McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

Transcription

1 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

3 Contents 1 Overview of Endpoint Upgrade Assistant 5 Overview Key features How it works Preparing to upgrade 9 Preparation checklist Products that you can upgrade Support for other McAfee products in your environment Setting up your test environment Planning your deployment options Using Endpoint Upgrade Assistant 15 Installing and launching Endpoint Upgrade Assistant Analyzing your environment Analyze upgrade requirements for your environment Configure upgrade notifications Planning your upgrades Checking in the required software Deploying and tracking upgrades Upgrading with McAfee epo 21 What happens during upgrades Workflow for deploying upgrades with McAfee epo Create a deployment task in Endpoint Upgrade Assistant Create a deployment task in McAfee epo Command-line options supported by McAfee epo Upgrading with custom installers 27 Using Package Creator to create custom product installers Requirements for Package Creator Workflow for upgrading with custom product installers Download the McAfee Agent frame package file Create product installers with Package Creator Command-line options supported by Package Creator Best practices and troubleshooting 33 Best practices for managing upgrade information Export system and product information Troubleshooting blocked endpoints Refresh the McAfee epo database Troubleshooting installation and uninstallation issues Remove files after a failed installation Troubleshooting issues with Endpoint Upgrade Assistant Troubleshoot issues with Upgrade Automation McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 3

4 Contents Troubleshooting issues related to Package Creator Increase package size limit in McAfee epo Resolving return codes in log files Reporting an issue to McAfee Support McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

5 1 Overview 1 of Endpoint Upgrade Assistant Contents Overview Key features How it works Overview McAfee Endpoint Upgrade Assistant is a tool that assists with upgrading endpoints in your managed environment to McAfee Endpoint Security. Administrators can use Endpoint Upgrade Assistant to: Analyze endpoints, detect the supported McAfee products that are installed, and determine the minimum requirements for upgrading to Endpoint Security. Upgrade older versions of Endpoint Security or legacy products to the latest version of Endpoint Security. Remove incompatible McAfee products and upgrade to recommended versions. Plan, deploy, and track product upgrades throughout the environment. Endpoint Upgrade Assistant is bundled with Endpoint Upgrade Automation client software, which runs on endpoints to manage the upgrade process. Components Endpoint Upgrade Assistant includes these McAfee epolicy Orchestrator (McAfee epo ) components: Endpoint Upgrade Assistant extension Installed on the McAfee epo server. Provides the features for analyzing, preparing, and tracking McAfee product upgrades for your environment. Make sure that your servers are running epolicy Orchestrator or later. Endpoint Upgrade Assistant does not change the McAfee epo environment. It collects and analyzes the data about an environment, then displays the requirements for upgrading endpoints to Endpoint Security. Endpoint Upgrade Automation client package Deployed to managed endpoints. Provides the ability to remove, upgrade, and install supported McAfee products. Upgrade Automation does change the environment. It removes existing products and installs new versions. Customers who want to take advantage of Upgrade Automation, but don't use McAfee epo for deployment purposes, can use the Endpoint Upgrade Assistant Package Creator tool. Download it separately to create custom, deployable product packages for use with McAfee epo or third-party tools. McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 5

6 1 Overview of Endpoint Upgrade Assistant Key features Key features Endpoint Upgrade Assistant analyzes your environment and reports the upgrade status for endpoints. You can use Endpoint Upgrade Assistant to plan, deploy, and track product upgrades. Analyze Endpoint Upgrade Assistant analyzes the endpoints in your environment to determine: The minimum requirements for upgrading to Endpoint Security. Other McAfee products running on endpoints that require an upgrade to maintain compatibility with Endpoint Security. Problems that prevent upgrades. The analysis runs automatically in the background when Endpoint Upgrade Assistant is installed, and you can re-analyze your environment whenever you need to. You can also configure options for the analysis. Endpoint Upgrade Assistant displays the results on its landing page. You can use this information to plan your upgrades. Endpoint Upgrade Assistant also displays a notification on the McAfee epo landing page about endpoints in your environment that are ready for upgrades. Deploy Endpoint Upgrade Assistant lets you choose the deployment options that are right for your environment. Deploy using Upgrade Automation Deploy all selected products to all selected endpoints with a single task. You can create an Upgrade Automation task directly from Endpoint Upgrade Assistant or from McAfee epo. Upgrade Automation runs on the endpoint, determines whether it needs to remove a legacy product or upgrade an earlier version of Endpoint Security, then installs the selected version of Endpoint Security. Upgrade Automation also upgrades incompatible versions of McAfee products and installs compatible McAfee products. Use McAfee epo tags to specify the endpoints to upgrade Endpoint Upgrade Assistant uses McAfee epo tags to identify servers and workstations that require specific product upgrades. View these tags in the Tag Catalog under a group called Endpoint Upgrade Assistant Tags. You can create a single tag for all endpoints that are eligible for Upgrade Automation. When you create a deployment task in McAfee epo, select one of the tags you've created with Endpoint Upgrade Assistant. All tagged endpoints are upgraded when the deployment task runs. Deploy using McAfee epo or third-party tools Endpoint Upgrade Assistant provides options for deploying upgrades and a tool for creating custom upgrade installers. McAfee epo Upgrade endpoints that are ready for Upgrade Automation with a single deployment task. You can create deployment tasks from Endpoint Upgrade Assistant or McAfee epo. You can also download the Package Creator tool to create custom product installers for use with McAfee epo. Third-party tools Download the Package Creator tool to create custom product installers for use with third-party deployment tools, such as Microsoft System Center Configuration Manager and IBM BigFix. You can select the products to include and configure installation options. Track Endpoint Upgrade Assistant displays the status of the Upgrade Automation deployment tasks you have created. For deployment tasks that are running or completed, you can view the status of the upgrade for each endpoint (Install Successful, Failed, or Pending). 6 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

