McAfee Application Control Windows Installation Guide. (McAfee epolicy Orchestrator)

Transcription

1 McAfee Application Control Windows Installation Guide (McAfee epolicy Orchestrator)

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Application Control Windows Installation Guide

3 Contents 1 Install the software 5 System requirements Supported McAfee epo versions Install the extension manually Install the extension with Software Manager Add the software license key Install the Solidcore client manually Install the Solidcore client with Software Manager Install the Solidcore client on the endpoints Verify the Solidcore client installation Enable the Solidcore client Upgrade the software 13 Upgrade Solidcore extension manually Upgrade Solidcore extension with Software Manager Verify the Solidcore extension upgrade Add the Solidcore client package to the repository manually Add the Solidcore client package to the repository with Software Manager Upgrade the Solidcore client on the endpoints Verify the Solidcore client upgrade Uninstall the software 19 Remove the Solidcore client Remove the Solidcore extension Remove the Solidcore client package McAfee Application Control Windows Installation Guide 3

4 Contents 4 McAfee Application Control Windows Installation Guide

5 1 Install 1 the software Contents System requirements Install the extension manually Install the extension with Software Manager Add the software license key Install the Solidcore client manually Install the Solidcore client with Software Manager Install the Solidcore client on the endpoints Verify the Solidcore client installation Enable the Solidcore client System requirements Before installing Change Control or Application Control, make sure that your environment meets these requirements. To review system requirements for this release, see KB Verify that the McAfee epo server and database are installed and configured. McAfee epo is a management tool that installs software and deploys policies on the managed endpoints. It also allows you to monitor client activity, create reports, and store and distribute content and software updates. Make sure that McAfee Agent is installed on each endpoint where you want to install Change Control or Application Control. McAfee Agent acts as the intermediary between the Solidcore client and McAfee epo server. It sends data between the two. Download the Solidcore extension package from the McAfee Downloads site. The Solidcore extension file is typically named Solidcore_epo_extn_<version>.<build>.zip. Download the Solidcore client package from the McAfee Downloads site. Here are the available Solidcore client packages. Operating system Microsoft Windows Package name SOLIDCOR<version>-<build>_WIN.zip Make sure that the target platforms where you want to install the Solidcore client are supported. See KB87944 for Change Control and Application Control). Determine the database sizing requirements for your setup. See KB72753 for Change Control and Application Control. Review the minimum system requirements for Change Control and Application Control. See KB McAfee Application Control Windows Installation Guide 5

6 1 Install the software Install the extension manually Supported McAfee epo versions This release of McAfee Application Control and McAfee Change Control is compatible with these McAfee epolicy Orchestrator (McAfee epo ) versions. McAfee epo McAfee epo and Install the extension manually The Solidcore extension integrates with the McAfee epo console and provides Change Control and Application Control features. Before you begin Make sure that the extension file is stored at an accessible location. 1 On the McAfee epo console, select Menu Software Extensions to open the Extensions page. 2 Click Install Extension. 3 Browse to and select the Solidcore_epo_extn_<ver>.<build>.zip file, then click OK. 4 Verify the information about the Install Extension page, then click OK. 5 Verify that the Solidcore product name appears in the Extensions list. If the product name is not listed or you encounter errors during installation, review the Orion.log file in the <McAfee epo install dir>\server\logs directory to analyze failure cause. Install the extension with Software Manager The Solidcore extension integrates with the McAfee epo console and provides Change Control and Application Control features. 1 On the McAfee epo console, select Menu Software Software Manager. 2 From the Product Categories list, select Software (by Label) Endpoint Security. 3 Select McAfee Application Control 8.1 or McAfee Change Control Click Check In for the epo Management Extension. 5 On the Check In Software Summary page, select the I accept the terms in the license agreement checkbox and click OK. Add the software license key Licenses determine the product features that are enabled in your system. When you install the Solidcore extension, a default evaluation license for Integrity Control lasting 90 days is provided. You can extend this evaluation license for another 90 days or add a full license. The license key determines the features that are enabled. Any or all features can be enabled and used at the same time. 6 McAfee Application Control Windows Installation Guide

