McAfee Endpoint Security Installation Guide. (McAfee epolicy Orchestrator)

Transcription

1 McAfee Endpoint Security Installation Guide (McAfee epolicy Orchestrator)

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Endpoint Security Installation Guide

3 Contents 1 Installation overview 5 Which type of installation do you need? First-time installation workflow Upgrade installation workflow Upgrade legacy software with migrated settings workflow Upgrade with Endpoint Upgrade Assistant workflow Planning your installation 15 Planning product installation and management options Products that you can upgrade Compatibility with other virus-detection and firewall products Compatibility with other McAfee products System requirements 19 4 Pre-installation tasks 21 Preparing your environment Setting up your test environment Preconfiguring the product Create custom packages with Endpoint Security Package Designer Install custom client packages on the management server Create a custom policy to import ESConfigTool command-line options Install or upgrade the software 29 Upgrade McAfee Agent Install the product software on the management server Download Endpoint Security content files Deploy software to managed systems remotely Command-line options for deploying the software Create an installation URL Install software locally with an installation URL Upgrade with McAfee installation tools 37 Migrating custom settings when upgrading legacy software Overview of migration tasks Upgrading with Endpoint Upgrade Assistant How Endpoint Upgrade Assistant works Post-installation tasks 41 Verify the installation Test malware detection Test Real Protect scanning McAfee Endpoint Security Installation Guide 3

4 Contents 8 Remove the software 43 Remove the software from managed systems remotely Remove the software from systems locally Troubleshoot installations and upgrades 45 Customer support information Resolving Firewall issues with Adaptive mode Resolving McAfee error codes and messages Resolving Windows error messages Checking installation log files Checking Real Protect log file entries Using the MER tool for troubleshooting McAfee Endpoint Security Installation Guide

5 1 1 Installation overview Installation features in McAfee Endpoint Security assist with installing the software on Windows systems for the first time and upgrading to a new version. You can select one or more of these modules to deploy to systems managed by McAfee epolicy Orchestrator (McAfee epo ) version and later: McAfee Endpoint Security Threat Prevention McAfee Endpoint Security Firewall McAfee Endpoint Security Web Control McAfee Endpoint Security Adaptive Threat Protection (ATP) Requires Threat Prevention. McAfee Endpoint Security Platform (the McAfee Endpoint Security Common module) is automatically installed with any Endpoint Security module. Contents Which type of installation do you need? First-time installation workflow Upgrade installation workflow Upgrade legacy software with migrated settings workflow Upgrade with Endpoint Upgrade Assistant workflow McAfee Endpoint Security Installation Guide 5

6 1 Installation overview Which type of installation do you need? Which type of installation do you need? Select the workflow that suits your environment and goals. Chapters in this guide contain information about each type of installation. If you plan to use any McAfee installation tools, additional guides describe requirements and tasks that are specific to the tools. See also Products that you can upgrade on page 16 Upgrading with Endpoint Upgrade Assistant on page 38 Migrating custom settings when upgrading legacy software on page 37 First-time installation workflow When installing Endpoint Security for the first time, you must install server-side software on the management server, then deploy the client software remotely to managed systems or ask users to install it locally. 1 Check in the product package file to the McAfee epo server. 2 Manually update your McAfee epo server with the latest content files required for Endpoint Security: AMCore, Exploit Prevention, and Adaptive Threat Protection content files. 6 McAfee Endpoint Security Installation Guide

7 Installation overview Upgrade installation workflow 1 3 Deploy the client software with default or custom settings to managed systems in one of these ways: Remotely to multiple managed systems with deployment tasks. Locally on managed systems with an installation URL. 4 Verify that the client software is installed and up to date on all managed systems. 5 (Optional) Configure settings as needed. Upgrade installation workflow Upgrade from a previous version of Endpoint Security or from a supported legacy product. 1 Confirm that your upgrade path is supported. 2 Check in the product package files and the McAfee Agent package files (if required) to the McAfee epo server. 3 Upgrade McAfee Agent, if required. 4 Manually update your McAfee epo server with the latest content files required for Endpoint Security: AMCore, Exploit Prevention, and Adaptive Threat Protection content files. 5 Deploy the client software with default or custom settings to managed systems in one of these ways: Remotely to multiple managed systems with deployment tasks. Locally on managed systems with an installation URL. McAfee Endpoint Security Installation Guide 7

