Deploy IBM Access Client Solutions via PDQ Deploy

Right now I have a 3-step deployment:

1. Install
2. Add ACS shortcut
3. Add Session Mgr shortcut

Installation is run as a command line.

cscript.exe //b "\\Server\IBMiAccess_v1r1\Windows_Application\install_acs_64_allusers.js" /Q

I also have that file in the Files field in the Detail tab, and Run As is set to "Logged on User." Please note that this won't work unless you've already gone through the steps to customize the installation with the /adminconfig switch. This only has to be done once, and it's well-documented by IBM.

Once that step is complete, the program will be installed. The last two steps are just for making shortcuts, which you might not have to do if you set it up with /adminconfig. I wanted to have control over where I put the shortcuts (Public desktop vs user's desktop) and so that I had some indicator that the program installed. Being a javascript rather than an actual installer, the program doesn't show up in "Programs and Features," so it's sometimes hard to tell if it's installed on a PC or if your deployment was even successful. The script puts the files in the following folder:

C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\

So my shortcut for "Access Client Solutions" points to:

C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\acslaunch_win-64.exe

And my shortcut for "ACS Session Manager" points to:

C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\acslaunch_win-64.exe /plugin=sm

After that, you'll still need to configure each machine with new sessions, as they changed from .WS files to .HOD. The new ACS program will still open .WS files, but won't save changes to them without making you save as .HOD. And to make matters worse, if you made shortcuts using the old Session Manager (Start or Configure Sessions), those shortcuts won't work because they're technically not pointing to .WS files directly, but pointing to the old PCSWS.exe and passing the .WS file as an argument. I haven't found an easy way around this yet.

I was able to get this to work after adding a sleep of 60 seconds. PDQ Deploy was deleting the installation files before the IBM vbs scripts finished copying all of the files.

1. Customize installation properties using Windows_Application\install_acs_64.js /AdminConfig
2. Install the application on a test computer to create shortcuts needed for the PDQ Deploy Package. Use the command: install_acs_64_allusers.js /Q
3. Create install.bat in the Client Access Solutions installation root folder

Install.bat contains: cscript.exe //b .\Windows_Application\install_acs_64_allusers.js /Q

4. Create PDQ Deploy Package

Steps:

1 - Install Java Runtime Environment 64-bit latest version

2 - Install Client Access Solutions Client with the following options:

Install File: Client\install.bat

Include Entire Directory: True

Options: Deploy User (use package setting)

3 - Sleep for 60 seconds

4 - Create Create Shortcut for Access Client Solutions by copying the shortcut file created in step 2 to C:\Users\Public\Desktop

5 - Create Shortcut for ACS Session Mgr by copying the shortcut file created in step 2 to C:\Users\Public\Desktop

I'm running into the same issues with this program. I've only run it on one user successfully, and it was via the command line, and without the /Q switch. I can't replicate it with anyone else. Most of the time, my test users just get script errors, or their PCs open up the .js file for editing, rather than executing the script.

Also, I ran it as the logged on user, not as Deploy user. I'm curious to know what user mode you're set to.

Have you tried running the installer with the /adminconfig switch and going through the steps to customize the installation? According to IBM's Bob Seemann in his article, the EULA gets accepted silently when the /adminconfig part is set up and /q is used at installation.

I hope someone comes up with a solution for this, I don't want to have to manually do this on our 350+ PCs!

Update: I've found a way to run IBM's script for ACS by using cscript in the command line, as mentioned by Nate Blevins in another PDQ thread about Trend Micro. I'm still working out the kinks, but deploying the script in that way has been the most effective solution I have come across.

Can you give any details on what you did for this? I need to do this for a few hundred machines soon, so any help would be greatly appreciated.

This sounds great, thank you very much. This is my first time using PDQ, so this will be very helpful.

I pre-built .hod files for the 6 connections we need. I'll add a step to copy those from the server to "%userprofile%\Documents\IBM\iAccessClient\Emulator\" so they should just show up for people. I'm sure some folks will need to customize a bit, but our service desk can help with those special cases if necessary.

I have a need to do just what is described above. Did either of you get this to deploy successfully and if you did can you share the package?

Jack, here's a paste of my deployment package in its current state. We still haven't pushed it to all users, but it has been tested successfully on a handful of Windows 10 and Windows 7 PCs. It includes steps to migrate existing sessions (named Session A.ws and Session B.ws) but those sections can be edited or disabled to suit your needs. Also, you might need to still configure some things on each client PC. But it should do the majority of the work for you.

https://pastebin.com/bezB87TS

I'd be interested to hear how it works in your environment.

