonitor. Information about the User Account

Control (UAC) appears.

2. Click Continue. The UAC will ask if you want to allow the program to make changes to the computer.

3. Click Yes to proceed. BelArc Analysis will generate an updated profile.

BelArc System Profile

AMKJG-223B-60177 Date: 07/06/2016 Revision 1

4. To retain a copy of the profile summary, go to File menu > Print command or Save as command on the menu.

2.1.2 Software Installation

If the client software is not on the system, go to \\arc-mcac-va132\ris$\apps\BelArc and install BelMonitor.exe using the default settings.

0 Initial Release. 11/01/2015

1 Updated 2.1.2 Software Installation location from arc-mcac-a037a to arc-mcac-va132. 07/06/2016 file://arc-mcac-va132/ris$/apps/BelArc%20

Remote Services Using Bomgar

AMKJG-223B-60180 Date: 07/06/2016 Revision 0

REMOTE SERVICES USING BOMGAR

1. Overview Bomgar Remote Support provides remote assistance through firewalls to desktops, servers, POS systems, and mobile devices. Bomgar is used to support ESC and ESC-supported customers on all of their government purchased systems directly, or over the web. This process is equally suited for use in the following imaging and deployment scenarios:

• New Employee (new computer)

• Existing relocating employee (changing computers)

• Existing employee reimage (keeping same computer)

2. Process

2.1 REPRESENTATIVE CONSOLE

Bomgar uses the Windows or Domain credentials. There are three ways to connect to a customer’s computer. You can use the Share a Session Key; Email a Link to a Customer or Jump To. Session Key and Email Link to a Customer are more commonly used when a customer is off-site; however, elevated privileges are not applied with these sessions. See Elevated Privileges for elevated access. Jump To is generally used when a customer is on-site, as it automatically provides elevated privileges.

1. Open the Bomgar Representative Console and log in using domain credentials or PIV credentials.

2. Click Start to see the three ways to connect.

2.1.1 Share a Session Key

1. Have the customer open a browser session and go to https://remote.esc.gov.

2. Technician clicks Generated Session Key.

3. Provide customer with Session Key.

a. The session key expires in 24 Hours.

https://remote.esc.gov/

4. Instruct customer to enter Session Key and click the Submit button.

5. Customer enters Name. Click the Submit button.

6. Technician clicks OK > Finished.

7. The new session will be listed in the technician’s Personal Queue.

a. Highlight and click Accept Session.

8. Technician clicks Full Customer Client.

9. Customer clicks Accept.

10. Click Run.

11. Click Run.

12. Technician clicks for screen sharing.

13. Customer clicks Allow.

14. Technician now has control of the customer’s pc.

a. Complete the necessary work.

15. To end the sesssion, techcnican clicks th red “X” with Bomgar.

16. Click End Session > OK.

17. Customer receives a message and clicks OK.

2.1.2 Email a Link to a Customer

1. Click Email and enter the customer’s name into To… and Send.

2. Customer receives email and clicks the link pro.

3. Customer enters Name and clicks the Submit button.

4. Follow 2.1.1 Share a Session Key steps 7 through 17.

2.1.3 Jump To

1. Technician enters Hostname/IP: (Barcode: i.e. ARCACW100094493.)

2. Click Jump.

3. Click Screen Sharing > Finished.

4. Customer clicks Allow.

2.2 ELEVATED PRIVILEGES

Provide elevated privileges when using the Session Key or Email a Link to a Customer. The customer must be using VPN to have an internal connection to the MMAC network.

1. On the Customers computer go to C:\Windows\System32.

2. Right-click compmgmt.msc and Run as Administrator.

3. Computer Management will open.

4. Go to Local Users and Groups.

5. Select Groups > Administrators.

6. Click on the Add button.

7. Add the customer’s name and then log off and back on.

8. The customer should have administrative privileges.

NOTE: Selecting elevated privileges within the software is not functional at this time.