7 Overview of Endpoint Upgrade Assistant How it works 1 How it works Endpoint Upgrade Assistant analyzes your environment, reports the information you need to plan your upgrade strategy, and provides features for deploying upgrades and tracking their status. Tabs guide you through the tasks required to upgrade. 1 Specify what to upgrade Select the version of Endpoint Security to install and the endpoints to upgrade. 2 Analyze your environment Discover endpoints that require upgrades and endpoints that can't be analyzed. 3 Check in and install the required software Check in the required software to the McAfee epo server to make it available for deployment tasks using the Software Catalog. 4 Tag endpoints to upgrade Create one tag for all endpoints that you want to upgrade with a single deployment task. You can tag all endpoints that are ready for Upgrade Automation. You can also tag endpoints that require manual upgrades of specific software. 5 Deploy and track upgrades Deploy using Upgrade Automation or manually configure McAfee epo deployment tasks. You can also use Endpoint Upgrade Assistant Package Creator to create installers for third-party tools. See also Analyzing your environment on page 15 Planning your upgrades on page 17 Checking in the required software on page 19 Deploying and tracking upgrades on page 20 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 7

8 1 Overview of Endpoint Upgrade Assistant How it works 8 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

9 2 Preparing 2 to upgrade Contents Preparation checklist Products that you can upgrade Support for other McAfee products in your environment Setting up your test environment Planning your deployment options Preparation checklist To streamline the upgrade process and resolve potential issues in your environment before they occur, perform these tasks before upgrading. Verify that endpoints can be analyzed Check that a supported version of McAfee Agent is installed on all endpoints you plan to upgrade and reporting to McAfee epo. Endpoint Upgrade Assistant analyzes endpoints managed with McAfee Agent. If your environment includes endpoints where McAfee Agent isn't installed or set to Managed mode, Endpoint Upgrade Assistant reports them as Blocked from upgrading. Check that your McAfee products are supported Check that Endpoint Upgrade Assistant can upgrade the products and versions installed on endpoints that you want to upgrade. Check that other McAfee products installed on the endpoints are compatible with Upgrade Automation. If your environment includes endpoints where incompatible products are installed, Endpoint Upgrade Assistant reports them as Requires product upgrades. Set up test systems Select a subset of your System Tree to upgrade as a test. Testing your upgrade allows you to verify that endpoints upgrade as expected, and make changes as needed, before deploying upgrades to all endpoints. Disable features that detect and reinstall uninstalled products If you have set up applications or processes to detect when programs are uninstalled and reinstall them automatically, you need to disable this functionality. If you're upgrading legacy products, Upgrade Automation uninstalls them during the upgrade process. Take steps to prevent endpoints from reinstalling the legacy products before Upgrade Automation installs the new product versions. McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 9

