Prerequisites for Application Management in Configuration Manager

IIS is required on the site system servers that run the Application Catalog website point, the Application Catalog web service point, the management point, and distribution point.

For more information about this requirement, see the Prerequisites for Site System Roles section in the Supported Configurations for Configuration Manager topic.

For mobile devices that are enrolled by Configuration Manager:

• If you use Active Directory Certificate Services to code sign applications for mobile device applications, do not use a version 3 certificate template.

When you code sign applications in order to deploy them to mobile devices, do not use a certificate that was generated by using a version 3 template (Windows Server 2008, Enterprise Edition). This certificate template creates a certificate that is not compatible with Configuration Manager applications for mobile devices.

Clients must be configured to audit logon events if you want to automatically create user device affinities.

Configuration Manager reads the following two settings from the local security policy on client computers to determine automatic user device affinities:

• Audit account logon events

• Audit logon events

To automatically create relationships between users and devices, make sure that these two settings are enabled on client computers. You can use Windows Group Policy to configure these settings.

Management point

Clients will contact a management point to download client policy, to locate content, and to connect to the Application Catalog.

Client settings

Many client settings control how applications are installed on the client and the end user experience on the client. These client settings include the following:

• Computer Agent

• Computer Restart

• Software Deployment

• User and Device Affinity

For more information about these client settings, see About Client Settings in Configuration Manager.

For information about how to configure client settings, see How to Configure Client Settings in Configuration Manager.

App-V 4.6 SP1 or later client to run virtual applications

To be able to successfully create virtual applications in Configuration Manager, client computers must have the App-V 4.6 SP1 or later client installed.

You must also update the App-V client with the hotfix described in the Knowledge Base article 2645225 before you can successfully deploy virtual applications.

Application Catalog website point

The Application Catalog website point is a site system role that provides users with a list of available software.

For information about how to configure this site system role, see Configuring the Application Catalog and Software Center in Configuration Manager.

Security permissions for application management

You must have the following security permissions to manage applications.

To create, modify and retire applications:

• Alerts – Create, Delete, Modify, Modify Report, Read, Run Report.

• Application – Approve, Create, Delete, Modify, Modify Folder, Move Object, Read, Run Report, Set Security Scope.

• Boundaries – Read.

• Boundary Group – Read.

• Collection – Modify Client Status Alert, Read, Read Resource.

• Distribution Point – Copy to Distribution Point, Read.

• Distribution Point Group – Copy to Distribution Point, Read.

• Global Condition – Read.

• Package – Create, Delete, Modify, Modify Folder, Modify Report, Move Object, Read, Run Report, Set Security Scope.

• Site – Read.

The Application Author security role includes the preceding listed permissions that are required to create, modify and retire applications in Configuration Manager.

To deploy applications:

• Alerts – Create, Delete, Modify, Modify Report, Read, Run Report.

• Application – Read, Run Report.

• Boundaries – Read.

• Boundary Group – Read.

• Client Agent Setting – Read.

• Collection – Deploy Applications, Deploy Client Settings, Deploy Packages, Modify Client Status Alert, Read, Read Resource.

• Deployment Templates – Read.

• Distribution Point – Read.

• Distribution Point Group – Read, Create Association to Collection.

• Global Condition – Read.

• Mobile Device Enrollment Profiles – Read.

• Package – Read, Run Report.

• Query – Read.

• Site – Read.

• Status Messages – Read.

• User Device Affinities – Read, Run Report.

The Application Deployment Manager security role includes the preceding listed permissions that are required to deploy applications in Configuration Manager.

The Application Administrator security role contains all of the permissions from both the Application Author and the Application Deployment Manager security roles.

For more information, see Configure Role-Based Administration in the Configuring Security for Configuration Manager topic.