2.3 PIV LOGIN AND SWITCH USER

The appropriate virtual smart card drivers must be installed on both your local system and the remote system, with their services running. Unless using Jump To, the functionality does not require the virtual smart card driver to be pre-installed on the customer's system. In this scenario, Bomgar installs the driver as part of the Jump to the end system being accessed. This fucntionality will also not be available while using the session key or email link.

1. While the customer is logged in, click the smart card.

a. A dot will appear next to the selected reader to install the required drivers.

b. If the selected reader is not the fucntional reader, select it again to allow the additonal readers to be available.

2. Customer’s PC will show the driver loading in the bottom right corner.

3. Technician’s PC will show the driver loading in the bottom right corner.

4. Click Ctrl Alt Del > Switch User.

5. Click Cntrl Alt Del > OK > Switch User.

6. Click the Smart Card button to see the certificates.

7. Select the certificate.

8. The smart card reader will now request the login with PIV.

2.4 FILE TRANSFER

With an open Bomgar session click the File Transfer Tab to transfer files to the supported machine.

1. Click File Transfer.

2. Select the file to be transferred.

3. Select the location to be transferred to.

4. Click the folder Upload Selected Files to Remote System.

5. Highlight the file, and click the folder Start the Selected Transfer.

3. Troubleshooting If the smart card button does not appear in the screen sharing tool bar, verify the representative smart card service is running on your local computer. If the smart card button is present but disabled, verify the customer’s smart card service is running on the remote computer.

Technician’s Machine

Cuaotmer’s Machine

4. Document Control

4.1 DOCUMENT HISTORY

0 Reviewed – no changes. 07/06/2016

Asset Management Clearance

AMKJG-223B-60181 Date: xx/xx/2021 Revision 2

ASSET MANAGEMENT CLEARANCE

1. Overview The Asset Management Clearance work order (WO) task occurs as part of the official process followed by Government Employees and Contractors departing the Mike Monroney Aeronautical Center (MMAC) upon resignation, retirement, termination, or death.

2. Process

2.1 ASSET MANAGEMENT CLEARANCE PROCESS

This process begins when a task in the AMC DT ASSETS Support Group queue changes to “Pending” status. The technician must be a member of this support group to assign and work a task in the queue. The proper asset management permissions must have been enabled within the Service Management Tool (SMT) as well.

2.1.1 Locate Person ID

1. Technician assigns a task in the queue to work as shown in the example task. Click Save.

2. Technician changes the assigned task status to “Work In Progress” when ready to work. Type “Working” in the Work Info Summary and then click Save to update the status.

3. Technician reviews all notes for the WO and task. Task information typically identifies user information, to include last day of duty, routing information, location, email address, supervisor, or specific system IDs. Information about a requested data litigation hold may also be provided when applicable. Furthermore, since a clearance happens for each Government Employee and Contractor departing the MMAC, the departing person identified on the task may not be a supported user.

4. Technician searches for the identified user under Manage Bulk Updates, which is a function of the Asset Management Console.

5. Search by the user’s last name and click the Search button. If you cannot locate the user’s last name quickly when scrolling, enter less characters to provide more user options for consideration. Characters entered for a user’s last name should always be lower case. In some cases, the departing user may appear in the SMT with a logon instead of a last name in accordance with the applicable Line of Business (LOB) requirements.

6. A list of users with matching search criteria will be displayed for review.

7. Click the ID that most likely matches the user identified within the task. In some cases, you will have multiple possible choices or a user with multiple IDs.

NOTE: Possible items in the task that would help to identify the correct ID include:

• FTE or Contractor Identification

• Site (Is the user located at the MMAC, a REMOTE MMAC user or at another site?)

• Middle Initial

• Routing Information

• Building/Room Location

• Email address

8. Click View to see details about the ID. Information shown under the General tab can also help to identify the correct user from the list of possible matches. In some circumstances the person submitting the clearance may not know the exact email address or the routing information shown is not current in the SMT.

