Skip to content

Home > Demo Guides > Workspace ONE

DRAFT — NOT FOR DISTRIBUTION

Managing Windows Servers with Workspace ONE UEM

This demo shows how Workspace ONE UEM solves five common Windows Server challenges from one console: slow server setup, security that's hard to prove, risky updates, remote access that exposes servers, and too many tools. It ends with an introduction to Workspace ONE Vulnerability Defense.

Before You Begin

You need:

  • An active TestDrive account.
  • Access to the Windows Server demo machine TD-WINSRV01 in Horizon.
  • The Tenant Administrator role in the Workspace ONE UEM console.

Before the session, confirm the demo tile and pool names, the server group (Organization Group) name, and the names of the pre-staged security settings, app, health check (Sensor), and fix-it script.

Prepare the Demo

  1. Sign in to TestDrive and launch the Windows Server demo machine TD-WINSRV01.
  2. Wait for the desktop to load and for enrollment to complete. First enrollment can take up to five minutes.
  3. In a second browser tab, open Workspace ONE UEM and go to Devices > List View.
  4. Filter by the server Organization Group and find the demo server by hostname. Note the hostname for the walkthrough.

The Demo Server Resets

The demo server is a disposable copy that's rebuilt between sessions. Don't expect changes to stick around, and confirm its reset behavior before presenting.

1. New Servers Manage Themselves From Day One

Customer challenge: Setting up a server by hand is slow, and every manual step is a chance to miss something. A server that's missed is a server that's not protected.

How Workspace ONE helps: Like a new employee whose badge and laptop are ready on day one, a new server checks in and gets its policies the moment it's built.

Demo steps:

  1. Show the Windows Server desktop and explain that this server was just built for the session.
  2. In Devices > List View, show that it already appears in the server group.
  3. Open Details View > Summary and point to the enrollment status and last check-in time. No one touched it.

Key points:

  • No one had to touch this server to get it managed.
  • Every new server gets the same policies automatically, so none fall through the cracks.
  • Outcome: Faster setup, fewer mistakes, less risk from day one.

Presenter note: Confirm the enrollment flow and the account used for enrollment on the current server image before the session.

2. Prove Your Servers Are Secure

Customer challenge: Saying servers are secure is easy. Proving it to an auditor or a board is hard, and it usually means spreadsheets and screenshots.

How Workspace ONE helps: A security baseline works like an inspector's checklist: it's applied to every server, and Workspace ONE shows the result for each one.

Demo steps:

  1. Go to Resources > Profiles & Baselines > Baselines and open the pre-staged Windows Server Security Baseline. This is the security checklist, built from industry-recommended settings.
  2. Show which servers it applies to.
  3. Open the server's Details View > Baselines to show the server's checklist result.
  4. Optionally, open the pre-staged Windows Server ADMX profile to show how extra settings fine-tune the checklist.

Key points:

  • The checklist is applied the same way to every server.
  • The proof is one click away, ready for any auditor.
  • Outcome: Move from "trust us" to "here's the proof."

Presenter note: Don't edit or delete shared sample content. Check how the baseline and ADMX settings interact in the current configuration before answering questions about conflicts.

3. Make Updates Safe, and Fast When It Matters

Customer challenge: Servers run the business. Teams hesitate to update them because a bad update can take things down, so updates get delayed and risk piles up.

How Workspace ONE helps: Phased rollouts update a few test servers first, and then the rest on the customer's schedule. When one fix can't wait, it can be sent to just the servers that need it.

Demo steps:

  1. Go to Resources > Apps > Native and open the pre-staged server application.
  2. Show its phased rollout: test servers first, then production.
  3. Explain that the team decides when the next phase starts, to match their maintenance window.
  4. Open the Windows update area, select one specific update, and show how it's aimed at just the server group. Don't deploy it.

Key points:

  • Test first, and then roll out with confidence.
  • Updates happen on the customer's schedule, not at random.
  • When something is urgent, fix just that, on just the servers that need it.
  • Outcome: Fewer outages from updates and less waiting on critical fixes.

