VirusScan Enterprise - McAfeedownloadcenter.mcafee.com/.../docs/vse_70_configguide_epo_25x_en… · Configuration Guide 5 Preface This Configuration Guide introduces the configuration

C O N F I G U R A T I O N G U I D E

V E R S I O N 7 . 0

VirusScan Enterprise

For use wi th ePolicy Orchestrator versions 2.5 and 2.5.1

COPYRIGHT

© 2003 Networks Associates Technology, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Networks Associates Technology, Inc., or its suppliers or affiliate companies. To obtain this permission, write to the attention of the Network Associates legal department at: 3965 Freedom Circle, Santa Clara, California 95054, or call +1-972-308-9960.

TRADEMARK ATTRIBUTIONS

Active Firewall, Active Security, Active Security (in Katakana), ActiveHelp, ActiveShield, AntiVirus Anyware and design, Bomb Shelter, Certified Network Expert, Clean-Up, CleanUp Wizard, CNX, CNX Certification Certified Network Expert and design, Design (stylized N), Disk Minder, Distributed Sniffer System, Distributed Sniffer System (in Katakana), Dr Solomon’s, Dr Solomon’s label, Enterprise SecureCast, Enterprise SecureCast (in Katakana), Event Orchestrator, EZ SetUp, First Aid, ForceField, GMT, GroupShield, GroupShield (in Katakana), Guard Dog, HelpDesk, HomeGuard, Hunter, LANGuru, LANGuru (in Katakana), M and design, Magic Solutions, Magic Solutions (in Katakana), Magic University, MagicSpy, MagicTree, McAfee, McAfee (in Katakana), McAfee and design, McAfee.com, MultiMedia Cloaking, Net Tools, Net Tools (in Katakana), NetCrypto, NetScan, NetShield, NetStalker, Network Associates, NetXray, NotesGuard, Nuts & Bolts, Oil Change, PC Medic, PCNotary, PrimeSupport, Recoverkey, Recoverkey – International, Registry Wizard, ReportMagic, Router PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, SmartDesk, Sniffer, Sniffer (in Hangul), Stalker, SupportMagic, TIS, TMEG, Total Network Security, Total Network Visibility, Total Network Visibility (in Katakana), Total Service Desk, Total Virus Defense, Trusted Mail, UnInstaller, Virex, Virus Forum, ViruScan, VirusScan, WebScan, WebShield, WebShield (in Katakana), WebSniffer, WebStalker, WebWall, Who’s Watching Your Network, WinGauge, Your E-Business Defender, ZAC 2000, Zip Manager are registered trademarks of Network Associates, Inc. and/or its affiliates in the US and/or other countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners.

This product includes or may include software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)

This product includes or may include cryptographic software written by Eric Young. ([email protected])

LICENSE AGREEMENTNOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE

YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED

SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND

OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE

PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE

PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF

YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF

APPLICABLE, YOU MAY RETURN THE PRODUCT TO NETWORK ASSOCIATES OR THE PLACE OF PURCHASE FOR A FULL

REFUND.

Issued FEBRUARY 2003 / VirusScan® Enterprise software version 7.0

http://www.openssl.org/

mailto:[email protected]


Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Getting more VirusScan Enterprise information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Getting related ePolicy Orchestrator information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Contacting McAfee and Network Associates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1 Configuring AutoUpdate 7.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Adding the AutoUpdate 7.0 .NAP file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Creating an update task for VirusScan Enterprise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Creating a new update task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Setting task options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Scheduling the task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Creating a mirror task for VirusScan Enterprise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Creating a new mirror task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Setting task options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Setting AutoUpdate 7.0 policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

2 Configuring VirusScan Enterprise 7.0 . . . . . . . . . . . . . . . . . . . . . 21

Adding the product to the Repository . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Deploying the product . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Adding the product installation files to the Repository . . . . . . . . . . . . . . . . . . . . . . . . 22

Deploying VirusScan Enterprise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Setting policies for the product . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Server and workstation policy settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Setting general policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Setting policies for default processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Advanced . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Configuration Guide iii

Contents

Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Setting policies for low-risk processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Setting policies for high-risk processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Setting policies for on-delivery scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Advanced . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Setting user interface policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Display Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Password Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Setting Alert Manager Alerts policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Alert Manager Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Scheduling tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Creating a new scan task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Configuring the scan task settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Configuring the schedule settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Scheduling the task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

iv VirusScan® Enterprise software version 7.0

Preface

This Configuration Guide introduces the configuration information of VirusScan® Enterprise software version 7.0 for use with McAfee ePolicy Orchestrator™ versions 2.5 and 2.5.1, and provides the detailed instructions for:

n Installing the VirusScan Enterprise 7.0 .NAP files in the ePolicy Orchestrator repository.

n Configuring VirusScan Enterprise policies.

n Deploying the VirusScan Enterprise 7.0 software.

n Scheduling a task from the ePolicy Orchestrator console.