7 Install the software Install the Solidcore client manually 1 1 On the McAfee epo console, select Menu Configuration Server Settings to open the Setting Categories page. 2 Select Solidcore, then click Edit to open the Edit Solidcore page. 3 Enter the license keys, then click Save. Install the Solidcore client manually The Solidcore client provides change monitoring, change prevention, and whitelisting features. For all supported platforms, the Solidcore client works well on both physical and virtual machines (VM). Before you begin Before you install the Solidcore client, add the Solidcore client package to the McAfee epo repository. 1 On the McAfee epo console, select Menu Software Master Repository. 2 From the Packages in Master Repository page, click Check In Package. 3 Set the package type to Product or Update (.ZIP). 4 Browse to and select the package (.zip) file and click Next to open the Package Options page. 5 Check and confirm the information. Package info: Verify the package details. Branch: Select the branch you want. Set to Current for new products. Options: (Optional) Select Move the existing package to the Previous branch to move an existing package to the previous branch. Package signing: Indicates if the package is signed by McAfee or if it is a third-party package. Conflicting Packages that will be removed: Displays a list of packages, if any, that will be deleted. 6 Click Save to add the package. 7 The new package appears in Packages in Master Repository list. Install the Solidcore client with Software Manager The Solidcore client provides change monitoring, change prevention, and whitelisting features. For all supported platforms, the Solidcore client works well on both physical and virtual machines (VM). Before you begin Before you install the Solidcore client, add the Solidcore client package to the McAfee epo repository. McAfee Application Control Windows Installation Guide 7

8 1 Install the software Install the Solidcore client on the endpoints 1 On the McAfee epo console, select Menu Software Software Manager. 2 Click the Refresh button at the top of the page, next to Software Manager. Wait until you see a green check next to the button. 3 From the Product Categories list, select Software (by Label) Endpoint Security. 4 Select McAfee Application Control 8.1 or McAfee Change Control Click Check In for the Solidcore Client for Linux package. 6 On the Check In Software Summary page, select the I accept the terms in the license agreement checkbox and click OK. Install the Solidcore client on the endpoints The Solidcore client provides change monitoring, change prevention, and whitelisting features. For all supported platforms, the Solidcore client works well on both physical and virtual machines (VM). 1 On the McAfee epo console, select Menu Systems System Tree. 2 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and click the Assigned Client s tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify s on a Single System. 3 Click Actions New Client Assignment to open the Client Assignment Builder page. 4 Select the McAfee Agent product and Product Deployment task type, then click Create New. 5 Specify the task name and add any descriptive information. 6 Select the target platform. For example, when installing the Solidcore client package on the Linux operating system, select Windows as the target platform. 7 Specify the component and action. a Select the appropriate package from the Products and components list. b c d Select the Install action. Select the language of the package. Specify the branch where to add the package. 8 Click Save, then click Next to open the Schedule page. 9 Specify scheduling details, then click Next. 10 Review and verify the task details, then click Save. 11 (Optional) Click Wake Up Agents to send your client task to the endpoint immediately. 8 McAfee Application Control Windows Installation Guide

9 Install the software Verify the Solidcore client installation 1 Verify the Solidcore client installation The Solidcore client provides change monitoring, change prevention, and whitelisting features. You can verify if the software was installed successfully on an endpoint. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Select a group or endpoint from the list to view details for the selected node in the Systems tab. 3 Review logs from the McAfee epo console. a Select a system on the Systems page. b Select Actions Agent Show Agent Log to view the agent log for the endpoint. By default, agent logs are not enabled on the McAfee epo console. c Check the log to verify that the software was successfully installed on the endpoint. 4 Review the properties for the system. a Click Wake Up Agents to fetch properties immediately. Typically, information is exchanged between the agent and server after an agent-server communication interval (ASCI). The default ASCI value is 60 minutes. You can send an agent wake-up call to ensure immediate communication and data exchange between the server and the agent, without waiting for the ASCI to expire. b c Click a system on the Systems page to view details for the selected endpoint. Click the Products tab and review the Solidcore version. Click the row to review additional information, including the product version and installation path. If the Solidcore information is not listed, check the log files on the endpoint to verify that the software was successfully installed. If the Solidcore client installation fails, the log files provide information about the cause for failure. Logs files are located in /var/log/mcafee/solidcore/folder and installation logs in /var/log/mcafee/solidcore/solidcores3_install*.log. Enable the Solidcore client To activate the software, place the Solidcore client in Enabled mode. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and click the Assigned Client s tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify s on a Single System. 3 Click Actions New Client Assignment to open the Client Assignment Builder page. 4 Select the Solidcore product and SC: Enable task type, then click Create New. 5 On the Client Catalog page, specify the task name and add any descriptive information. McAfee Application Control Windows Installation Guide 9

