Application Resilience policies for Absolute Secure Access

You can activate an Application Resilience policy for Absolute Secure Access (formerly NetMotion Mobility) to collect information about the functional status of Secure Access installed on your Windows devices and view the results in reports. You can also configure the policy to attempt to repair or reinstall the application.

Health checks

In addition to checking the version, the following table describes the health checks performed:

If you select Report higher versions as Compliant, higher versions report Compliant without running health checks.

Component	Test performed
Services	Installed	Running	Signed by
One of the following: Absolute Secure Access Client (messerv.exe) Mobility XG Client (messerv.exe)	P	P	One of the signers entered in the policy configuration By default, Signers contains "NetMotion Software, Inc", "NetMotion Software, Inc.", "Absolute Software Corp.", and "Microsoft Windows Hardware Compatibility Publisher".
Drivers	Installed	Running	Signed by
One of the following: Absolute Secure Access Packet Filter (nmfilter.sys) NetMotion Packet Filter (nmfilter.sys)	P	P	One of the signers entered in the policy configuration By default, Signers contains "NetMotion Software, Inc", "NetMotion Software, Inc.", "Absolute Software Corp.", and "Microsoft Windows Hardware Compatibility Publisher".
Application name
The application uses one of the following names: Absolute Secure Access Client NetMotion Mobility Client

Repairing and reinstalling

You can configure an Application Resilience policy for Secure Access to enable the Application Resilience (RAR) component A lightweight software component of the Secure Endpoint Agent that detects the status of third party applications installed on a device. The component may also attempt to repair the third party application if it is non-compliant. The RAR component is deployed on a device only when the device is associated with a customized policy group and that policy group's Application Resilience policy is activated. to attempt to repair Secure Access if it's not functioning, or reinstall it if it's missing or can't be repaired.

Depending on the Absolute product licenses associated with your account, the Report and repair and Report, repair, and reinstall options may not be available.

The RAR component of the Secure Endpoint Agent can respond to the following issues:

Issue	Resolution
Repair
One of the following services isn't running: Secure Access Client or Mobility XG Client (messerv.exe)	The RAR component restarts the service. A device restart is required. The Secure Endpoint Agent doesn't force the device to restart, so a status of Not Compliant continues to show in the Application Resilience reports until the device user performs a restart. You can review the report's Status details to determine if a restart is required.
One of the following services isn't installed and the service's executable can be detected on the device: Secure Access Client or Mobility XG Client (messerv.exe)	The RAR component reinstalls the missing service. A device restart is required. The Secure Endpoint Agent doesn't force the device to restart, so a status of Not Compliant continues to show in the Application Resilience reports until the device user performs a restart. You can review the report's Status details to determine if a restart is required.
One of the following drivers isn't running: Secure Access Packet Filter or NetMotion Packet Filter (nmfilter.sys)	The RAR component restarts the driver.
One of the following drivers isn't installed and the driver's executable can be detected on the device: Secure Access Packet Filter or NetMotion Packet Filter (nmfilter.sys)	The RAR component reinstalls the missing driver.
Reinstall
Downgrades are not supported. If the version installed on a device is higher than the expected version, no action is taken.
One of the following services isn't installed and the service's executable cannot be detected on the device: Secure Access Client or Mobility XG Client (messerv.exe)	The RAR component downloads and installs the configured version of the application. A device restart is required after the application is installed. The Secure Endpoint Agent doesn't force the device to restart, so a status of Not Compliant continues to show in the Application Resilience reports until the device user performs a restart. You can review the report's Status details to determine if a restart is required.
One of the following drivers isn't installed and the driver's executable cannot be detected on the device: Secure Access Packet Filter or NetMotion Packet Filter (nmfilter.sys)
Secure Access failed to be repaired, or the expected version isn't installed

Issue

Resolution

Repair

One of the following services isn't running:

Secure Access Client or Mobility XG Client (messerv.exe)

The RAR component restarts the service.

A device restart is required. The Secure Endpoint Agent doesn't force the device to restart, so a status of Not Compliant continues to show in the Application Resilience reports until the device user performs a restart. You can review the report's Status details to determine if a restart is required.