AudienceThis information is designed for system and network administrators who are responsible for their company’s anti-virus program.

Configuration Guide 5

Preface

Getting more VirusScan Enterprise information

Product Guide Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures.

Available in an Adobe Acrobat .PDF file from either the product CD or the McAfee download site.

Installation Guide

System requirements and instructions for installing and starting the software.

Available as a printed booklet that accompanies the product CD. Also available in an Adobe Acrobat .PDF file from either the product CD or the McAfee download site.

Help Product information in the Help system that is accessed from within the application.

n The Help system provides high-level and detailed information. Access from either a Help menu option or Help button in the application.

n Context-sensitive (What’s This?) Help provides brief descriptions of the selections in the application. Access by right-clicking on an option, pressing the [F1] control key, or dragging the question icon to an option.

Release Guide The Release Guide for VirusScan Enterprise 7.0 contains product information, detailed instructions for configuring the software, information on new features and their use.

6 VirusScan® Enterprise software version 7.0

Preface

Release Notes README file. Product information, system requirements, resolved issues, any known issues, and last-minute additions or changes to the product or its documentation.

Available as a .TXT file from either the product CD or the McAfee download site.

Contact A list of phone numbers, street addresses, web addresses, and fax numbers for Network Associates offices in the United States and around the world. Also provides contact information for services and resources, including:

n Technical Support

n Customer Service

n Download Support

n AVERT Anti-Virus Emergency Response Team

n McAfee Beta Site

n On-Site Training

n Network Associates Offices Worldwide


Preface

Getting related ePolicy Orchestrator informationSeveral documents are directly referred to in this guide. It is important to have ready access to these documents while configuring VirusScan Enterprise 7.0 with ePolicy Orchestrator.

Product Guide Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures.

Available in an Adobe Acrobat .PDF file from either the product CD or the McAfee download site.

Help Product information in the Help system that is accessed from within the application.

n The Help system provides high-level and detailed information. Access from either a Help menu option or Help button in the application.

n Context-sensitive (What’s This?) Help provides brief descriptions of the selections in the application. Access by right-clicking on an option, pressing the [F1] control key, or dragging the question icon to an option.

Release Notes README file. Product information, system requirements, resolved issues, any known issues, and last-minute additions or changes to the product or its documentation.

Available as a .TXT file from either the product CD or the McAfee download site.


Preface

Contacting McAfee and Network Associates

Technical Support http://knowledge.nai.com

McAfee Beta Site www.mcafeeb2b.com/beta/

AVERT Anti-Virus Emergency Response Team

www.mcafeeb2b.com/naicommon/avert/default.asp

Download Site www.mcafeeb2b.com/naicommon/download/

DAT File Updates www.mcafeeb2b.com/naicommon/download/dats/find.asp

ftp://ftp.nai.com/pub/antivirus/datfiles/4.x

Product Upgrades www.mcafeeb2b.com/naicommon/download/upgrade/login.asp

Valid grant number required. Contact Network Associates Customer Service.

On-Site Training www.mcafeeb2b.com/services/mcafee-training/default.asp

Network Associates Customer Service:

E-mail [email protected]

Web www.nai.com

www.mcafeeb2b.com

US, Canada, and Latin America toll-free:

Phone +1-888-VIRUS NO or +1-888-847-8766

Monday – Friday, 8 a.m. – 8 p.m., Central Time

For additional information on contacting Network Associates and McAfee — including toll-free numbers for other geographic areas — see the Contact file that accompanies this product release.


http://knowledge.nai.com

http://www.mcafeeb2b.com/beta/

http://www.mcafeeb2b.com/naicommon/avert/default.asp

http://www.mcafeeb2b.com/naicommon/download/

http://www.mcafeeb2b.com/naicommon/download/dats/find.asp

ftp://ftp.nai.com/pub/antivirus/datfiles/4.x

http://www.mcafeeb2b.com/naicommon/download/upgrade/login.asp

http://www.mcafeeb2b.com/services/mcafee-training/default.asp


http://www.nai.com

http://www.mcafeeb2b.com

Preface


1
Configuring AutoUpdate 7.0
AutoUpdate 7.0 is a common component used in multiple McAfee products, and it contains both scheduling and updating features. The AutoUpdate 7.0 scheduling feature is used to schedule all update and mirror tasks. The AutoUpdate 7.0 updating feature is used to perform scheduled or immediate update tasks.

This chapter provides information on deploying and managing VirusScan Enterprise 7.0 with ePolicy Orchestrator versions 2.5 and 2.5.1. The following steps are used to configure AutoUpdate 7.0 via ePolicy Orchestrator to manage VirusScan Enterprise update tasks.

1 Adding the AutoUpdate 7.0 .NAP file

2 Creating an update task for VirusScan Enterprise

3 Creating a mirror task for VirusScan Enterprise

4 Setting AutoUpdate 7.0 policy

Adding the AutoUpdate 7.0 .NAP fileBefore creating update tasks for VirusScan Enterprise from the ePolicy Orchestrator console, you must add the AutoUpdate .NAP file to the Repository.

