Dell Command | Update 3.1 Tips and Tricks for Workspace ONE UEM Integration

Recently, I have seen an uptick in issues and confusion with integrating both Dell Command | Update and Dell Command | Monitor into Workspace ONE UEM. Since publishing the Integrating with Dell Client Command Suite: Operational Tutorial, which leveraged Dell Command | Update version 2.4.0 and Dell Command | Monitor version 10.0.0.331, there have been a few interesting product updates, both from Dell and VMware. Most notably, Dell released Dell Command | Update version 3.1 which includes: 

• Automatic suspension of BitLocker when BIOS updates are applied (enabled by default) 
• Command-line interface support (CLI was supported in 2.4, then removed in 3.0)
• Enhanced return codes for command-line interface
• Options to schedule updates on a weekly or monthly basis (supported in 2.4, then removed in 3.0) 

VMware Workspace ONE UEM relies on the command-line interface, specifically dcu-cli.exe, to support the integration with Dell Command | Update; hence why the tutorial called out support for 2.4 and not 3.0. Many customers have patiently waited for Dell Command | Update 3.1, mainly for the automatic suspension of BitLocker. This blog will walk you through my lessons learned after receiving feedback from the Tech Zone and VMware Technology Network forums from various customers having issues with both Dell Command | Update and Dell Command | Monitor.  

Using Dell Command | Update with Workspace ONE UEM

Let’s start with Dell Command | Update. The table below is a summary of the key tips to remember when using Dell Command | Update with Workspace ONE UEM.  

*VMware Workspace ONE UEM only supports the Windows 32 and 64-bit version.
**Requires users with administrative rights to perform actions.  

Upgrading Dell Command | Update from 2.4 to 3.1.1 

If you have not deployed Dell Command | Update 2.4, then you can simply upload 3.1.x directly. However, many customers are currently using 2.4 and need to upgrade to 3.1.x. In this example, I am using Dell Command | Update 3.1.1 which was released in February 2020. We will see how to add a new version and retire version 2.4 gracefully.  

1. Obtain the latest version of Dell Command | Update from the Dell Command | Update Knowledge Base page.  
   Note: VMware Workspace ONE UEM only supports the Windows 32 and 64-bit version for Microsoft Windows 10. Dell Command | Update 3.1+ requires the Workspace ONE Intelligent Hub version 20.3+.  
2. Extract the DellCommandUpdate.msi from the EXE app. To do this, start the install by running the EXE. You will see the status say, “Extracting DellCommandUpdate.msi”, on the next step you can cancel the install. The DellCommandUpdate.msi will be located under C:\Windows\{58F8BA1C-1C6B-44EB-B34E-2AE95949D05F} for the 3.1.1. version of Dell Command | Update. We will use this MSI in a later step when uploading into the Workspace ONE UEM console.  
3. Once you are logged into your Workspace ONE UEM console, navigate to Apps & Books > Applications > Native. Find your Dell Command | Update 2.4 app. If you have tons of apps, you can use the Search List or Filters. 
4. Click on Dell Command | Update, ensuring it says 2.4.0 under the Version column.  
    
5. Click ADD VERSION in the top right corner.
    
6. Click Upload, then Choose File. Select DellCommandUpdate.msi (extracted from our previous step), and click Save. 
7. Ensure you select the checkbox for Retire Previous Versions. Selecting this option will force all devices to update to the 3.1.1 version of Dell Command | Update.
   
8. You can make any minor adjustments under the Deployment Options tab to the app such as updating the Install Timeout to a lower value or updating the When to Install conditions. Once your customizations (optional) are completed, click Save & Assign. 
9. Once the app has been published, you should see that Dell Command | Update version 3.1.1 is now the only active option being deployed. 
   Note: If you wanted to rollback to version 2.4, you could use the Filters option to see Retired or All apps and unretire version 2.4 and retire or deactivate version 3.1.1. 
   

Pushing the OEM Updates Profile with Dell Command | Update 3.1+  

There are a few nuances to consider once you have deployed Dell Command | Update 3.1 to your managed Dell devices with Workspace ONE UEM which I will cover and provide workarounds for until they are addressed in the product.  

1. If you upgrade from Dell Command | Update version 2.4 to 3.1+ a profile re-push is required since the settings are not retained during the upgrade.  
2. During an OEM Updates profile push, if the Dell Command | Update GUI is open, then the profile will fail to install. The error on the device shows that dcu-cli is currently in use and cannot apply the settings. This did not occur with the 2.4 version.  
3. If you choose Monthly for Check for Updates under Schedule in the OEM Updates profile, the Day of the month gets set; however, users are still able to change this configuration option in the Dell Command | Update GUI under Settings. I do not see this as a huge issue since the devices will still check for updates and apply them even if the user decides to change the day of the month, therefore I will not cover this and we can wait for a Dell Command | Update product update to fix this issue.
   

Now that we know of these nuances, we can see how to overcome them. I will start with addressing how to successfully push the OEM Updates profile if the Dell Command | Update is still open on the user’s desktop. We will create a new OEM Updates profile which will run a PowerShell command to close Dell Command | Update, then apply the OEM Updates profile.  

