Terminal kitting system and program

Abstract

This system provides a terminal provisioning system that simplifies terminal management, reduces terminal provisioning time, and alleviates the burden on system administrators in a hybrid AD configuration where terminals join domains to both the internal network and the internet. [Solution] In the terminal provisioning system 10, automatic provisioning data, including a device name change script, is stored in the automatic provisioning data storage means 32 in the cloud environment. When the user terminal 80 is powered on, the automatic provisioning data is acquired and the terminal provisioning process is executed. The device name change script is registered with the task scheduler 83. After the terminal provisioning process is completed, the device name change script is executed to change the temporary device name stored in the AD server 60 in the on-premises environment to the device name for official registration.

Description

Technical Field

[0001] The present invention relates to a terminal kitting system and a program configured by a computer that performs kitting of user terminals, and can be used, for example, when completing the terminal life cycle only by wireless connection for terminal devices used in business in a company.

Background Art

[0002] Devices such as personal computers (hereinafter referred to as "PCs") used for business in a company need to be grasped by the IT department for their actual operation status, so it is common to specify the device name (also referred to as the host name, etc.) based on a certain naming rule. Also, the device name of a PC device is used as a name for uniquely identifying the device in an agent-type asset management application (for example, Microsoft Configuration Manager, Lanscope, etc.), and it is important to assign a device name based on a certain naming rule in the management of PC devices.

[0003] When managing Windows (registered trademark) PC devices in a large company, it is common to configure them to participate in the Active Directory (hereinafter sometimes abbreviated as "AD") server and connect to the intranet, which is the corporate internal network. Also, in recent years, a hybrid AD configuration (Entra Hybrid participation configuration) that participates in both the Microsoft device management server (Microsoft Entra ID) and both the intranet and internet domains has become common. This hybrid AD configuration is a configuration for managing user and terminal information in both the on-premises AD environment and the cloud AD environment, which are widely used by many companies.

[0004] Furthermore, deploying PC devices to employees in a work-ready state in organizations with many employees requires significant effort and expense. The aforementioned domain joining process was typically performed by the IT department beforehand, involving wired connection of PC devices to an on-premises Active Directory server for domain joining. Methods to automate this process include master image USB booting using Microsoft solutions and OS provisioning using Configuration Manager task sequences.

[0005] Specifically, as shown in Figure 9, many terminals (before use by users, but referred to here as user terminals) 100A, 100B, 100C, ... which will be used by users within the company, are sent from the terminal manufacturer's factory to the terminal vendor, and then shipped from the terminal vendor to the company's kitting center. At the kitting center, system administrators belonging to the company's IT department insert USB memory sticks 110 containing a master image created by the system administrator into each of the user terminals 100A, 100B, 100C, ... received from the terminal vendor, and manually perform the kitting work one by one using USB booting, thereby mass-producing user terminals 100. In this process, the system administrator inserts a wired LAN cable into each user terminal 100A, 100B, 100C, ... to connect to the company's internal network, the company intranet 120. The system administrator then accesses the AD server 130 connected to the company intranet 120 to join the corporate domain and registers the device names of each user terminal 100A, 100B, 100C, ... with the AD server 130. After the kitting process is complete, each user terminal 100A, 100B, 100C, ... is transported from the company's kitting center to each of the company's business locations A, B, C, ... by means of transportation. At each business location A, B, C, ..., each user operates their kitted user terminal 100A, 100B, 100C, ... to connect to the company intranet 120 via a wired connection, access the AD server 130, and perform their work. Therefore, traditionally, the procedure for joining the corporate domain was performed by the system administrator, not by each user.

[0006] On the other hand, in recent years, with the development of the internet, the limitations of perimeter-based security have been pointed out, and zero-trust security has become widespread. In this security model, solutions such as Mobile Device Management (MDM), which manage devices that only join an internet domain (Entra-only), have also become popular. However, Microsoft's MDM service, Intune, has previously struggled to provide the same level of device control as on-premises Active Directory servers, which has hindered its widespread adoption. Recently, however, Intune's functionality has been enhanced, raising its control level, and its use in PC device management is increasing. In this environment, using Windows Autopilot, a solution for automatically provisioning PC devices, makes it possible to provide devices using only wireless connections, without the need for wired connections.

[0007] Furthermore, known systems for performing terminal provisioning include provisioning systems that can reduce the costs required for introducing new terminals while avoiding security risks (see Patent Document 1), and computer provisioning problem countermeasure management systems that can efficiently manage computer provisioning (see Patent Document 2). [Prior art documents] [Patent Documents]

[0008] [Patent Document 1] Japanese Patent Publication No. 7221372 [Patent Document 2] Japanese Patent Publication No. 2014-41536 [Overview of the project] [Problems that the invention aims to solve]

[0009] To achieve the aforementioned hybrid AD configuration (Entra Hybrid participation configuration) that joins both intranet and internet domains, the conventional approach was to first join the domain to the on-premises Active Directory server on the intranet, then apply group policies, and finally register device information with the device management server (Microsoft Entra ID) on the internet to join the domain. This conventional process involves terminal provisioning as shown in Figure 9, which places a heavy workload on system administrators in the company's IT department. Furthermore, each terminal used by a user (100A, 100B, 100C, ...) is transported via the company's provisioning center to each business location A, B, C, ..., resulting in a delay before each user can begin their work.

[0010] On the other hand, as mentioned above, by using Windows Autopilot, a feature provided as part of Microsoft's MDM service Intune, it is possible to perform terminal provisioning of PC devices using only a wireless connection, without the need for a wired connection. Therefore, each user can perform terminal provisioning of the PC devices they will use at each business location A, B, C, etc., which reduces the workload of system administrators and shortens the time it takes for each user to start work. However, in order to implement a hybrid AD configuration (Entra Hybrid participation configuration) using Windows Autopilot, since terminal provisioning is performed from the factory default state by Windows Autopilot, it is necessary to register device information with a device management server on the internet (Microsoft Entra ID) and then join the domain to the on-premises Active Directory server on the intranet, which is the reverse of the conventional process.

[0011] However, terminal provisioning via wireless communication using Windows Autopilot presents the following challenges due to constraints imposed by the solution service specifications. Specifically, as mentioned above, the device names of PC devices used for business purposes in a company are generally specified based on naming conventions established by the company for convenience in terminal management. In contrast, terminal provisioning using Windows Autopilot only allows specifying the prefix string at the beginning of the device name (see Figure 5), and the part following the prefix can only be part of the serial number or a random number, which causes inconvenience in terminal management.

[0012] For example, consider a scenario where a user's PC device becomes network-isolated due to a virus infection or other reasons, and the user informs the system administrator by phone (verbally). In this case, the device name automatically generated by Intune does not follow the naming conventions established by the user (meaning the organization to which the user belongs, such as a company or public entity), but is a random string of numbers and letters. This makes it highly likely to lead to communication errors, such as the user misreading their device name (for example, misreading the letter O as the number zero) or the system administrator mishearing it.

[0013] Furthermore, if the same automatic generation of device names occurs when performing device provisioning with any MDM service that joins an internet domain, not just Microsoft's Intune, the device names will not be specified according to the naming conventions established by the user (the organization to which the user belongs, such as a company or public entity), and similar problems will arise.

[0014] Therefore, from a terminal management perspective, it is desirable to construct a terminal provisioning system that can assign device names based on naming conventions (referred to in this application as "user numbering conventions") established by the user (the organization to which the user belongs, such as a company or public organization), rather than by the provider of the MDM service, thereby simplifying terminal management. Furthermore, if such a terminal provisioning system can be constructed, it will be possible to shorten the time required for terminal provisioning and reduce the burden on system administrators when realizing a hybrid AD configuration that joins domains on both the intranet (the internal network of the organization to which the user of the terminal belongs, such as a company or public organization) and the internet.

