CONFIGURATION GUIDE. VirusScan Enterprise VERSION 7.0. For use with epolicy Orchestrator versions 2.5 and 2.5.1

Transcription

1 CONFIGURATION GUIDE VirusScan Enterprise VERSION 7.0 For use with epolicy Orchestrator versions 2.5 and 2.5.1

2 COPYRIGHT 2003 Networks Associates Technology, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Networks Associates Technology, Inc., or its suppliers or affiliate companies. To obtain this permission, write to the attention of the Network Associates legal department at: 3965 Freedom Circle, Santa Clara, California 95054, or call TRADEMARK ATTRIBUTIONS Active Firewall, Active Security, Active Security (in Katakana), ActiveHelp, ActiveShield, AntiVirus Anyware and design, Bomb Shelter, Certified Network Expert, Clean-Up, CleanUp Wizard, CNX, CNX Certification Certified Network Expert and design, Design (stylized N), Disk Minder, Distributed Sniffer System, Distributed Sniffer System (in Katakana), Dr Solomon s, Dr Solomon s label, Enterprise SecureCast, Enterprise SecureCast (in Katakana), Event Orchestrator, EZ SetUp, First Aid, ForceField, GMT, GroupShield, GroupShield (in Katakana), Guard Dog, HelpDesk, HomeGuard, Hunter, LANGuru, LANGuru (in Katakana), M and design, Magic Solutions, Magic Solutions (in Katakana), Magic University, MagicSpy, MagicTree, McAfee, McAfee (in Katakana), McAfee and design, McAfee.com, MultiMedia Cloaking, Net Tools, Net Tools (in Katakana), NetCrypto, NetScan, NetShield, NetStalker, Network Associates, NetXray, NotesGuard, Nuts & Bolts, Oil Change, PC Medic, PCNotary, PrimeSupport, Recoverkey, Recoverkey International, Registry Wizard, ReportMagic, Router PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, SmartDesk, Sniffer, Sniffer (in Hangul), Stalker, SupportMagic, TIS, TMEG, Total Network Security, Total Network Visibility, Total Network Visibility (in Katakana), Total Service Desk, Total Virus Defense, Trusted Mail, UnInstaller, Virex, Virus Forum, ViruScan, VirusScan, WebScan, WebShield, WebShield (in Katakana), WebSniffer, WebStalker, WebWall, Who s Watching Your Network, WinGauge, Your E-Business Defender, ZAC 2000, Zip Manager are registered trademarks of Network Associates, Inc. and/or its affiliates in the US and/or other countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners. This product includes or may include software developed by the OpenSSL Project for use in the OpenSSL Toolkit. ( This product includes or may include cryptographic software written by Eric Young. (eay@cryptsoft.com) LICENSE AGREEMENT NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO NETWORK ASSOCIATES OR THE PLACE OF PURCHASE FOR A FULL REFUND. Issued FEBRUARY 2003 / VirusScan Enterprise software version 7.0

3 Contents Preface Audience Getting more VirusScan Enterprise information Getting related epolicy Orchestrator information Contacting McAfee and Network Associates Configuring AutoUpdate Adding the AutoUpdate 7.0.NAP file Creating an update task for VirusScan Enterprise Creating a new update task Setting task options Scheduling the task Creating a mirror task for VirusScan Enterprise Creating a new mirror task Setting task options Setting AutoUpdate 7.0 policy Configuring VirusScan Enterprise Adding the product to the Repository Deploying the product Adding the product installation files to the Repository Deploying VirusScan Enterprise Setting policies for the product Server and workstation policy settings Setting general policies General Messages Reports Setting policies for default processes Processes Detection Advanced Configuration Guide iii

4 Contents Actions Setting policies for low-risk processes Processes Setting policies for high-risk processes Processes Setting policies for on-delivery scanning Detection Advanced Actions Alerts Reports Setting user interface policies Display Options Password Options Setting Alert Manager Alerts policies Alert Manager Alerts Scheduling tasks Creating a new scan task Configuring the scan task settings Configuring the schedule settings Scheduling the task iv VirusScan Enterprise software version 7.0

5 Preface This Configuration Guide introduces the configuration information of VirusScan Enterprise software version 7.0 for use with McAfee epolicy Orchestrator versions 2.5 and 2.5.1, and provides the detailed instructions for: n n n n Installing the VirusScan Enterprise 7.0.NAP files in the epolicy Orchestrator repository. Configuring VirusScan Enterprise policies. Deploying the VirusScan Enterprise 7.0 software. Scheduling a task from the epolicy Orchestrator console. Audience This information is designed for system and network administrators who are responsible for their company s anti-virus program. Configuration Guide 5

