Dell Wyse Management Suite Version 3.x and 4.x Deployment Guide

Notes, Cautions, and Warnings

[i] NOTE: A NOTE indicates important information that helps you make better use of your product.

[⚠] CAUTION: A CAUTION indicates either potential damage to hardware or loss of data and tells you how to avoid the problem.

[❗] WARNING: A WARNING indicates a potential for property damage, personal injury, or death.

© 2021-2022 Dell Inc. or its subsidiaries. All rights reserved. Dell, EMC, and other trademarks are trademarks of Dell Inc. or its subsidiaries. Other trademarks may be trademarks of their respective owners.

Chapter 1: Introduction

Wyse Management Suite is a next-generation management solution for centrally configuring, monitoring, managing, and optimizing Dell Hybrid Client-powered endpoints and Dell thin clients. It offers advanced features like cloud and on-premises deployment, manage-from-anywhere capabilities via a mobile application, and enhanced security features such as BIOS configuration and port lockdown. Additional functionalities include device discovery and registration, asset and inventory management, configuration management, operating system and application deployment, real-time commands, monitoring, alerts, reporting, and endpoint troubleshooting. This document outlines a deployment strategy for Wyse Management Suite on a single virtual machine or server within a private cloud, designed to support up to 120,000 devices.

Chapter 2: Hardware Requirements

This section details the hardware requirements for Wyse Management Suite based on the number of devices managed.

[i] NOTE: Wyse Management Suite can be installed on a physical or virtual machine.

[i] NOTE: WMS.exe and WMS_Repo.exe should be installed on separate servers. For public cloud, install the remote repository. For private cloud, install both remote and local repositories. Installation is supported on physical or virtual machines. The repository and WMS server do not require the same operating system.

[i] NOTE: For 10,000 devices, minimum RAM is 12 GB for secure MQTT communications.

[i] NOTE: Wyse Management Suite 3.5+ requires MongoDB version 4.2.16 for distributed setups.

[i] NOTE: Wyse Management Suite 3.6+ repository installation supports Windows 2016/2019 on Azure and AWS, but not Google Cloud Platform. After installation, the repository URL is displayed as the VM hostname. For endpoint reachability, the URL must be edited to use the VM's DNS name (e.g., uw2-wmstest-vw01.westus2.cloudapp.azure.com or ec2-3-141-79-165.us-east-2.compute.amazonaws.com).

Chapter 3: Wyse Management Suite Deployment Architecture

Wyse Management Suite components include:

• WMS Web Application: Application server hosting Wyse Management Suite.
• Memcached: Used for caching data to improve performance and scalability.
• MQTT: Used for push notifications to thin clients.
• MongoDB: NoSQL database for performance and scalability.
• MariaDB: Relational database for structured data.
• EMSDK: SDK for managing Teradici devices.

Figure 1. Wyse Management Suite architecture: A Web Browser and Wyse Thin Client connect to the WMS Web Application. The Web Browser uses HTTPS (Port 443). The Wyse Thin Client uses MQTT (Port 1883) and Secure MQTT (Port 8443). The WMS Web Application interacts with MQTT, MongoDB (Port 27017), MySQL/MariaDB (Port 3306), Software Vault (Port 9443), Memcached (Port 11211), and EMSDK (Port 49159).

Chapter 4: Deployment Details

Wyse Management Suite supports up to 120,000 connected devices. Deployment can be on a single server or multiple servers.

Deployment on a single server to support 50,000 thin client devices

Minimum hardware requirements:

Deployment on a single server to support 120,000 thin client devices

Minimum hardware requirements:

Figure 2. Wyse Management Suite on a single server: Thin clients connect via DNS Server to the WMS Server, which comprises MQTT, Tomcat, Memcached, MongoDB, MariaDB, and Software Vault.

Deployment details to support Teradici devices

The EMSDK component is required for Teradici device support and is included in the WMS.exe installer. EMSDK can be installed locally or on a separate server. Multiple EMSDK instances can be deployed, each supporting up to 5,000 Teradici devices.