10 2 Preparing to upgrade Products that you can upgrade Install Endpoint Upgrade Assistant on the McAfee epo server Endpoint Upgrade Assistant is a self-contained McAfee epo extension that is installed by default on some versions of McAfee epo. If you need to install Endpoint Upgrade Assistant or upgrade to a newer version, you can download the software from the Software Catalog. Installing Endpoint Upgrade Assistant also checks in the Endpoint Upgrade Automation client package to all branches of McAfee epo. This lets you deploy from any branch. Best practice: Before upgrading, check that you're using latest version of Endpoint Upgrade Assistant, then download and install a newer version if one is available. (Optional) Prepare to migrate legacy product settings To preserve custom settings for legacy products, you need to migrate those settings on the McAfee epo server during the upgrade process. To prepare for migration: Review your custom policy settings and client tasks, consolidating them where possible. Remove duplicate and unused policies and tasks. Install the Endpoint Migration Assistant extension on the McAfee epo server. You can download the software from the Software Catalog. See the McAfee Endpoint Security Migration Guide for more information. (Optional) Create custom installers If your upgrade requires a custom installer package, download the Endpoint Upgrade Assistant Package Creator tool from the Software Catalog to a system that has access to the installer packages. For deploying with third-party solutions Use Package Creator to create installers that you can deploy with your preferred tools. For deploying with McAfee epo Use Package Creator to customize packages for specific upgrade requirements. Best practice: If you plan to move endpoints to another McAfee epo server during the upgrade, use Package Creator to create a custom installation package that includes the McAfee Agent installer. See also Products that you can upgrade on page 10 Support for other McAfee products in your environment on page 11 Setting up your test environment on page 11 Troubleshooting blocked endpoints on page 34 Using Package Creator to create custom product installers on page 27 Products that you can upgrade You can use Upgrade Automation to upgrade supported products with a single deployment task. The action that Upgrade Automation takes depends on the product being upgraded. Product Upgrades to Endpoint Security Endpoint Security or later McAfee VirusScan Enterprise 8.8 and later McAfee Threat Intelligence Exchange (TIE) for VirusScan Enterprise 1.x and later McAfee Host Intrusion Prevention (McAfee Host IPS) 8.8 and later Upgrade Automation action Upgraded to Endpoint Security or later Replaced with Endpoint Security Threat Prevention Removed Replaced with Endpoint Security Firewall (Optional) 10 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

11 Preparing to upgrade Support for other McAfee products in your environment 2 Product McAfee SiteAdvisor Enterprise None Upgrades for other McAfee products McAfee Agent 4.6 and later McAfee Data Loss Prevention (McAfee DLP) 9.2 and later McAfee Data Exchange Layer (DXL) Client 4.0 and earlier McAfee Active Response 2.2 or later Upgrade Automation action Replaced with Endpoint Security Web Control (Optional) McAfee Endpoint Security Adaptive Threat Protection (ATP) installed (Optional; Requires Endpoint Security Threat Prevention) Upgraded to version or later Upgraded to selected version (Optional) Upgraded to selected version, or installed if not present (Optional) Upgraded to selected version, or installed if not present (Optional; Requires Endpoint Security Adaptive Threat Protection) Support for other McAfee products in your environment You need to make sure that unsupported McAfee products are not installed on systems where you plan to run Endpoint Upgrade Automation. Upgrade Automation coexists on endpoints with these products, but does not change them: Product McAfee File and Removable Media Protection (FRP) McAfee Drive Encryption McAfee Change Control Versions and later and later , , or and later These products prevent Upgrade Automation from running: Product McAfee Host Intrusion Prevention McAfee MOVE AntiVirus McAfee VirusScan Enterprise McAfee VirusScan Enterprise for Offline Virtual Images McAfee VirusScan Enterprise for SAP McAfee VirusScan Enterprise for Storage Versions 7.0 and earlier All versions 8.5 and earlier All versions All versions All versions Setting up your test environment You should always test planned upgrades on a subset of endpoints before performing a controlled rollout of the Endpoint Upgrade Automation package across your environment. Upgrade Automation ensures that endpoints do not end up in an unsuitable state. However, upgrades for multiple products, groups, and endpoint types involve many components, and you might not always anticipate the results correctly. It's important to test upgrades in test environments or small groups before upgrading your entire environment. McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 11

12 2 Preparing to upgrade Planning your deployment options General guidelines Review these best practices before setting up your test environment. Do not include endpoints that are essential to your daily operations in your test environment. Select endpoints that reflect the diversity of your environment. Use the Overview tab to identify suitable endpoints by reviewing the software running on them. Use the Prepare tab to ensure that the necessary software packages are available in the correct software branch. Use the Deploy & Track tab to identify the deployments performed using Endpoint Upgrade Assistant. When selecting a test environment, make sure that you consider the following information to identify representative endpoints: McAfee product combinations and versions Operating systems Servers and workstations Best practice: Test on a subset of servers before upgrading your entire server environment. Validate the upgrade on servers and workstations. Some endpoints might require a restart. You need to restart them manually; the Upgrade Automation deployment task doesn't initiate a restart after all upgrades are complete. Planning your deployment options Endpoint Upgrade Assistant lets you customize upgrades by specifying options for the upgrade workflow when you create the package file and deployment task. Before upgrading, you should decide which options you want to use. Specify these options in different ways, depending on your deployment method. Keeping compatible versions of McAfee Agent When McAfee Agent version or later is installed on an endpoint where you plan to upgrade Endpoint Security, upgrading McAfee Agent is optional. You can choose not to upgrade McAfee Agent when you create the deployment task. When you specify this option and a compatible version of McAfee Agent is present on the endpoint, the McAfee Agent installation package isn't downloaded and the McAfee Agent isn't upgraded. If all the endpoints you plan to upgrade have versions of McAfee Agent that are compatible with Endpoint Security, it is not necessary to check in McAfee Agent to the McAfee epo branch. However, if an incompatible version of McAfee Agent is installed on any endpoint, the deployment task attempts to download the version of McAfee Agent that is checked in. In these cases: If version or later is checked in Upgrade Automation upgrades McAfee Agent and installs Endpoint Security. If version or later is not checked in Upgrade Automation fails on the endpoints that have an incompatible version of McAfee Agent. This option is available on the Overview tab in Endpoint Upgrade Assistant or as a command-line option in McAfee epo. It is also available in Endpoint Upgrade Assistant Package Creator. 12 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