10 1 Install the software Enable the Solidcore client 6 Select the platform, the subplatform, and indicate whether to enable Change Control, Application Control, or both. 7 Enable Change Control, complete these steps. Solidcore clients running Windows all Windows NT and Windows 2000 Steps No configuration is needed. Select Reboot endpoint checkbox to restart the endpoint. On the Windows platforms, a pop-up message is displayed at the endpoint 5 minutes before the endpoint is restarted. This allows the user to save work and data on the endpoint. 8 Enable Application Control, complete these steps. Solidcore clients running Windows all Steps 1 Specify the scan priority. This determines the priority of the thread that is run to create the whitelist on the endpoints. Set the scan priority to Low. This makes sure that Application Control causes minimal performance impact on the endpoints but might take longer (than when you set the priority to High) to create the whitelist. 2 Specify the activation option. Limited Feature Activation The endpoints are not restarted and limited features of Application Control are activated. Memory Protection features are available only after the endpoint is restarted. Full Feature Activation The endpoints are restarted, whitelist created, and all features of Application Control including Memory Protection are active. Restarting the endpoints is needed to enable the memory protection features. The endpoint is restarted 5 minutes after the client task is received at the endpoint. A pop-up message is displayed on the endpoint before the endpoint is restarted. 3 Select Start Observe Mode to place the endpoints in Observe mode. 4 (Optional) Select Pull Inventory. If you select this option, the software fetches the inventory details for the endpoints (after the whitelist is created) and makes the details available on the McAfee epo console after ASCI. Select this option if you want to manage the inventory using the McAfee epo console. Windows NT or Windows 2000 Select Reboot endpoint checkbox to restart the endpoint after solidification is complete. Restarting the system is needed to enable the software. A pop-up message is displayed at the endpoint 5 minutes before the endpoint is restarted. This allows the user to save work and data on the endpoint. 9 Click Save, then click Next to open the Schedule page. 10 Specify scheduling details, then click Next. 11 Review and verify the task details, then click Save. 12 (Optional) Click Wake Up Agents to send your client task to the endpoint immediately. 10 McAfee Application Control Windows Installation Guide

11 Install the software Enable the Solidcore client 1 13 Verify that the software is enabled. a Click Wake Up Agents to fetch properties immediately. b c Click a system on the Systems page. The details for the selected system are displayed. Select the Products tab and review the Solidcore version. Click the row to review the license status. McAfee Application Control Windows Installation Guide 11

12 1 Install the software Enable the Solidcore client 12 McAfee Application Control Windows Installation Guide

13 2 Upgrade the software Contents Upgrade Solidcore extension manually Upgrade Solidcore extension with Software Manager Verify the Solidcore extension upgrade Add the Solidcore client package to the repository manually Add the Solidcore client package to the repository with Software Manager Upgrade the Solidcore client on the endpoints Verify the Solidcore client upgrade Upgrade Solidcore extension manually Upgrade the Solidcore extension to access the new features in a release. Before you begin Stop the McAfee epo Event Parser service and back up the relevant files before you upgrade the Solidcore extension. 1 Select Control Panel Administrative Tools Services. 2 Right-click the McAfee epolicy Orchestrator <version> Event Parser service and click Stop. 3 Back up these items. McAfee epo database <McAfee epo install dir>\server\extensions\installed\solidcore directory <McAfee epo install dir>\server\conf\catalina\localhost\solidcore_meta.xml file 4 On the McAfee epo console, select Menu Software Extensions to open the Extensions page. 5 Click Install Extension, browse to, and select the Solidcore_epo_extn_<ver>.<build>.zip file, then click OK. 6 Verify the information about the Install Extension page, then click OK. Backup the McAfee epo database. McAfee Application Control Windows Installation Guide 13