Deployment on a single server to support 5,000 Teradici devices

Figure 3. Wyse Management Suite on a single VM with remote EMSDK: Teradici devices connect to EMSDK (Port 5172), which communicates with the WMS Server components (MQTT, Tomcat, Memcached, MongoDB, MariaDB, Software Vault) via Port 49159.

Figure 4. Wyse Management Suite with EMSDK on a single VM: Similar to Figure 3, showing Teradici devices connecting to EMSDK and then to the WMS Server.

Deployment to support more than 5,000 Teradici devices

Figure 5. Wyse Management Suite on a single VM with multiple remote EMSDKs: Multiple EMSDK instances (potentially managed by HAProxy) connect to Teradici devices (Port 5172) and then to the WMS Server (Port 49159).

Wyse Management Suite on a separate database server

This architecture involves deploying MongoDB and MariaDB on separate servers from the WMS components.

Figure 6. Wyse Management Suite on a separate database server: Thin clients connect via DNS Server to the WMS Server (MQTT, Tomcat, Memcached, Software Vault), which then connects to a separate DB Server hosting MariaDB and MongoDB.

Chapter 5: Custom Port Configurations

Wyse Management Suite uses default ports for its installed applications:

• Apache Tomcat: 443
• MariaDB database: 3306
• Mongo database: 27017
• MQTT Broker: 1883
• Memcached: 11211
• Software vault: 9443
• EMSDK: 5172, 49159 (optional for Teradici devices)

Changing default ports is recommended only if there is a conflict, using the Custom installation option. You can configure the Tomcat connection port 49159 for Teradici, but not the device port 5172.

For more details, refer to the Custom installation section in the Dell Wyse Management Suite 2.x Quick Start Guide at support.dell.com/manuals.

Change the Tomcat service port

To change the Tomcat service port after installation, you can either reinstall using Custom installation mode or change ports manually:

1. Stop the Tomcat service (identified as "Dell WMS: Tomcat Service").
2. Edit the file <INSTALLDIR>\Tomcat-9\conf\server.xml in a text editor.
3. Find and replace all occurrences of port 443 with the desired port number. Changing references to port 8443 is optional.
4. Save the server.xml file and exit.
5. Start the Tomcat service.

Enter the new port number in the URL (e.g., https://xyz.wysemanagementsuite.com:553/ccm-web). This URL is used for portal access and device registration.

[i] NOTE: Dell recommends not changing the Memcached port after installation.

Change the MQTT port

Steps to configure the MQTT broker service:

1. Stop the Tomcat and MQTT services.
2. Edit the file <INSTALLDIR>\wmsmqtt\mqtt.conf.
3. Uncomment the #port 1883 entry and change 1883 to your preferred port (e.g., 2883).
4. Save the file and start the MQTT broker service. Verify it's running on the new port using ps> get-nettcpconnection -LocalPort 2883.
5. Configure Tomcat: Open a command prompt, navigate to C:\Program Files\DELL\WMS\MongoDB\bin, and run the command: mongo stratus -u stratus -p <mongodbPassword> -eval "db.bootstrapProperties.update({'name': 'mqtt.server.url'}, {'name': 'mqtt.server.url', 'value': 'tcp://xyz-pns.wysemanagementsuite.com:2883', 'isActive': 'true', 'committed': 'true'}, {upsert:true})"
6. Start the Tomcat service and re-register devices so the MQTT URL points to the new port.

Change the MariaDB port

Steps to configure MariaDB:

1. Start the Tomcat service and stop the MariaDB service.
2. Edit the file <INSTALLDIR>\Database\SQL\my.ini.
3. Change the port number for both [mysqld] and [client] sections to your preferred port (e.g., 3308).
4. Save the file and start the MariaDB service.
5. Configure Tomcat: Edit <INSTALLDIR>\Tomcat-8\webapps\ccm-web\WEB-INF\classes\bootstrap.properties.
6. Update the jpa.connection.url property with the new port (e.g., jdbc:mysql://localhost:3308/stratus?...).
7. Save the file and start the Tomcat service. Verify the service is running on the configured port using ps>get-nettcpconnection -LocalPort 3308.