13 Preparing to upgrade Planning your deployment options 2 Specifying a custom location for log files During upgrades, events are saved in log files you can use for verifying that upgrades completed successfully or for troubleshooting problems. By default, the log files are saved at the location %windir%\temp\mcafeelogs \EndpointUpgradeAutomation.log. You can also specify a custom location for the log files: From McAfee epo Use the --log command-line option to enter a custom location. From Package Creator Enter a custom location in a text box. If the specified folder doesn't exist, the product creates it, then saves the log files. Selecting McAfee SysPrep options McAfee SysPrep is a standalone tool that adds third-party injectors to the McAfee Trusted Store, which ensures that the injectors work together with Endpoint Security. A version of SysPrep is packaged with Endpoint Upgrade Assistant, but if a later version of SysPrep is available, Upgrade Automation can use it with the current version of Endpoint Upgrade Assistant. From McAfee epo Check in the updated SysPrep package to the same branch in McAfee epo as Endpoint Upgrade Assistant. When Upgrade Automation runs on the endpoint, it downloads and runs the updated SysPrep package. From Package Creator Select the new SysPrep package to include in the installer. When SysPrep returns a failure message, such as Unknown 3rd party DLL injector is found, the default functionality is that Endpoint Upgrade Assistant does not stop running, because not all third-party injections cause an issue with Endpoint Security. You can choose to stop Endpoint Upgrade Assistant when a third-party DLL injector is found. In this case, Endpoint Upgrade Assistant does not remove VirusScan Enterprise and McAfee Host IPS, to ensure that the endpoint is always protected. This option is available as a command-line option in McAfee epo. It is also available in Endpoint Upgrade Assistant Package Creator. Reporting in System Custom Property fields Endpoint Upgrade Assistant provides the ability to monitor some endpoint events during deployment by using command-line options. This allows you to know when specific events occur and respond to them, if needed. For example, you can check when it's time to restart the endpoint after upgrading McAfee DLP. Events are reported in one of the four Custom fields that appear on the System Properties tab of the McAfee epo System Details page. This option is available as a command-line option in McAfee epo. Sending telemetry data to McAfee Endpoint Upgrade Automation includes a telemetry feature that collects and sends anonymous deployment data to McAfee. This data is used to improve product robustness and performance in future releases. This option is available as a command-line option in McAfee epo. It is also available in Endpoint Upgrade Assistant Package Creator. This option is enabled by default. You can disable it by using a command-line option in McAfee epo, or by selecting System Send Telemetry to toggle the feature on and off in Package Creator. A checkmark appears when the feature is enabled. McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 13

14 2 Preparing to upgrade Planning your deployment options The telemetry feature collects the following anonymous data: Product name (EUA) Product version Iteration number List of products installed prior to upgrade List of products installed post upgrade List of completed upgrade progress milestones Command line used for upgrade MD5 hash of machine GUID Machine locale (LCID) Success/failure of deployment Return code from Endpoint Upgrade Assistant See also Planning your upgrades on page 17 Command-line options supported by McAfee epo on page 24 Create product installers with Package Creator on page 30 Command-line options supported by Package Creator on page McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

15 3 Using 3 Endpoint Upgrade Assistant Contents Installing and launching Endpoint Upgrade Assistant Analyzing your environment Planning your upgrades Checking in the required software Deploying and tracking upgrades Installing and launching Endpoint Upgrade Assistant Endpoint Upgrade Assistant is installed automatically with some versions of McAfee epo. If it isn't already installed in your environment, you can download it from the Software Catalog or your product download page, then install it to the McAfee epo server. Endpoint Upgrade Assistant also checks in the Endpoint Upgrade Automation client package to all branches of McAfee epo. This lets you deploy upgrades from any branch. Best practice: Before upgrading, check that you're using latest version of Endpoint Upgrade Assistant, then download and install a newer version if one is available. Once it's installed, you can run Endpoint Upgrade Assistant by clicking the product in the Software section of the McAfee epo main menu. For more information about using Endpoint Upgrade Assistant, you can watch this Training video. Analyzing your environment Endpoint Upgrade Assistant analyzes the McAfee epo database to determine what software is installed on endpoints in your environment, how it compares to the product versions recommended by McAfee, and what the minimum requirements are for upgrading endpoints. By default, the Endpoint Upgrade Assistant extension: Analyzes your environment automatically when it's first installed, then re-analyzes your environment weekly. Analyzes the requirements for upgrading all endpoints in your environment to the latest version of Endpoint Security. You can select different settings and re-analyze your environment whenever you need to. Endpoint Upgrade Assistant uses analysis information to display: McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 15