1 Log on to the ePolicy Orchestrator server.

2 In the console tree under ePolicy Orchestrator, right-click Repository, then select Configure Repository.

Figure 1-1. Configure Repository option



The Configuration Software Repository dialog box appears.

3 Select Add new software to be managed.

4 Click Continue to open the Select a Software Package dialog box.

5 Select the CMU300.NAP file.

6 Click Open to add the file to the Repository.

7 Click Yes when prompted to enable software deployment support.

NOTEClicking Yes adds the installation files to the Repository. If you click No, the installation files must be added manually.

8 Click OK when complete.

Creating an update task for VirusScan EnterpriseUse these procedures to create, edit, or schedule an update task for VirusScan Enterprise:

n Creating a new update task

n Setting task options

n Scheduling the task on page 13

Figure 1-2. Configure Software Repository



Creating a new update task1 In the console tree under ePolicy Orchestrator, right-click Directory or the

desired site, group, or computer, then select Schedule Task. The Schedule New Task dialog box appears.

2 Type a New Task Name. This can be any name or description for the task, and will be listed on the Tasks tab.

3 From the Software list, select McAfee AutoUpdate 7.0 — Update.

4 Click OK to create the new task.

Setting task optionsThis task does not require configuration.

Scheduling the taskFor more information about scheduling tasks, see Scheduling tasks on page 44.

1 On the Tasks tab in the upper details pane, right-click the task that you created, then select Edit Task. The ePolicy Orchestrator Scheduler dialog box appears.

2 On the Task tab, deselect Inherit.

3 To enable this task, select Enable; otherwise, it won’t start, regardless of settings in this dialog box.

4 Select Stop the task if it runs for to limit the amount of time for which the task can run before it is automatically cancelled.

5 Click the Schedule tab.



6 Deselect Inherit.

7 Select the frequency for the task in Schedule Task, then specify the corresponding Schedule Task options.

� If you select a Daily frequency in Schedule Task, specify the daily interval under Schedule Task Daily.

� If you select a Weekly frequency in Schedule Task, specify the weekly interval and select the days of week on which to execute the task.

8 Select the Start Time and whether to use UTC Time (formerly GMT Time) or Local Time.

NOTEUTC (Universal Time Coordinate) is a new acronym designed to be used in all languages to replace the English term Greenwich Mean Time (GMT).

9 Select Enable randomization to start this task randomly on all selected client computers, then enter the time within which you want all computers to start the task.

Figure 1-3. Schedule tab



10 Select Run missed task if you want to ensure that this task is started on any client computers that are not available during the scheduled time.

NOTEIf your systems run a login script after a reboot, then you will want to enter a number of minutes in the Delay missed task by box so that the task will not begin until after the login scripts have run.

11 Click OK.

Creating a mirror task for VirusScan EnterpriseUse these procedures to create a mirror task for VirusScan Enterprise.

NOTEA mirror site refers to your repository list and mirrors (replicates) the first site listed. If it cannot connect for some reason, the mirror site tries the next site listed, and so on.

Creating a new mirror task1 In the console tree under ePolicy Orchestrator, right-click Directory or the


2 Type a New Task Name. This can be any name or description for the task, and will be listed on the Tasks tab.

3 From the Software list, select Common Update with a Task Type of Mirror.

4 Click OK to create the new task.

Setting task options1 On the Tasks tab in the details pane, right-click the task that you created, then

select Edit Task. The ePolicy Orchestrator Scheduler dialog box appears.

2 Click Settings. The Task Settings dialog box appears.



3 Deselect Inherit.

4 Set Destination Options by entering the path to the folder where you want the mirror to reside. The path must be a local folder with read and write access.

5 Click OK to return to the ePolicy Orchestrator Scheduler dialog box.

Setting AutoUpdate 7.0 policyUse AutoUpdate 7.0 to define repositories from which you can obtain the latest updates for your McAfee anti-virus products.

1 In the console tree under ePolicy Orchestrator, select Directory.

2 In the upper details pane, expand McAfee AutoUpdate 7.0 and select Configuration. The McAfee AutoUpdate 7.0 General Policies dialog box appears.

Figure 1-4. Task Settings — Mirror



Repositories tab

1 Click the Repositories tab.

2 Deselect Inherit. A Default site is preconfigured to connect to the Network Associates HTTP download site. By leaving it selected, this site is used as one of your User defined repositories.

3 To add a new site to your repositories list, click Add. The Site options dialog box appears.

Figure 1-5. General Policies



4 In the Repository field, type the name for this repository. This name will appear in your list of repositories.

5 Select the appropriate type of site:

� HTTP SiteA web page.

� FTP SiteAn FTP site.

� UNC PathA shared UNC directory (for example, \\PATH\TO\DIRECTORY).

� Local PathA site on the computer, either a local or a mapped drive.