Change the MongoDB database port

Steps to configure MongoDB:

1. Stop the Tomcat and MongoDB services.
2. Edit the file <INSTALLDIR>\MongoDB\mongod.cfg.
3. Update the port property to your preferred port number (e.g., 27027).
4. Save the file and start the MongoDB service. Verify it's running on the new port.
5. Configure Tomcat: Edit <INSTALLDIR>\Tomcat-8\webapps\ccm-web\WEB-INF\classes\bootstrap.properties.
6. Update the mongodb.seedList property with the new port (e.g., localhost:27027).
7. Save the file and start the Tomcat service. Verify the service is running on the required port using ps>get-nettcpconnection -LocalPort 27027.

Remote repository

Wyse Management Suite supports local and remote repositories for applications and OS images. The WMS_Repo.exe software facilitates the creation of distributed remote repositories. This feature is available for Pro license subscribers.

Prerequisites

• For cloud deployment, navigate to Portal Administration > Console Settings > File Repository and download WMS_Repo.exe.
• Server requirements for WMS repository software: Windows 2012 R2 or 2016 Server Standard, 4 CPU, 8 GB RAM, 40 GB storage.

[i] NOTE: Wyse Management Suite 3.6+ repository installation supports Windows 2016/2019 on Azure and AWS, but not Google Cloud Platform. The repository URL must be edited to use the VM's DNS name for endpoint reachability.

About this task: Install WMS-Repo software

1. Log in as Administrator and install WMS_Repo.exe on the repository server.
2. Click Next and follow the on-screen instructions.
3. Click Launch to open the WMS Repository registration screen in a web browser.
4. Select "Register to Public WMS Management Portal" for public cloud registration.
5. Enter the following details: Wyse Management Suite server URL, WMS Repository URL (with domain name), administrator username, administrator password, and repository path. Ensure the repository path has read/write access for the "Dell WMS Repository Tomcat Service".
6. Click Register.
7. A successful registration window will be displayed.
8. The Wyse Management Suite portal will confirm the successful registration of the remote repository.

[i] NOTE: HTTPS is enabled by default with a self-signed certificate. To use a custom domain-specific certificate, upload it on the registration page.

The server restarts, and the uploaded certificate is displayed.

[i] NOTE: If using a self-signed or private domain certificate, upload it on the repository server to validate Wyse Management Suite CA credentials.

Navigate to the C:\wmsrepo location to view saved repository files.

Wyse Management Suite repository is displayed as "Dell WMS Repository: Tomcat Service" in Windows Local Services and starts automatically on server restart.

Chapter 6: Upgrade Wyse Management Suite version 2.x to 3.x

Prerequisites

• Ensure sufficient disk space and configured local repository.
• Temporarily disable antivirus or monitoring tools during the upgrade. Consider adding exclusions for WMS directories.

Steps

1. Double-click the Wyse Management Suite 3.x installer package.
2. On the Welcome screen, click Next. (The EULA screen may appear if upgrading from 3.0).
3. Read and accept the License Agreement.
4. On the Upgrade page, configure shared folder and access rights for the CIFS user (Use Existing User or Create New User).
5. [i] NOTE: If Teradici EM SDK was installed previously, it will be updated automatically. If not, select the Teradici EM SDK checkbox to install it.
6. Select the "Bind Memcached to 127.0.0.1" checkbox to bind memcache locally.
7. Select appropriate TLS versions based on device support. [i] NOTE: WDA versions lower than WDA_14.4.0.135_Unified, Import tool, and 32-bit Merlin images are not compatible with TLSv1.1+. Use TLSv1.0 if managing older devices.
8. Click Launch to open the Wyse Management Suite web console.

Chapter 7: Upgrade Wyse Management Suite version 3.x to 3.3

Prerequisites

• Ensure sufficient disk space and configured local repository.
• Temporarily disable antivirus or monitoring tools during the upgrade. Consider adding exclusions for WMS directories.