6 Preface Getting more VirusScan Enterprise information Product Guide Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures. Available in an Adobe Acrobat.PDF file from either the product CD or the McAfee download site. Installation Guide System requirements and instructions for installing and starting the software. Available as a printed booklet that accompanies the product CD. Also available in an Adobe Acrobat.PDF file from either the product CD or the McAfee download site. Help Product information in the Help system that is accessed from within the application. n n The Help system provides high-level and detailed information. Access from either a Help menu option or Help button in the application. Context-sensitive (What s This?) Help provides brief descriptions of the selections in the application. Access by right-clicking on an option, pressing the [F1] control key, or dragging the question icon to an option. Release Guide The Release Guide for VirusScan Enterprise 7.0 contains product information, detailed instructions for configuring the software, information on new features and their use. 6 VirusScan Enterprise software version 7.0

7 Preface Release Notes README file. Product information, system requirements, resolved issues, any known issues, and last-minute additions or changes to the product or its documentation. Available as a.txt file from either the product CD or the McAfee download site. Contact A list of phone numbers, street addresses, web addresses, and fax numbers for Network Associates offices in the United States and around the world. Also provides contact information for services and resources, including: n n n n n n n Technical Support Customer Service Download Support AVERT Anti-Virus Emergency Response Team McAfee Beta Site On-Site Training Network Associates Offices Worldwide Configuration Guide 7

8 Preface Getting related epolicy Orchestrator information Several documents are directly referred to in this guide. It is important to have ready access to these documents while configuring VirusScan Enterprise 7.0 with epolicy Orchestrator. Product Guide Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures. Available in an Adobe Acrobat.PDF file from either the product CD or the McAfee download site. Help Product information in the Help system that is accessed from within the application. n n The Help system provides high-level and detailed information. Access from either a Help menu option or Help button in the application. Context-sensitive (What s This?) Help provides brief descriptions of the selections in the application. Access by right-clicking on an option, pressing the [F1] control key, or dragging the question icon to an option. Release Notes README file. Product information, system requirements, resolved issues, any known issues, and last-minute additions or changes to the product or its documentation. Available as a.txt file from either the product CD or the McAfee download site. 8 VirusScan Enterprise software version 7.0

9 Preface Contacting McAfee and Network Associates Technical Support McAfee Beta Site AVERT Anti-Virus Emergency Response Team Download Site DAT File Updates Product Upgrades ftp://ftp.nai.com/pub/antivirus/datfiles/4.x Valid grant number required. Contact Network Associates Customer Service. On-Site Training Network Associates Customer Service: Web US, Canada, and Latin America toll-free: Phone VIRUS NO or Monday Friday, 8 a.m. 8 p.m., Central Time For additional information on contacting Network Associates and McAfee including toll-free numbers for other geographic areas see the Contact file that accompanies this product release. Configuration Guide 9

10 Preface 10 VirusScan Enterprise software version 7.0

11 Configuring AutoUpdate AutoUpdate 7.0 is a common component used in multiple McAfee products, and it contains both scheduling and updating features. The AutoUpdate 7.0 scheduling feature is used to schedule all update and mirror tasks. The AutoUpdate 7.0 updating feature is used to perform scheduled or immediate update tasks. This chapter provides information on deploying and managing VirusScan Enterprise 7.0 with epolicy Orchestrator versions 2.5 and The following steps are used to configure AutoUpdate 7.0 via epolicy Orchestrator to manage VirusScan Enterprise update tasks. 1 Adding the AutoUpdate 7.0.NAP file 2 Creating an update task for VirusScan Enterprise 3 Creating a mirror task for VirusScan Enterprise 4 Setting AutoUpdate 7.0 policy Adding the AutoUpdate 7.0.NAP file Before creating update tasks for VirusScan Enterprise from the epolicy Orchestrator console, you must add the AutoUpdate.NAP file to the Repository. 1 Log on to the epolicy Orchestrator server. 2 In the console tree under epolicy Orchestrator, right-click Repository, then select Configure Repository. Figure 1-1. Configure Repository option Configuration Guide 11

12 Configuring AutoUpdate 7.0 The Configuration Software Repository dialog box appears. Figure 1-2. Configure Software Repository 3 Select Add new software to be managed. 4 Click Continue to open the Select a Software Package dialog box. 5 Select the CMU300.NAP file. 6 Click Open to add the file to the Repository. 7 Click Yes when prompted to enable software deployment support. Clicking Yes adds the installation files to the Repository. If you click No, the installation files must be added manually. 8 Click OK when complete. Creating an update task for VirusScan Enterprise Use these procedures to create, edit, or schedule an update task for VirusScan Enterprise: n n Creating a new update task Setting task options n Scheduling the task on page VirusScan Enterprise software version 7.0