8 1 Installation overview Upgrade installation workflow 6 Verify that the client software is installed and up to date on all managed systems. 7 (Optional) Configure settings as needed. See also Products that you can upgrade on page 16 8 McAfee Endpoint Security Installation Guide

9 Installation overview Upgrade legacy software with migrated settings workflow 1 Upgrade legacy software with migrated settings workflow When upgrading legacy products to Endpoint Security, you can optionally save (or migrate) your custom settings using Endpoint Migration Assistant. 1 Confirm that your upgrade path is supported. 2 Review your legacy settings and prepare them for migration. 3 Check in the product package files and the McAfee Agent package files to the McAfee epo server. 4 Upgrade McAfee Agent. 5 Manually update your McAfee epo server with the latest content files required for Endpoint Security: AMCore, Exploit Prevention, and Adaptive Threat Protection content files. 6 Migrate policies, client tasks, and other settings from supported legacy products. 7 Deploy the client software with default or custom settings to managed systems in one of these ways: Remotely to multiple managed systems with deployment tasks. Locally on managed systems with an installation URL. 8 Verify that the client software is installed and up to date on all managed systems. McAfee Endpoint Security Installation Guide 9

10 1 Installation overview Upgrade legacy software with migrated settings workflow 9 Verify that the settings migrated successfully. 10 (Optional) Configure settings as needed. See also Products that you can upgrade on page 16 Migrating custom settings when upgrading legacy software on page McAfee Endpoint Security Installation Guide

11 Installation overview Upgrade with Endpoint Upgrade Assistant workflow 1 Upgrade with Endpoint Upgrade Assistant workflow Endpoint Upgrade Assistant helps you simplify and automate upgrades across your environment. You can use Endpoint Upgrade Assistant to upgrade all the systems that meet requirements with a single deployment task, and to plan deployments that ensure compatibility between Endpoint Security and other McAfee products running on managed systems. Best practice: Use Endpoint Upgrade Assistant for upgrades in environments where you must maintain compatibility with other McAfee products and need to upgrade them along with Endpoint Security. 1 Confirm that your upgrade path is supported. 2 Check in the product package file to the McAfee epo server. 3 Manually update your McAfee epo server with the latest content files required for Endpoint Security: AMCore, Exploit Prevention, and Adaptive Threat Protection content files. 4 Analyze your environment with Endpoint Upgrade Assistant to determine the requirements for upgrading. Endpoint Upgrade Assistant reports information about systems that are ready to upgrade, systems that require remediation, and the required remedial tasks. 5 Prepare systems for upgrading, as needed. 6 Deploy the client software with a deployment task to systems that are ready to upgrade. McAfee Endpoint Security Installation Guide 11

12 1 Installation overview Upgrade with Endpoint Upgrade Assistant workflow 7 Verify that the client software is installed and up to date on all managed systems. 8 (Optional) Configure settings as needed. 12 McAfee Endpoint Security Installation Guide

13 Installation overview Upgrade with Endpoint Upgrade Assistant workflow 1 See also Products that you can upgrade on page 16 Upgrading with Endpoint Upgrade Assistant on page 38 McAfee Endpoint Security Installation Guide 13

14 1 Installation overview Upgrade with Endpoint Upgrade Assistant workflow 14 McAfee Endpoint Security Installation Guide

15 2 Planning 2 your installation Contents Planning product installation and management options Products that you can upgrade Compatibility with other virus-detection and firewall products Compatibility with other McAfee products Planning product installation and management options These tasks make sure you have everything you need to install and configure your software. Plan your installation strategy For both first-time installations and upgrades: Decide the best level of automation The installation wizard installs the software with default settings and minimal interaction. Decide the required level of customization You can create custom product installation packages, using the Endpoint Security Package Designer, that include preconfigured policy settings and installation features. Plan your upgrade strategy If you're upgrading to a new software version: Decide the best way to upgrade Decide what type of upgrade you need and how and when to implement it. Best practice: See the Endpoint Security Upgrade Project Planning Guide (PD27093) for a detailed checklist and recommendations for all phases of upgrading to Endpoint Security. Decide whether to use McAfee installation tools: To save custom settings from legacy products Use Endpoint Migration Assistant to migrate custom policy settings when you upgrade legacy products to Endpoint Security. To analyze your upgrade requirements and simplify upgrade tasks Use McAfee Endpoint Upgrade Assistant to analyze your managed systems, detect the supported McAfee products that are installed, and determine the minimum requirements for upgrading. This tool helps you plan, deploy, and track upgrades throughout your environment. McAfee Endpoint Security Installation Guide 15

