McAfee EPOLICY ORCHESTRATOR 4.0.2

McAfee ePolicy Orchestrator 4.0.2

Product Guide

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form

or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FLASHBOX, FOUNDSTONE, GROUPSHIELD, HERCULES, INTRUSHIELD, INTRUSION INTELLIGENCE,

LINUXSHIELD, MANAGED MAIL PROTECTION, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, MCAFEE.COM, NETSHIELD,

PORTALSHIELD, PREVENTSYS, PROTECTION-IN-DEPTH STRATEGY, PROTECTIONPILOT, SECURE MESSAGING SERVICE, SECURITYALLIANCE,

SITEADVISOR, THREATSCAN, TOTAL PROTECTION, VIREX, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc.

and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other

registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,

WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH

TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS

THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,

A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU

DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN

THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

License Attributions

Refer to the product Release Notes.

McAfee ePolicy Orchestrator 4.0.2 Product Guide2

Contents

Introducing ePolicy Orchestrator 4.0.2................................................13

ePolicy Orchestrator 4.0.2 components and what they do. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

The ePO server....................................................................13

TheMcAfeeAgent..................................................................14

Usingthisguide...........................................................................14

Audience.........................................................................15

Where to find McAfee enterprise product information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Configuring ePolicy Orchestrator Servers..............................................16

ePO user accounts........................................................................17

Global administrators...............................................................17

How permission sets work..................................................................17

Contacts.................................................................................18

Serversettingsandthebehaviorstheycontrol..................................................18

Availableservertasks and whatthey do.......................................................19

The Audit Log............................................................................20

The Event Log............................................................................20

Data exports from any table or chart.........................................................21

MyAVERT Security Threats .................................................................22

Logging on and off from ePO servers.........................................................22

Logging on to ePO servers...........................................................22

LoggingoffofePO servers...........................................................23

Viewing the server version number ..........................................................23

Working with user accounts.................................................................23

Creating user accounts..............................................................23

Editing user accounts...............................................................24

Deleting user accounts..............................................................24

Workingwithpermissionsets................................................................24

Creatingpermissionsetsforuseraccounts..............................................25

Duplicating permission sets..........................................................25

Editing permission sets..............................................................26

Deletingpermissionsets.............................................................26

3McAfee ePolicy Orchestrator 4.0.2 Product Guide

Working with contacts.....................................................................26

Creating contacts..................................................................26

Editingcontacts....................................................................27

Deleting contacts..................................................................27

Working with server settings................................................................27

Specifying an email server...........................................................28

Configuring the template and location for exported reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Determining which events are forwarded to the server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Viewingandchangingcommunicationports.............................................29

Working with the Server Task Log............................................................29

Viewing the Server Task Log.........................................................30

Filtering the Server Task Log.........................................................30

Purging the Server Task Log.........................................................31

Working with the Audit Log.................................................................31

ViewingtheAuditLog...............................................................31

Purging the Audit Log...............................................................32

PurgingtheAuditLogonaschedule...................................................32

Working with the Event Log.................................................................33

Viewing the Event Log..............................................................33

Purging events....................................................................33

Purging the Event Log on a schedule..................................................34

WorkingwithMyAvertSecurityThreats........................................................34

Configuring MyAvert update frequency and proxy settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Viewing threat notifications..........................................................35

Deleting threat notifications..........................................................35

Exporting tables and charts to other formats...................................................36

Allowed Cron syntax when scheduling a server task.............................................36

Organizing Systems for Management..................................................38

The System Tree..........................................................................39

Considerations when planning your System Tree................................................40

Administrator access................................................................40

Environmental borders and their impact on system organization. . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Subnets and IP address ranges.......................................................41

Tagsand systems with similar characteristics............................................42

Operating systems and software......................................................42

Tags and how they work...................................................................42

Active Directory and NT domain synchronization................................................43

McAfee ePolicy Orchestrator 4.0.2 Product Guide4

Contents

Active Directory synchronization......................................................43

NT domain synchronization..........................................................45

Criteria-based sorting......................................................................45

Howsettingsaffectsorting...........................................................46

IP address sorting criteria...........................................................46

Tag-based sorting criteria............................................................47

Group order and sorting.............................................................47

Catch-all groups...................................................................47