13 Configuring AutoUpdate 7.0 Creating a new update task 1 In the console tree under epolicy Orchestrator, right-click Directory or the desired site, group, or computer, then select Schedule Task. The Schedule New Task dialog box appears. 2 Type a New Task Name. This can be any name or description for the task, and will be listed on the Tasks tab. 3 From the Software list, select McAfee AutoUpdate 7.0 Update. 4 Click OK to create the new task. Setting task options Scheduling the task This task does not require configuration. For more information about scheduling tasks, see Scheduling tasks on page On the Tasks tab in the upper details pane, right-click the task that you created, then select Edit Task. The epolicy Orchestrator Scheduler dialog box appears. 2 On the Task tab, deselect Inherit. 3 To enable this task, select Enable; otherwise, it won t start, regardless of settings in this dialog box. 4 Select Stop the task if it runs for to limit the amount of time for which the task can run before it is automatically cancelled. 5 Click the Schedule tab. Configuration Guide 13

14 Configuring AutoUpdate 7.0 Figure 1-3. Schedule tab 6 Deselect Inherit. 7 Select the frequency for the task in Schedule Task, then specify the corresponding Schedule Task options. w w If you select a Daily frequency in Schedule Task, specify the daily interval under Schedule Task Daily. If you select a Weekly frequency in Schedule Task, specify the weekly interval and select the days of week on which to execute the task. 8 Select the Start Time and whether to use UTC Time (formerly GMT Time) or Local Time. UTC (Universal Time Coordinate) is a new acronym designed to be used in all languages to replace the English term Greenwich Mean Time (GMT). 9 Select Enable randomization to start this task randomly on all selected client computers, then enter the time within which you want all computers to start the task. 14 VirusScan Enterprise software version 7.0

15 Configuring AutoUpdate Select Run missed task if you want to ensure that this task is started on any client computers that are not available during the scheduled time. 11 Click OK. If your systems run a login script after a reboot, then you will want to enter a number of minutes in the Delay missed task by box so that the task will not begin until after the login scripts have run. Creating a mirror task for VirusScan Enterprise Use these procedures to create a mirror task for VirusScan Enterprise. A mirror site refers to your repository list and mirrors (replicates) the first site listed. If it cannot connect for some reason, the mirror site tries the next site listed, and so on. Creating a new mirror task 1 In the console tree under epolicy Orchestrator, right-click Directory or the desired site, group, or computer, then select Schedule Task. The Schedule New Task dialog box appears. 2 Type a New Task Name. This can be any name or description for the task, and will be listed on the Tasks tab. 3 From the Software list, select Common Update with a Task Type of Mirror. 4 Click OK to create the new task. Setting task options 1 On the Tasks tab in the details pane, right-click the task that you created, then select Edit Task. The epolicy Orchestrator Scheduler dialog box appears. 2 Click Settings. The Task Settings dialog box appears. Configuration Guide 15

16 Configuring AutoUpdate 7.0 Figure 1-4. Task Settings Mirror 3 Deselect Inherit. 4 Set Destination Options by entering the path to the folder where you want the mirror to reside. The path must be a local folder with read and write access. 5 Click OK to return to the epolicy Orchestrator Scheduler dialog box. Setting AutoUpdate 7.0 policy Use AutoUpdate 7.0 to define repositories from which you can obtain the latest updates for your McAfee anti-virus products. 1 In the console tree under epolicy Orchestrator, select Directory. 2 In the upper details pane, expand McAfee AutoUpdate 7.0 and select Configuration. The McAfee AutoUpdate 7.0 General Policies dialog box appears. 16 VirusScan Enterprise software version 7.0

17 Configuring AutoUpdate 7.0 Figure 1-5. General Policies Repositories tab 1 Click the Repositories tab. 2 Deselect Inherit. A Default site is preconfigured to connect to the Network Associates HTTP download site. By leaving it selected, this site is used as one of your User defined repositories. 3 To add a new site to your repositories list, click Add. The Site options dialog box appears. Configuration Guide 17

18 Configuring AutoUpdate 7.0 Figure 1-6. Site options 4 In the Repository field, type the name for this repository. This name will appear in your list of repositories. 5 Select the appropriate type of site: w w w w HTTP Site A web page. FTP Site An FTP site. UNC Path A shared UNC directory (for example, \\PATH\TO\DIRECTORY). Local Path A site on the computer, either a local or a mapped drive. 6 In URL or Path (depending on which type of site you selected), type the path to the site. In Port, specify the port. Specify login credentials with read access if authentication is necessary. The standard HTTP port is 80. The standard FTP port is Click OK to return to the McAfee AutoUpdate 7.0 General Policies dialog box. Proxy Settings tab 1 Click the Proxy Settings tab. 18 VirusScan Enterprise software version 7.0

19 Configuring AutoUpdate 7.0 Figure 1-7. Proxy Settings 2 Deselect Inherit. 3 Select the appropriate type of proxy settings: w w w Don t use a proxy Connect directly, without a proxy. (This is selected as the default.) Use Internet Explorer Proxy Settings Use the same proxy settings found in the computer s Internet Explorer options. Manually configure the proxy settings Use the proxy settings specified here. 4 If you selected Manually configure the proxy settings, specify them in the space provided. Enter the Address and Port number for your HTTP or FTP proxy, as well as authentication information if it is required. 5 If you have any exceptions, select Specify exceptions and enter any repositories that you want to connect to directly (without using a proxy) in the text box provided. Configuration Guide 19