1. Start by unassigning or deactivating your old profile before pushing the new profile. Feel free to follow these steps and do some testing, but before assigning the new profile to all your devices, the old profile should be removed.  
2. In the Workspace ONE UEM console, navigate to Devices > Profiles & Resources > Profiles, then click on ADD > Add Profile.  
3. Click Windows, then Windows Desktop, then Device Profile. Complete the following steps: 
   1. Type OEM Updates for Name. 
   2. Type Auto Close Dell Command | Update for Description.  
   3. Select your Smart Group to target your Dell devices. 
   4. Scroll down to the bottom. 
   5. Click on Custom Settings, then Configure.
      
4. We will see how we can run a simple PowerShell command targeted to the Workspace ONE Intelligent Hub to close Dell Command | Update before applying the OEM Updates profile. Note: It’s very important to configure the Custom Settings payload before the OEM Updates payload so that we close the Dell Command | Update GUI before applying the settings.
   1. Switch the Target to Workspace ONE Intelligent Hub.
   2. Uncheck the Make Commands Atomic checkbox.
   3. Paste in the below text for Install Settings and Remove Settings.  

Note: Ensure the ID is a unique value. In this example, I used 1 and 2. A unique ID must be provided for each node and VMware uses GUID values so there will not be any overlap.

The PowerShellCommand value that we are using is:
Stop-Process -Name ‘DellCommandUpdate’ -Force; Start-Sleep -s 3
This command will close Dell Command | Update if its open on the user’s desktop. Feel free to modify the script for your needs, but make sure to test the functionality before continuing.  

<wap-provisioningdoc id="1" name="customprofile"> 

   <characteristic type="com.airwatch.winrt.powershellcommand" uuid="7957d046-7765-4422-9e39-6fd5eef38174"> 

     <parm name="PowershellCommand" value="Stop-Process -Name 'DellCommandUpdate' -Force; Start-Sleep -s 3"/> 

  </characteristic>  

</wap-provisioningdoc> 

4. Click OEM Updates, then click Configure.
   

5. Configure your OEM Updates payload, then click Save and Publish.  
6. Optionally, you can validate that the profile is configured correctly by clicking on the radio button next to your profile, then clicking </> XML. You should see com.airwatch.winrt.customsettings first, then com.airwatch.winrt.oem second. This means that the device will process the PowerShell command first then apply the OEM Updates settings. 
   Note: When making updates to the OEM Updates payload, the order will switch; thus, if you plan to make changes, you will have to edit the profile, then add version, remove the OEM Updates payload, then re-configure the OEM Updates payload. You can also copy the XML and paste the entire payload into a single Custom Settings profile; however, you will lose out on the OEM Updates payload UI to quickly see the current settings.
   1. You can also achieve a similar workaround using Workspace ONE Intelligence automation and Device Sensors. Below is an example using Sensors to return the Dell Command | Update version and Lock Status (if OEM Updates profile has configured Dell Command | Update), then publishes the profile to close Dell Command | Monitor (create a profile with only the PowerShell Custom Settings payload). The automation will also tag the device, this tag is tied to a custom smart group which is assigned to the new OEM Updates profile.
      Note: I chose not to add both payloads to the same profile to get around needed to re-configure the OEM Updates profile. I also chose not to use two consecutives Install Profile actions since these actions are done in parallel, not sequentially.  
   2. Call to Action: If you find other workarounds please post them in the comments below!  
   3. Download dcu_locked sample Sensor   
   4. Download dcu_version sample Sensor   

Lessons Learned using Dell Command | Monitor with Workspace ONE UEM 

While starting my testing with Dell Command | Update, a few VMware Technology Network (VMTN) users mentioned having issues using the BIOS profile. After some investigation with our product team, I have some lessons learned to quickly mention.  

1. Starting with VMware Workspace ONE UEM version 1904, the Dell Command | Monitor client is automatically seeded and pushed along with the publishing of the BIOS profile. You no longer must worry about pushing the Dell Command | Monitor client! Version 10.0.0.331 is seeded in the console and version 10.2.1 is the latest release from Dell. You can publish the latest version via Apps & Books; however, only do this if you required features in the latest version. Steps for deploying the Dell Command | Monitor client can be found in the Integrating with Dell Client Command Suite: Operational Tutorial.  
2. If your BIOS profile continues to fail to install, ensure that the settings and configurations you have selected in the profile are supported by the device type/model. Keep in mind that BIOS Attributes and System Properties under the Custom section of the BIOS payload are required and will cause the profile to fail if one of these settings are not supported by the device.  

Troubleshooting Tips 

One of my most popular tutorials is the Troubleshooting Windows 10: Operational Tutorial and I plan on making some major updates soon! In the meantime, if you are trying to increase the logging level to troubleshoot issues with Dell Command | Update or Dell Command | Monitor please see my quick tips posted on this VMTM post.  

Getting Started and Related Resources 

• Integrating with Dell Client Command Suite Operational Tutorial  
• Understanding Windows 10 Modern Management Learning Path  
• Using Workspace ONE Sensors Lab Walk-through  
• Be sure to join the conversations in the VMTN discussion forums!