[0015] The objective of the present invention is to provide a terminal provisioning system that can simplify terminal management, shorten terminal provisioning time, and reduce the burden on system administrators in a hybrid AD configuration in which terminals join domains to both the internal network and the internet. [Means for solving the problem]

[0016] The present invention is a terminal provisioning system comprising a computer that performs provisioning of user terminals, A device management cloud system located in a cloud environment connected to the user terminals to be kitted via the internet, It comprises a user terminal and an Active Directory server located in an on-premises environment, connected via an internal network. The device management cloud system is Automatic kitting data storage means that stores automatic kitting data for user terminals, including a device name change script for performing the process of changing the device name of a user terminal, in association with the serial number of the user terminal that has been registered in advance by the system administrator or their designated data entry agent, The system includes a device control means that automatically generates a temporary device name for a user terminal, consisting of a designated prefix section that has been previously entered by the system administrator or their designated input agent, and a subsequent section consisting of a random number or a part of a serial number. Active Directory Server is, The system includes an Active Directory data storage means that stores Active Directory data, including a temporary device name of a user terminal, received from a device management cloud system via the internet and an internal network connected thereto. The user terminal is, An automatic kitting data acquisition means that acquires automatic kitting data stored in an automatic kitting data storage means via the internet from a device management cloud system, An automatic kitting execution means executes terminal kitting processing, which includes the process of registering a device name change script in a task scheduler installed on the user terminal, using the automatic kitting data acquired by this automatic kitting data acquisition means. The system includes a task execution means that, after the completion of terminal provisioning by this automatic provisioning execution means, executes a device name change script to automatically generate a device name for official registration by changing the subsequent part of the temporary device name stored in the Active Directory data storage means to a number that increases or decreases regularly according to a predetermined user numbering rule. The device name change process performed by this task execution means is This process is characterized by the following steps: obtaining a device name from among the device names stored in the Active Directory data storage means that includes the last assigned number according to the user numbering rule in its suffix by querying the Active Directory server via the internal network; calculating a new assigned number by increasing or decreasing the obtained last assigned number according to the user numbering rule; automatically generating a device name for official registration that includes this new assigned number; and transmitting the generated device name for official registration to the Active Directory server via the internal network, thereby changing the temporary device name stored in the Active Directory data storage means to the device name for official registration.

[0017] Here, "internal network" refers to the internal network of an organization, such as a company, to which users who will be using the user terminals subject to the kitting process belong. This organization is not limited to companies, but can be for-profit or non-profit, for example, a company, a public organization or government agency, an educational institution, a hospital, etc. Therefore, the users are company employees, civil servants, teachers, medical professionals, etc.

[0018] Furthermore, "user numbering rules" do not refer to numbering rules determined by individual users, but rather to unique numbering rules determined by the company, public organization, or other group to which each user belongs. Therefore, in order to distinguish them from the naming rules used in the device management cloud system's process of generating temporary device names (general-purpose numbering rules applicable to any organization), we refer to them as "user numbering rules" in contrast to those used by the device management cloud system.

[0019] Furthermore, the "user numbering rule" may be a numbering system that increases by 1 to create consecutive numbers, or a numbering system that decreases by 1 to create consecutive numbers, or it may not be limited to consecutive numbers (increasing or decreasing by 1), but may be a numbering system that increases or decreases by 10, for example; in short, it should increase or decrease in a regular manner. Note that in the "device name change processing by task execution means," the term "last numbering value" is used instead of "maximum numbering value" to include cases where the number is decreasing.

[0020] In such a terminal kitting system of the present invention, in the automatic kitting data storage means of the device management cloud system, automatic kitting data of the user terminal including the device name change script is stored. When the power is turned on in the user terminal to be kitted, the automatic kitting data acquisition means acquires the automatic kitting data, and the automatic kitting execution means uses the automatic kitting data to execute the terminal kitting process. The device name change script is registered in the task scheduler provided in the user terminal. After the end of the terminal kitting process by the automatic kitting execution means, the task execution means executes the device name change script, and changes the subsequent part of the temporary device name stored in the active directory data storage means of the Active Directory (AD) server to a number that regularly increases or decreases according to a predetermined user numbering rule, thereby executing a device name change process for automatically generating the device name for this registration.

[0021] For this reason, the device name becomes easy for users and system administrators to recognize or easy to convey to others, so that terminal management can be facilitated. Also, unlike the conventional example shown in FIG. 9 described above, instead of the system administrator manually performing kitting for all user terminals 100A, 100B, 100C,... at the in-house kitting base, each user can automatically perform kitting of their own terminal at each in-house business base A, B, C,.... Therefore, it is possible to shorten the time for terminal kitting and reduce the burden on the system administrator. And since wireless terminal kitting is also possible, further shortening of the terminal kitting time can be achieved, and highly flexible terminal kitting independent of location can be realized, and the above object is achieved by these.

[0022] <Configuration for incrementing the subsequent part of the device name by 1 according to the user numbering rule>

[0023] Furthermore, in the terminal kitting system of the present invention described above, The task execution means is, The device name change process is configured to change the trailing part of the temporary device name to a sequential number that increases by 1 according to the user numbering rule. The last assigned number is the maximum assigned number, and a configuration can be adopted in which the next assigned number is the maximum assigned number plus 1.

[0024] By configuring the device names to increment by one according to a user numbering rule, the device names become simple and easy to understand, thus more reliably avoiding communication errors and other inconveniences by users and system administrators. Furthermore, since device names can be perceived as numerical values, the number of terminal devices can be determined by looking at the device name. In other words, the device name serves as a count of the number of terminal devices, making it much easier for system administrators to grasp the total number of terminal devices and manage increases and decreases.

[0025] <Configuration for querying a specific Active Directory server among multiple Active Directory servers>

[0026] Furthermore, in the terminal kitting system of the present invention described above, The system includes multiple Active Directory servers that synchronize Active Directory data stored in an Active Directory data storage means with each other. The task execution means is, It is desirable that the device name change process be configured to query a specific Active Directory server, specified by its server name, from among multiple Active Directory servers belonging to the same domain, via the internal network, for a device name whose suffix includes the last assigned number according to the user numbering rule.

[0027] In this configuration, where queries are made to a specific Active Directory server among multiple Active Directory servers, it becomes possible to prevent the inconvenience of conflicting reference data across multiple Active Directory servers when referencing a device name containing the last assigned number, resulting in user terminals with the same device name. In other words, when multiple Active Directory servers with the same domain that synchronize data are provided, LDAP (Lightweight Directory Access Protocol) access to the Active Directory server is usually done by specifying the domain. However, since it is not possible to control the timing of terminal provisioning processing using automatic provisioning data executed by the automatic provisioning execution means, when referencing a device name containing the last assigned number, if the normal access process to the Active Directory server (access process by specifying the domain) is performed, the reference data may conflict across multiple Active Directory servers due to the relationship between the timing of data synchronization and the timing of the reference, potentially resulting in user terminals with the same device name. Therefore, although access to the Active Directory server is usually done by specifying the domain (accessing any server among multiple Active Directory servers with the same domain), it is possible to prevent the aforementioned inconvenience from occurring by specifying the server name of a specific Active Directory server when accessing it.

[0028] <A configuration in which device names containing a pseudo-number in the suffix are prepared as device names for non-existent, pseudo-user terminals in the Active Directory data storage means.>

[0029] Furthermore, in the terminal kitting system of the present invention described above, It is desirable that the Active Directory data storage means of the Active Directory server be configured to store device names that include a pseudo number in the trailing part, which is used as a basis for assigning the initial numbering value according to the user numbering rule by the task execution means, as device names of pseudo user terminals that do not actually exist.

[0030] In this configuration, where the Active Directory data storage means is configured to store device names containing a pseudo-number in the suffix as device names for non-existent pseudo-user terminals, the number of conditional branches in the processing algorithm of the device name change script is reduced, the processing logic is simplified, and the processing time is shortened.

[0031] <Invention of a program>

[0032] Furthermore, the program of the present invention is intended to make a computer function as the terminal kitting system described above.

[0033] Furthermore, the above program or any part thereof can be recorded and stored or distributed on recording media such as magneto-optical disks (MO), compact discs (CD), digital versatile disks (DVD), flexible disks (FD), magnetic tape, read-only memory (ROM), electrically erasable and rewritable read-only memory (EEPROM), flash memory, random access memory (RAM), hard disk drives (HDD), solid state drives (SSD), and flash disks. It can also be transmitted using transmission media such as wired networks like local area networks (LAN), metropolitan area networks (MAN), wide area networks (WAN), the Internet, intranets, extranets, wireless communication networks, or combinations thereof, and can also be transmitted on carrier waves. Moreover, the above program may be part of another program, or may be recorded on a recording media together with a separate program. [Effects of the Invention]

[0034] As described above, according to the present invention, the device management cloud system acquires automatic provisioning data for user terminals, including a device name change script. After the terminal provisioning process is completed on the user terminal, the device name change script is executed to change the temporary device name stored in the Active Directory data storage means of the Active Directory server to the device name for official registration. This makes it possible to use a device name that is easy for users and system administrators to recognize, or a device name that is easy to communicate to others. This facilitates terminal management and eliminates the need for manual provisioning by system administrators, thus shortening terminal provisioning time and reducing the burden on system administrators. [Brief explanation of the drawing]

[0035] [Figure 1] Overall configuration diagram of a terminal kitting system according to one embodiment of the present invention. [Figure 2] A flowchart illustrating the processing flow (part 1) of the terminal kitting system according to the above embodiment. [Figure 3] A flowchart illustrating the processing flow (part 2) of the terminal kitting system according to the above embodiment. [Figure 4] A flowchart illustrating the processing flow (part 3) of the terminal kitting system according to the above embodiment. [Figure 5] A diagram illustrating the naming convention for device names in the above embodiment. [Figure 6] A diagram showing the configuration of the automatic kitting data storage means of the above embodiment. [Figure 7] A diagram illustrating the flow of provisional device names in the above embodiment. [Figure 8] A diagram illustrating the device name change process in the above embodiment. [Figure 9] A diagram illustrating the conventional terminal kitting process. [Modes for carrying out the invention]

[0036] One embodiment of the present invention will be described below with reference to the drawings. Figure 1 shows the overall configuration of the terminal kitting system 10 of this embodiment. Figures 2 to 4 show the processing flow by the terminal kitting system 10 in flowcharts. Figure 5 is an explanatory diagram of the device naming convention. Figure 6 shows the configuration of the automatic kitting data storage means 32. Furthermore, Figure 7 is an explanatory diagram of the provisional device name flow, and Figure 8 is an explanatory diagram of the device name change process.

