Install BlackBerry UEM version 12.21 MR1 or 12.23 in a BSI-certified environment

  1. Extract the contents of the UEM installation package.
  2. Run a text editor as an administrator and open the deployer.properties file from the extracted installation package (<drive>:\BlackBerry\UEM\BlackBerry UEM <version>).
  3. Specify the properties as required for your organization’s environment. For more information about the available properties, see the UEM Installation and Upgrade Guide.
    For the db.authentication.type property, use the default value of INTEGRATED to configure UEM to connect to the UEM database using Windows authentication.
  4. Save and close the deployer.properties file.
  5. In the text editor, open the bsi.properties file from the extracted installation package (<drive>:\BlackBerry\UEM\BlackBerry UEM <version>\context).
  6. Specify the following properties:
    • cert.pinning.tenant: Specify the SRP ID for the UEM instance that you will install.
    • tenant.country.code: The country code for the location of your tenant (for example, DE).
  7. Save and close the bsi.properties file.
    Note: If steps 5 to 7 are not completed, the UEM installation process will fail and the UEM database must be deleted before you run the installer again.
  8. Using the same Windows service account that you will use to run the UEM installation process, open the command prompt as an administrator.
  9. Run the following commands to generate a database encryption key:
    • cd <extracted_UEM_installer_package>\db\Database\tools
    • beskeytool.bat generatekey

    The database encryption key is displayed. Copy and save the key value if you want to install multiple instances of UEM (instructions are provided below for how to import the generated key to the additional UEM instances).

  10. Run the following commands to install UEM from the command prompt and enable an encrypted connection between UEM and Microsoft SQL Server:
    setup.exe --script --iAcceptBESEULA --propertyFiles bsi.properties --properties "db.encrypt=true,db.trustServerCertificate=false,db.trustmanagerclass= mdm.contract.database.ssl.NiapSQLServerTrustManager, db.trustmanagerconstructorarg=<path_to_SQL_certificate>"

    If you want to use a group Managed Service Account (gMSA) to install or upgrade UEM and run the UEM services, see Configure permissions for the service account, and Install or upgrade BlackBerry UEM using the command prompt window for the modified commands that you will need to use.

  11. After the installation process is complete, in the Windows Services, verify that the UEM Core and Management console services are running. To verify the version of UEM that is installed, including the specific build (catalog) number, open “Add or remove programs” in Windows and select BlackBerry UEM to view the version.
  • Log in to UEM for the first time.
  • Create an LDAP client certificate used for mutual authentication and connect to an LDAP directory.
  • See the Guide to setting up BlackBerry UEM for a reference that walks you through the resources for setting up and administering a UEM environment. For additional setup tasks that must be completed for a BSI-certified environment, see Configure BlackBerry UEM for a BSI-certified environment.
  • If you want to install multiple instances of UEM, repeat the installation steps above on a different computer, but at step 9 you must run the following commands instead:
    • cd <extracted_UEM_installer_package>\db\Database\tools
    • beskeytool.bat importkey -key <key_value> -server <database_server_hostname> -instance <database_instance> -port <database_port> -name <database_name> -authtype INTEGRATED -user <database_user_name>
    <key_value> is the database encryption key that was generated in step 9. If you did not save the generated key, you can run the following command on the computer where you installed the first UEM instance to display the key:
    • cd <extracted_UEM_installer_package>\db\Database\tools
    • beskeytool.bat printkey