NOTE: You may review information on the other WO task entries and in other available support tools, such as FAA Profile, Active Directory, Belarc or Microsoft Outlook to help identify the correct ID or IDs. For any possible discrepancies, consult with the SMT Admin regarding the IDs set to DELETE profile status; however, all WO tasks are set to the same sequence. This means you might begin your task actions before the SMT Admin has identified the correct IDs.

Document the efforts you took to locate the user, such as what tools you searched within to look for this user in the Work Info tab notes. In the event that you cannot locate the user, which can happen with a clearance task, indicate in the Work Info tab notes that the user could not be found within the SMT and that no further action is required. You can then close the task once you have documented your actions in the Work Info tab. When the departing user is not a customer supported by the ESC Line of Business (LOB), you may indicate in the Work Info notes that the user is not an employee within the ESC LOB and that no further action is required. You can then close the task once you have documented your actions.

9. Review the list of Configuration Item (CI) relationships for the applicable Person ID or IDs, which can be found under the CIs tab. You may see other types of Government-Furnished Equipment (GFE) related to a departing user, such as a mobile phone or server, but your task action is to address the Desktop-supported relationships for any applicable ID. The remaining CI relationships will be addressed by designated personnel outside of AMK-223B within their task actions. Do not leave a Desktop-supported CI related to a departing user. In situations where the departing user is the Primary POC in the SMT and the AD machine account for a shared device, you will remove the relationships for the departing user and locate a new Primary POC for the shared device in the SMT and in AD. Since you cannot modify the supported CI relationships from the Person ID accessed via the Manage Bulk Updates function, you may want to make a list of the CI relationships to address.

2.1.2 Modify CI Relationships

1. Return to the Asset Management Console and search for an existing CI record from the

Manage CIs function.

2. Perform a search to access a CI record. Once displayed, modify the CI relationship from the People tab within the actual CI record.

3. Click Remove to unrelate the CI record from the ID. Then click Save. For users with multiple CI hardware relationships, you must review and modify each CI record on an individual basis. You may find a Person ID that has no CI relationships, which means that no further action might be required. However, if you think this is a supported customer, research in other support tools to see if you could find user activity on a machine not currently related within the SMT. You can find the user’s logon from the Login/Access Details tab for the Person ID or you can do a wildcard search by logon within Belarc to help identify user activity.

4. This research may identify another AD machine account assigned to the departing user – in which case, review the associated CI record for any needed changes within the SMT. If the departing user has duplicate IDs within the SMT, review and work all related supported CI relationships for the departing user.

5. Modify the CI record as needed. You may need to update the location of the CI, which might be the location of the user listed on the task, unless you determine that the CI is located in another area, such as a classroom. Information provided on the machine account in AD can also be used to determine the last location for the CI.

Research as needed in support tools to determine the best possible location.

Besides location, you may need to modify the machine status, add missing information, such as the model and/or the warranty, or even remove an invalid user relationship if you should notice discrepancies while working on a record. In a situation where the departing user was actually using a device that does not exist in the SMT, you will create a new CI record for that device and update it according to the available information. Make a note of the departing user’s previous utilization of the CI within the Work Info tab since it cannot be captured via the normal CI relationship retention history.

6. Review the Belarc profile for the related CI to determine if the CI could have been shared. Research further if you notice regular logon activity by other users, as the machine might need to be related to a new person in the case of a shared, classroom or a student services machine. Relate the CI to another person using the Add button if your research indicates that the machine activity should continue. You may need to contact another person, such as the supervisor listed on the task, or a property delegate, to help determine whether to retain a machine account and assign a new POC. You may also ping the machine account to help determine if the machine is in use.