Steps

1. Double-click the Wyse Management Suite 3.2 installer package.
2. On the Welcome screen, click Next. (The EULA screen may appear if upgrading from 3.0).
3. Read and accept the License Agreement.
4. On the Upgrade page, configure shared folder and access rights for the CIFS user (Use Existing User or Create New User).
5. [i] NOTE: If Teradici EM SDK was installed previously, it will be updated automatically. If not, select the Teradici EM SDK checkbox to install it.
6. Select the "Bind Memcached to 127.0.0.1" checkbox to bind memcache locally.
7. Select a port for secure MQTT communication (default is 8443). [i] NOTE: Port selection is shown when upgrading from 3.1/3.1.1 to 3.3.
8. If there's a Hostname mismatch, the "Update MQTT Config" window appears. Select "Apply recommended changes" to update URLs. [i] NOTE: This window appears when upgrading from 3.2/3.2.1 to 3.3.
9. Click Next.
10. Click Launch to open the Wyse Management Suite web console.

Chapter 8: Upgrade Wyse Management Suite version 3.x to 3.5

Prerequisites

• Ensure sufficient disk space and configured local repository.
• Temporarily disable antivirus or monitoring tools during the upgrade. Consider adding exclusions for WMS directories.

Steps

1. Double-click the Wyse Management Suite 3.5 installer package.
2. On the Welcome screen, click Next. (The EULA screen may appear if upgrading from 3.0).
3. Read and accept the License Agreement.
4. On the Upgrade page, configure shared folder and access rights for the CIFS user (Use Existing User or Create New User). Password must be > 8 characters.
5. Click Next.
6. Enter Service Account Credentials. Password must be 9-127 characters.
7. Click Next.
8. Enter Software Vault password (must be > 8 characters).
9. Click Next.
10. [i] NOTE: If Teradici EM SDK was installed previously, it will be updated automatically. If not, select the Teradici EM SDK checkbox to install it.
11. Select a port for secure MQTT communication (default is 8443). [i] NOTE: Port selection is shown when upgrading from 3.1/3.1.1 to 3.5.
12. Select "Apply recommended changes" if you want to change URLs. [i] NOTE: "Update MQTT Config" window appears when upgrading from 3.2/3.2.1 to 3.5.
13. Click Next.
14. Click Launch to open the Wyse Management Suite web console.

Chapter 9: Upgrade Wyse Management Suite version 3.x to 3.6

Prerequisites

• Ensure sufficient disk space and configured local repository.
• Temporarily disable antivirus or monitoring tools during the upgrade. Consider adding exclusions for WMS directories.

Steps

1. Double-click the Wyse Management Suite 3.6 installer package.
2. On the Welcome screen, click Next. (The EULA screen may appear if upgrading from 3.0).
3. Read and accept the License Agreement.
4. On the Upgrade page, configure shared folder and access rights for the CIFS user (Use Existing User or Create New User). Password must be > 8 characters.
5. Click Next.
6. Configure Service Account Credentials:
   • For 3.3/3.3.1 to 3.6: Options are Create New Local User (username 2-20 chars, password 9-127 chars with complexity rules, not same as Teradici username), Use Existing Local User (ensure service logon rights, no admin rights recommended), or Use Existing Domain User (ensure service logon rights, no admin rights recommended). [i] NOTE: LDAP port 389 must be open for AD communication.
   • For 3.5 to 3.6: Enter credentials to create a local user with least privileges.
7. Click Next.
8. Enter Software Vault password (must be > 8 characters).
9. Click Next.
10. [i] NOTE: If Teradici EM SDK was installed previously, it will be updated automatically. If not, select the Teradici EM SDK checkbox to install it.
11. Select a port for secure MQTT communication (default is 8443). [i] NOTE: Port selection is shown when upgrading from 3.1/3.1.1 to 3.6.
12. Select "Apply recommended changes" if you want to change URLs. [i] NOTE: "Update MQTT Config" window appears when upgrading from 3.2/3.2.1 to 3.6.
13. Click Next.
14. Click Launch to open the Wyse Management Suite web console.