How a system is first placed in the System Tree................................................47

Working with tags.........................................................................48

CreatingtagswiththeTagBuilder.....................................................49

Excludingsystemsfromautomatictagging..............................................49

Applyingtagsto selected systems.....................................................50

Applying criteria-based tags automatically to all matching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Creating and populating groups..............................................................51

Creatinggroupsmanually............................................................52

Addingsystemsmanuallytoanexistinggroup...........................................53

Importingsystemsfromatextfile.....................................................54

Sortingsystems into criteria-based groups..............................................55

Importing Active Directory containers..................................................57

Importing NTdomains toan existinggroup.............................................59

Synchronizing the System Tree on a schedule...........................................61

Updating the synchronized group with an NT domain manually. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Moving systems manually within the System Tree...............................................62

Distributing Agents to Manage Systems...............................................64

Agents and SuperAgents...................................................................65

Agent-server communication ...............................................................66

SuperAgents and broadcast wake-up calls..............................................67

Agentactivity logs.........................................................................69

Agentpolicysettings.......................................................................69

Security Keys.............................................................................71

Agent-server secure communicationkeys...............................................71

Master repository key pair...........................................................72

Other repository public keys.........................................................72

Methods of agent distribution...............................................................72

Creating custom agent installation packages...................................................73

Distributing agents........................................................................73

5McAfee ePolicy Orchestrator 4.0.2 Product Guide

Contents

Deploying the agent with ePolicyOrchestrator...........................................74

Installing the agent with login scripts..................................................76

Installingtheagentmanually.........................................................77

Enabling the agent on unmanaged McAfee products. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

Including the agentonanimage......................................................78

Using other deployment products.....................................................79

Distributing the agent to WebShield appliances and Novell NetWare servers. . . . . . . . . . . . . . . . . . 79

Forcing the agent to call in to the server......................................................79

Upgrading existing agents..................................................................79

Upgrading agents using login scripts or manual installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

Upgrading agents with ePolicy Orchestrator.............................................80

Removing the agent.......................................................................81

Running FRMINST.EXE from a command line............................................81

Removing agents when deleting systems from the System Tree. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Removing agents when deleting groups from the System Tree. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Removing agents from systems in query results. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Maintaining the agent......................................................................82

Sending manual wake-up calls to systems..............................................83

Sending manual wake-up calls to a group..............................................83

Sending wake-up calls on a schedule..................................................84

Viewing the agent activity log........................................................85

Viewing of the agent and product properties............................................85

Running agent tasks from the managed system.........................................86

Workingwithsecuritykeys...........................................................88

Agent command-line options................................................................94

Agentinstallationcommand-lineoptions.......................................................94

Creating Repositories....................................................................96

Repository types and what they do...........................................................96

Types of distributed repositories......................................................98

Repository branches and their purposes................................................99

Repositorylistfileanditsuses........................................................99

Howrepositorieswork together.............................................................100

Ensuringaccesstothesource site...........................................................101

Using Internet Explorer proxy settings for the master repository. . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Configuring custom proxy settings for the master repository . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

Working with source and fallback sites.......................................................103

Switching source and fallback sites...................................................103

McAfee ePolicy Orchestrator 4.0.2 Product Guide6

Contents

Creating source sites..............................................................104

Editing source and fallback sites.....................................................105

Deleting source or fallback sites.....................................................105

Using SuperAgents as distributed repositories.................................................105

Creating SuperAgent repositories....................................................106

Selecting which packages are replicated to SuperAgent repositories. . . . . . . . . . . . . . . . . . . . . . . . 106

Deleting SuperAgent distributed repositories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Creating and configuring FTP, HTTP, and UNC repositories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Creating a folder location on an FTP, HTTP server or UNC share. . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Adding the distributed repository to ePolicy Orchestrator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Enabling folder sharing for UNC and HTTP repositories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

Editing distributed repositories ......................................................110

Deleting distributed repositories.....................................................110

Working with the repository list files.........................................................110

Exporting the repository list SITELIST.XML file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

Exporting the repository list SITEMGR.XML file for backup or use by other servers. . . . . . . . . . . . 111

Importing distributed repositories from the SITEMGR.XML file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Importing source sites from the SITEMGR.XML file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Changing credentials on multiple distributed repositories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Managing Products with Policies and Client Tasks..................................114