[0037] <Overall configuration of terminal kitting system 10>

[0038] In Figure 1, the terminal kitting system 10 consists of various computer devices connected to the Internet 1 and / or the internal network, Intranet 2. While the internal network is described here as Intranet 2 within a company, it is not limited to a company and can be any internal network of an organization with multiple users, regardless of whether it is for-profit or non-profit. The Internet 1 and Intranet 2 are connected via a firewall 3.

[0039] Specifically, the terminal kitting system 10 includes a device management cloud system 20 located in a cloud environment connected to the Internet 1, and an Active Directory server (AD server) 60 located in an on-premises environment connected to an intranet 2, which is an internal network. In addition, an on-premises integration server 50 and a cloud outbound integration server 70 are connected to intranet 2 as computer equipment located in the on-premises environment. Furthermore, although not shown in the diagram, a proxy server (which can be considered a component of intranet 2) is also connected to intranet 2, and these also constitute the terminal kitting system 10.

[0040] The device management cloud system 20 is configured to include a device control server 30 and a device management server 40. Specifically, in this embodiment, for example, Microsoft's Intune is used as the device control server 30, and Microsoft's Entra ID is used as the device management server 40. Data transmission between the device control server 30 and the device management server 40 may be via the Internet 1, or via the internal network of the administrator of the device management cloud system 20. The device control server 30 and the device management server 40 may be configured on the same physical computer, in which case the transmission may be via the computer's internal bus.

[0041] The device control server 30 is comprised of one or more computers and includes a device control means 31, an automatic kitting data storage means 32 (Autopilot Record in this embodiment), a device control data storage means 33, and a program storage means 34. The automatic kitting data storage means 32 and the device control data storage means 33 are located in a tenant area allocated to an organization such as a company to which users operating user terminals 80 and system administrators operating administrator terminals 91 belong.

[0042] Here, the device control means 31 is implemented by a central processing unit (CPU) located inside the device control server 30, one or more programs that define the operating procedures of this CPU, and working memory such as main memory and cache memory. Details of this device control means 31 will be described later.

[0043] Furthermore, non-volatile memory such as hard disk drives (HDDs) and solid-state drives (SSDs) can be used as the storage means 32, 33, and 34. Details of these storage means 32, 33, and 34 will be described later.

[0044] The device management server 40 is configured to include a device management means 41 and a device management data storage means 42.

[0045] Here, the device management means 41 is implemented by a central processing unit (CPU) located inside the device management server 40, one or more programs that define the operating procedures of this CPU, and working memory such as main memory and cache memory. Details of this device management means 41 will be described later.

[0046] Furthermore, the device management data storage means 42 can be, for example, a non-volatile memory such as a hard disk drive (HDD) or a solid-state drive (SSD). Details of this device management data storage means 42 will be described later.

[0047] The on-premises integration server 50 (In this embodiment, Intune Connector) is composed of one or more computers and periodically checks whether new device management data (In this embodiment, Entra Device data) has been generated in the device management data storage means 42 of the device management server 40. If it has been generated, it retrieves the new device management data from the device management server 40 and sends it to the AD server 60. In this process, the query signal from the on-premises integration server 50 to the device management server 40 is sent via intranet 2, a proxy server (not shown), a firewall 3, and the internet 1, and the device management data is sent from the device management server 40 to the on-premises integration server 50 in the reverse order. The device management data is also sent from the on-premises integration server 50 to the AD server 60 via intranet 2.

[0048] Note that the dotted arrows in Figure 1 indicate the main data flow, but they do not represent the data transmission path itself; they merely connect the computer equipment that serves as the starting and ending point of data transmission.

[0049] The Active Directory server (AD server) 60 is comprised of one or more computers and includes Active Directory (AD) processing means 61 and Active Directory (AD) data storage means 62. This AD server 60 is a server that has Active Directory (AD) functionality (a function included in Windows Server) and is a domain controller that manages various resources such as personnel and device information owned by organizations such as companies to which users belong, within a domain.

[0050] Furthermore, this AD server 60 has multiple AD servers 60 in the same domain, and data is synchronized between these multiple AD servers 60 (for example, every 15 minutes). Note that when one AD server 60 is composed of multiple computers, each computer has a different function, but when it is stated above that there are multiple AD servers 60 in the same domain, it means that there are replicas (copies) of the server, which is a completely different meaning. Therefore, when one AD server 60 is composed of multiple computers, the replicas (copies) of AD server 60 will also be composed of multiple computers. The number of AD servers 60, including replicas (not the number of computers), can be two, three or more.

[0051] Furthermore, a specific AD server 60 among the multiple AD servers 60 in the same domain will be denoted with the code 60A and referred to as AD server 60A. This specific AD server 60A is the AD server 60 that receives a query for the device name, including the maximum assigned value (the last assigned value), when the user terminal 80 performs the device name change process (a process performed by the device name change script that follows the completion of the terminal provisioning process). Details of this process will be described later.

[0052] Here, the Active Directory (AD) processing means 61 is implemented by a central processing unit (CPU) located inside the AD server 60, one or more programs that define the operating procedures of this CPU, and working memory such as main memory and cache memory. Details of this AD processing means 61 will be described later.

[0053] Furthermore, the Active Directory (AD) data storage means 62 can be, for example, a non-volatile memory such as a hard disk drive (HDD) or a solid-state drive (SSD). Details of this AD data storage means 62 will be described later.

[0054] Note that the function for storing user IDs and passwords and performing user authentication using them may be provided on a server other than the AD server 60, but in this embodiment, the description will be based on the assumption that the AD server 60 has the function for performing authentication.

[0055] The cloud transmission collaboration server 70 (Entra Connector in this embodiment) is composed of one or more computers and periodically (for example, every 30 minutes) performs a process to synchronize Active Directory device data (AD device data) stored in the Active Directory (AD) data storage means 62 of the AD server 60 with device management data (Entra Device data in this embodiment) stored in the device management data storage means 42 of the device management server 40 (Entra ID in this embodiment). In this case, the transmission of AD device data from the AD server 60 to the cloud transmission collaboration server 70 is performed via intranet 2. In addition, the transmission of AD device data from the cloud transmission collaboration server 70 to the device management server 40 is performed via intranet 2, a proxy server (not shown), a firewall 3, and the internet 1.

[0056] Furthermore, Internet 1 and Intranet 2 are connected to user terminals 80, which are the target of the kitting process and are operated by users (in this case, company employees), and to administrator terminals 91, which are operated by system administrators (who are also company employees) belonging to the IT department of the organization (in this case, the company). Therefore, user terminals 80 and administrator terminals 91 are computer devices in a hybrid AD configuration (Entra Hybrid participation configuration) that joins the domains of both Internet 1 and Intranet 2.

[0057] Furthermore, a vendor terminal 90, operated by a vendor that sells terminals such as PC devices, is connected to Internet 1. In this case, the vendor is not an employee of the company, but rather an input agent for the system administrator, that is, someone who has been commissioned by the company to handle some system-related tasks. Therefore, the vendor terminal 90 connects to Internet 1, but does not connect to Intranet 2. However, like the system administrator, the vendor may be considered to have the authority to connect to Intranet 2.

[0058] These user terminals 80, vendor terminals 90, and administrator terminals 91 are composed of computers and each is equipped with a display means such as an LCD display and an input means such as a mouse, keyboard, or touch panel. The connection between these terminals 80, 90, and 91 and the Internet 1 or intranet 2 can be wired, wireless, or a hybrid of both. However, for the user terminal 80 to be kitted, a wireless connection enables location-independent terminal kitting, and the terminal kitting process and subsequent device name change process (processing by a device name change script that is executed after the completion of the terminal kitting process) in this invention can be completed wirelessly, thereby improving work efficiency. In addition, the user terminals 80, vendor terminals 90, and administrator terminals 91 may be composed of mobile devices such as tablets or smartphones.

[0059] The user terminal 80 includes an automatic kitting data acquisition means 81, an automatic kitting execution means 82, a task scheduler 83, and a business processing means 84. The task scheduler 83 is configured to include a task execution means 83A and a schedule storage means 83B.