16 3 Using Endpoint Upgrade Assistant Analyzing your environment A notification on the McAfee epo landing page about the endpoints in your environment that are ready to upgrade using Upgrade Automation. Environment Overview data on the Endpoint Upgrade Assistant landing page and at the top of other pages. For the Environment Overview, endpoints are grouped into four categories: Upgrade complete Successfully upgraded to Endpoint Security. Ready to upgrade Ready to upgrade to Endpoint Security using Upgrade Automation. Requires product upgrades Running incompatible versions of McAfee products that you need to upgrade manually before running Upgrade Automation. Blocked from upgrading Can't be upgraded or analyzed by Endpoint Upgrade Assistant. You can select a checkbox if you want to include systems that aren't managed by McAfee Agent in this overview. You can use this information to identify the endpoints that require upgrades, resolve differences between the reported and expected status of endpoints, or troubleshoot upgrade issues. View Systems Displays the McAfee epo System Tree page, listing the endpoints in the corresponding category. Export System and Product Details Downloads the information for each category in comma-separated values (CSV) format, with the name, path, and type (server or workstation) for each endpoint. Adds the products and versions running on endpoints. This lets you search, sort, and filter the analysis data. For example, you can sort by product to create a listing of all endpoints running each version of each product (for example, outdated versions of McAfee Agent). See also Best practices for managing upgrade information on page 33 Export system and product information on page 34 Troubleshooting blocked endpoints on page 34 Analyze upgrade requirements for your environment By default, Endpoint Upgrade Assistant analyzes the requirements for upgrading all endpoints to the latest version of Endpoint Security. You can re-analyze your environment, and specify custom options, whenever you need to. Task 1 Click Re-Analyze Environment. You can do this on the landing page or at the top of any other page in Endpoint Upgrade Assistant. If this option isn't available, you can skip this step. 2 On the Endpoint Upgrade Assistant landing page, select the version of Endpoint Security you want to upgrade to. 3 Select which endpoints in your environment to analyze. You can analyze All Systems or specific groups and endpoints. The time required to analyze your selection depends on the size of the McAfee epo database and the number of endpoints selected. Best practice: Analyzing a subset of your environment can reduce the time required to analyze and provide flexibility when planning upgrades. You can also use this option to select a subset of your environment for testing purposes, so that you can deploy and verify upgrades to non-critical endpoints before upgrading your entire environment. 4 Click Analyze Environment. 16 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

17 Using Endpoint Upgrade Assistant Planning your upgrades 3 See also Setting up your test environment on page 11 Configure upgrade notifications Endpoint Upgrade Assistant displays analysis results on the McAfee epo landing page and each page of Endpoint Upgrade Assistant. By default, Endpoint Upgrade Assistant displays: A notification in McAfee epo when 80% of the endpoints in your environment are ready to upgrade. An Environment Overview chart and table that summarize the results of the latest analysis in Endpoint Upgrade Assistant. You can select different settings for this information by configuring options on the Endpoint Upgrade Assistant landing page. Task 1 To customize the notification that appears in McAfee epo, specify a new value for Display logon message when percentage of systems ready to upgrade exceeds. To change when the notification appears Type a different number in the text box. For example, to display the notification when 75% or more of the systems in your environment are ready to upgrade, change the number in the text box to 75%. To disable the message currently displayed in McAfee epo Type a higher number in the text box. For example, if the notification says that 80% of the systems in your environment are ready to upgrade, change the number in the text box to 81% or higher. McAfee epo won't display the notification again until more endpoints are ready to upgrade. 2 To disable the McAfee epo landing page notification and hide the analysis information on the Endpoint Upgrade Assistant landing page, for Enable Endpoint Assistant landing page, select No from the drop-down list. 3 Click Save. Planning your upgrades You can use the information on the Overview tab to plan your upgrade strategy and resolve issues. This tab provides details about: Products and number of endpoints that require upgrades. The minimum product versions required for upgrades. Current versions of products in your environment and number of endpoints where they are installed. McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 17