16 2 Planning your installation Products that you can upgrade Plan your product deployment and management strategy Be ready to select and configure these options: Decide on a deployment strategy You can deploy the product to managed systems by using your management platform software, third-party tools, or an installation URL. Decide on a management strategy You can use McAfee epo with McAfee Agent to manage versions of Endpoint Security Client on Windows systems, and compatible client software on Mac and Linux systems. Best practice: For optimum product experience, upgrade all Endpoint Security modules to the same version. Decide on an update strategy You can configure settings for regular updates to systems where the product is installed, and to the server repository when managing systems with McAfee epo. Plan your test strategy You need to deploy the software you plan to install in a test environment or to a test group, then verify the results before deploying it to the larger environment. Testing lets you verify that endpoints upgrade as expected, and make changes as needed, before deploying upgrades to all endpoints. Best practice: As part of your planning process, schedule time to thoroughly test the installation you're planning, and to research and resolve any issues discovered. Test or progressive deployments typically catch issues that you would not want to experience on a wide-scale, mass deployment, for example, issues related to specific programs or files in your environment that you might not have considered. Consider how you want to set up your test environment. For example, identify the variables you need to include in your test environment (such as client system and servers, exclusions, and third-party products) and identify the groups and endpoints that are available for testing. Plan your Adaptive Threat Protection strategy If you plan to install Endpoint Security Adaptive Threat Protection, decide whether to integrate it with the optional McAfee Threat Intelligence Exchange (TIE) server. The TIE server stores information about file and certificate reputations, then passes that information to other systems and devices in your environment. This enables them to communicate security information in real time, then act immediately to prevent the threat from spreading, even to remote networks and systems. To integrate Adaptive Threat Protection with the TIE server, you must install additional product components in a specific order. Make sure to consider these requirements when planning your Endpoint Security installation. See the McAfee Threat Intelligence Exchange product documentation for more information. See also Preconfiguring the product on page 22 Upgrading with Endpoint Upgrade Assistant on page 38 Migrating custom settings when upgrading legacy software on page 37 Setting up your test environment on page 22 Products that you can upgrade If an earlier, supported version of one or more Endpoint Security product modules is installed in your environment, you can upgrade to version If supported legacy products, such as McAfee VirusScan 16 McAfee Endpoint Security Installation Guide

17 Planning your installation Compatibility with other virus-detection and firewall products 2 Enterprise, are installed, you can upgrade to Endpoint Security 10.6, and optionally migrate your custom settings. You can upgrade these existing products: Endpoint Security 10.2.x or 10.5.x Existing product versions are removed before the new versions are installed. You can choose not to remove McAfee Host Intrusion Prevention. Supported legacy products Existing product versions are removed before the new versions are installed. To keep custom settings, you must migrate them when you upgrade to Endpoint Security. VirusScan Enterprise 8.8 McAfee Host Intrustion Prevention (McAfee Host IPS) 8.0 McAfee SiteAdvisor Enterprise 3.5 Endpoint Security Adaptive Threat Protection 10.5 Existing product version is removed before the new version is installed. McAfee Endpoint Security Threat Intelligence 10.2 Existing product version is removed before the new version is installed. See KB87476 for more information about recommended software upgrade paths. Best practices for product compatibility The installation wizard validates that the installation doesn't fail, but it doesn't perform additional upgrade compatibility testing. Follow these best practices to minimize product compatibility issues on systems where you install Endpoint Security. For optimal performance and protection, upgrade all Endpoint Security modules to the same version. When planning to upgrade the software in complex environments, see the Endpoint Security Upgrade Project Planning Guide (PD27093) for a detailed checklist and recommendations for all phases of upgrading to Endpoint Security. Use Endpoint Upgrade Assistant to analyze complex environments for compatibility issues with existing McAfee products and resolve issues before upgrading. Some earlier versions of Endpoint Security were susceptible to injections from third-party DLLs that created issues with product removal and upgrades. Endpoint Security 10.6 makes a due-diligence effort to enable earlier versions to trust well known injectors, but that intelligence is static and limited. To minimize potential issues when upgrading a previous version of Endpoint Security, use Endpoint Upgrade Assistant 2.1 or later to upgrade an earlier version of Endpoint Security to See also System requirements on page 3 Migrating custom settings when upgrading legacy software on page 37 Upgrading with Endpoint Upgrade Assistant on page 38 Compatibility with other virus-detection and firewall products You don't need to uninstall existing virus-detection and firewall products on systems before installing Endpoint Security. The installation wizard detects these products and resolves most conflicts automatically. Best practice: For information about how to troubleshoot compatibility issues between Endpoint Security and third-party applications, see KB McAfee Endpoint Security Installation Guide 17