7. Delete all related machine account(s) in AD for the departing user’s primary machines since some users have more than one machine. If your research should determine that the machine account must remain in AD after user departure, modify the machine account to add a new assigned Primary POC, location and routing, or to make the description standard. The CI record location and person relationship in the SMT should match the description for any machine account you retained in AD and assigned to a different POC. If you must leave a machine account up, you can expect that the machine account will be disabled or deleted during the automated system process. Make notes on your task actions for the corresponding AD machine accounts. In some cases the device related to a CI record has already begun the reimaging process to prepare for the onboarding of a new employee and has already been moved to the WDS OU for reimaging. Do not delete this AD machine account either.

NOTE: Do not delete a departing user’s machine account from AD prior to the last day of duty specified on the WO. The departing user retains network access until 6:00 pm on the last day of duty. You will wait until the following business day to delete the AD machine account.

NOTE: In the event of a data litigation hold issued on a departing Manager, the request will have originated outside of this AMK-223B clearance process, and all actions to secure applicable data should have occurred prior to the task reaching the “Pending” status to be worked in the queue. For any departing manager, you can remove any CI record relationships associated with the departing Manager’s ID in the SMT, but do not delete any associated machine accounts until specifically requested. A data retention hold request is to be submitted to obtain the hard drive(s) for the departing manager, which should be done before deleting the AD machine account. Information on the user’s FAA profile will identify the departing user as a “Verified AHR-Manager” on the FAA profile.

In special circumstances, management may request a data retention hold on a departing user by calling the CSC to obtain the hard drive. This process requires user name, applicable machine name, location and the name of the property POC that would secure and retain the hard drive to open the ticket. If you believe that a data retention hold might apply to a departing user’s hard drive, for example, a deceased person, do not delete the machine account from AD while performing actions on the clearance task to allow the data retention hold request on the user’s hard drive to process.

When a classroom instructor departs the MMAC, there may be multiple machine relationships. The machine accounts for classroom machines should be left in the proper OU for that classroom; however, you can research to identify a new POC for that classroom and update the description for the new POC.

8. Enter information about all actions performed on the task, including any discrepancies noticed, in the Work Info tab notes. Your Work Info notes should indicate any CI records you modified, as well as any AD machine account changes – such as machine accounts you deleted, and/or any machine accounts retained, or that required description modifications.

9. Return to the Person ID(s) to verify that you have removed all existing supported CI relationships within the SMT.

10. Relate any CI records that were reviewed and/or modified as part of your task actions to the associated WO via the Relationships tab.

11. When an ESC user departs the MMAC, send an email to the COR to identify the departing user, WO and the device CI information.

12. Add the Product Category information in the Tab Categorization tab.

13. Close the task when you have performed all needed actions.

0 Initial Release. 09/04/2015

1 Changed two screen captures. Changed “BelArc” to Belarc.” 07/06/2016

2 Updated process for accessing and modifying CI records.

Changed screen captures. Assigned new Process Owner & Approver. Added more information about a data hold. Added note about what to do if the user is not our LOB. Expanded information about deleting AD machine accounts. Added note about duplicate IDs.

01/21/2021

Asset Management Name Change

AMKJG-223B-60182 Date: xx/xx/2021 Revision 1

ASSET MANAGEMENT NAME CHANGE

1. Overview The Asset Management Name Change task occurs as part of a supported customer’s request for a name change on existing accounts.

2. Process

2.1 ASSET MANAGEMENT NAME CHANGE PROCESS

This process begins when a task in the AMC DT ASSETS Support Group queue changes to “Pending” status. The technician must be a member of this support group to assign and work a task in the queue. The proper asset management permissions must have been enabled within the Service Management Tool (SMT) as well.

2.1.1 Locate Person ID

1. Technician assigns a task in the queue to work as shown in the example task. Click Save.

2. Technician changes the assigned task status to “Work In Progress” when ready to perform work as shown in the example. Type “Working” in the Work Info Summary and then click Save to update the status.