One of the following services isn't installed and the service's executable can be detected on the device:

Secure Access Client or Mobility XG Client (messerv.exe)

The RAR component reinstalls the missing service.

One of the following drivers isn't running:

Secure Access Packet Filter or NetMotion Packet Filter (nmfilter.sys)

The RAR component restarts the driver.

One of the following drivers isn't installed and the driver's executable can be detected on the device:

Secure Access Packet Filter or NetMotion Packet Filter (nmfilter.sys)

The RAR component reinstalls the missing driver.

Reinstall

Downgrades are not supported. If the version installed on a device is higher than the expected version, no action is taken.

One of the following services isn't installed and the service's executable cannot be detected on the device:

Secure Access Client or Mobility XG Client (messerv.exe)

The RAR component downloads and installs the configured version of the application.

A device restart is required after the application is installed. The Secure Endpoint Agent doesn't force the device to restart, so a status of Not Compliant continues to show in the Application Resilience reports until the device user performs a restart. You can review the report's Status details to determine if a restart is required.

One of the following drivers isn't installed and the driver's executable cannot be detected on the device:

Secure Access Packet Filter or NetMotion Packet Filter (nmfilter.sys)

Secure Access failed to be repaired, or the expected version isn't installed

Absolute Secure Access may require multiple restarts for both Report and repair, and Report, repair, and reinstall. The Secure Endpoint Agent doesn't force the device to restart, so a status of Not Compliant may continue to show in the Application Resilience reports. To complete the repair or reinstall process, have the device user restart the device twice.

Preparing the installers

You can add a 32-bit installer, a 64-bit installer, or both. The installers:

must be MSI files
can have any file name

Pre-caching installers

The RAR component looks for the following files names when checking pre-cached installers:

Component	File name
Installers	NetMotion.msi

Configuring Application Resilience policies

Before you activate an Application Resilience policy, you need to configure the policy. You need to configure the application version in addition to the settings in Configuring Application Resilience policies.

To configure the application version:

Under Application version, select 12.* or higher from the drop-down.
Under Absolute Secure Access (formerly NetMotion Mobility) version, enter the version of Secure Access you expect to be running on your devices.
- The target version must be a sequence of digits separated by a period.
- You can use wildcard "*" characters after the major version number, for example, 12.* or 12.70.*.
Make sure the version you are entering is consistent with version 12.x or higher.

If you selected the Report, repair, and reinstall option, you also need to configure this setting in addition to the settings in Configuring Application Resilience policies.

To configure the Secure Access specific setting:

Under Absolute Secure Access (formerly NetMotion Mobility) Server Address, do one of the following to specify the configuration options to use during reinstallation of the Absolute Secure Access client:
- If you want reinstallations to follow the same configuration specified on the Absolute Secure Access server, select Enter the server address of the Absolute Secure Access server and enter the VPN server address provided by Absolute in the following format: 255.255.255.255.
- If you want to use custom configurations contained in an information (INF) file, select Upload the INF file, click Upload File, and select the INF file that contains your customizations. For information about structuring and customizing the INF file, see the Absolute Secure Access help.
[Optional] To only reinstall the application if it's missing, select the checkbox next to Do not reinstall or upgrade if the app is already installed. When this option is selected, the application is not reinstalled when either of the following conditions apply:
- The application version is lower than the expected version.
- The application can't be repaired.
[Optional] Under Additional installation commands, enter the applicable installation parameters to configure any settings not covered by the policy configuration.
- This field accepts properties supported by Windows Installer in the format [Property]=[Value]. For example, for a silent installation without any user interaction or device restart, enter REBOOT=ReallySuppress. See Microsoft's Property Reference for the list of supported properties.
- This field also accepts Absolute Secure Access installation properties in the format [Property]=[Value]. See the Absolute Secure Access help for more information on the available properties.
- This field does not accept Microsoft Standard Installer (msiexec.exe) command-line parameters.
- If you added the Absolute Secure Access MSI file to the policy, the file is automatically included in the preconfigured installation parameters and does not need to be added in this field.