[0060] Here, the automatic kitting data acquisition means 81, the automatic kitting execution means 82, the task execution means 83A of the task scheduler 83, and the business processing means 84 are implemented by a central processing unit (CPU) located inside the user terminal 80, one or more programs (including an operating system (OS)) that define the operating procedures of this CPU, and working memory such as main memory and cache memory. Details of each of these means 81, 82, 83A, and 84 will be described later.

[0061] Furthermore, the schedule storage means 83B of the task scheduler 83 can employ, for example, non-volatile memory such as a hard disk drive (HDD) or solid-state drive (SSD). Details of this schedule storage means 83B will be described later.

[0062] <Configuration of Device Management Cloud System 20 / Device Control Server 30 / Device Control Means 31>

[0063] When the user terminal 80 is powered on for the first time, the device control means 31 receives a signal (including a serial number) from the user terminal 80 via the Internet 1 requesting the acquisition of automatic kitting data. In response to the received acquisition request, the device control means 31 performs a process of transmitting the automatic kitting data (in this embodiment, Autopilot Profile data) stored in the automatic kitting data storage means 32 (see Figure 6), which is associated with the serial number, to the user terminal 80 that made the acquisition request, via the Internet 1.

[0064] Furthermore, when the device control means 31 receives a signal requesting the acquisition of a program (including Zscaler) from the user terminal 80 via the Internet 1 while the terminal kitting process is being executed on the user terminal 80, it also executes the process of sending the program related to the acquisition request, which is stored in the program storage means 34, to the user terminal 80 that made the acquisition request via the Internet 1.

[0065] Furthermore, the device control means 31 also receives device management data (Entra Device data) transmitted from the device management server 40 (Entra ID in this embodiment) and performs the process of storing it as device control data (Intune Device data) in the device control data storage means 33.

[0066] The device control means 31 also receives the serial numbers of all user terminals 80 (terminals before initial power-on) that are to be kitted, transmitted via the Internet 1 from the vendor terminal 90 or administrator terminal 91, and stores the received serial numbers in the automatic kitting data storage means 32 (see Figure 6). At the stage when these serial numbers are registered, the automatic kitting data storage means 32 has not yet assigned any automatic kitting data indicating the contents of the terminal kitting process to each serial number.

[0067] Furthermore, in response to a display request from the administrator terminal 91, the device control means 31 transmits data for displaying a settings screen (Web screen) for registering the contents of the terminal kitting process (OS setting information, selection information for programs to be used on the user terminal 80, a device name change script (this device name change script contains the server name of a specific AD server 60A), a prefix specifying the device name of the user terminal 80, the domain of the AD server 60 (for example, any.daiwa.co.jp), etc.) to the administrator terminal 91 via the Internet 1. It also receives the terminal kitting process setting information transmitted from the administrator terminal 91 via the Internet 1 (information entered and set by the system administrator using the settings screen on the administrator terminal 91, including information specifying a group of user terminals 80 to which the created automatic kitting data will be assigned), and stores the received setting information as automatic kitting data (in this embodiment, Autopilot Profile data) in the automatic kitting data storage means 32 (see Figure 6) in association with the serial number of each user terminal 80 to be kitted. For example, when performing the same terminal provisioning process on 100 user terminals 80, the same automated provisioning data is assigned to the serial number of each of those 100 user terminals 80.

[0068] Furthermore, when the device control means 31 receives configuration information for terminal kitting processing (including a prefix specifying the device name of the user terminal 80) transmitted from the administrator terminal 91 via the Internet 1, it automatically generates a temporary device name for each user terminal 80 to be kitted, and stores the generated temporary device name as part of the automatic kitting data in the automatic kitting data storage means 32 (see Figure 6), associating it with the serial number of each user terminal 80 to be kitted.

[0069] In this case, as shown at the top of Figure 5, the device control means 31 takes the first part of the provisional device name to be generated as the designated prefix part (a string input by the system administrator or their input agent) received from the administrator terminal 91 as setting information for terminal kitting processing, and executes a process to automatically generate the subsequent part. The subsequent part is either a random number generated by the device control means 31, or a part of the serial number extracted by the device control server 30 from the serial number (a string assigned by the manufacturer according to the manufacturer's numbering rules). In the example in Figure 5, the designated prefix part is "ANY-MB1", the subsequent part is the random number "abcx0a2z", and the provisional device name is "ANY-MB1abcx0a2z" when these are concatenated.

[0070] <Configuration of Device Management Cloud System 20 / Device Control Server 30 / Automatic Kitting Data Storage Means 32: Figure 6>

[0071] The automatic kitting data storage means 32 (Autopilot Record in this embodiment) can be configured, as shown in Figure 6, for example, with an automatic kitting data assignment table and an automatic kitting data content table. The automatic kitting data assignment table stores the serial number of the user terminal 80, the device name (a temporary device name), and the identification information of the automatic kitting data (Autopilot Profile data) in association. The automatic kitting data content table stores the identification information of the automatic kitting data (Autopilot Profile data) (for example, a name such as Autopilot_Deployment_Profile01) and the automatic kitting data in association. However, the automatic kitting data storage means 32 is not limited to such table configurations; in short, it is sufficient if it stores the serial number, the device name (a temporary device name), and the automatic kitting data in association.

[0072] Here, the automatic provisioning data (Autopilot Profile data in this embodiment) includes OS configuration information, selection information for programs (including Zscaler and business applications) to be installed on the user terminal 80 (however, installation may be done retrospectively, or simply by downloading them), a device name change script (a PowerShell script that describes the server name of a specific AD server 60A), a device name prefix, and the domain of AD server 60 (for example, any.daiwa.co.jp). In addition, the automatic provisioning data also includes the generated temporary device name after a temporary device name has been automatically generated using the specified prefix.

[0073] Note that the automatic kitting data for kitting any one user terminal 80 may be divided into multiple parts, in which case there will be identification information for multiple grouped automatic kitting data. In this case, it is necessary to assign the multiple divided automatic kitting data to a group of user terminals 80 (for example, 100 terminals) that should undergo the same terminal kitting process. Therefore, the identification information for each of the grouped automatic kitting data is associated with each serial number of the user terminals 80 in that group and stored in the automatic kitting data assignment table of the automatic kitting data storage means 32. Accordingly, in the example in Figure 6, in addition to Autopilot_Deployment_Profile01, other grouped identification information is also stored.

[0074] <Configuration of Device Management Cloud System 20 / Device Control Server 30 / Device Control Data Storage Means 33>

[0075] The device control data storage means 33 stores device control data (Intune Device date in this embodiment). This device control data includes the serial number of the user terminal 80 and the device name (a temporary device name or the changed device name for official registration).

[0076] <Configuration of device management cloud system 20 / device control server 30 / program storage means 34>

[0077] The program storage means 34 stores various programs, such as software for security measures like antivirus, data protection, and information leakage prevention (including Zscaler, which implements zero-trust security), and application programs (business applications) used in business operations. Zscaler (Zscaler Private Access) provides a VPN connection for wireless access to the on-premises AD server 60 connected to intranet 2.

[0078] <Configuration of Device Management Cloud System 20 / Device Management Server 40 / Device Management Means 41>

[0079] The device management means 41 receives device information of the user terminal 80 (including a temporary device name and serial number) transmitted from the user terminal 80 via the Internet 1 while the terminal provisioning process is being performed on the user terminal 80, and executes a process to store it in the device management data storage means 42 as device management data (in this embodiment, Entra Device data) before the device name change.

[0080] Furthermore, when the device management means 41 receives a query signal from the on-premises integration server 50 (In this embodiment, Intune Connector) to determine whether new device management data (Intra Device data in this embodiment) has been generated, if new device management data (device management data for a user terminal 80 that has been powered on and terminal kitting processing has started) has been generated, it retrieves the new device management data (including a temporary device name and serial number) from the device management data storage means 42 and transmits it to the on-premises integration server 50 via the Internet 1, firewall 3, proxy server (not shown), and intranet 2.

[0081] Furthermore, when the device management means 41 receives AD device data (including a temporary device name, serial number, and authentication token issued by the AD server 60) that is periodically (for example, every 30 minutes) transmitted from the cloud transmission cooperation server 70 (Entra Connector in this embodiment) via the intranet 2, proxy server (not shown), firewall 3, and internet 1, it stores the AD device data in the device management data storage means 42 as device management data (including a temporary device name, serial number, and authentication token) before the device name change, and also executes a process to send on-premises domain participation information (including an authentication token for accessing the AD server 60) to the user terminal 80 that is performing terminal provisioning processing via the internet 1.

[0082] When the device management means 41 receives AD device data (including the device name for registration, serial number, and authentication token) that is periodically (for example, every 30 minutes) transmitted from the cloud transmission cooperation server 70 (Entra Connector in this embodiment) via the intranet 2, proxy server (not shown), firewall 3, and internet 1, it stores the AD device data in the device management data storage means 42 as device management data (including the device name for registration, serial number, and authentication token) after the device name change, and also executes the process of sending the device management data (including the device name for registration, serial number, and authentication token) to the device control server 30.