6 In URL or Path (depending on which type of site you selected), type the path to the site. In Port, specify the port. Specify login credentials with read access if authentication is necessary.

NOTEThe standard HTTP port is 80. The standard FTP port is 21.

7 Click OK to return to the McAfee AutoUpdate 7.0 General Policies dialog box.

Proxy Settings tab

1 Click the Proxy Settings tab.

Figure 1-6. Site options



2 Deselect Inherit.

3 Select the appropriate type of proxy settings:

� Don’t use a proxyConnect directly, without a proxy. (This is selected as the default.)

� Use Internet Explorer Proxy SettingsUse the same proxy settings found in the computer’s Internet Explorer options.

� Manually configure the proxy settingsUse the proxy settings specified here.

4 If you selected Manually configure the proxy settings, specify them in the space provided. Enter the Address and Port number for your HTTP or FTP proxy, as well as authentication information if it is required.

5 If you have any exceptions, select Specify exceptions and enter any repositories that you want to connect to directly (without using a proxy) in the text box provided.

Figure 1-7. Proxy Settings



NOTEThe Manually configure the proxy settings option automatically bypasses the local server address.

Advanced tab

1 Click the Advanced tab.

2 Deselect Inherit.

3 Under Repository selection options, select the appropriate option:

� Use ePO configured repositoriesUse the list of sites that was configured from within ePolicy Orchestrator using AutoUpdate 7.0, as described in this chapter.

� Use client configured repositoriesUse the list of sites that was configured from within the local copy of VirusScan on the workstation.

NOTEYou can customize the policy at any directory level. For example, you can configure some sites at root directory level, and configure other sites at a subdirectory level.

4 Click Apply.


2
Configuring VirusScan Enterprise 7.0
VirusScan Enterprise 7.0 software replaces the VirusScan 4.5.1 and NetShield 4.5 products. Therefore, VirusScan Enterprise installs on both desktops and servers.

This chapter provides instructions on:

n Adding the product to the Repository on page 21

n Deploying the product on page 22

n Setting policies for the product on page 25

n Scheduling tasks on page 44

Adding the product to the RepositoryBefore configuring or deploying VirusScan Enterprise from the ePolicy Orchestrator console, you must add the VirusScan Enterprise .NAP file to the Repository.

1 Log on to the ePolicy Orchestrator server with administrator rights.

2 In the console tree under ePolicy Orchestrator, right-click Repository, then select Configure Repository.

The Configuration Software Repository dialog box appears.

Figure 2-1. Configure Repository option



3 Select Add new software to be managed.

4 Click Continue to open the Select a Software Package dialog box.

5 Select the VSE700.NAP file.

6 Click Open to add the file to the Repository.

7 Click Yes when prompted to enable software deployment support.

NOTEClicking Yes adds the installation files to the Repository. If you click No, the installation files must be added manually. For more information, see Adding the product installation files to the Repository on page 22.

8 Click OK when complete.

Deploying the productYou can deploy the VirusScan Enterprise product, with or without modified policies, to a site, group, single computer, or the Directory.

Adding the product installation files to the RepositoryTo deploy VirusScan Enterprise from the ePolicy Orchestrator console, the VirusScan Enterprise installation package file (INSTALL.PKG) and the setup (binary) files must be added to the Repository. These files are either on the product CD or at a location where you have stored them.

Figure 2-2. Configure Software Repository dialog box



If you have modified VirusScan Enterprise and created a customized .PKG file with McAfee Installation Designer™ to deploy, you can browse to its location during this process.

NOTEIf you selected Yes in Step 7 on page 22, you do not need to perform this procedure.


2 In the console tree under ePolicy Orchestrator, right-click Repository, then select Configure Repository. The Configure Software Repository dialog box appears.

3 Select Enable software deployment, then click Continue to open the Select a Software Package dialog box.

4 Select the INSTALL.PKG file, then click Open.

NOTEIf the setup (binary) files are located in the same folder as the INSTALL.PKG file, they are installed automatically. If the setup files are located in a different folder, use the Browse dialog box to select the folder containing the binaries.

5 Click OK when the installation completes successfully.

Deploying VirusScan EnterpriseOnce all the necessary VirusScan Enterprise software files have been added to the Repository, you can deploy the software to a selected site, group, single computer, or the entire Directory.

NOTEYou can deploy the product before or after setting other policies.

1 In the console tree under Directory, select the desired site, group, single computer, or the entire Directory to which you want to deploy VirusScan Enterprise.



2 Select VirusScan Enterprise 7.0 on the Policies tab in the upper details pane.

The installation page appears in the lower details pane.

3 Deselect Inherit.

4 Select Force Install VirusScan Enterprise.

5 Click Select to open the Software Package dialog box.

6 Select the VirusScan Enterprise 7.0 software package, then click OK.

7 Click Apply to save these settings.

Figure 2-3. Directory and Policy selections

Figure 2-4. VirusScan Enterprise installation page



8 When you are ready to make this installation policy available to the ePolicy Orchestrator agent, select Enforce Policies for VirusScan Enterprise.