18 3 Using Endpoint Upgrade Assistant Planning your upgrades Endpoints that require manual tasks before using Upgrade Automation. Technical articles with additional information about the products to be upgraded. After analysis is complete, you can use this tab to identify endpoints in three categories. Ready for Upgrade Automation These endpoints meet all requirements for upgrading. Click More Info to toggle the display of a table that includes details, such as the steps required to upgrade, type of endpoints, and upgrade package size. In this table: To create a tag for these endpoints, click Tag Systems. To export details about these endpoints in comma-separated value (CSV) format, click Export System Details. Click Product versions to display a list of McAfee products, the version currently installed, and the minimum required version you need to upgrade to. For legacy products, such as VirusScan Enterprise, no minimum required version is listed because those products will be upgraded to Endpoint Security. Best practice: For optimal performance and protection, upgrade all products to the latest version. To open the McAfee epo System Tree page and view the systems where you can install the product versions, click View Systems. To view more detailed information, click a link to a technical article, when available. To keep a compatible version of McAfee Agent that is already installed on endpoints, select Do not remove versions of McAfee Agent that are compatible with McAfee Endpoint Security When this option is selected and a compatible version of McAfee Agent is installed, it won't be upgraded. Requires product upgrades These endpoints have incompatible software installed and require manual tasks to make them Ready for Upgrade Automation. Click More Info to toggle the display of a table that shows the manual tasks, product versions, and number of restarts required. In this table: To create a tag for all endpoints that require a manual task, click Tag Systems. To export details about endpoints that require a manual task, click Export System Details. Click Product versions to display product details for the endpoints. To open the McAfee epo System Tree page and view these systems, click View Systems. To view more detailed information, click a link to a technical article, when available. After performing the required manual tasks, click Re-Analyze Environment. Endpoints that no longer require manual tasks are moved to the Ready for Upgrade Automation table. Blocked from upgrading These endpoints have issues that prevent Endpoint Upgrade Assistant from analyzing or upgrading them. Click More Info to toggle the display of a table that divides the endpoints into three categories and provides details about the issues. In this table: To create a tag for all endpoints in a category, click Tag Systems. To export details about endpoints in a category, click Export System Details. To view more detailed information, click a link to a technical article, when available. After resolving issues on these endpoints, click Re-Analyze Environment. Endpoints that are no longer blocked are moved to one of the other tables. 18 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

19 Using Endpoint Upgrade Assistant Checking in the required software 3 See also Export system and product information on page 34 Troubleshooting blocked endpoints on page 34 Checking in the required software You can use the Prepare tab to verify that the required software is available for upgrades. Use the information on this tab to identify: Policy settings that need to be migrated. Product client packages required for upgrades. Product client packages currently checked in You can view the Current, Evaluation, or Previous branch. You must check in all packages to the same branch to use Upgrade Automation. Product extensions required If the products you're upgrading require a product extension, you need to install those on the McAfee epo server manually. When you're ready to upgrade, you can use this tab to identify these additional requirements: Policy Migration These products require action to create or migrate custom policy settings or to convert settings to a supported format. This section describes the required actions. Packages Required for Upgrade Automation These software packages need to be checked in to the Software Catalog. This section shows what is currently checked in and what needs to be upgraded to meet the product versions recommended by McAfee. Actions required are highlighted in red. In this section: From the View Branch drop-down list, select the McAfee epo branch that you want to deploy the upgrade from. When the Endpoint Upgrade Assistant extension is installed, the Upgrade Automation client package is checked in to all McAfee epo branches. This lets you deploy Upgrade Automation from any branch. Resolve issues that are highlighted in red under the Notes section. Select product version to install Select the version for each product you want to install from the drop-down list. If you don't want to install or upgrade the product, select Do not install or Do not upgrade. The list shows only the versions that are available in the selected McAfee epo branch. Incompatible versions of this product were detected Select a compatible version to upgrade to. After checking in the required software packages and resolving the issues highlighted in red, click Refresh to confirm that your server is up to date. This refreshes only the information on the Prepare tab without fully re-analyzing your selected environment. If you plan to deploy upgrades from outside Endpoint Upgrade Assistant, click Copy Command Line to copy the command-line options for use in McAfee epo. Best practice: If you don't want to enter deployment task options manually, click Copy Command Line in Endpoint Upgrade Assistant to copy to the Windows clipboard the command-line options that match your selections on the Overview and Prepare tabs. McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 19

20 3 Using Endpoint Upgrade Assistant Deploying and tracking upgrades Deploying and tracking upgrades You can use the Deploy & Track tab to create Upgrade Automation deployment tasks and verify their status. The Upgrade Automation table shows how many endpoints are ready for upgrades using Upgrade Automation: Only systems with existing versions of Endpoint Security Only systems with legacy products All systems eligible for Upgrade Automation For each category of endpoints: To configure and schedule an upgrade Click Create Deployment Task. To create a tag for these endpoints Click Tag Systems. For Upgrade Automation deployment tasks that are running or completed, you can check the Deployment Status table to verify the status of the upgrade on each endpoint (Install Successful, Failed, or Pending). See also Create a deployment task in Endpoint Upgrade Assistant on page 23 Create a deployment task in McAfee epo on page McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