Chapter 10: Upgrade Wyse Management Suite version 3.x to 4.0

Prerequisites

• Ensure sufficient disk space and configured local repository.
• Temporarily disable antivirus or monitoring tools during the upgrade. Consider adding exclusions for WMS directories.

Steps

1. Double-click the Wyse Management Suite 4.0 installer package.
2. On the Welcome screen, click Next. (The EULA screen may appear if upgrading from 3.0).
3. Read and accept the License Agreement.
4. On the Upgrade page, configure shared folder and access rights for the CIFS user (Use Existing User or Create New User). Password must be > 8 characters.
5. Click Next.
6. Configure Service Account Credentials:
   • For 3.3/3.3.1 to 4.0: Options are Create New Local User (username 2-20 chars, password 9-127 chars with complexity rules, not same as Teradici username), Use Existing Local User (ensure service logon rights, no admin rights recommended), or Use Existing Domain User (ensure service logon rights, no admin rights recommended). [i] NOTE: LDAP port 389 must be open for AD communication.
   • For 3.5 to 4.0: Enter credentials to create a local user with least privileges.
7. Click Next.
8. Enter Software Vault password (must be > 8 characters).
9. Click Next.
10. [i] NOTE: If Teradici EM SDK was installed previously, it will be updated automatically. If not, select the Teradici EM SDK checkbox to install it.
11. Select a port for secure MQTT communication (default is 8443). [i] NOTE: Port selection is shown when upgrading from 3.1/3.1.1 to 4.0.
12. Select "Apply recommended changes" if you want to change URLs. [i] NOTE: "Update MQTT Config" window appears when upgrading from 3.2/3.2.1 to 4.0.
13. Click Next.
14. Click Launch to open the Wyse Management Suite web console.

Chapter 11: Software Vault Utility

Software Vault secures, stores, and controls access to encryption keys. The utility can be downloaded from Dell's support site or accessed via command prompt for WMS 3.5+.

Topics

• Back up your database
• Restore your database
• Export the Software Vault key
• Import the Software Vault key

Back up your database

Steps:

1. Open a command prompt where the Wyse Management Suite database is installed.
2. Run backup commands for MongoDB (mongodump) and MariaDB (mysqldump).
3. Export the Software Vault key using the Software Vault utility (see "Export the Software Vault key").

Restore your database

Prerequisites

To restore the database on a different Wyse Management Suite server, stop Tomcat services.

Steps

1. Copy the Stratus database folder (from backup) to the MongoDB bin folder.
2. Copy the wmsdump.sql file (from backup) to the MariaDB bin folder.
3. Run restore commands for MongoDB (mongorestore) and MariaDB (using mysql.exe).
4. Import the Software Vault key from the previous server (see "Import the Software Vault key").
5. Start the Wyse Management Suite services.
6. Log in to Wyse Management Suite.

[i] NOTE: When restoring to a new server, resource files (ThinOS firmware, applications, BIOS, logos, etc.) may need to be re-uploaded via the WMS user interface.

Export the Software Vault key

Steps:

1. Open a command prompt as administrator on the WMS server.
2. Browse to the utility's folder.
3. Run the .exe file with parameters: softwareVaultUtility-1.x.x.x.exe -mode export -password <PASSWORD>. This creates a password-protected keys.zip file.
4. Extract keys.zip using the same password. [i] NOTE: Use WinRAR or 7z for extraction.
5. [i] NOTE: Save keys.zip and the checksum file securely.

Import the Software Vault key

Steps:

1. Copy the utility, keys.zip, and checksum file to a folder.
2. Run the .exe file with parameters: softwareVaultUtility-1.x.x.x.exe -mode import -password <PASSWORD>. A backup.zip file is generated.
3. Extract backup.zip using the same password. It contains bootstrap.properties, keys.json, server.xml, and configuration.properties.
4. After importing, restart the Tomcat service.

[i] NOTE: The password used for export must be used for import. Use WinRAR or 7z for extraction.

[i] NOTE: Save backup.zip securely and do not rename/edit keys.zip or checksum files.

[i] NOTE: Do not rerun the import command; keys.zip is deleted after import.