20 Configuring AutoUpdate 7.0 The Manually configure the proxy settings option automatically bypasses the local server address. Advanced tab 1 Click the Advanced tab. 2 Deselect Inherit. 3 Under Repository selection options, select the appropriate option: w w Use epo configured repositories Use the list of sites that was configured from within epolicy Orchestrator using AutoUpdate 7.0, as described in this chapter. Use client configured repositories Use the list of sites that was configured from within the local copy of VirusScan on the workstation. 4 Click Apply. You can customize the policy at any directory level. For example, you can configure some sites at root directory level, and configure other sites at a subdirectory level. 20 VirusScan Enterprise software version 7.0

21 Configuring VirusScan Enterprise VirusScan Enterprise 7.0 software replaces the VirusScan and NetShield 4.5 products. Therefore, VirusScan Enterprise installs on both desktops and servers. This chapter provides instructions on: n Adding the product to the Repository on page 21 n Deploying the product on page 22 n Setting policies for the product on page 25 n Scheduling tasks on page 44 Adding the product to the Repository Before configuring or deploying VirusScan Enterprise from the epolicy Orchestrator console, you must add the VirusScan Enterprise.NAP file to the Repository. 1 Log on to the epolicy Orchestrator server with administrator rights. 2 In the console tree under epolicy Orchestrator, right-click Repository, then select Configure Repository. Figure 2-1. Configure Repository option The Configuration Software Repository dialog box appears. Configuration Guide 21

22 Figure 2-2. Configure Software Repository dialog box 3 Select Add new software to be managed. 4 Click Continue to open the Select a Software Package dialog box. 5 Select the VSE700.NAP file. 6 Click Open to add the file to the Repository. 7 Click Yes when prompted to enable software deployment support. Clicking Yes adds the installation files to the Repository. If you click No, the installation files must be added manually. For more information, see Adding the product installation files to the Repository on page Click OK when complete. Deploying the product You can deploy the VirusScan Enterprise product, with or without modified policies, to a site, group, single computer, or the Directory. Adding the product installation files to the Repository To deploy VirusScan Enterprise from the epolicy Orchestrator console, the VirusScan Enterprise installation package file (INSTALL.PKG) and the setup (binary) files must be added to the Repository. These files are either on the product CD or at a location where you have stored them. 22 VirusScan Enterprise software version 7.0

23 If you have modified VirusScan Enterprise and created a customized.pkg file with McAfee Installation Designer to deploy, you can browse to its location during this process. If you selected Yes in Step 7 on page 22, you do not need to perform this procedure. 1 Log on to the epolicy Orchestrator server. 2 In the console tree under epolicy Orchestrator, right-click Repository, then select Configure Repository. The Configure Software Repository dialog box appears. 3 Select Enable software deployment, then click Continue to open the Select a Software Package dialog box. 4 Select the INSTALL.PKG file, then click Open. If the setup (binary) files are located in the same folder as the INSTALL.PKG file, they are installed automatically. If the setup files are located in a different folder, use the Browse dialog box to select the folder containing the binaries. 5 Click OK when the installation completes successfully. Deploying VirusScan Enterprise Once all the necessary VirusScan Enterprise software files have been added to the Repository, you can deploy the software to a selected site, group, single computer, or the entire Directory. You can deploy the product before or after setting other policies. 1 In the console tree under Directory, select the desired site, group, single computer, or the entire Directory to which you want to deploy VirusScan Enterprise. Configuration Guide 23

24 2 Select VirusScan Enterprise 7.0 on the Policies tab in the upper details pane. Figure 2-3. Directory and Policy selections The installation page appears in the lower details pane. Figure 2-4. VirusScan Enterprise installation page 3 Deselect Inherit. 4 Select Force Install VirusScan Enterprise. 5 Click Select to open the Software Package dialog box. 6 Select the VirusScan Enterprise 7.0 software package, then click OK. 7 Click Apply to save these settings. 24 VirusScan Enterprise software version 7.0

25 8 When you are ready to make this installation policy available to the epolicy Orchestrator agent, select Enforce Policies for VirusScan Enterprise. WARNING Clicking Apply does not install the software to the designated targets. Selecting Enforce Policies for VirusScan Enterprise sets the product to be installed during the next agent-to-server communication. This also installs the customized policies, if you altered and applied them. For more information about agent-to-server communication, see the epolicy Orchestrator version 2.x product documentation. Setting policies for the product Configuring VirusScan Enterprise 7.0 policies from the epolicy Orchestrator console allows you to enforce, across groups of computers, the options that define how all tasks and permissions are configured. These policies override configurations set on individual workstations. For information regarding policies and how they are enforced, see the epolicy Orchestrator 2.x product documentation. Before configuring any policies, select the group of computers in the console tree for which you want to set policies. The VirusScan Enterprise 7.0 policy tabs, on which you can set VirusScan Enterprise policies, are nearly identical to the dialog boxes and their tabs in the VirusScan Console. For complete information about the options you can set for VirusScan Enterprise, refer to the VirusScan Enterprise 7.0 Product Guide. Once you set and save the desired policy options for a destination computer or group of destination computers, and you are ready to make the new policies available to the epolicy Orchestrator agent to deploy, you must select VirusScan Enterprise 7.0 on the Policies tab in the upper details pane and select Enforce Policies for VirusScan Enterprise in the lower details pane. Selecting this option allows the policies to be deployed during the next agent-to-server communication. Configuration Guide 25