[0083] <Configuration of Device Management Cloud System 20 / Device Management Server 40 / Device Management Data Storage Means 42>

[0084] The device management data storage means 42 stores device management data (in this embodiment, Entra Device date). This device management data includes the serial number of the user terminal 80, the device name (a temporary device name or the changed device name for official registration), and, after the AD server 60 issues an authentication token, an authentication token for accessing the AD server 60.

[0085] <Configuration of Active Directory Server (AD Server) 60 / Active Directory (AD) Processing Means 61: Figures 8 and 5>

[0086] The Active Directory (AD) processing means 61 performs all processes that enable the AD functions of the AD server 60 to function, but in this application, it performs the following processes in particular.

[0087] In other words, when the AD processing means 61 receives device management data (including the serial number of the user terminal 80 and a temporary device name) for a new device (a user terminal 80 performing terminal kitting) transmitted via the intranet 2 from the on-premises integration server 50 (In this embodiment, Intune Connector), it issues an authentication token for the user terminal 80 to access the AD server 60, and executes a process to store the received device management data, along with the issued authentication token, as AD device data in the AD data storage means 62.

[0088] Furthermore, the AD processing means 61 also performs the process of sending the AD device data (including the serial number of the user terminal 80, a temporary device name, and an authentication token) stored in the AD data storage means 62 to the cloud transmission cooperation server 70 via the intranet 2.

[0089] Furthermore, when the AD processing means 61 of a specific AD server 60A among the multiple AD servers 60 receives a query signal (a query signal via LDAP (Lightweight Directory Access Protocol)) containing the maximum numbered device name transmitted from the user terminal 80 via the intranet 2 after the terminal provisioning process at the user terminal 80 is completed, it refers to the AD device data stored in the AD data storage means 62 of the specific AD server 60A, extracts the device name containing the maximum numbered device name from the AD device data for each user terminal 80, transmits the extracted device name containing the maximum numbered device name to the user terminal 80 that made the query via the intranet 2, receives the device name for final registration after the device name change transmitted from the user terminal 80 via the intranet 2, updates the AD device data using the received device name for final registration, and stores the updated AD device data (including the serial number of the user terminal 80, the device name for final registration, and the authentication token) in the AD data storage means 62 of the specific AD server 60A.

[0090] Updates to the AD device data stored in the AD data storage means 62 of this specific AD server 60A are reflected in other AD servers 60 through a synchronous process.

[0091] The reason for sending a query signal (LDAP query signal) for the device name containing the maximum assigned value to a specific AD server 60A is to prevent the inconvenience of conflicting reference data among multiple AD servers 60, resulting in the creation of user terminals 80 with the same device name. In other words, when multiple AD servers 60 with the same domain that synchronize data are provided, LDAP access to the AD servers 60 is usually performed by specifying the domain. However, since the timing of the terminal provisioning process using the automatic provisioning data executed by the automatic provisioning execution means 82 cannot be controlled, if the normal access process to the AD server 60 (access process by specifying the domain) is performed when referencing a device name containing the maximum assigned value (last assigned value), the reference data may conflict among multiple AD servers 60 due to the relationship between the timing of data synchronization among multiple AD servers 60 and the timing of the reference, potentially resulting in the creation of user terminals 80 with the same device name. Therefore, while typically an AD server is accessed by specifying a domain (accessing any server among multiple AD servers 60 that belong to the same domain), by specifying the server name of a specific AD server 60A in addition to specifying the domain of the AD server 60, it is possible to prevent the undesirable situation of reference data conflicts described above.

[0092] More specifically, for example, when the AD processing means 61 of a particular AD server 60A receives an LDAP query signal from a user terminal 80 (a query signal to refer to a device name including the maximum assigned value), as shown in Figure 8, if the AD data storage means 62 has stored "ANY-MB1-PC00000" to "ANY-MB1-PC00003" as device names for each user terminal 80, with the trailing part being a sequential number, then these are the device names for the actual registration after the device name change. On the other hand, "ANY-MB1abcx0a2z" and "ANY-MB1vrf98g5up" have the trailing part being a random number, so they are temporary device names before the device name change. Therefore, the AD processing means 61 of the specific AD server 60A determines that the device name containing the maximum numbering value related to the LDAP query is "ANY-MB1-PC00003", and executes the process of sending the extracted "ANY-MB1-PC00003" to the user terminal 80 (here, referred to as user terminal 80D) that made the LDAP query via intranet 2.

[0093] Then, when "ANY-MB1-PC00003" is sent to the user terminal 80D that performed the LDAP query, the user terminal 80D sends "ANY-MB1-PC00004", which is the device name for registration, via intranet 2, along with the serial number of the user terminal 80D. The AD processing means 61 of the specific AD server 60A receives this "ANY-MB1-PC00004" and processes it to store it in the AD data storage means 62 in association with the serial number of the received user terminal 80D. As a result, the AD device data for the user terminal 80D stored in the AD data storage means 62 of the specific AD server 60A is updated from a state including the temporary device name "ANY-MB1abcx0a2z" to a state including the device name for registration "ANY-MB1-PC00004", as shown in Figures 8 and 5.

[0094] Furthermore, if an LDAP query for a device name including the maximum assigned number is received while none of the user terminals 80 targeted for kitting have yet undergone the process of changing their temporary device name to a device name for official registration, the AD data storage means 62 of a specific AD server 60A will have the device name "ANY-MB1-PC00000" in it, but all other devices will have a temporary device name with a random number trailing. Therefore, "ANY-MB1-PC00000" will be sent to the user terminal 80 that made the LDAP query for a device name including the maximum assigned number. Consequently, in this case, the user terminal 80 will calculate a new assigned number as "-PC00001", and "ANY-MB1-PC00001" will be automatically generated as the device name for official registration. The trailing part "-PC00000" is a pseudo-number, and a user terminal 80 with the device name "ANY-MB1-PC00000" does not actually exist. By preparing a device name for a non-existent pseudo-user terminal 80 in the AD data storage means 62 of a specific AD server 60A, the algorithm of the device name change script executed on the user terminal 80 can be simplified.

[0095] Furthermore, the AD processing means 61 also performs the process of sending the AD device data after the device name change (including the serial number of the user terminal 80 and the device name for this registration) stored in the AD data storage means 62 to the cloud transmission cooperation server 70 via the intranet 2.

[0096] Furthermore, the AD processing means 61 receives input from the system administrator from the administrator terminal 91 to register the combination of each user's ID and initial password, and also receives input from the user terminal 80 to change the password, and executes a process to store the received ID and password combinations for each user in the AD data storage means 62 as login authentication data. In addition, when the AD processing means 61 receives the ID and password transmitted from the user terminal 80 via the intranet 2 for access to the AD server 60 from the user terminal 80, it executes a login authentication process to determine whether the received ID and password combination matches the ID and password combination registered in the AD data storage means 62.

[0097] <Configuration of Active Directory Server (AD Server) 60 / Active Directory (AD) Data Storage Means 62>

[0098] The Active Directory (AD) data storage means 62 stores various resources, such as personnel and device information, owned by organizations such as companies to which users and system administrators belong, as Active Directory data (AD data), associated with areas indicated by domains. The AD data includes AD device data (including the serial number of the user terminal 80, a temporary device name or a device name for official registration after updating, and an authentication token), login authentication data showing the relationship between user ID and password, and other business data (for example, employee information associated with the user's name, department, address, telephone number, user ID (employee number), data created for business purposes, and data used for business purposes).

[0099] <Configuration of user terminal 80 / automatic kitting data acquisition means 81>

[0100] The automatic kitting data acquisition means 81, when the user terminal 80 is first powered on, performs the following process: it transmits the serial number of the user terminal 80 to the device control server 30 (In this embodiment, Intune) via the Internet 1 to acquire the automatic kitting data (Autopilot Profile data) stored in the automatic kitting data storage means 32 (Autopilot Record in this embodiment) of the device control server 30 (Intune in this embodiment) associated with the serial number of the user terminal 80, and receives the automatic kitting data (including a device name change script) transmitted from the device control server 30 via the Internet 1. This automatic kitting data acquisition means 81 is implemented by the functions of the OS (Windows). The acquired automatic kitting data may be stored in main memory or in non-volatile memory.

[0101] <Configuration of user terminal 80 / automatic kitting execution means 82>

[0102] The automatic kitting execution means 82 automatically executes terminal kitting processing, which includes registering the device name change script included in the automatic kitting data with the task scheduler 83 provided on the user terminal 80, using the automatic kitting data acquired by the automatic kitting data acquisition means 81.