Nathan,

Thank you so much! I've taken a quick look and I see I will have to adjust some of my file locations and I can begin testing. I will let you know how it goes.

Jack

For some reason the command will only work when I set it to run as "Logged on User", even when the default deploy credentials has full access to the repository share. Does anyone know why this is?

Also the /Q switch does not appear to work, still seeing UI during install.

Using the same command recommended above:

cscript.exe //b "\\server\share\Repository\IBM\IBM i ACS\Windows_Application\install_acs_64_allusers.js" /Q

Anon4343 - I know this is two years old - but I'm having massive issue get this to install. I followed you guide and it just copies the folder down but does not run.

David Anderson

Maybe try increasing the sleep timer. Watch the processes on the computer to make sure that the script is actually running. Our computers have the Java RE installed on them. That might be a prerequisite.

Good afternoon, I've been working on this for the last few days with the steps above using the Sleep command and calling a bat file to run the JS file. I'm noticing that the js doesn't get called in my install step. The install_acs_log doesn't even show the attempt to update ACS doesn't get started. I tried adding the Sleep command before the Install step as it would move through the Install step so quickly as it didn't have a care in the world the js needed to be called. Any help is appreciated.

Deploy Package Steps:

Step 1: Copy files

Step 2: Sleep

Step 3: Install "Calls Install.bat to run JS locally on the machine (cscript.exe //b "C:\Users\Public\IBM\ClientSolutions\Windows_Application\install_acs_64_allusers.js" /Q)"

Step 4: Sleep

Since we're setup such that the jar install occurs when the first user launches the app, our PDQ deployment for IBM i ACS is just two simple copy steps (aside from UI-related stuff like accepting EULA and allowing the app through Windows firewall).

Been working perfectly for us since 2019.

So you're not running the JS script after copying files? I'm not sure this would benefit our environment as we try not to have users update their own ACS applications.

Jason, any chance on seeing the rest of those steps?  I'm drawing a blank on EULA and Firewall

Sure thing. Keep in mind, there are several ACS deployment methods per IBM's documentation. I don't remember all the details, but we chose either the "Local and User Customized" or "Local and Admin Customized" options (details here).

I believe the install method is determined by the AcsConfig.properties file. Here's what ours looks like:

For step one, we copy the IBM folder to C:\Users\Public on the client machine. Under IBM is the ClientSolutions folder, then everything else is under that, including the modified AcsConfig.properties file.

For step two, we copy these shortcuts to C:\Users\Public\Desktop:

Access Client Solutions points to:

C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\acslaunch_win-64.exe

ACS Session Mgr points to:

C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\acslaunch_win-64.exe /plugin=sm

WEST03 is just a pre-built .HOD session file, which I manually staged in the IBM folder before copying it over. This is specific to our environment.

C:\Users\Public\IBM\ClientSolutions\Start_Programs\Windows_x86-64\acslaunch_win-64.exe C:\Users\Public\IBM\ClientSolutions\Emulator\WEST03.hod

For step 3, I used Procmon or some other monitoring tool to figure out how to accept the EULA ahead of time. Turns out it's a reg key:

reg add "HKLM\SOFTWARE\JavaSoft\Prefs\com\ibm\iaccess\base" /v eula_g_accepted /t REG_SZ /d 1 /f

For step 4, "Allow IBM i ACS Windows Firewall" is a PowerShell command that suppresses the one-time prompt to allow the app through the domain firewall. Up to you if you want to include it.

New-NetFirewallRule -DisplayName "Launch of IBM i Access Client Solutions" -Profile Domain -Direction Inbound -Action Allow -Program "C:\users\public\ibm\clientsolutions\start_programs\windows_x86-64\acslaunch_win-64.exe"

For step 5, "Java 8 Allow" just links to another package that suppresses a similar prompt to allow Java 8 through the domain firewall. I've yet to find some kind of global Java PATH variable to java.exe, so you have to update the command for every new version of Java. Honestly, I stopped updating the path and haven't had any complaints, so it may not be worth including this in your package:

New-NetFirewallRule -DisplayName "Java(TM) Platform SE Binary" -Profile Domain -Direction Inbound -Action Allow -Program "C:\Program Files\Java\jre1.8.0_301\bin\java.exe"

Screenshots:

Jason, I can't thank you enough for posting that!   YOU GET 4 GOLD STARS TODAY!!!

It's interesting because they have several different JS files for me to setup the install, but your way with the exe is also an option.  I have it right now that someone creates a package for a department and then zips all the contents.  PDQ deploy copy's it locally to the machine, extract it, set the eula, set the firewall, install using the JS name, then delete the file and the zip file.  Seems to be working well.  

Again, THANK YOU!

Happy to help!