26 To set policies for VirusScan Enterprise in epolicy Orchestrator: 1 Log on to the epolicy Orchestrator server. 2 In the console tree under epolicy Orchestrator Directory, select the site, group, single computer, or the entire Directory. Figure 2-5. epolicy Orchestrator console The Policies, Properties, and Tasks tabs appear in the upper details pane. 3 Select the Policies tab in the upper details pane, then expand VirusScan Enterprise 7.0. The following policy pages appear in the tree: w w w w w w w General Policies Default Processes Policies Low-Risk Processes Policies High-Risk Processes Policies On Delivery Scan Policies User Interface Policies Alert Manager Alert Policies 4 Select an item under VirusScan Enterprise 7.0 to display its policy pages. 26 VirusScan Enterprise software version 7.0

27 Server and workstation policy settings At the top of every policy page are two buttons: Server and Workstation. These buttons allow you to select whether you are configuring policies for the servers or workstations in the group of destination computers. Therefore, you can simultaneously deploy two different configurations to the computers in a given group. It is important that you select and verify this option as you configure the settings. Setting general policies The options on the General Policies tabs apply to all on-access scanning. Select General Policies under VirusScan Enterprise 7.0 in the upper details pane. These options are divided among three tabs: General, Messages, and Reports. General 1 In the lower details pane, select the General tab. Figure 2-6. General Policies General tab 2 Deselect Inherit. 3 Configure the following policy options: Configuration Guide 27

28 Scan Choose whether to scan floppy disks during shutdown, and whether to scan boot sectors. General Choose the location and name of the on-access scan quarantine folder, and whether to enable or disable on-access scanning at startup. Scan time Choose the maximum scan time in seconds for archives and the maximum scan time for all files. You can also choose whether to enforce the scan time limit for all files. 4 Click Apply to save these settings. This tab is identical to the General tab of the VirusScan On-Access Scan Properties dialog box when you select General Settings. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. Messages 1 In the lower details pane, select the Messages tab. Figure 2-7. General Policies Messages tab 2 Deselect Inherit. 3 Configure the following policy options on this tab: 28 VirusScan Enterprise software version 7.0

29 Messages for local users Choose whether to display the On-Access Scan Messages dialog box for local users, and what actions the local users without administrator rights can take on infected files. Response to network users Choose whether to send network users a message in the event of an outbreak, and whether to disconnect remote users and deny access to the network share in the event of an outbreak. 4 Click Apply to save these settings. This tab is identical to the Messages tab of the VirusScan On-Access Scan Properties dialog box when you select General Settings. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. Reports These options allow you to configure and specify the logging of virus activity. 1 In the lower details pane, select the Reports tab. Figure 2-8. General Policies Reports tab 2 Deselect Inherit. 3 Configure the following policy options: Log file Choose whether to log virus activity data to a log file, whether to limit the size of the log file, and specify the location of the log file. What to log in addition to virus activity Choose what types of information you want logged. Configuration Guide 29

30 4 Click Apply to save these settings. This tab is identical to the Reporting tab of the VirusScan On-Access Scan Properties dialog box when you select General Settings. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. Setting policies for default processes The default processes policies that you set here are for on-access scanning. Default processes are any processes that are not specified as low-risk or high-risk. In the upper details pane, select Default Processes Policies. These policy options are divided among four tabs: Processes, Detection, Advanced, and Actions. Processes These options allow you to specify which processes are scanned by default during an on-access scan. 1 In the lower details pane, select the Processes tab. Figure 2-9. Default Processes Policies Processes tab 2 Deselect Inherit. 3 Choose whether to set policies for all processes or only those processes not specified as low-risk or high-risk. (For information about low-risk and high-risk processes, see the VirusScan Enterprise 7.0 Product Guide.) 4 Click Apply to save these settings. This tab is identical to the Processes tab of the VirusScan On-Access Scan Properties dialog box when you select Default Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. 30 VirusScan Enterprise software version 7.0