18 2 Planning your installation Compatibility with other McAfee products If the Windows firewall is enabled The wizard does not disable the Windows firewall automatically to prevent conflicts. If incompatible virus detection or firewall software is installed The wizard tries to uninstall the software. If it can't, it prompts the user to cancel the installation, uninstall the incompatible software manually from the Windows Control Panel, then resume the installation where it left off. Best practice: See KB85522 for a list of the software products uninstalled automatically. If you have incompatible software that does not appear on this list, manually uninstall it before installing Endpoint Security. If Common Event Enabler (CEE)/Common AntiVirus Agent (CAVA) is running CEE/CAVA is a framework running on a Windows platform that enables third-party anti-virus engines to scan files stored on a Dell EMC Celerra, VNXe, VNX, Unity, or VMAX enas/nas array. You can install Endpoint Security with CAVA support by using a command-line option. The CAVA option disables the blocking cache in the On-Access Scanner (OAS), increases the number of OAS scanning threads to 200, and enables network scanning. These setting changes are needed for OAS to scan all files from CAVA. You can specify a different number of scanning threads during or after installation. See KB88973 for more information. When upgrading from a previous version of Endpoint Security with CAVA, you must use the CAVA command-line option. Otherwise, the installation removes CAVA from the upgraded system. If McAfee Host Intrusion Prevention is installed McAfee Endpoint Security Firewall replaces the Host Intrusion Prevention Firewall, and you can also migrate your existing firewall settings to the new firewall. Host Intrusion Prevention (without its firewall module) can run side by side with Endpoint Security Firewall. You are not required to upgrade to Endpoint Security Firewall or migrate your settings. You can continue to run the McAfee Host IPS Firewall after installing Endpoint Security Firewall. Whenever McAfee Host IPS Firewall is installed and enabled, Endpoint Security Firewall is disabled even if enabled in the policy settings. See also Command-line options for deploying the software on page 32 Compatibility with other McAfee products Check for compatibility with existing McAfee products on systems where you plan to install the software, then follow instructions for resolving conflicts. If McAfee Client Proxy is installed Web Control disables itself automatically if it detects a web gateway appliance or if McAfee Client Proxy is installed and in redirection mode. If McAfee Application Control and McAfee Change Control are running The system stops responding (hangs) when memory protection features in McAfee Application Control, McAfee Change Control 8.x or 7.x, and Endpoint Security or Host Intrusion Prevention are running at the same time. Best practice: Disable Application Control and Change Control memory protection features and use the Endpoint Security or Host Intrusion Prevention memory protection features. For full Application Control and Change Control memory protection recommendations, see PD To run Endpoint Security with Application Control and Change Control on a system: Installation order Install Endpoint Security first, then Application Control and Change Control. If already installed Disable the Memory Protection and Script As Updater features in Application Control and Change Control. See KB81465 for more information. 18 McAfee Endpoint Security Installation Guide