WARNINGClicking Apply does not install the software to the designated targets. Selecting Enforce Policies for VirusScan Enterprise sets the product to be installed during the next agent-to-server communication. This also installs the customized policies, if you altered and applied them. For more information about agent-to-server communication, see the ePolicy Orchestrator version 2.x product documentation.

Setting policies for the productConfiguring VirusScan Enterprise 7.0 policies from the ePolicy Orchestrator console allows you to enforce, across groups of computers, the options that define how all tasks and permissions are configured. These policies override configurations set on individual workstations.

For information regarding policies and how they are enforced, see the ePolicy Orchestrator 2.x product documentation.

Before configuring any policies, select the group of computers in the console tree for which you want to set policies.

The VirusScan Enterprise 7.0 policy tabs, on which you can set VirusScan Enterprise policies, are nearly identical to the dialog boxes and their tabs in the VirusScan Console. For complete information about the options you can set for VirusScan Enterprise, refer to the VirusScan Enterprise 7.0 Product Guide.

NOTEOnce you set and save the desired policy options for a destination computer or group of destination computers, and you are ready to make the new policies available to the ePolicy Orchestrator agent to deploy, you must select VirusScan Enterprise 7.0 on the Policies tab in the upper details pane and select Enforce Policies for VirusScan Enterprise in the lower details pane. Selecting this option allows the policies to be deployed during the next agent-to-server communication.



To set policies for VirusScan Enterprise in ePolicy Orchestrator:


2 In the console tree under ePolicy Orchestrator | Directory, select the site, group, single computer, or the entire Directory.

The Policies, Properties, and Tasks tabs appear in the upper details pane.

3 Select the Policies tab in the upper details pane, then expand VirusScan Enterprise 7.0. The following policy pages appear in the tree:

� General Policies

� Default Processes Policies

� Low-Risk Processes Policies

� High-Risk Processes Policies

� On Delivery E-Mail Scan Policies

� User Interface Policies

� Alert Manager Alert Policies

4 Select an item under VirusScan Enterprise 7.0 to display its policy pages.

Figure 2-5. ePolicy Orchestrator console



Server and workstation policy settingsAt the top of every policy page are two buttons: Server and Workstation. These buttons allow you to select whether you are configuring policies for the servers or workstations in the group of destination computers. Therefore, you can simultaneously deploy two different configurations to the computers in a given group. It is important that you select and verify this option as you configure the settings.

Setting general policiesThe options on the General Policies tabs apply to all on-access scanning.

Select General Policies under VirusScan Enterprise 7.0 in the upper details pane. These options are divided among three tabs: General, Messages, and Reports.

General1 In the lower details pane, select the General tab.

2 Deselect Inherit.

3 Configure the following policy options:

Figure 2-6. General Policies — General tab



ScanChoose whether to scan floppy disks during shutdown, and whether to scan boot sectors.

GeneralChoose the location and name of the on-access scan quarantine folder, and whether to enable or disable on-access scanning at startup.

Scan timeChoose the maximum scan time in seconds for archives and the maximum scan time for all files. You can also choose whether to enforce the scan time limit for all files.


NOTEThis tab is identical to the General tab of the VirusScan On-Access Scan Properties dialog box when you select General Settings. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

Messages1 In the lower details pane, select the Messages tab.

2 Deselect Inherit.

3 Configure the following policy options on this tab:

Figure 2-7. General Policies — Messages tab



Messages for local usersChoose whether to display the On-Access Scan Messages dialog box for local users, and what actions the local users without administrator rights can take on infected files.

Response to network usersChoose whether to send network users a message in the event of an outbreak, and whether to disconnect remote users and deny access to the network share in the event of an outbreak.


NOTEThis tab is identical to the Messages tab of the VirusScan On-Access Scan Properties dialog box when you select General Settings. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

ReportsThese options allow you to configure and specify the logging of virus activity.

1 In the lower details pane, select the Reports tab.

2 Deselect Inherit.


Log fileChoose whether to log virus activity data to a log file, whether to limit the size of the log file, and specify the location of the log file.

What to log in addition to virus activityChoose what types of information you want logged.

Figure 2-8. General Policies — Reports tab




NOTEThis tab is identical to the Reporting tab of the VirusScan On-Access Scan Properties dialog box when you select General Settings. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

Setting policies for default processesThe default processes policies that you set here are for on-access scanning. Default processes are any processes that are not specified as low-risk or high-risk.

In the upper details pane, select Default Processes Policies. These policy options are divided among four tabs: Processes, Detection, Advanced, and Actions.

ProcessesThese options allow you to specify which processes are scanned by default during an on-access scan.

1 In the lower details pane, select the Processes tab.

2 Deselect Inherit.

3 Choose whether to set policies for all processes or only those processes not specified as low-risk or high-risk. (For information about low-risk and high-risk processes, see the VirusScan Enterprise 7.0 Product Guide.)