21 4 Upgrading 4 with McAfee epo Contents What happens during upgrades Workflow for deploying upgrades with McAfee epo Create a deployment task in Endpoint Upgrade Assistant Create a deployment task in McAfee epo What happens during upgrades When you deploy the Upgrade Automation client software to an endpoint, it performs these tasks for the products you've specified to upgrade. 1 Downloads the software packages you've checked in for the products you want to upgrade, then verifies that they're the correct product versions. 2 Verifies that no Windows Updates are pending. If updates are pending, the Upgrade Automation process exits so that updates can be applied. For example, if a Windows Update has been downloaded and not applied, or a required reboot following a Windows Update has not been performed, you need to manually complete the pending actions, then start the Upgrade Automation upgrade again. 3 Verifies that no conflicting products exist on the endpoint. 4 Harvests local policies for VirusScan Enterprise and McAfee Host IPS. 5 Removes VirusScan Enterprise, McAfee Host IPS, and Threat Intelligence Exchange (TIE) for VirusScan Enterprise. 6 Upgrades McAfee Agent (if selected) and installs Endpoint Security, which then applies the local policies. 7 Upgrades McAfee Data Loss Prevention to the selected version. 8 Installs or upgrades McAfee Data Exchange Layer Client to the selected version. 9 Installs or upgrades McAfee Active Response Client to the selected version. 10 Sends telemetry data to McAfee when installation is complete. McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 21

22 4 Upgrading with McAfee epo Workflow for deploying upgrades with McAfee epo Workflow for deploying upgrades with McAfee epo You can follow this workflow to upgrade endpoints using McAfee epo. Before upgrading, check that your environment and the systems you plan to upgrade meet all requirements. Best practice: Deploy upgrades in a test environment or to a test group, then verify the results before deploying upgrades to the larger environment. See the McAfee Endpoint Security Installation Guide and McAfee epolicy Orchestrator Product Guide for more information about these tasks. Best practice: If you plan to move endpoints to another McAfee epo server during the upgrade, use Package Creator to create a custom installation package that includes the McAfee Agent installer. 1 Prepare policies as needed. If you are migrating legacy policies Review and revise your settings to eliminate unused, outdated, and duplicate settings. If you are preconfiguring policies Create a custom package using Endpoint Security Package Designer. See the McAfee Endpoint Security Installation Guide for instructions. 2 On the Endpoint Upgrade Assistant landing page, select the version of Endpoint Security to install and the System Tree groups, then analyze your environment. 3 On the Overview tab, view the systems that are ready for Upgrade Automation and the products that need to be upgraded. If some systems require manual tasks or are blocked from upgrading, you can resolve the issues, then re-analyze your environment. 4 On the Prepare tab, verify that all required software is checked in to McAfee epo. Check in the required software to the same McAfee epo branch where you plan to deploy Endpoint Upgrade Assistant. 5 Manually update your McAfee epo server with the latest AMCore, Exploit Prevention, and Adaptive Threat Protection files (if needed) content files required for Endpoint Security. See the McAfee Endpoint Security Installation Guide for instructions. See the Endpoint Security Common Product Guide for more information about content files. 6 (Required only when migrating legacy product settings.) Migrate policies, client tasks, and other settings from supported legacy products on the McAfee epo server. You need to install the Migration Assistant extension before migrating. See the McAfee Endpoint Security Migration Guide for more information. 7 Configure policies as needed. 8 Create a deployment task, then deploy the client software to endpoints. You can deploy using Upgrade Automation or manually configure McAfee epo deployment tasks. Endpoint Upgrade Assistant installs the products that you have checked in. If you do not select any modules to install or check them in to McAfee epo, the Upgrade Automation deployment task fails. Best practice: Restart the endpoints manually after upgrading, taking care to consider the effects of restarts in server environments. Upgrade Automation doesn't restart endpoints after deployment. 22 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

23 Upgrading with McAfee epo Create a deployment task in Endpoint Upgrade Assistant 4 9 Verify that the deployment task completed successfully. From Endpoint Upgrade Assistant Check the Deploy & Track tab for the status of the task and endpoints. From McAfee epo Check that the client software is installed and up to date on all endpoints. See also Analyzing your environment on page 15 Planning your upgrades on page 17 Checking in the required software on page 19 Deploying and tracking upgrades on page 20 Workflow for upgrading with custom product installers on page 28 Create a deployment task in Endpoint Upgrade Assistant You can create a McAfee epo deployment task directly from the Deploy & Track tab to deploy products using Upgrade Automation. Best practice: Use this method to create a task with the product options currently selected on the Endpoint Upgrade Assistant tabs. Then track the status for the task on the same tab where you create it. Task 1 On the Deploy & Track tab, click Create Deployment Task. 2 On the Create Deployment Task page, specify a name for the task. The branch and product options that you selected on the Prepare and Overview tabs appear. If you want to change them, cancel this task, select the correct settings on those tabs, then begin this task again. 3 For Policy Migration, select the checkbox to acknowledge that you have either migrated legacy custom policies and client tasks or understand that McAfee Default policy settings will be enforced. (Required only when migrating legacy product settings.) 4 Specify when to run the deployment task. The default setting is Run immediately. If you're scheduling it for later, specify a date and time. 5 Select the systems to upgrade. By default, both workstations and servers are upgraded. You can also select individual systems from a list. 6 Click Create. 7 Verify that the information for the task is correct, then click OK. Create a deployment task in McAfee epo When systems are ready to upgrade using Upgrade Automation, you can deploy upgrades with standard McAfee epo deployment methods. Best practice: Use this method when you need to deploy a custom product installer that you've created with Package Creator. See the McAfee epo Product Guide for more information. McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 23