14 2 Upgrade the software Upgrade Solidcore extension with Software Manager Upgrade Solidcore extension with Software Manager Upgrade the Solidcore extension to access the new features in a release. You can also upgrade the Solidcore extension using Software Manager. 1 Stop the McAfee epo Event Parser service and back up the relevant files before you upgrade the Solidcore extension. 1 Select Control Panel Administrative Tools Services. 2 Right-click the McAfee epolicy Orchestrator <version> Event Parser service and click Stop. 3 Back up these items. McAfee epo database. <McAfee epo install dir>\server\extensions\installed\solidcore directory. <McAfee epo install dir>\server\conf\catalina\localhost\solidcore_meta.xml file. 2 On the McAfee epo console, select Menu Software Software Manager. 3 From the Product Categories list, select Software (by Label) Endpoint Security. 4 Select McAfee Application Control or McAfee Change Control Click Update for the epo Management Extension. 6 On the Update Software Summary page, click OK. Verify the Solidcore extension upgrade Check if the Solidcore extension was upgraded successfully. 1 Check if the Solidcore product name appears in the Extensions list. If the product name is not listed or you encounter errors during upgrade, review the Orion.log file in the <McAfee epo install dir>\server\logs directory to analyze failure cause. After you upgrade the Solidcore extension, the domain NetBIOS Name is not available for existing users imported directly from an Active Directory to rule groups and policies. To make sure the domain NetBIOS Name is available for such users, delete and reimport users from the Active Directory. After the upgrade, any users that you import from the Active Directory and add to new or existing rule groups and policies automatically include the domain NetBIOS Name. 2 Start the McAfee epo Event Parser service. a Select Control Panel Administrative Tools Services. b Right-click the McAfee epolicy Orchestrator <version> Event Parser service and click Start. 14 McAfee Application Control Windows Installation Guide

15 Upgrade the software Add the Solidcore client package to the repository manually 2 3 Verify that migration of data was successful. a On the McAfee epo console, select Menu Automation Server Log. b c Check if the Solidcore: Migration server task is complete. This server task completes upgrade-related activities. If the task is in progress, wait until the task completes. Make sure you do not edit any existing settings while this task is in progress. If the migration fails, review the Server Log, resolve any issues, and run the Solidcore: Migration server task manually to complete the migration. 4 (Optional) Run the Rule Group Sanity Check server task from the McAfee epo console to fix the inconsistencies in the rule groups. This task updates and corrects the Solidcore Rule Group for errors in installers and certificates. This task also issues warnings for trusted groups related issues. a b c d e f g On the McAfee epo console, select Menu Automation Server s. Click New to open the Server Builder wizard. Type the task name and click Next. Select Solidcore: Rule Group Sanity Check from the Actions drop-down list, then click Next. Specify the schedule for the task, then click Next to open the Summary page. Review the task summary and click Save. Review the logs generated by the server task (on the Server Log page) to view the warnings, if any. Add the Solidcore client package to the repository manually Before you can upgrade, you must add the Solidcore client package to the McAfee epo repository. Before you begin To review system requirements, see KB On the McAfee epo console, select Menu Software Master Repository to open the Packages in Master Repository page. 2 Click Check In Package. 3 Set the package type to Product or Update (.ZIP). 4 Browse to and select the package (.zip) file, then click Next to open the Package Options page. 5 Check and confirm the information. Package info: Verify the package details. Branch: Select the branch you want. Set to Current for new products. Options: (Optional) Select the Move the existing package to the Previous branch option to move an existing package to the previous branch. McAfee Application Control Windows Installation Guide 15

16 2 Upgrade the software Add the Solidcore client package to the repository with Software Manager Package signing: Indicates if the package is signed by McAfee or if it is a third-party package. Conflicting Packages that will be removed: Displays a list of packages, if any, that will be deleted. 6 Click Save to check in the package. The new package appears in Packages in Master Repository list. Add the Solidcore client package to the repository with Software Manager Before you can upgrade, you must add the Solidcore client package to the McAfee epo repository. You can add it automatically using Software Manager. Before you begin To review system requirements, see KB On the McAfee epo console, select Menu Software Software Manager. 2 Click the Refresh button at the top of the page, next to Software Manager. Wait until you see a green check next to the button. 3 From the Product Categories list, select Software (by Label) Endpoint Security. 4 Select McAfee Application Control or McAfee Change Control Under Components, select the build you want to install. Check the build number under Available Version and Additional Check In Details. 6 Click Update for the Solidcore Client package. 7 On the Update Software Summary page, click OK. Upgrade the Solidcore client on the endpoints Upgrade the Solidcore client on the endpoints to access new features available in the recent version. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Apply the client task to a group or an endpoint: Group Select a group in the System Tree and click the Assigned Client s tab. Endpoint Select the endpoint on the Systems page and click Actions Agent Modify s on a Single System. 3 Click Actions New Client Assignment to open the Client Assignment Builder page. 4 Select the McAfee Agent product, Product Deployment task type, then click Create New to open the Client Catalog page. 16 McAfee Application Control Windows Installation Guide