NOTEThis tab is identical to the Processes tab of the VirusScan On-Access Scan Properties dialog box when you select Default Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

Figure 2-9. Default Processes Policies — Processes tab



DetectionThese options allow you to specify what is scanned and not scanned during an on-access scan.

1 In the lower details pane, select the Detection tab.

2 Deselect Inherit.


Scan filesChoose when to scan files and whether files on network drives are scanned.

What to scanChoose which file types to scan. Use the Additions button to add file types to the list of default file types, or the Specified button to define a custom list of file types to scan.

What not to scanUse the Exclusions button to define a custom list of specific files, folders, and drives not to scan.

Select Overwrite client exclusions if you want only the exclusions that have been added in the policy to be used.

NOTEIf Overwrite client exclusions is deselected, the client machine will use the exclusions that were set locally and the exclusions set here, in the policy.

Figure 2-10. Default Processes Policies — Detection tab




NOTEThis tab is nearly identical to the Detection tab of the VirusScan On-Access Scan Properties dialog box when you select Default Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

AdvancedThis tab allows you to specify advanced scan options to be used during an on-access scan.

1 In the lower details pane, select the Advanced tab.

2 Deselect Inherit.


HeuristicsChoose whether to scan for unknown viruses.

Non-virusesChoose whether to scan for potentially unwanted programs and joke programs.

Compressed filesChoose whether to scan packed executables, archives, and MIME-encoded files.


Figure 2-11. Default Processes Policies — Advanced tab



NOTEThis tab is identical to the Advanced tab of the VirusScan On-Access Scan Properties dialog box when you select Default Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

ActionsThis tab allows you to define the primary and secondary actions to perform on infected files during an on-access scan.

1 In the lower details pane, select the Actions tab.

2 Deselect Inherit.

3 Use the drop-down lists to define the primary and secondary actions to perform on infected files.


NOTEThis tab is identical to the Action tab of the VirusScan On-Access Scan Properties dialog box when you select Default Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

Figure 2-12. Default Processes Policies — Actions tab



Setting policies for low-risk processesThese policies apply to processes specified as having a lower risk of infection, and are used during an on-access scan.

Select Low-Risk Processes Policies under VirusScan Enterprise 7.0 on the Policies tab in the upper details pane. These policy options are divided among four tabs: Processes, Detection, Advanced, and Actions.

NOTEIf you selected Use the settings on these tabs for all processes for Default Processes, the policies options for Low-Risk Processes and High-Risk Processes are disabled.

The options on these tabs affect processes specified as low-risk on the Processes tab. The Detection, Advanced, and Actions tabs are identical to the tabs of the same names under Default Processes Policies. For instructions on setting the options on these tabs, see Setting policies for default processes on page 30.

ProcessesThe options on this tab allow you to specify which processes have a low risk of spreading infection and are scanned as such during an on-access scan.


2 Deselect Inherit.

3 Use the Add and Remove buttons to define the list of low-risk processes.


Figure 2-13. Low-Risk Processes Policies — Processes tab



NOTEThis tab is identical to the Processes tab of the VirusScan On-Access Scan Properties dialog box of VirusScan Enterprise when you select Low-Risk Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

Setting policies for high-risk processesThese policies apply to processes specified as having a higher risk of infection, and are used during an on-access scan.

Select High-Risk Processes Policies under VirusScan Enterprise 7.0 on the Policies tab in the upper details pane. These policy options are divided among four tabs: Processes, Detection, Advanced, and Actions.

NOTEIf you selected Use the settings on these tabs for all processes for Default Processes, the policies options for Low-Risk Processes and High-Risk Processes are disabled.

The options on these tabs affect processes specified as high-risk on the Processes tab. The Detection, Advanced, and Actions tabs are identical to the tabs of the same names under Default Processes Policies. For instructions on setting the options on these tabs, see Setting policies for default processes on page 30.

ProcessesThe options on this tab allow you to specify which processes have a high risk of spreading infection, and will be scanned as such during an on-access scan.


2 Deselect Inherit.

Figure 2-14. High-Risk Processes Policies — Processes tab



3 Use the Add and Remove buttons to define the list of high-risk processes.


NOTEThis tab is identical to the Processes tab of the VirusScan On-Access Scan Properties dialog box of VirusScan Enterprise when you select High-Risk Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

Setting policies for on-delivery scanningSelect On Delivery E-Mail Scan Policies under VirusScan Enterprise 7.0 in the upper details pane. Policy options for on-delivery scanning are divided among five tabs: Detection, Advanced, Actions, Alerts, and Reports.

DetectionThis tab allows you to specify detection options during an on-delivery scan.

1 In the lower details pane, select the Detection tab.

2 Deselect Inherit.


Scanning of e-mailChoose whether to enable on-delivery e-mail scanning for Microsoft Exchange clients.