[0103] In addition to registering the device name change script with the task scheduler 83, the automatic kitting execution means 82 performs terminal kitting processing according to the automatic kitting data, including OS configuration processing, and the acquisition of various programs such as security software (including Zscaler for achieving zero-trust security) and business applications. Specifically, the acquisition of various programs involves sending download request signals for each specified program to the device control server 30 via the Internet 1 according to the automatic kitting data, receiving and saving each program sent from the device control server 30 via the Internet 1, and performing installation if necessary.

[0104] Furthermore, the automatic kitting execution means 82 also performs the process of saving the temporary device name included in the automatic kitting data to the device name storage area (non-volatile memory) provided on the user terminal 80.

[0105] <Configuration of user terminal 80 / task scheduler 83 / task execution means 83A: Figures 8 and 5>

[0106] Task execution means 83A executes each task (including the device name change script) stored in the schedule storage means 83B, and is a function provided by the OS (Windows). In this embodiment, after the terminal kitting process by the automatic kitting execution means 82 is completed, and therefore Zscaler is already installed, the task execution means 83A executes the device name change script (PowerShell script) to change the trailing part of the temporary device name contained in the AD device data stored in the AD data storage means 62 of a specific AD server 60A to a regular number according to a predetermined user numbering rule (see Figure 5), thereby executing a device name change process that automatically generates a device name for registration.

[0107] More specifically, the task execution means 83A, as a device name change process by the device name change script, obtains device names stored in the AD data storage means 62 of a specific AD server 60A, which include the maximum assigned number (the last assigned number) assigned according to the user numbering rule in the suffix, by performing an LDAP query to the specific AD server 60A via intranet 2 while ensuring security with Zscaler, and then uses the maximum assigned number in the suffix of the obtained device name according to the user numbering rule (for example, the rule of adding a sequential number that increases by 1 to the header "-PC"). By incrementing the value by 1, a new numbering value is calculated, and a device name for official registration, which includes this new numbering value in the suffix, is automatically generated and stored in the device name storage area (non-volatile memory) provided on the user terminal 80 (overwriting the temporary device name). At the same time, the automatically generated device name for official registration is sent to a specific AD server 60A via the intranet 2 while ensuring security by Zscaler, thereby executing a process to change the temporary device name included in the AD device data stored in the AD data storage means 62 of the specific AD server 60A to the device name for official registration. Note that this change in device name is also reflected in AD servers 60 other than the specific AD server 60A through a synchronous process.

[0108] Specifically, if the device name obtained by an LDAP query to a specific AD server 60A, which includes the maximum assigned number (last assigned number) in the suffix, is "ANY-MB1-PC00003" as shown in Figure 8, then "ANY-MB1" is the designated prefix and "-PC00003" is the suffix (see Figure 5). Therefore, the task execution means 83A calculates "-PC00004" by increasing this maximum assigned number "-PC00003" by 1 according to the user numbering rule, concatenates the designated prefix "ANY-MB1" and the calculated suffix "-PC00004" to generate a device name for registration, and sends the generated "ANY-MB1-PC00004" along with the serial number of the user terminal 80 (here, user terminal 80D) to the specific AD server 60A via intranet 2 while ensuring security with Zscaler. As a result, the AD device data for the user terminal 80D stored in the AD data storage means 62 of a specific AD server 60A is updated from a state including the temporary device name "ANY-MB1abcx0a2z" to a state including the device name for official registration "ANY-MB1-PC00004", as shown in Figures 8 and 5.

[0109] <Configuration of User Terminal 80 / Task Scheduler 83 / Schedule Storage Means 83B>

[0110] The schedule storage means 83B stores each task (including the device name change script) executed by the task execution means 83A, and is a storage area reserved by the OS (Windows) functionality.

[0111] <Configuration of user terminal 80 / business processing means 84>

[0112] The business processing means 84 executes business processes using business applications obtained by the automatic kitting execution means 82 through terminal kitting processing, or business applications obtained thereafter. The business processing means 84 accesses the AD server 60 via intranet 2 while ensuring security with Zscaler as needed, and performs processes such as referencing, creating, updating, and deleting AD data stored in the AD data storage means 62.

[0113] <Processing flow by terminal kitting system 10: Figures 2-4>

[0114] (Explanation of Figure 2)

[0115] In Figure 2, as a preliminary step for the terminal kitting process, the vendor, who is a terminal supplier, operates the vendor terminal 90 on behalf of the system administrator to input the serial numbers of the terminals sold to the system administrator or organization (the terminals to be used as user terminals 80) for each unit sold, and transmits them to the device control server 30 (Intune in this embodiment) via the Internet 1 (Step S1).

[0116] The device control server 30 receives the serial numbers of each user terminal 80 for the number of units sold, transmitted via the Internet 1 by the device control means 31, and stores all of these serial numbers in the automatic kitting data storage means 32 (see Figure 6) (step S2).

[0117] Next, the system administrator operates the administrator terminal 91 to input the ID and initial password combinations for each user and sends them to the AD server 60 via intranet 2 (step S3). The AD server 60 receives the ID and initial password combinations for each user sent from the administrator terminal 91 using the AD processing means 61 and stores them in the AD data storage means 62. If there are already ID and password combinations being used by each user, those combinations may be stored in the AD data storage means 62.

[0118] Furthermore, the system administrator operates the administrator terminal 91 and inputs configuration information for creating Autopilot Profile data on a configuration screen (Web screen) sent from the device control server 30 (Intune) via the Internet 1, and sends the entered configuration information to the device control server 30 via the Internet 1 (step S4). The configuration information entered and sent here (information for creating Autopilot Profile data) includes OS configuration information, selection information for programs to be used on the user terminal 80 (Zscaler for security measures, various business applications, etc.), a device name change script (this device name change script contains the server name of a specific AD server 60A), a device name prefix, the domain of the AD server 60 (for example, any.daiwa.co.jp), and information specifying a group of user terminals 80 to which the created Autopilot Profile data will be assigned.

[0119] The device control server 30 receives configuration information transmitted via the Internet 1 by the device control means 31, creates automatic kitting data using the received configuration information, and stores the created automatic kitting data in the automatic kitting data storage means (Autopilot Record) 32 (see Figure 6) in association with all the serial numbers of the group of user terminals 80 assigned by the configuration information (step S5).

[0120] Furthermore, the device control server 30, using the device control means 31, automatically generates a temporary device name (see Figure 5) using a specified prefix included in the configuration information and a generated random number or a portion of the serial number of the user terminal 80 to be kitted. The automatically generated temporary device name is also associated with the serial number as part of the automatic kitting data. The data is stored in the automatic kitting data storage means (Autopilot Record) 32 (see Figure 6) (step S5).

[0121] Subsequently, when the user powers on the user terminal 80, the automatic kitting data acquisition means 81, which is a function of the OS (Windows), sends inquiry information (including its own serial number) to the device control server 30 via the Internet 1 to determine whether or not it (the terminal that powered on) is subject to automatic kitting (Autopilot Profile) (step S6).

[0122] The device control server 30 receives inquiry information from the user terminal 80 regarding whether or not it is subject to automatic provisioning (including the serial number of the user terminal 80 making the inquiry) via the device control means 31 (step S7). If automatic provisioning data (Autopilot Profile data) associated with the serial number included in the received inquiry information is registered in the automatic provisioning data storage means (Autopilot Record) 32 (see Figure 6), the automatic provisioning data (including a temporary device name) is sent to the user terminal 80 making the inquiry via the Internet 1 (step S8).

[0123] On the user terminal 80, the automatic kitting data acquisition means 81 receives automatic kitting data (Autopilot Profile data) from the device control server 30 (step S9), and the automatic kitting execution means 82 starts executing automatic kitting using the received automatic kitting data (including a temporary device name) (step S10). Specifically, this involves configuring the OS, downloading programs (such as business applications) to be used on the user terminal 80, and installing them if necessary. On the device control server 30, the device control means 31 responds to the acquisition request from the user terminal 80 by sending the program related to the acquisition request stored in the program storage means 34 to the user terminal 80 via the Internet 1 (step S11). Note that the processing in steps S28 to S31 in Figure 3, which will be described later, is also included in the processing in steps S10 and S11 here, but it is described separately to show that it is a process that should be completed before the authentication processing in steps S32 and S33 in Figure 3.

[0124] Furthermore, in the process of step S10 described above, the automatic kitting execution means 82 also performs the process of saving the temporary device name included in the automatic kitting data to the device name storage area (non-volatile memory) provided on the user terminal 80.

[0125] Next, the user terminal 80 uses the automatic kitting execution means 82 to register the device name change script (which contains the server name of a specific AD server 60A) included in the received automatic kitting data with the task scheduler 83's schedule storage means 83B (step S12).

[0126] Then, the automatic kitting execution means 82 transmits the device information (including a temporary device name and serial number) of the user terminal 80 performing automatic kitting to the device management server 40 (Entra ID) via the Internet 1 (step S13).