19 3 System 3 requirements Systems must have specific hardware and software to run McAfee Endpoint Security. Review the requirements before installing the product software to make sure that your installation is successful. System and hardware requirements This release supports deploying Endpoint Security to Windows operating systems. You can manage Windows, Mac, and Linux clients from McAfee epo using Endpoint Security extensions. For a complete list of current system requirements: Endpoint Security KB82761 Endpoint Security for Mac KB84934 Endpoint Security for Linux KB87073 Supported and unsupported browsers Product installation and Web Control features have been verified to function correctly on most versions of popular browsers. URL installation requires one of the supported browsers and an Internet connection. Microsoft Internet Explorer, version 11 Version 10 is supported only on Windows Vista. Google Chrome Doesn't support the Show Balloon option in Web Control. Mozilla Firefox, version 56 and later Safari See KB The installation wizard works with the default security level for Internet Explorer. For other browsers, select a security level that enables Javascript. See the web browser's documentation for instructions to configure the security level if you must change it. Microsoft Edge isn't supported. Because Chrome and Firefox release new versions frequently, Web Control might not work with a new update. A Web Control patch is released as soon as possible to support the changes from Google or Mozilla. For the latest information about browsers that Web Control supports, see KB Supported security management platforms Set up the management platform and place the network systems under its management. Check that the following requirements are met before proceeding with installation: Installed McAfee epo or later. Deployed McAfee Agent or later to managed systems. (McAfee Agent is recommended.) McAfee Endpoint Security Installation Guide 19

20 3 System requirements Important information about McAfee Host IPS The Endpoint Security 10.6 installation package includes McAfee Host Intrusion Prevention Content This content version is required by McAfee Host IPS and adds support for the new digital signatures introduced with Endpoint Security The installation updates the content on systems running McAfee Host IPS with previous versions of the content. See also Products that you can upgrade on page 16 Upgrade McAfee Agent on page McAfee Endpoint Security Installation Guide

21 4 Pre-installation 4 tasks Contents Preparing your environment Setting up your test environment Preconfiguring the product Create custom packages with Endpoint Security Package Designer Install custom client packages on the management server Create a custom policy to import Preparing your environment These tasks help you identify and resolve potential issues before they occur. See KB88288 for more information about performing these and other recommended quick start tasks before installing the product. Evaluate your environment. Make sure that systems meet requirements See KB82761 for a listing of supported management platforms, environments, and operating systems for Endpoint Security. Check whether Updates or Hotfixes are necessary to support operating system changes or updates. Make sure that other products are compatible with Endpoint Security Check for compatibility issues with other products running on systems. Determine required anti-virus and firewall exclusions. Make sure that the software you want to upgrade is supported See KB87476 for more information about recommended software upgrade paths. Review settings you want to save If you plan to save custom settings when you upgrade, review your settings, client tasks, and assignments, consolidating them where possible. Remove duplicates and unused objects. Run McAfee GetClean Run the McAfee GetClean tool on the deployment base images for your production systems to make sure that clean files are sent to McAfee Global Threat Intelligence (McAfee GTI) to be categorized. This tool helps to ensure that McAfee GTI does not provide an incorrect reputation value for your files. For more information, see KB73044 and the McAfee GetClean Product Guide. Run McAfee SysPrep Run the McAfee SysPrep tool to detect and allow trusted third-party software to inject into McAfee processes, which ensures that the injectors work together with Endpoint Security. This allows third-party software to function, while allowing McAfee to maintain a trust boundary. McAfee SysPrep is available from the Downloads tab of the ServicePortal: McAfee Endpoint Security Installation Guide 21