3. Technician reviews all notes for the task. Information on this task will typically identify user’s previous and new last names, as well as other identifying information. Although this task frequently happens as a result of a marriage or divorce, the user may have to submit a ticket due to a misspelled name.

4. Technician searches for the identified user under Manage Bulk Updates, which is a function of the Asset Management Console.

5. Search first by the user’s original last name (not the new last name) and click Search. If you cannot locate the user’s last name quickly when scrolling, enter less characters to provide more user options for consideration. Characters entered for a user’s last name should always be lower case.

6. A list of users with matching search criteria will be displayed.

7. Click the ID that most likely matches the user identified within the task. In some cases, you may have multiple possible choices.

Possible items listed in the task that would help to identify the correct ID include:

• FTE or Contractor Identification

• Site (Is the user located at the Mike Monroney Aeronautical Center or at another FAA site?)

• Middle Initial

• Routing Information

• Building/Room Location

8. Click View to see details about the ID. Information shown under the General tab can also help to identify the correct user from the list of possible matches, such as the Email Address.

NOTE: You may want to search on the user’s previous name and the new name to locate the Person ID.

9. Review the list of CI relationships related to the Person ID, which can be found under the CIs tab. Your task action is to address the Desktop-supported relationships for an ID.

Although you may see CI record relationships for other government-furnished equipment, such as a mobile device, you do not have sufficient permissions to address.

Allow them to remain attached to the ID.

10. Identify the supported CI relationships that you need to address for this ID. Since you cannot access the CI relationships from this function, you may want to make a list. For users with multiple supported relationships, you must modify each CI record on an individual basis.

2.1.2 Modify CI Relationships

1. Return to the Asset Management Console and search for an existing CI record.

2. For each CI record, modify the User’s relationship from the People tab.

3. Click Remove to unrelate the old Person ID from the CI record. Then click Save.

4. Now relate the CI record to the new Person ID. Clicking Add from the People tab will bring up a People search screen so you can scroll through and locate the same user under the new name. At this point, you are searching by the new last name if the last name was affected.

NOTE: The default selection for the user relationship is “No,” which would be applicable for a shared CI. Use “Yes” when relating a machine to the primary user.

5. A list of users in the SMT with matching last names (or portions of) will be displayed.

6. Click the ID that most likely matches the user identified on the task according to the right last name.

NOTE: If you should notice a discrepancy with the new ID, or you cannot locate it, open a ticket for the Remedy Admins to resolve. Since the new ID must refresh through Active Directory, you must wait for it to appear in Remedy. In cases where the new ID is not yet there, make a note on the status as to why you are waiting to perform work.

7. Select “Used By” for the relationship role and then click Add. The user will be related to the CI with the proper ID and name.

8. Click Save in the People tab to retain your modifications.

9. Modify the CI record as needed, including any information needed for the machine status, location and/or the existing warranty, if you should notice discrepancies while working on the record.

10. Review the machine account(s) in Active Directory for all related CIs. Update the machine account description for the assigned user according to the name change, location and routing info. Ensure that the description exists in the proper standard format.

11. Modify the user’s name in the machine account description using the proper name and correct spelling. Update the machine account description if a discrepancy is found during review of location and routing. If you should notice that the machine account is no longer assigned to the user in AD, then research the activity and relate the proper user to that CI. Do not leave a user related to a CI record in the SMT when the user is not assigned to the machine account.

12. Review Belarc support tools to verify that the user is now logging in with the correct name. This will also help you to determine if the user is still using one of the existing CI relationships or if it was an old relationship that needed attention. In some cases, the CI relationship may remain from an old device after the machine account has been removed.

13. Make notes in the Task Work Info tab on all actions performed for any changes you made to CI record(s) and related AD machine accounts.

14. Relate all CI records modified during work performed to the Task using the Relationships tab.

15. Add the Product Category information in the Tab Categorization tab.

16. Close the task when you have performed all needed actions.

0 Reviewed. No changes. 07/06/2016

Updating to new version with new process owner and approver; added new screen shots and updated instructions.