[0127] The device management server 40 receives device information (including a temporary device name and serial number) from the user terminal 80 performing automatic kitting via the device management means 41, and manages the device as device management data (Entra Device data) before the device name change. The data is stored in the data storage means 42 (step S14).

[0128] Next, the device management means 41 automatically transmits the device information (including a temporary device name and serial number) stored as device management data before the device name change to the device control server 30 (step S15). The device control server 30 receives the device information (including a temporary device name and serial number) from the device management server 40 via the device control means 31 and stores it in the device control data storage means 33 as device control data (Intune Device data) before the device name change (step S16).

[0129] (Explanation of Figure 3)

[0130] In Figure 3, the on-premises integration server 50 (Intune Connector) sends query information regarding the presence or absence of newly generated device management data (Entra Device data) to the device management server 40 (Entra ID) via intranet 2, a proxy server (not shown), a firewall 3, and the internet 1 (step S17). When the device management server 40 receives the query information from the on-premises integration server 50 via the device management means 41 (step S18), if new device management data (including serial number and temporary device name) is stored in the device management data storage means 42, it sends the new device management data to the on-premises integration server 50 via the internet 1, a firewall 3, a proxy server (not shown), and intranet 2 (step S19).

[0131] The on-premises integration server 50 receives device management data (including serial number and temporary device name) from the device management server 40 and sends the received device management data to the AD server 60 via intranet 2 (step S20).

[0132] The AD server 60 receives device management data (including serial number and temporary device name) from the on-premises integration server 50 using the AD processing means 61 and stores it as AD device data in the AD data storage means 62 (step S21).

[0133] Next, the AD processing means 61 issues an authentication token for access from the user terminal 80 to the AD server 60 and stores it in the AD data storage means 62 as AD device data (step S22).

[0134] Then, the AD processing means 61 transmits the AD device data stored in the AD data storage means 62 (including the serial number of the user terminal 80, a temporary device name, and an authentication token) to the cloud transmission cooperation server 70 via the intranet 2 (step S23). This transmission is performed periodically (for example, every 30 minutes).

[0135] The cloud transmission integration server 70 receives AD device data (including the serial number of the user terminal 80, a temporary device name, and an authentication token) from the AD server 60, and sends the received AD device data to the device management server 40 (Entra ID) via intranet 2, a proxy server (not shown), firewall 3, and the internet 1 (step S24).

[0136] The device management server 40 receives AD device data (including the serial number of the user terminal 80, a temporary device name, and an authentication token) from the cloud transmission cooperation server 70 via the device management means 41, stores it in the device management data storage means 42 as device management data (which still includes a temporary device name) (step S25), and further transmits on-premises domain participation information (including the authentication token) via the Internet 1 to the user terminal 80 (the user terminal 80 performing terminal provisioning) whose serial number is included in the received AD device data (step S26).

[0137] On the user terminal 80, the automatic kitting execution means 82 receives on-premises domain participation information (including an authentication token) transmitted from the device management server 40 via the Internet 1, and stores the received authentication token in a non-volatile memory (not shown) provided on the user terminal 80 (step S27). This authentication token is later used when accessing the AD server 60 in business processing by the business processing means 84.

[0138] Next, the automatic kitting execution means 82 sends a signal requesting the acquisition of Zscaler, a security program, to the device control server 30 (Intune) via the Internet 1 (step S28). The device control server 30 receives the signal requesting the acquisition of Zscaler from the user terminal 80 via the device control means 31 (step S29), and sends the Zscaler program, which is the program related to the acquisition request and is stored in the program storage means 34, to the user terminal 80 via the Internet 1 (step S30). The user terminal 80 receives and installs Zscaler, which is sent from the device control server 30 via the Internet 1, via the automatic kitting execution means 82 (step S31). These steps S28 to S31 are part of the processes in steps S10 and S11 of Figure 2 described above, but they are described separately because they should be completed before the processes in the next steps S32 and S33.

[0139] Next, the automatic kitting execution means 82 sends a Windows user ID and password to the AD server 60 in the on-premises environment via intranet 2, which is a communication path secured by Zscaler, in order to sign in to the AD server 60 (step S32). The AD server 60 performs a login authentication process using the AD processing means 61 to determine whether the ID and password combination received from the user terminal 80 matches the ID and password combination registered in the AD data storage means 62 (step S33). With this, the terminal kitting process by the automatic kitting execution means 82 is completed.

[0140] (Explanation of Figure 4)

[0141] In Figure 4, the user terminal 80, using the task execution means 83A of the task scheduler 83, executes a device name change script stored in the schedule storage means 83B, conditional on the completion of automatic kitting based on automatic kitting data (Autopilot Profile data). It then sends a signal requesting the acquisition of a device name, including the maximum assigned value assigned according to the user numbering rule, via an LDAP query, to the AD server name representing a specific AD server 60A among multiple AD servers 60 having the same domain, via the intranet 2 (step S34).

[0142] In a specific AD server 60A, the AD processing means 61 receives a request from the user terminal 80 to obtain a device name including the maximum assigned value (step S35), extracts the device name including the maximum assigned value (in the example in Figure 8, "ANY-MB1-PC00003") from the AD device data stored in the AD data storage means 62, and sends it to the user terminal 80 via the intranet 2 (step S36).

[0143] On the user terminal 80, the task execution means 83A receives the device name including the maximum numbered value (in the example in Figure 8, "ANY-MB1-PC00003") (step S37). Using the acquired maximum numbered value, a new numbered value is calculated according to the user numbering rule (by adding 1 to the maximum numbered value), and a device name for official registration (in the example in Figure 8, "ANY-MB1-PC00004") is automatically generated and stored in the device name storage area (non-volatile memory) provided on the user terminal 80 (step S38). Note that a temporary device name is already stored in this device name storage area, so it is overwritten.

[0144] Next, the task execution means 83A sends the generated device name for registration (in the example in Figure 8, "ANY-MB1-PC00004") to a specific AD server 60A via the intranet 2 (step S39). The specific AD server 60A receives the device name for registration sent from the user terminal 80 via the intranet 2 using the AD processing means 61, and changes the device name included in the AD device data stored in the AD data storage means 62 from a temporary device name (in the example in Figures 8 and 5, "ANY-MB1abcx0a2z") to the device name for registration (in the example in Figures 8 and 5, "ANY-MB1-PC00004") (step S40). This change in device name is also reflected synchronously to AD servers 60 other than the specific AD server 60A.

[0145] Subsequently, the AD server 60, using the AD processing means 61, transmits the latest AD device data stored in the AD data storage means 62, i.e., the AD device data after the device name change (including the serial number of the user terminal 80 and the device name for this registration), to the cloud transmission cooperation server 70 via the intranet 2 (step S41). This transmission is performed periodically (for example, every 30 minutes).

[0146] The cloud transmission linkage server 70 receives AD device data (including the serial number of the user terminal 80 and the device name for this registration) from the AD server 60, and sends the received AD device data to the device management server 40 (Entra ID) via intranet 2, a proxy server (not shown), firewall 3, and the internet 1 (step S42).

[0147] The device management server 40 receives AD device data (including the serial number of the user terminal 80 and the device name for registration) from the cloud transmission cooperation server 70 via the device management means 41, stores the updated device management data (including the serial number and the device name for registration) in the device management data storage means 42 (step S43), and then automatically transmits this latest device information (including the serial number and the device name for registration) to the device control server 30 (step S44).

[0148] The device control server 30 receives device information (including serial number and device name for registration) from the device management server 40 via the device control means 31 and stores it in the device control data storage means 33 as device control data after the device name change (step S45).

[0149] <Flowchart for generating and changing device names: Figures 7 and 8>

[0150] As shown in Figure 7, a temporary device name (e.g., "ANY-MB1abcx0a2z") is automatically generated in step S5 of Figure 2 and stored in the automatic kitting data storage means (Autopilot Record) of the device control server 30 (Intune). Subsequently, it is transmitted to the user terminal 80 to be kitted as part of the automatic kitting data (Autopilot Profile data) (steps S8, S9 of Figure 2), and in step S10 of Figure 2, it is stored in the device name storage area provided on the user terminal 80.

[0151] Next, the temporary device name is stored as part of the device management data (Entra Device data) in the device management data storage means 42 of the device management server 40 (Entra ID) in step S14 of Figure 2, and further stored in the device control data storage means 33 of the device control server 30 (Intune) in step S16 of Figure 2.

[0152] Then, the temporary device name is sent from the device management server 40 (Entra ID) in step S19 of Figure 3, passes through the on-premises integration server 50 (Intune Connector) in step S20 of Figure 3, and is stored in the AD data storage means 62 of the AD server 60 as part of the AD device data among the AD data in step S21 of Figure 3.