31 Detection These options allow you to specify what is scanned and not scanned during an on-access scan. 1 In the lower details pane, select the Detection tab. Figure Default Processes Policies Detection tab 2 Deselect Inherit. 3 Configure the following policy options: Scan files Choose when to scan files and whether files on network drives are scanned. What to scan Choose which file types to scan. Use the Additions button to add file types to the list of default file types, or the Specified button to define a custom list of file types to scan. What not to scan Use the Exclusions button to define a custom list of specific files, folders, and drives not to scan. Select Overwrite client exclusions if you want only the exclusions that have been added in the policy to be used. If Overwrite client exclusions is deselected, the client machine will use the exclusions that were set locally and the exclusions set here, in the policy. Configuration Guide 31

32 4 Click Apply to save these settings. This tab is nearly identical to the Detection tab of the VirusScan On-Access Scan Properties dialog box when you select Default Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. Advanced This tab allows you to specify advanced scan options to be used during an on-access scan. 1 In the lower details pane, select the Advanced tab. Figure Default Processes Policies Advanced tab 2 Deselect Inherit. 3 Configure the following policy options: Heuristics Choose whether to scan for unknown viruses. Non-viruses Choose whether to scan for potentially unwanted programs and joke programs. Compressed files Choose whether to scan packed executables, archives, and MIME-encoded files. 4 Click Apply to save these settings. 32 VirusScan Enterprise software version 7.0

33 This tab is identical to the Advanced tab of the VirusScan On-Access Scan Properties dialog box when you select Default Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. Actions This tab allows you to define the primary and secondary actions to perform on infected files during an on-access scan. 1 In the lower details pane, select the Actions tab. Figure Default Processes Policies Actions tab 2 Deselect Inherit. 3 Use the drop-down lists to define the primary and secondary actions to perform on infected files. 4 Click Apply to save these settings. This tab is identical to the Action tab of the VirusScan On-Access Scan Properties dialog box when you select Default Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. Configuration Guide 33

34 Setting policies for low-risk processes These policies apply to processes specified as having a lower risk of infection, and are used during an on-access scan. Select Low-Risk Processes Policies under VirusScan Enterprise 7.0 on the Policies tab in the upper details pane. These policy options are divided among four tabs: Processes, Detection, Advanced, and Actions. If you selected Use the settings on these tabs for all processes for Default Processes, the policies options for Low-Risk Processes and High-Risk Processes are disabled. The options on these tabs affect processes specified as low-risk on the Processes tab. The Detection, Advanced, and Actions tabs are identical to the tabs of the same names under Default Processes Policies. For instructions on setting the options on these tabs, see Setting policies for default processes on page 30. Processes The options on this tab allow you to specify which processes have a low risk of spreading infection and are scanned as such during an on-access scan. 1 In the lower details pane, select the Processes tab. Figure Low-Risk Processes Policies Processes tab 2 Deselect Inherit. 3 Use the Add and Remove buttons to define the list of low-risk processes. 4 Click Apply to save these settings. 34 VirusScan Enterprise software version 7.0

35 This tab is identical to the Processes tab of the VirusScan On-Access Scan Properties dialog box of VirusScan Enterprise when you select Low-Risk Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. Setting policies for high-risk processes These policies apply to processes specified as having a higher risk of infection, and are used during an on-access scan. Select High-Risk Processes Policies under VirusScan Enterprise 7.0 on the Policies tab in the upper details pane. These policy options are divided among four tabs: Processes, Detection, Advanced, and Actions. If you selected Use the settings on these tabs for all processes for Default Processes, the policies options for Low-Risk Processes and High-Risk Processes are disabled. The options on these tabs affect processes specified as high-risk on the Processes tab. The Detection, Advanced, and Actions tabs are identical to the tabs of the same names under Default Processes Policies. For instructions on setting the options on these tabs, see Setting policies for default processes on page 30. Processes The options on this tab allow you to specify which processes have a high risk of spreading infection, and will be scanned as such during an on-access scan. 1 In the lower details pane, select the Processes tab. Figure High-Risk Processes Policies Processes tab 2 Deselect Inherit. Configuration Guide 35

36 3 Use the Add and Remove buttons to define the list of high-risk processes. 4 Click Apply to save these settings. This tab is identical to the Processes tab of the VirusScan On-Access Scan Properties dialog box of VirusScan Enterprise when you select High-Risk Processes. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. Setting policies for on-delivery scanning Select On Delivery Scan Policies under VirusScan Enterprise 7.0 in the upper details pane. Policy options for on-delivery scanning are divided among five tabs: Detection, Advanced, Actions, Alerts, and Reports. Detection This tab allows you to specify detection options during an on-delivery scan. 1 In the lower details pane, select the Detection tab. Figure On Delivery Scan Policies Detection tab 2 Deselect Inherit. 3 Configure the following policy options: Scanning of Choose whether to enable on-delivery scanning for Microsoft Exchange clients. 36 VirusScan Enterprise software version 7.0