22 4 Pre-installation tasks Setting up your test environment McAfee SysPrep adds third-party injectors to the McAfee Trusted Store, which ensures that the injectors work together with Endpoint Security. Run this tool to: Automatically update the McAfee Trust store for third-party injectors that McAfee recognizes and that exist on the system. McAfee SysPrep sends Event ID 1095 for these injectors and writes them to the logs. Identify any unknown injectors and determine if they are signed or unsigned. McAfee SysPrep sends Event 1092 for these injectors and writes them to the logs. See KB89860 for more information about using McAfee SysPrep. See also System requirements on page 3 Compatibility with other McAfee products on page 18 Compatibility with other virus-detection and firewall products on page 17 Setting up your test environment Use a test environment to install the software on a subset of systems and verify the results before installing across your environment. Installations and upgrades for multiple products, groups, and endpoint types can involve many components, and you might not always anticipate all the results correctly. It's important to test upgrades in test environments or small groups before upgrading your entire environment. General guidelines Review these best practices before setting up your test environment. Do not include endpoints that are essential to your daily operations in your test environment. Select endpoints that reflect the diversity of your environment. For example, include one endpoint from each group and remote location, include a server. When selecting a test environment, make sure that you consider the following information to identify representative endpoints: McAfee product combinations and versions Operating systems Servers and workstations Best practice: Test on a subset of servers before upgrading your entire server environment. Policy settings and exclusions Validate the upgrade on servers and workstations. Preconfiguring the product You can customize settings for product features before deploying the software to managed systems. Preconfigured settings take effect as soon as installation is complete. Use them to install Endpoint Security with settings in place, rather than waiting for the first policy enforcement. Preconfigure custom settings when you need to meet specific requirements. For example, preconfigure port exclusions to ensure that vital communications are not blocked when Firewall is installed, or preconfigure settings required for compliance with security regulations. 22 McAfee Endpoint Security Installation Guide

23 Pre-installation tasks Create custom packages with Endpoint Security Package Designer 4 Overview of preconfiguration process Endpoint Security Package Designer steps you through the process of creating a custom installation file, which you can deploy to managed systems using McAfee epo or third-party software. 1 Customize policies with the settings required for your environment. 2 Create a custom product package that includes the product modules you want to install and the preconfigured settings. The Endpoint Security Package Designer steps you through this process. 3 Check in components from the custom product package to a location accessible by your deployment software. For McAfee epo, this is the Master Repository. 4 Deploy the policy settings to managed systems. Use McAfee epo or a third-party deployment tool. You can also use command-line tools to export and import custom policies during installation. You might want to do this when troubleshooting or testing a system locally. 1 Customize the settings required for your system. 2 Export the settings using ESConfigTool with command-line options. 3 Import the settings using SetupEP with command-line options. Best practices McAfee preconfigures features with default settings that protect systems in medium-risk environments. These settings ensure that systems can access important websites and applications until there is time to customize the settings. When customizing product features, make sure to configure: Where and how systems get updates. How often and what time of day systems check for updates. Access to required websites and applications without interruption. If you migrate or save settings from legacy products, settings included in a custom package take precedence over legacy settings. In these cases, the custom settings are applied instead of the legacy settings. Create custom packages with Endpoint Security Package Designer Endpoint Security Package Designer creates a customized client package (installation).zip file that contains all the software you want to deploy and preconfigured policies. Before you begin Make sure that Endpoint Security is installed on managed systems. Package Designer checks to verify that it is installed. Make sure that you have a source package to customize, if needed, as part of this process. Make sure that you have downloaded and installed Package Designer on a system that has access to the source package you plan to customize. Package Designer is a standalone tool that you can download from Software Manager. You need to install and run Package Designer on a managed or unmanaged system where Endpoint Security is installed; Package Designer uses the installed Endpoint Security files to generate the custom package. Once that package is created, you can deploy it to other systems. McAfee Endpoint Security Installation Guide 23