Extensionsand what they do...............................................................114

Policy management.......................................................................115

Policy application.........................................................................116

Client tasks and what they do..............................................................117

Bringing products under management.......................................................118

Viewing policy information.................................................................118

Viewing groups and systems where a policy is assigned. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

Viewing the settings of a policy......................................................119

Viewing policy ownership...........................................................119

Viewing assignments where policy enforcement is disabled. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Viewingpoliciesassignedtoagroup..................................................120

Viewing policies assigned to a specific system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Viewing a group’s policy inheritance..................................................120

Viewingand resetting broken inheritance..............................................120

WorkingwiththePolicyCatalog.............................................................121

CreatingapolicyonthePolicyCatalogpage...........................................121

Duplicating a policy on the Policy Catalog page. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

7McAfee ePolicy Orchestrator 4.0.2 Product Guide

Contents

Editing a policy’s settings from the Policy Catalog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Renaminga policy from the PolicyCatalog.............................................122

Deleting a policy from the Policy Catalog..............................................123

Working with policies.....................................................................123

Changingthe ownerof apolicy......................................................123

SharingpoliciesbetweenePOservers.................................................124

Assigning a policy to a group of the System Tree. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

Assigningapolicytoamanagedsystem...............................................125

Assigning a policy to multiple managed systems within a group. . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

Enforcing policies for a product on a group............................................126

Enforcing policies for a product on a system...........................................126

Copying and pasting assignments....................................................127

Working with client tasks..................................................................128

Creating and scheduling client tasks..................................................129

Editing client tasks................................................................129

Deleting client tasks...............................................................129

Frequently asked questions................................................................130

Deploying Software and Updates......................................................131

Deployment packages for products and updates...............................................131

Product and update deployment............................................................133

Deployment tasks.................................................................134

Update tasks.....................................................................134

Global updating...................................................................135

Pull tasks........................................................................136

Replication tasks..................................................................137

Repository selection...............................................................137

Server TaskLog...................................................................138

Checking in packages manually.............................................................138

Using the Product Deployment task to deploy products to managed systems. . . . . . . . . . . . . . . . . . . . . . . . 139

Configuring the Deployment task for groups of managed systems. . . . . . . . . . . . . . . . . . . . . . . . . . 140

Configuring the Deployment task to install products on a managed system. . . . . . . . . . . . . . . . . . 140

Deploying update packages automatically with global updating. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

Deploying update packages with pull and replication tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

Using pull tasks to update the master repository. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Replicating packages from the master repository to distributed repositories. . . . . . . . . . . . . . . . . . 145

Configuring agent policies to use a distributed repository. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Using local distributed repositories that are not managed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

McAfee ePolicy Orchestrator 4.0.2 Product Guide8

Contents

Checking in engine, DAT and EXTRA.DAT update packages manually. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Updating managed systems regularly with a scheduled update task. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Confirming that clients are using the latest DAT files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Evaluating new DATs and engines before distribution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Manually moving DAT and engine packages between branches. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Deleting DAT or engine packages from the master repository. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Sending Notifications...................................................................152

Notificationsand how itworks..............................................................153

Throttlingandaggregation..........................................................153

Notification rules and System Tree scenarios...........................................153

Default rules.....................................................................155

Planning................................................................................155

Determining how events are forwarded......................................................156

Determining which events are forwarded immediately. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

Determining which events are forwarded..............................................157

SettingupePONotifications................................................................157

Giving users appropriate permissions to Notifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Working with SNMP servers.........................................................158

Working with registered executables and external commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Creating and editing Notification rules.......................................................163

Describing the rule................................................................163

Setting filters for the rule...........................................................164

Settingthresholdsoftherule........................................................164

Configuringthenotificationsfortherule...............................................165

Viewing the history of Notifications..........................................................166

Configuring the Notification Log.....................................................166

Viewing the details of Notification Log entries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

Purging the Notifications Log........................................................167

Product and component list................................................................168

Frequently asked questions................................................................168

Querying the Database.................................................................170

Queries................................................................................170

Public and personal queries.........................................................171

Query permissions................................................................171

Query Builder...........................................................................172

Multi-server roll-up querying...............................................................173

Preparing for roll-up querying..............................................................174