37 Attachments Choose which file types to scan. Use the Additions button to add file types to the list of default file types, or the Specified button to define a custom list of file types to scan. 4 Click Apply to save these settings. This tab is identical to the Detection tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise version 7.0 Product Guide. Advanced This tab allows you to specify advanced scan options during an on-delivery scan. 1 In the lower details pane, select the Advanced tab. Figure On Delivery Scan Policies Advanced tab 2 Deselect Inherit. 3 Configure the following policy options: Heuristics Choose whether to scan for unknown viruses. Non-viruses Choose whether to scan for potentially unwanted programs and joke programs. Configuration Guide 37

38 Compressed files Choose whether to scan compressed files, archives, and MIME-encoded files. message body Choose whether to scan the body of messages. 4 Click Apply to save these settings. This tab is identical to the Advanced tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. Actions This tab allows you to define the primary and secondary actions to perform on infected messages and their attachments. 1 In the lower details pane, select the Actions tab. Figure On Delivery Scan Policies Actions tab 2 Deselect Inherit. 3 Use the drop-down lists to define the primary and secondary actions to perform on infected files. 4 If you select Move infected attachments to a folder, you can choose a name for the mailbox folder, or accept the default name (quarantine). 5 Click Apply to save these settings. This tab is identical to the Actions tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. 38 VirusScan Enterprise software version 7.0

39 Alerts This tab allows you to define options regarding the on-delivery scanner alerts. 1 In the lower details pane, select the Alerts tab. Figure On Delivery Scan Policies Alerts tab 2 Deselect Inherit. 3 Configure the following policy options: alert Choose whether to define and send a reply message to the sender of an infected message, and whether to define and send an alert message to the recipient. If Prompt for Action is selected Choose whether to create and display a custom message to the recipient, and whether to sound an audible alert when an infection is detected in an message or its attachments. 4 Click Apply to save these settings. This tab is identical to the Alerts tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise version 7.0 Product Guide. Configuration Guide 39

40 Reports This tab allows you to configure log files. 1 Select the Reports tab in the lower details pane. Figure On Delivery Scan Policies Reports tab 2 Deselect Inherit. 3 Configure the following policy options: Log file Choose whether to log on-delivery scanner data to a file, the location of that file, and whether to limit the size of the log file. What to log Select the on-delivery scan data you want to log. 4 Click Apply to save these settings. This tab is identical to the Reports tab of the On-Delivery Scan Properties dialog box of VirusScan Enterprise. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. 40 VirusScan Enterprise software version 7.0

41 Setting user interface policies Select User Interface Policies under VirusScan Enterprise 7.0 in the upper details pane. These policy options appear on the following tabs: Display Options and Password Options. Display Options This tab allows you to configure security-related display settings. 1 Select the Display Options tab in the lower details pane. Figure User Interface Policies Display Options 2 Deselect Inherit. 3 Configure the following policy options: System tray icon Choose which, if any, menu options are available to users from the system tray icon. You can choose all menu options, minimal menu options, or no options. Local console refresh time Choose how often (in seconds) local consoles refreshes. 4 Click Apply to save these settings. This tab is identical to the User Interface Options tab of the Options dialog box of VirusScan Enterprise (accessed from the Tools menu of the VirusScan Enterprise). For complete information about these options, see the VirusScan Enterprise version 7.0 Product Guide. Configuration Guide 41

42 Password Options This tab allows you to define a password, and the policy pages and tabs that the password protects. 1 Select the Password Options tab in the lower details pane. Figure Password Options 2 Deselect Inherit. 3 Select the desired level of password protection: w w w No password Password protection for all items listed below Password protection for the selected items below 4 If you selected password protection in Step 3, enter and confirm the desired password in the boxes provided. 5 If you selected the last option in Step 3, select which items in the list to protect. If the icon next to the name of the policy page is a closed red lock, that item is protected by the password. If the icon is an open green lock, that item is not protected by the password. 42 VirusScan Enterprise software version 7.0

43 Setting Alert Manager Alerts policies Select Alert Manager Alerts Policies under VirusScan Enterprise 7.0 in the upper details pane. These policy options appear on a single tab: Alert Manager Alerts. For information about configuring the Alert Manager server with epolicy Orchestrator, see the Alert Manager product documentation. Alert Manager Alerts This tab allows you to configure the VirusScan Enterprise features that generate alerts, and the destination for alerts. 1 Select the Alert Manager Alerts tab in the lower details pane. Figure Alert Manager Alerts 2 Deselect Inherit. 3 Configure the following policy options: Which components will generate alerts Select which VirusScan Enterprise components you want to generate alerts when infections are detected. Alert Manager destination selection Choose to enable or disable alerting. If you enable alerting, you must select whether to enable centralized alerting or Alert Manager alerting, and the location of the folder or server to receive the alerts. 4 Click Apply to save these settings. Configuration Guide 43