Presenter note: Confirm the app name and the Windows update console path in the tenant. Don't promise a deployment time or outcome that hasn't been tested.

4. Remote Support Without Leaving the Door Open

Customer challenge: Many teams leave Remote Desktop open to the internet so they can fix servers from anywhere. That's like leaving the front door unlocked for the repair person, and attackers know to check that door.

How Workspace ONE helps: With Workspace ONE Assist, support connects through the management console instead, so Remote Desktop doesn't have to stay exposed.

Demo steps:

  1. In the server's Details View, select Remote Management (Assist).
  2. If Assist is available, start a session and show the screen view, file access, or command line.
  3. End the session.

Key points:

  • Support can see, fix, and transfer files from the same console.
  • There's no need to expose Remote Desktop to the internet.
  • Outcome: A smaller target for attackers, with no slowdown for support.

Presenter note: Confirm the tenant's licensing, network requirements, and Assist readiness before making claims about either. Don't change Remote Desktop or firewall settings during the demo.

5. One Place to See and Fix Everything

Customer challenge: Most teams manage servers with one tool, laptops with another, and scripts somewhere else. Every extra tool is another login, another handoff, and another place for problems to hide.

How Workspace ONE helps: Like a car's dashboard, one console shows server roles, health checks, and fixes alongside every laptop and desktop.

Demo steps:

  1. In Details View, open Roles and Features to show what the server is doing. This view is read-only.
  2. Open a pre-staged health check (Sensor), such as free disk space, and show its value.
  3. Open a pre-staged fix-it script (Script) and walk through what it does.
  4. Run the script only if it's confirmed safe. Otherwise, explain what it would do.
  5. Show the result in the script history.

Key points:

  • See it, fix it, and confirm it, without logging in to each server.
  • Servers and laptops are managed from the same place.
  • Outcome: Fewer tools, fewer handoffs, faster answers.

Presenter note: Confirm any server-specific Omnissa Intelligence dashboards or automation before demonstrating them.

6. What's Next: Vulnerability Defense

Customer challenge: Security teams find a weakness and open a ticket. IT has to figure out which servers are affected and how to fix them. Weeks can pass between finding and fixing.

How Workspace ONE helps: Workspace ONE Vulnerability Defense finds known weaknesses on Windows desktops and servers. It ranks them by how likely attackers are to actually use them, fixes them from the same console, and confirms when they're gone. Think of a smoke detector that also turns on the sprinkler in the right room and confirms the fire is out.

Key points:

  • Find it, rank it, fix it, and prove it's fixed, all in one place.
  • Focus on what attackers are actually exploiting, not just what sounds scary.
  • No exports, no tickets, no second tool.

Introduction Only

TestDrive isn't yet integrated with CrowdStrike, so there's no live data to demo. Don't open Vulnerability Defense in the console. Customers need UEM 2607 or later, the Vulnerability Defense add-on (included in Workspace ONE Platinum), and CrowdStrike Falcon Exposure Management, licensed separately. For details, see the product documentation.

Wrap-Up

Customer challenge Workspace ONE outcome
Slow, error-prone server setup New servers get managed automatically from day one.
Security you can't prove A security checklist on every server, with proof on demand.
Risky updates Test first, roll out on your schedule, and fix urgent issues precisely.
Remote access that's a security hole Support through the console without leaving Remote Desktop open.
Too many tools One place to see and fix servers and endpoints.
Slow path from finding to fixing weaknesses (what's next) Vulnerability Defense finds, ranks, fixes, and confirms in one console.

Demo Cautions

  • Don't edit, delete, or activate shared sample content.
  • Don't deploy updates during the demo.
  • Don't run a script until its effects have been reviewed and confirmed safe for the demo server.
  • Don't turn on ADMX settings that disable Remote Desktop Services on the Horizon-hosted server.
  • Allow time for first enrollment, and confirm that the demo server appears in UEM before the session.
  • Introduce Vulnerability Defense verbally only. The TestDrive tenant doesn't currently have a CrowdStrike integration.