24 4 Upgrading with McAfee epo Create a deployment task in McAfee epo Task 1 In McAfee epo: On the Product Deployment page in McAfee epo, create a new deployment task. From the Client Task Catalog in McAfee epo, select a Client Task Type of McAfee Agent Product Deployment Task, then create a new task. 2 From the Product and Components section, select the Upgrade Automation package that you installed with Endpoint Upgrade Assistant. 3 From the Tag Catalog, select the Upgrade Automation tag that you created with Endpoint Upgrade Assistant. 4 Specify other options as needed. Upgrade Automation supports several command-line options. 5 Create the task. Command-line options supported by McAfee epo Upgrade Automation supports these command-line options for deployment tasks created in McAfee epo. If you don't want to enter deployment task options manually, click Copy Command Line in Endpoint Upgrade Assistant to copy to the Windows clipboard the command-line options that match your selections on the Overview and Prepare tabs. Option --keepma --excludefw --excludewc --installdlp=<version> --installatp --installdxl --installmar --tag[=1 4] where: 1 4 specifies one of four Custom fields --exitondllinjector --ignorebatterylevel Description Do not upgrade versions of McAfee Agent that are compatible with Endpoint Security. Do not deploy Endpoint Security Firewall. The module won't be downloaded and installed. Do not deploy Web Control. The module won't be downloaded and installed. Installs or upgrades McAfee DLP if it's present in the selected McAfee epo branch. Supported versions are: 9.3, 9.4, 10, and 11. If this command-line option is not present, McAfee DLP isn't upgraded. Install Adaptive Threat Protection. Install Data Exchange Layer. Install the version of Active Response that is checked in to the same branch as Endpoint Upgrade Assistant. If version 2.2 is installed and version 2.3 is checked in, version 2.2 is upgraded to version 2.3. Report endpoint events in a Custom field on the System Properties tab in the McAfee epo System Details page. For example, --tag=3 reports endpoint events in the Custom 3 field, and --tag or --tag=1 reports in the Custom 1 field. Stop the Endpoint Security upgrade if McAfee SysPrep returns a failure message. Ignore battery charge level if the endpoint is a mobile computer. 24 McAfee Endpoint Upgrade Assistant 2.3.x Product Guide

25 Upgrading with McAfee epo Create a deployment task in McAfee epo 4 Option --ignoreensoscheck Description Don't verify the version of Windows running on the endpoint before installing Endpoint Security. By default, Upgrade Automation verifies that a compatible version of Windows is running on the endpoint you plan to upgrade. If it's incompatible, no upgrade occurs. Use this option to proceed with the upgrade regardless of the Windows version. Best practice: Allowing Upgrade Automation to verify the version of Windows helps to prevent upgrade failures caused by product incompatibility. --log=<path> --notelemetry --retryafterreboot Save the Upgrade Automation installation log file in the specified location. For example, --log=c:\mcafeeeualogs creates the C:\mcafeeEUALOGS\ folder and saves the log file at that location. By default, the log file is saved at the location %windir%\temp \McAfeeLogs \EndpointUpgradeAutomation.log. Do not collect and send anonymous telemetry data from Upgrade Automation. If Endpoint Security fails to install on the first attempt Do not initiate a restart automatically. Wait until the endpoint restarts, then attempt to install Endpoint Security. If Endpoint Security is manually installed before the endpoint restarts Detect that the product is installed, then cancel the pending installation. Supported events for Custom fields Not all upgrade workflows use all the supported event properties. Endpoint Upgrade Assistant reports these properties: Property EUA_CLIENT_EXECUTION_STARTED EUA_REBOOT_REQUIRED ENS_INSTALL_PENDING EUA_ENDPOINT_REBOOTED ENS_INSTALLING EUA_EXECUTION_COMPLETE Description Endpoint upgrade has started. Restart the endpoint. Endpoint has been restarted. Endpoint Security is installing. Deployment task is completed. Check the status of the deployment task on the Deploy & Track tab. EUA_EXECUTION_COMPLETE REBOOT_REQUIRED DLP_UPGRADED Deployment task is completed. Check the status of the deployment task on the Deploy & Track tab. Restart the endpoint to enable McAfee DLP. McAfee Endpoint Upgrade Assistant 2.3.x Product Guide 25