01/21/2021

Asset Management Quality Control

AMKJG-223B-60184 Date: 11/01/2015 Revision 0

ASSET MANAGEMENT QUALITY CONTROL

1. Overview Asset Management Configuration Item (CI) records are created and maintained in the Service Management Tool (SMT) for supported computers. The Asset Management Quality Control process occurs as a task at the end of a Change Request (CRQ.)

2. Process

2.1 ASSET MANAGEMENT PROCESS

This process begins when a task in the AMC DT ASSETS Support Group queue changes to “Pending” status. The technician must be a member of this support group to assign and work a task in the queue.

2.1.1 Create CI Record

1. Technician assigns a task in the queue to work.

2. Technician changes the assigned task status to “Work In Progress” when ready to work.

3. Technician reviews all notes for the task and the parent CRQ.

4. Technician determines the CI bar codes for the affected records based on all notes and a review of support tools.

5. Technician verifies the possible new CI bar code by searching in Active Directory (AD) for a machine account.

NOTE: If no machine account found for the identified bar code, research to determine if another machine was set up instead. Although the Deployment technician should make notes for a change to the setup, such as a machine change, this does not always happen. The Asset Management technician should research all available tools to determine the machine deployed.

If in doubt, discuss with the Deployment technician to identify the machine that was set up for this user. If no machine was set up, and there are no notes for the set up to be cancelled, make a note that there was no action and close the task. Setup cancellations and duplicate setup submissions are usually well documented in the CRQ, but in rare cases, this may happen.

6. Review the machine account in AD for proper OU, assigned user, location and routing info. Ensure that the description exists in the proper standard format of: User Name/Building & Room/Routing (Example AMK-223B.) Searching by *wildcard within AD will enable the technician to determine if duplicate machine accounts exist.

7. Update machine account description if a discrepancy is found during review.

8. Move the machine account to the proper OU if not already there. If the machine is still in the AMC WDS OU, the technician’s name should be identified in the description, and there should be a note somewhere in the CRQ/tasks as to why the machine needs to remain in the AMC WDS OU (software install/issue being resolved etc). Contact Deployment technician if there is any doubt. Add the Deployment technician’s name to the machine account if it is not already there and the machine account needs to remain in the AMC WDS OU. Example for Technician name when in AMC WDS OU: **Sunita**

9. Contact the Deployment technician if the machine name used for imaging appears to have a discrepancy, such as the wrong bar code, or the wrong machine name standard.

10. Search for the machine in SCCM to see if it registers properly and if the assigned user is logging in.

11. Right-click the machine name to access the Resource Explorer. See if the Resource Explorer drops down for the machine. If the Resource Explorer does not drop down all the way, there may be an issue with the way SCCM was installed. Contact the Deployment technician with any discrepancies or questions to address.

12. Verify that the service tag or serial number matches in the PC Bios and the System Enclosure. The correct System Enclosure will show the SMBIOS Asset Tag unique identifier that shipped from the manufacturer. This asset tag should match the machine name used at imaging. Contact the Deployment technician if any discrepancies are found.

13. Locate the machine profile in BelArc.

14. If the machine is not found in BelArc, make a note in the task. The profile may not be there if the machine was set up but not turned on, as in the case of a classroom deployment. Pinging the machine can help the technician decide if the machine is just not turned on at that point. If the machine responds to a ping, has been in the proper OU for a while and there is no BelArc profile, research further. Are there other machines in that same OU found in BelArc? If none of them are registering in BelArc, notify the BelArc Admin about the discrepancy in case it should be investigated further, as in the case of a newly-created OU.