9McAfee ePolicy Orchestrator 4.0.2 Product Guide

Contents

Registering ePO servers............................................................174

CreatingaDataRollUpservertask...................................................174

Working with queries.....................................................................175

Creating custom queries............................................................175

Running an existing query..........................................................176

Running a query on a schedule......................................................176

Making personal queries public......................................................178

Duplicating queries................................................................178

Sharing a query between ePO servers................................................179

Exporting query results to other formats..............................................179

Default queries and what they display.......................................................180

MA: Agent Communication Summary query............................................180

MA:AgentVersionSummaryquery...................................................180

ePO: Compliance History query......................................................181

ePO: Compliance Summary query....................................................181

ePO: Malware Detection History query................................................181

ePO:DistributedRepositoryStatusquery..............................................182

ePO: Failed User Actions in ePO Console query. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

ePO: Failed Logon Attempts query...................................................182

ePO: Multi-Server Compliance History query...........................................182

ePO:SystemsperTop-LevelGroupquery..............................................183

ePO: Systems Tagged as Server query................................................183

ePO: Today’s Detections per Product query............................................183

Assessing Your Environment With Dashboards......................................184

Dashboards and how they work............................................................184

Queries as dashboard monitors......................................................184

Default dashboard monitors.........................................................184

Setting up dashboardaccessandbehavior....................................................185

Giving users permissions to dashboards...............................................185

Configuring the refresh frequency of dashboards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

WorkingwithDashboards..................................................................186

Creating dashboards...............................................................186

Makingadashboardactive..........................................................186

Selecting all active dashboards......................................................187

Makingadashboardpublic..........................................................187

Detecting Rogue Systems..............................................................189

Whatareroguesystems...................................................................189

McAfee ePolicy Orchestrator 4.0.2 Product Guide10

Contents

Inhaltsverzeichnis

Andere McAfee Software Handbücher

McAfee

McAfee FIREWALL 2.1-GETTING STARTED Bedienungsanleitung

McAfee

McAfee MTP09EMB1RAA - Total Protection 2009 Bedienungsanleitung

McAfee

McAfee VIRUSSCAN 5.1 Service-Handbuch

McAfee

McAfee MFN10EMB3RAA - Family Protection - PC Bedienungsanleitung

McAfee

McAfee DFFCDE-AA-DA - Endpoint Encryption For Files Bedienungsanleitung

McAfee

McAfee VIRUSSCAN PLUS 2009 Bedienungsanleitung

McAfee

McAfee STUDENT SURVIVAL KIT 1.0-GETTING STARTED Bedienungsanleitung

McAfee

McAfee SAV85E - Active VirusScan - PC Betriebsanleitung

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0 - LOG FILES FOR Bedienungsanleitung

McAfee

McAfee VIRUSSCAN 5.1 Bedienungsanleitung

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - Bedienungsanleitung

McAfee

McAfee NAPCKE-AB-AA - VirusScan For NetApp Bedienungsanleitung

McAfee

McAfee TSA00M005PAA - Total Protection Service Bedienungsanleitung

McAfee

McAfee VCLCDE-AA-DA - VirusScan Command Line Scanner... Bedienungsanleitung

McAfee

McAfee VIRUSSCAN 8.7I Bedienungsanleitung

McAfee

McAfee VIRUSSCAN PLUS 2008 Bedienungsanleitung

McAfee

McAfee MIS80E001RAI - Internet Security Suite 2006 Bedienungsanleitung

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 2 - S... Bedienungsanleitung

McAfee

McAfee VirusScan Bedienungsanleitung

McAfee

McAfee INTERNET SECURITY 5.0 Bedienungsanleitung

McAfee

McAfee VIRUSSCAN 5.1 Bedienungsanleitung

McAfee

McAfee ANTI-THEFT FILE PROTECTION Bedienungsanleitung

McAfee

McAfee MSA09EMB1RAA - Site Advisor Plus 2009 Bedienungsanleitung

McAfee

McAfee VIRUSSCAN WIRELESS 1.0 - Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Novell

Novell GROUPWISE 8 - INTERNET AGENT Bedienungsanleitung

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung

McAfee EPOLICY ORCHESTRATOR 4.0.2 - Bedienungsanleitung

Beliebte Software Handbücher anderer Marken