17 Upgrade the software Verify the Solidcore client upgrade 2 5 Specify the task name, add any descriptive information, select the target platform, then specify the component and action: Select the appropriate package from the Products and components list. Select the Install action. Select the language of the package. Set branch to Current for new packages. 6 Click Save, then click Next to open the Schedule page. 7 Specify scheduling details, click Next, then click Save. 8 Restart the endpoints. Verify the Solidcore client upgrade Once you upgrade the Solidcore client, you can check if it was upgraded successfully on an endpoint. 1 On the McAfee epo console, select Menu Systems System Tree. 2 Select a group or endpoint from the list to view details for the selected node in the Systems tab. 3 Review logs from the McAfee epo console. a Select an endpoint on the Systems page. b c Select Actions Agent Show Agent Log to view the agent log for the endpoint. Check the log to verify that the software was successfully upgraded on the endpoint. 4 Review the properties for the endpoint. a Click Wake Up Agents to fetch properties immediately. b c Click an endpoint on the Systems page to view details for the selected endpoint. Select the Products tab and review the Solidcore version. Click the row to review additional information, including the product version and installation path. If the Solidcore information is not listed or is incorrect, check the log files on the endpoint to verify that the software was successfully upgraded. If the Solidcore client upgrade fails, the log files provide information about the cause for failure. McAfee Application Control Windows Installation Guide 17

18 2 Upgrade the software Verify the Solidcore client upgrade 18 McAfee Application Control Windows Installation Guide

19 3 Uninstall 3 the software Contents Remove the Solidcore client Remove the Solidcore extension Remove the Solidcore client package Remove the Solidcore client To uninstall the software, remove the Solidcore client from the endpoints. 1 Place the endpoints in Disabled mode. 2 Restart the endpoints. 3 On the McAfee epo console, select Menu Systems System Tree. 4 Perform one of these actions: To apply the client task to a group, select a group in the System Tree and switch to the Assigned Client s tab. To apply the client task to an endpoint, select the endpoint on the Systems page and click Actions Agent Modify s on a Single System. 5 Click Actions New Client Assignment to open the Client Assignment Builder page. 6 Select the McAfee Agent product, Product Deployment task type, and click Create New to open the Client Catalog page. 7 Specify the task name, add any descriptive information, select the platform, and specify the components and action: Select the appropriate package from the Products and components list, then click Remove. Select the language of the package and Set branch to Current for new packages. 8 Click Save, then click Next to open the Schedule page. Specify scheduling details and click Next and Save. 9 Verify the Solidcore client removal. a Click Wake Up Agents to fetch properties immediately. Typically, information is exchanged between the agent and the server after an agent-server communication interval (ASCI). The default ASCI value is 60 minutes. Send an agent wake-up call to verify immediate communication and data exchange between the server and the agent, without waiting for the ASCI to expire. McAfee Application Control Windows Installation Guide 19

20 3 Uninstall the software Remove the Solidcore extension b c Click an endpoint on the Systems page to view details for the selected endpoint. Click the Products tab and make sure that Solidcore is not listed. Remove the Solidcore extension To uninstall the software, remove the Solidcore extension from the McAfee epo server. If you uninstall the Solidcore extension, the extension is removed from the McAfee epo server and database with all associated policies and tables. 1 On the McAfee epo console, select Menu Software Extensions to open the Extensions page. 2 Select Solidcore from the Extensions list. 3 Click Remove. 4 Verify that the Solidcore product name no longer appears in the Extensions list. If the product name is not removed or you encounter errors when you uninstall, review the Orion.log file in the <McAfee epo install dir>\server\logs directory to analyze the cause of the failure. Remove the Solidcore client package Remove the Solidcore client package from the McAfee epo server. 1 On the McAfee epo console, select Menu Software Master Repository to open the Packages in Master Repository page. 2 Select Delete for a package. 20 McAfee Application Control Windows Installation Guide

21 0-00