Experience Windows Server Management with Workspace ONE UEM¶

This guide demonstrates five business outcomes of managing Windows Server with Workspace ONE UEM in Omnissa TestDrive: automated onboarding, provable security, controlled patching, safer remote access, and unified visibility and remediation.

Before You Begin¶

You need:

An active TestDrive account.
Access to the Windows Server demo machine TD-WINSRV01 in Horizon.
The Tenant Administrator role in the Workspace ONE UEM console.

Before the session, confirm the current demo tile and pool names, the server Organization Group (OG), and the names of the pre-staged profiles, baseline, app, Sensor, and Script.

Prepare the Demo¶

Sign in to TestDrive and launch the Windows Server demo machine TD-WINSRV01.
Wait for the desktop to load and for enrollment to complete. First enrollment can take up to five minutes.
In a second browser tab, open Workspace ONE UEM and go to Devices > List View.
Filter by the confirmed Windows Server OG and locate the demo server by hostname. Record the hostname for the walkthrough.

Demo Machine Is a Disposable Horizon Instant Clone

The demo environment is intended to use a disposable Horizon instant clone. Confirm its current reset and cleanup behavior before presenting; do not rely on configuration persisting between sessions.

1. Automate Server Onboarding¶

Business value: Reduce manual provisioning steps and human error by enrolling new servers into management as part of the configured build process.

Show the Windows Server desktop and explain that this demo server was provisioned for the session.
In Devices > List View, show the server record in the dedicated Server OG.
Open the device’s Details View > Summary and show the OS version, enrollment status, and last-seen time.
Point out the service-account identity used for enrollment, if configured in this tenant.

Talking point: In the configured demo, enrollment is automated rather than initiated by an end user. Confirm the enrollment flow and identity for the current server image before the session.

2. Enforce and Demonstrate Security Compliance¶

Business value: Apply server security settings consistently and give administrators a central place to review policy assignment and device status.

Go to Resources > Profiles & Baselines > Baselines and open the pre-staged Windows Server Security Baseline. Do not edit or delete shared sample content.
Show the selected template and server version, then show its assignment to the Windows Server Smart Group.
Return to the server’s Details View > Baselines and show the reported status.
Open the pre-staged Windows Server ADMX profile and review its payloads. Confirm the profile contents and suitability for this server version before the demo.

Talking point: Baselines and ADMX profiles provide complementary policy controls. The draft configuration specifies that Baselines take precedence over ADMX settings and that the newest Baseline wins when Baselines conflict; verify these behaviors against the current configuration before presenting them.

3. Control Application and Patch Changes¶

Business value: Align routine server changes with change-control processes while retaining a path to target an individual urgent patch.

Go to Resources > Apps > Native and open the pre-staged server application. Confirm its name and supported server model in the tenant.
Show its Phased Deployment assignment, including the test and production phases.
Point out whether progression is manual and explain how an administrator can align the next phase with an approved maintenance window.
Show the application on the demo server only if it is already installed and the state is expected.
Open the Windows patch-management area using the confirmed console path. Select a specific patch and show its assignment to the Server Smart Group. Walk through the flow without deploying the patch.

Talking point: Phased assignments support controlled rollout. A targeted patch assignment can provide a more focused response than waiting for a broader update cycle; do not promise a deployment time or outcome that has not been validated.

4. Use Assist for Secure Remote Support¶

Business value: Provide remote support through Workspace ONE Assist and reduce reliance on exposing Remote Desktop Protocol (RDP) to the internet.

In the server’s Details View, select Remote Management (Assist).
If Assist is available and authorized, start a session and show the remote view, file manager, or command line.
End the session.

Talking point: The draft describes Assist connectivity over TCP 443 and as included with the Server SKU. Confirm the tenant’s licensing, network configuration, and Assist readiness before making those claims. Do not change RDP or firewall settings during this demo.

5. See and Remediate Server Issues From One Console¶

Business value: Give IT a shared view of server inventory and state, with tools to investigate and address issues without starting an interactive server session for every task.

In Details View, open Roles and Features and review the installed server roles. This view is read-only.
Open a pre-staged Sensor, such as disk space or service status, and show its reported value on the device.
Open a pre-staged Script and review its PowerShell content before running it.
Run the Script against the demo server only if it has been confirmed as safe for this environment. Otherwise, review the script without executing it.
Show the result in the device’s script execution history.

Talking point: Workspace ONE UEM can bring server inventory, device state, and management actions into the same console used for endpoints. Confirm any server-specific Omnissa Intelligence dashboards or automation before demonstrating them.

Wrap-Up¶

Business outcome	What to remember
Automated onboarding	New servers can enroll through the configured provisioning workflow.
Provable security	Administrators can review policy assignment and reported device status in UEM.
Controlled changes	Phased application rollout supports change control, with a separate targeted patch workflow.
Safer remote support	Assist can provide a remote support path without requiring an internet-exposed RDP connection.
Unified operations	Inventory, device state, Sensors, and Scripts are available from the UEM console.

Demo Cautions¶

Do not edit, delete, or activate shared sample content.
Do not deploy patches during the demo.
Do not run a Script until its effects have been reviewed and confirmed safe for the demo server.
Do not enable ADMX settings that disable RDS on the Horizon-hosted server.
Allow time for first enrollment and confirm the demo server is visible in UEM before the session.
Vulnerability Defense is Limited Availability in release 2604. Mention it only as a limited-availability capability, not as a live demo feature.