15. Identify the new CI bar code for the task in the notes.

16. Create a CI record according to the validated bar code, service tag or serial number, and machine name. The validated bar code should be the last nine digits of a 20-digit FAA bar code used in both the device machine name and the Asset Tag (internal unique identifier buried in the BIOS) as identified within SCCM or BelArc. For discrepancies, also check AITs.

NOTE: Once you have entered the CI Name in the field, click Save. The SMT will generate the new CI record. Do not add additional data to the CI record as the SMT only saves the record name on the initial save. You will need to access the new CI record from the Asset Management Console to enter additional data.

17. Once you have accessed the newly-created CI record, enter additional information in the fields:

• CI ID (AD machine name)

• Tag Number (service tag or serial number)

• Primary Capability (Workstation)

• User Affected (single user = “1;” adjust the number according to shared user activity up to “5” to indicate numerous users)

18. Enter product hardware and location information in the General tab.

• Tier 1 (Hardware)

• Tier 2 (Desktop)

• Tier 3 (Notebook/Laptop or Workstation)

• Product Name (Model if available; place the model in Additional Information if it has not yet been added)

• Region (AMC)

• Site Group (Oklahoma)

• Site (Building Numbers when available)

• Room (Room Number if applicable)

19. The Purchase Date is the shipping date. Locate the shipping date for the service tag or serial number from the manufacturer’s Web site. Information for a Dell machine can be found at http://www.dell.com/support/. Once you have entered a valid Dell service tag on the Web site, warranty information will be displayed.

20. Add the shipping date validated from the Dell Web site to the Purchase Date. (Example = 10/28/2014) http://www.dell.com/support/

21. Under the People tab, relate the new CI record to the assigned user. Multiple users can be related; however, for shared machines, the primary user relationship should be the person assigned to the machine account in AD.

22. Relate the warranty to the machine from the Contracts tab by searching under existing contracts. The warranty name will be the shipping date posted on the Web site of the validated bar code. (Example = 10/28/2014)

NOTE: If you cannot locate a warranty for the CI record, you can create a new one using the Create New Contracts function. The SMT will automatically relate the new warranty to the CI upon creation.

23. Enter info about actions performed on the task, including any discrepancies noticed, in the task notes.

24. Search for user/CI relationships through the Manage Bulk Updates function within the Asset console to determine what other CI records the user might have. The user’s PPL ID will identify any other existing CI relationships. If the user is still using an existing machine, ensure the related CI record is up to date or modify as needed. If the user is no longer assigned to that CI bar code, unrelate the user from the CI bar code. When creating a new CI record, the user will likely have an existing machine that is either being scheduled for excess or being assigned to a different user in a trickledown scenario.

Delete any associated machine accounts in AD and/or update machine account descriptions for these CI relationships based on your research of all support tools and user activity. Modify the CI record locations if discrepancies are noticed.

25. Enter notes for all actions performed on all CI records, including any existing relationships determined through research of support tools, whether the bar code was identified in the task or not.

26. Relate the new CI bar code to the task. Relate any other CI records that you modified during work performed to complete the task.

27. Close the task when all needed task actions have been performed.

2.1.2 Modify CI Record

1. Technician works an assigned task.

2. Technician reviews all notes for the task and the parent CRQ.

3. Technician determines the CI bar codes for the affected records based on all notes and a review of support tools.

4. Technician verifies the possible bar codes by searching in AD for machine account(s.)

machine was set up instead.

5. Review the machine account in AD for proper OU, assigned user, location and routing info. Ensure that the description exists in the proper standard format. – User Name Building Room Org –example AMK-223B.

6. Update machine account description if a discrepancy is found. When modifying a CI, the machine account may have been assigned to a different user. If you notice a different user logging in regularly via support tools, research further. Another user may be using the machine. Check SCCM and BelArc to review activity. If another user is logging into this machine, update the machine account for the proper user, location and routing info. You may also need to move the machine account to another proper OU.

7. Delete the machine account in AD if the assigned user is not retaining the bar code, and no host responds…