Figure 2-15. On Delivery E-Mail Scan Policies — Detection tab



AttachmentsChoose which file types to scan. Use the Additions button to add file types to the list of default file types, or the Specified button to define a custom list of file types to scan.


NOTEThis tab is identical to the Detection tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise version 7.0 Product Guide.

AdvancedThis tab allows you to specify advanced scan options during an on-delivery scan.

1 In the lower details pane, select the Advanced tab.

2 Deselect Inherit.


HeuristicsChoose whether to scan for unknown viruses.

Non-virusesChoose whether to scan for potentially unwanted programs and joke programs.

Figure 2-16. On Delivery E-Mail Scan Policies — Advanced tab



Compressed filesChoose whether to scan compressed files, archives, and MIME-encoded files.

E-mail message bodyChoose whether to scan the body of e-mail messages.


NOTEThis tab is identical to the Advanced tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

ActionsThis tab allows you to define the primary and secondary actions to perform on infected e-mail messages and their attachments.

1 In the lower details pane, select the Actions tab.

2 Deselect Inherit.

3 Use the drop-down lists to define the primary and secondary actions to perform on infected files.

4 If you select Move infected attachments to a folder, you can choose a name for the mailbox folder, or accept the default name (quarantine).


NOTEThis tab is identical to the Actions tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

Figure 2-17. On Delivery E-Mail Scan Policies — Actions tab



AlertsThis tab allows you to define options regarding the on-delivery scanner alerts.

1 In the lower details pane, select the Alerts tab.

2 Deselect Inherit.


E-mail alertChoose whether to define and send a reply message to the sender of an infected e-mail message, and whether to define and send an alert message to the recipient.

If ‘Prompt for Action’ is selectedChoose whether to create and display a custom message to the recipient, and whether to sound an audible alert when an infection is detected in an e-mail message or its attachments.


NOTEThis tab is identical to the Alerts tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise version 7.0 Product Guide.

Figure 2-18. On Delivery E-Mail Scan Policies — Alerts tab



ReportsThis tab allows you to configure log files.

1 Select the Reports tab in the lower details pane.

2 Deselect Inherit.


Log fileChoose whether to log on-delivery scanner data to a file, the location of that file, and whether to limit the size of the log file.

What to logSelect the on-delivery scan data you want to log.


NOTEThis tab is identical to the Reports tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

Figure 2-19. On Delivery E-Mail Scan Policies — Reports tab



Setting user interface policiesSelect User Interface Policies under VirusScan Enterprise 7.0 in the upper details pane. These policy options appear on the following tabs: Display Options and Password Options.

Display OptionsThis tab allows you to configure security-related display settings.

1 Select the Display Options tab in the lower details pane.

2 Deselect Inherit.


System tray iconChoose which, if any, menu options are available to users from the system tray icon. You can choose all menu options, minimal menu options, or no options.

Local console refresh timeChoose how often (in seconds) local consoles refreshes.


NOTEThis tab is identical to the User Interface Options tab of the Options dialog box of VirusScan Enterprise (accessed from the Tools menu of the VirusScan Enterprise). For complete information about these options, see the VirusScan Enterprise version 7.0 Product Guide.

Figure 2-20. User Interface Policies — Display Options



Password OptionsThis tab allows you to define a password, and the policy pages and tabs that the password protects.

1 Select the Password Options tab in the lower details pane.

2 Deselect Inherit.

3 Select the desired level of password protection:

� No password

� Password protection for all items listed below

� Password protection for the selected items below

4 If you selected password protection in Step 3, enter and confirm the desired password in the boxes provided.

5 If you selected the last option in Step 3, select which items in the list to protect.

NOTEIf the icon next to the name of the policy page is a closed red lock, that item is protected by the password. If the icon is an open green lock, that item is not protected by the password.

Figure 2-21. Password Options



Setting Alert Manager Alerts policiesSelect Alert Manager Alerts Policies under VirusScan Enterprise 7.0 in the upper details pane. These policy options appear on a single tab: Alert Manager Alerts.

NOTEFor information about configuring the Alert Manager server with ePolicy Orchestrator, see the Alert Manager product documentation.

Alert Manager AlertsThis tab allows you to configure the VirusScan Enterprise features that generate alerts, and the destination for alerts.

1 Select the Alert Manager Alerts tab in the lower details pane.

2 Deselect Inherit.


Which components will generate alertsSelect which VirusScan Enterprise components you want to generate alerts when infections are detected.

Alert Manager destination selectionChoose to enable or disable alerting. If you enable alerting, you must select whether to enable centralized alerting or Alert Manager alerting, and the location of the folder or server to receive the alerts.


Figure 2-22. Alert Manager Alerts



NOTEFor complete information about these options, see the VirusScan Enterprise 7.0 Product Guide or Alert Manager product documentation.

Scheduling tasksYou can schedule on-demand scan tasks to deploy either with an installation package, or to existing installations.

NOTETo create a new update task, see Configuring AutoUpdate 7.0 on page 11.