44 For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide or Alert Manager product documentation. Scheduling tasks You can schedule on-demand scan tasks to deploy either with an installation package, or to existing installations. To create a new update task, see Configuring AutoUpdate 7.0 on page 11. Creating a new scan task 1 In the console tree under epolicy Orchestrator, right-click Directory or the desired site, group, or computer, then select Schedule Task. The Schedule New Task dialog box appears. Figure Schedule New Task 2 Enter a New Task Name. 3 Select VirusScan Enterprise 7.0 On-Demand Scan from the Software list. 4 Click OK to create the task. 44 VirusScan Enterprise software version 7.0

45 Configuring the scan task settings 1 On the Tasks tab in the upper details pane, right-click the task, then select Edit Task. The epolicy Orchestrator Scheduler dialog box appears. Figure epolicy Orchestrator Scheduler 2 Click Settings to configure the task. The On Demand Scan Task dialog box appears. The task settings options are divided among five tabs: Where, Detection, Advanced, Actions, Reports, and Task. Figure Tabs of Task Settings You can configure these tabs in any order. For the purposes of this guide, these tabs are addressed from left to right. Configuration Guide 45

46 3 Select the Where tab to specify where scanning takes place. Figure On Demand Scan Task Where tab a b c Deselect Inherit. Use the Add, Edit, and Remove buttons to define the locations to scan. Under Scan Options, choose whether to include subfolders, and whether to scan boot sectors. 4 Select the Detection tab to specify the file types to scan. 46 VirusScan Enterprise software version 7.0

47 Figure On Demand Scan Task Detection tab a b Deselect Inherit. Configure the following policy options: What to scan Select All files, Default + additional types, or Specified file types (you can only select one of these options). Use the Additions button to add file types to the list of default file types, or the Specified button to define a custom list of file types to scan. What not to scan Use the Exclusions button to define a list of specific file types, folders, and drives not to scan (to exclude from the scan). If Overwrite client exclusions is not selected, the exclusions that are set for the client s default on-demand scanning are appended to the exclusions that were set for the task on the epolicy Orchestrator server. Compressed files Choose whether to scan inside packed executables, whether to scan inside multiple-file archives, and whether to scan MIME-encoded files. 5 Select the Advanced tab to define more specific settings. Configuration Guide 47

48 Figure On Demand Scan Task Advanced tab a b Deselect Inherit. Configure the following policy options: Heuristics Choose whether to scan for unknown program viruses, and whether to scan for unknown macro viruses. Non-viruses Choose whether to scan for potentially unwanted programs, and whether to scan for joke programs. CPU utilization Choose the maximum percentage of CPU usage for the scan task. Miscellaneous Choose whether to scan files that have been migrated to storage, and whether to rescan all files when DAT files are updated. 6 Select the Actions tab to specify the actions to take on infected files. 48 VirusScan Enterprise software version 7.0

49 Figure On Demand Scan Task Actions tab a b c Deselect Inherit. From the drop-down lists, select the primary and secondary actions to perform on infected files. If you select Move infected files to a folder, choose a destination folder for infected files. 7 Select the Reports tab to specify logging options. Configuration Guide 49

50 Figure On Demand Scan Task Reports a b Deselect Inherit. Configure the following policy options: Log file Choose whether to log virus scan activity, whether to limit the size of the log file, and the location of the log file. What to log in addition to virus activity Choose what types of information to log. 8 Select the Task tab to specify platform settings. 50 VirusScan Enterprise software version 7.0

51 Figure On Demand Scan Task Task a b c Deselect Inherit. Under Platform selection, choose whether to run the task on workstations, servers, or both. Under User account settings, enter the necessary user name, password, and domain name in the appropriate fields if you want the task to run under a specific account. If no account is entered, the task runs under the system account. 9 Click OK, when finished editing all the desired options on all tabs, to return to the epolicy Orchestrator Scheduler dialog box. Configuring the schedule settings 1 Under Schedule Settings on the Task tab of the epolicy Orchestrator Scheduler dialog box, deselect Inherit. 2 Select Enable on the Task tab to enable both the scheduling options under Schedule Settings on the Task tab, and the scheduling options on the Schedule tab of the epolicy Orchestrator Scheduler dialog box. Configuration Guide 51

52 3 Select Stop the task if it runs for to define a maximum amount of time for the task to run before being interrupted. If you select this checkbox, use the Hours and Minutes boxes to define the amount of time the task can run before it is interrupted. If you choose to stop the task after a defined amount of time, the task resumes from the point it was interrupted the next time it runs. Scheduling the task 1 Click the Schedule tab of the epolicy Orchestrator Scheduler dialog box to specify when the task runs. Figure epolicy Orchestrator Scheduler Schedule 2 Deselect Inherit. Enable must be selected under Schedule Settings on the Task tab to enable the options on the Schedule tab. 3 Select the options on this tab to schedule the task. The options on this tab are identical to the Schedule tab of the Schedule Settings dialog box accessed from the On-Demand Scan Properties dialog box. For complete information about these options, see the VirusScan Enterprise 7.0 Product Guide. 4 Click OK when you are through configuring and scheduling the task. 52 VirusScan Enterprise software version 7.0