[0153] Subsequently, as shown in Figure 8, a device name for official registration (for example, "ANY-MB1-PC00004") is automatically generated on the user terminal 80 in step S38 of Figure 4 and stored (overwritten) in the device name storage area provided on the user terminal 80. Then, the device name for official registration is sent to a specific AD server 60A in step S39 of Figure 4, and stored in the AD data storage means 62 of the specific AD server 60A as part of the AD device data within the AD data in step S40 of Figure 4. In other words, the device name included in the AD device data is changed from a temporary device name to the device name for official registration. This change of device name on the specific AD server 60A is then reflected in the other AD servers 60 through a synchronous process.

[0154] <Effects of this embodiment>

[0155] This embodiment provides the following advantages. Specifically, the terminal kitting system 10 stores the automatic kitting data (Autopilot Profile data) of the user terminal 80, including the device name change script, in the automatic kitting data storage means 32 of the device control server 30 (Intune in this embodiment) of the device management cloud system 20. When the user terminal 80 to be kitted is powered on, the automatic kitting data acquisition means 81 acquires the automatic kitting data, the automatic kitting execution means 82 executes the terminal kitting process using the automatic kitting data, registers the device name change script in the task scheduler 83 provided on the user terminal 80, and after the terminal kitting process by the automatic kitting execution means 82 is completed, the task execution means 83A executes the device name change script and performs a device name change process that automatically generates a device name for official registration by changing the trailing part of the temporary device name stored in the AD data storage means 62 of the AD server 60 to a regular number that increases by 1 according to the user numbering rule.

[0156] Therefore, device names become easier for users and system administrators to recognize and communicate to others, thus reducing the possibility of communication errors regarding device names between users and system administrators, and simplifying terminal management.

[0157] Furthermore, as shown in the conventional example in Figure 9 above, instead of the system administrator manually performing the kitting of all user terminals 100A, 100B, 100C, ... at the company's kitting center, each user can automatically kit their own terminal at each of the company's business locations A, B, C, .... Therefore, a kitting center becomes unnecessary, and the number of physical transit points for terminals from procurement to commencement of use can be reduced, thereby shortening the time required for terminal kitting, the time required to prepare new locations, and reducing the burden on system administrators.

[0158] Furthermore, since the kitting process for user terminals 80 can be automated, the time users spend on simple tasks can be reduced, thereby improving operational efficiency. In addition, even users with little knowledge of kitting can reliably complete the terminal kitting process.

[0159] Furthermore, because terminal provisioning can be completed using only wireless communication without the need for wired connections, it can be performed and completed anywhere in the country, regardless of location, allowing operations to begin immediately. This improves convenience for users who will be using the terminals.

[0160] Furthermore, the device name change process using the device name change script calculates a new numbering value by incrementing the device name by one each time according to the user numbering rules so that the subsequent part of the device name becomes a consecutive number, and automatically generates a device name for official registration. As a result, the device name becomes simple and easy to understand, which can more reliably avoid inconveniences such as communication errors by users and system administrators. Moreover, since the device name can be perceived as a numerical value, it becomes possible to grasp the number of terminal devices by looking at the device name. In other words, the device name serves as a count of the number of terminal devices, making it even easier for system administrators to grasp the total number of terminal devices and manage increases and decreases.

[0161] Furthermore, the device name change process using the device name change script performs an LDAP query to a specific AD server 60A among the multiple AD servers 60. This prevents conflicts in reference data between multiple AD servers 60 when referencing the device name including the last assigned value, thus preventing the occurrence of user terminals 80 with the same device name.

[0162] Furthermore, since the AD data storage means 62 of the AD server 60 is prepared with a device name that includes a pseudo number in the suffix as the device name of a non-existent pseudo-user terminal 80 (see Figure 8), the number of conditional branches in the processing algorithm of the device name change script is reduced, the processing logic can be simplified, and thus the processing time can be shortened.

[0163] <Form of transformation>

[0164] It should be noted that the present invention is not limited to the embodiments described above, and any modifications that can achieve the objectives of the present invention are included in the present invention.

[0165] For example, the terminal kitting system 10 of the above embodiment was configured to include an on-premises integration server 50 (Intune Connector) and a cloud outbound integration server 70 (Entra Connector). However, the transmission and reception of device information between the on-premises environment and the cloud environment is not limited to these configurations. In short, it is sufficient to be able to transmit and receive device information between the device management cloud system 20 and the AD server 60.

[0166] Furthermore, in the above embodiment, the user numbering rule used in the device name change process by the device name change script calculated a new numbering value by adding 1 to the current maximum numbering value, but it is not limited to this. For example, instead of increasing by 1, it may decrease by 1, or instead of increasing by 1, it may increase or decrease by 10, for example. In short, any user numbering rule that generates numbers that increase or decrease regularly is acceptable. In the above embodiment, the pseudo-number was "-PC00000" (see Figure 8), but if the user numbering rule decreases the number, the pseudo-number can be, for example, "-PC99999". However, it is preferable that the user numbering rule calculates a new numbering value by adding 1 to the current maximum numbering value, as in the above embodiment, and it is preferable that the pseudo-number is zero. Doing so makes it easier for system administrators to grasp the total number of terminal devices and manage increases and decreases. [Industrial applicability]

[0167] As described above, the terminal kitting system and program of the present invention are suitable for use, for example, in cases where a company completes the terminal lifecycle of terminal devices used for business purposes using only wireless connectivity. [Explanation of symbols]

[0168] 1. Internet 2. Intranet, which is an internal network. 10 Terminal Kitting System 20-Device Management Cloud System 30 Device control servers that make up the device management cloud system 31 Device control means 32 Automatic kitting data storage means 40 Device management servers that make up the device management cloud system 60. Active Directory Server (AD Server) 60A Specific Active Directory server (specific AD server) 62 Active Directory data storage means (AD data storage means) 80 User terminals 81 Automatic kitting data acquisition means 82 Automatic kitting execution means 83 Task Scheduler 83A Task execution means constituting the task scheduler 83B Schedule storage means constituting the task scheduler

Claims

1. A terminal provisioning system comprising a computer that performs provisioning of user terminals, A device management cloud system located in a cloud environment that is connected via the Internet to the user terminals subject to the aforementioned kitting, The system comprises the user terminal and an Active Directory server located in an on-premises environment, which is connected via an internal network. The aforementioned device management cloud system is Automatic kitting data storage means stores automatic kitting data for the user terminal, including a device name change script for performing a process to change the device name of the user terminal, in association with the serial number of the user terminal that has been previously registered by the system administrator or their designated data entry agent. The system includes a device control means that automatically generates a temporary device name for the user terminal, which consists of a designated prefix section that has been previously entered by the system administrator or their designated input agent, and a subsequent section consisting of a random number or a part of the serial number. The aforementioned Active Directory server, The device management cloud system includes an Active Directory data storage means that stores Active Directory data, including the temporary device name of the user terminal, received from the device management cloud system via the Internet and the internal network connected thereto. The aforementioned user terminal is Automatic kitting data acquisition means that acquires the automatic kitting data stored in the automatic kitting data storage means from the device management cloud system via the internet, Automatic kitting execution means, which uses the automatic kitting data acquired by this automatic kitting data acquisition means to execute terminal kitting processing including the process of registering the device name change script with the task scheduler provided on the user terminal, The system includes a task execution means that, after the completion of the terminal provisioning process by the automatic provisioning execution means, executes the device name change script to automatically generate a device name for registration by changing the subsequent part of the temporary device name stored in the Active Directory data storage means to a number that increases or decreases regularly according to a predetermined user numbering rule. The device name change process performed by this task execution means is This process involves querying the Active Directory server via the internal network to obtain a device name from among the device names stored in the Active Directory data storage means that includes the last assigned number value assigned according to the user numbering rule in the suffix; calculating a new assigned number value by increasing or decreasing the obtained last assigned number value according to the user numbering rule; automatically generating a device name for official registration that includes this new assigned number value; and transmitting the generated device name for official registration to the Active Directory server via the internal network, thereby changing the temporary device name stored in the Active Directory data storage means to the device name for official registration. A terminal kitting system characterized by the following features.

2. The task execution means is The device name change process is configured to change the subsequent part of the temporary device name to a sequential number that increases by one according to the user numbering rule. The previous last assigned number was the maximum assigned number, and the new assigned number is the maximum assigned number plus 1. The terminal kitting system according to feature 1.

3. The system comprises a plurality of Active Directory servers that synchronize the Active Directory data stored in the Active Directory data storage means with each other. The task execution means is The device name change process is configured to perform a query via the internal network to a specific Active Directory server, specified by its server name, among multiple Active Directory servers having the same domain, to find a device name whose suffix includes the last assigned number value assigned according to the user numbering rule. The terminal kitting system according to feature 1.

4. The Active Directory data storage means of the Active Directory server stores a device name in which the subsequent part includes a pseudo number used as a criterion when the task execution means assigns the first numbered value according to the user numbering rule, as the device name of a non-existent pseudo-user terminal. The terminal kitting system according to feature 1.

5. A program for causing a computer to function as a terminal kitting system according to any one of claims 1 to 4.

Images