Creating a new scan task1 In the console tree under ePolicy Orchestrator, right-click Directory or the


2 Enter a New Task Name.

3 Select VirusScan Enterprise 7.0 — On-Demand Scan from the Software list.

4 Click OK to create the task.

Figure 2-23. Schedule New Task



Configuring the scan task settings1 On the Tasks tab in the upper details pane, right-click the task, then select

Edit Task. The ePolicy Orchestrator Scheduler dialog box appears.

2 Click Settings to configure the task. The On Demand Scan Task dialog box appears. The task settings options are divided among five tabs: Where, Detection, Advanced, Actions, Reports, and Task.

NOTEYou can configure these tabs in any order. For the purposes of this guide, these tabs are addressed from left to right.

Figure 2-24. ePolicy Orchestrator Scheduler

Figure 2-25. Tabs of Task Settings



3 Select the Where tab to specify where scanning takes place.

a Deselect Inherit.

b Use the Add, Edit, and Remove buttons to define the locations to scan.

c Under Scan Options, choose whether to include subfolders, and whether to scan boot sectors.

4 Select the Detection tab to specify the file types to scan.

Figure 2-26. On Demand Scan Task — Where tab



a Deselect Inherit.

b Configure the following policy options:

What to scanSelect All files, Default + additional types, or Specified file types (you can only select one of these options). Use the Additions button to add file types to the list of default file types, or the Specified button to define a custom list of file types to scan.

What not to scanUse the Exclusions button to define a list of specific file types, folders, and drives not to scan (to exclude from the scan).

NOTEIf Overwrite client exclusions is not selected, the exclusions that are set for the client’s default on-demand scanning are appended to the exclusions that were set for the task on the ePolicy Orchestrator server.

Compressed filesChoose whether to scan inside packed executables, whether to scan inside multiple-file archives, and whether to scan MIME-encoded files.

5 Select the Advanced tab to define more specific settings.

Figure 2-27. On Demand Scan Task — Detection tab



a Deselect Inherit.


HeuristicsChoose whether to scan for unknown program viruses, and whether to scan for unknown macro viruses.

Non-virusesChoose whether to scan for potentially unwanted programs, and whether to scan for joke programs.

CPU utilizationChoose the maximum percentage of CPU usage for the scan task.

MiscellaneousChoose whether to scan files that have been migrated to storage, and whether to rescan all files when DAT files are updated.

6 Select the Actions tab to specify the actions to take on infected files.

Figure 2-28. On Demand Scan Task — Advanced tab



a Deselect Inherit.

b From the drop-down lists, select the primary and secondary actions to perform on infected files.

c If you select Move infected files to a folder, choose a destination folder for infected files.

7 Select the Reports tab to specify logging options.

Figure 2-29. On Demand Scan Task — Actions tab



a Deselect Inherit.


Log fileChoose whether to log virus scan activity, whether to limit the size of the log file, and the location of the log file.

What to log in addition to virus activityChoose what types of information to log.

8 Select the Task tab to specify platform settings.

Figure 2-30. On Demand Scan Task — Reports



a Deselect Inherit.

b Under Platform selection, choose whether to run the task on workstations, servers, or both.

c Under User account settings, enter the necessary user name, password, and domain name in the appropriate fields if you want the task to run under a specific account. If no account is entered, the task runs under the system account.

9 Click OK, when finished editing all the desired options on all tabs, to return to the ePolicy Orchestrator Scheduler dialog box.

Configuring the schedule settings1 Under Schedule Settings on the Task tab of the ePolicy Orchestrator Scheduler

dialog box, deselect Inherit.

2 Select Enable on the Task tab to enable both the scheduling options under Schedule Settings on the Task tab, and the scheduling options on the Schedule tab of the ePolicy Orchestrator Scheduler dialog box.

Figure 2-31. On Demand Scan Task — Task



3 Select Stop the task if it runs for to define a maximum amount of time for the task to run before being interrupted. If you select this checkbox, use the Hours and Minutes boxes to define the amount of time the task can run before it is interrupted.

NOTEIf you choose to stop the task after a defined amount of time, the task resumes from the point it was interrupted the next time it runs.

Scheduling the task1 Click the Schedule tab of the ePolicy Orchestrator Scheduler dialog box to

specify when the task runs.

2 Deselect Inherit.

NOTEEnable must be selected under Schedule Settings on the Task tab to enable the options on the Schedule tab.

3 Select the options on this tab to schedule the task.

NOTEThe options on this tab are identical to the Schedule tab of the Schedule Settings dialog box accessed from the On-Demand Scan Properties dialog box. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide.

4 Click OK when you are through configuring and scheduling the task.

Figure 2-32. ePolicy Orchestrator Scheduler — Schedule


Documents

VirusScan Enterprise - McAfeedownloadcenter.mcafee.com/.../docs/vse_70_configguide_epo_25x_en… · Configuration Guide 5 Preface This Configuration Guide introduces the configuration