24 4 Pre-installation tasks Create custom packages with Endpoint Security Package Designer Package Designer lets you select the client software and any preconfigured policy settings to include in the package file. You can then deploy the custom package files to managed systems in one of these ways: As a standalone, command-line installer (such as SetupEP) Using a McAfee epo deployment task Using a third-party network deployment tool Best practice: To make sure that a policy enforcement doesn't overwrite the custom settings, use McAfee epo (instead of the client console) to customize the settings, then use Package Designer to push the custom policy to the managed systems. Each version of Endpoint Security has a corresponding version of Package Designer. To customize and deploy packages for Endpoint Security 10.6, use Endpoint Security Package Designer For information about installing and using Package Designer, see KB Task 1 Open the Package Designer wizard. 2 (Optional) On the Select Folders screen, select the source package file and destination folder for the custom package, then click Next. 3 On the Modify Package screen, click Edit Settings to make any changes you need, then click Next. 4 On the Select Modules and Settings screen, select the modules and settings to include. Select each module Modules installed on the local system are selected by default. Select Default or Custom policies For each module, select whether to include the default policies or custom settings, where available. 5 (Optional) On the Select Executables screen, select executable files for programs you want to run before or after installation. The program you select is packaged into the installer and executed before or after the selected module is installed. You can include a standalone.exe file or a.zip file. A.zip file is useful when the selected program requires additional supporting files (for example, DLL and configuration files) to be present for it to run properly. 6 On the Create Package screen, review and verify your selections and the content of the custom package, then click Create. A progress bar displays the status of your request. 7 On the Package Completed screen, select an option: Open Package Location Navigates to the folder where the package was created. From there, you can check in the package to McAfee epo for deployment, or deploy it by using third-party software. Best practice: Test custom packages before deploying them to your McAfee epo environment. Finish Exits the wizard. See also Setting up your test environment on page McAfee Endpoint Security Installation Guide

25 Pre-installation tasks Install custom client packages on the management server 4 Install custom client packages on the management server If you created a client package with the Endpoint Security Package Designer, check in and install those files on the management server before deploying to client systems. Before you begin A custom package with custom policies was created and copied to a location that is accessible from your McAfee epo server. You can also use a third-party network deployment tool to deploy custom package files. See its product documentation for more information. If you migrate settings from legacy products to Endpoint Security, policies included in a custom package take precedence over legacy policies. In these cases, the custom policy settings are applied instead of the legacy settings. Task 1 Navigate to the folder where you created the custom package, then extract the files. From Package Designer, click Open Package Location in the Package Completed screen, or navigate to the location manually. Extract the package.zip file to expose the Endpoint Security module.zip files included within. These are the files you need to check in to McAfee epo. 2 For each.zip file that you extracted: a b c In the Master Repository, click Check In Package. On the Package tab of the Check In Package screen, select the package to check in, then click Next. On the Package Options tab, verify the package information and select the branch where you want to install the package, then click Save. The software is ready to deploy to systems, after you download the latest Endpoint Security content files. See also Download Endpoint Security content files on page 30 Deploy software to managed systems remotely on page 31 Create a custom policy to import Export preconfigured settings to a file that you can import when you install the software. Use ESConfigTool to do this. Before you begin Make sure that Endpoint Security is deployed to at least one managed system. This tool exports all policy settings for the selected product modules to a location that you specify. ESConfigTool is located in the Endpoint Security Platform folder (C:\Program Files\McAfee\Endpoint Security \Endpoint Security Platform, by default). Best practice: To create custom packages that include custom policies and client software for deployment with McAfee epo, use the Endpoint Security Package Designer. McAfee Endpoint Security Installation Guide 25

26 4 Pre-installation tasks Create a custom policy to import Task For option definitions, run ESConfigTool with no options: ESConfigTool.exe 1 Create a policy and configure the required settings, then save it. 2 Using the ESConfigTool command line, export the settings to create <file_name> and save this file to a folder that is not protected by McAfee. ESConfigTool.exe /export <file_name> [/module <TP FW WC ESP> ] The folder containing ESConfigTool is protected, so the export location should be a different, writable location. Example: ESConfigTool.exe /export C:\ENS\firewall.policy /module FW This example exports the Firewall settings to C:\ENS\firewall.policy. 3 Using the SetupEP utility, install Endpoint Security and import <file_name>. setupep.exe <options> /import <file_name> /module <FW TP WC ESP> Example: setupep.exe ADDLOCAL="fw,tp,wc" /import C:\ENS\firewall.policy /module FW This example installs Endpoint Security Firewall, Threat Prevention, Web Control product modules, and the Endpoint Security Common module, which installs automatically. It also imports settings from the firewall.policy file and applies them to the Firewall module. See also Command-line options for deploying the software on page 32 ESConfigTool command-line options Use these options with the ESConfigTool utility to create a file of preconfigured settings that you can import during installation of Endpoint Security. Open a Command Prompt window, then run the ESConfigTool command using the appropriate command-line options. Options are not case-sensitive. Example ESConfigTool.exe /export C:\ENS\preconfigured.policy /module TP FW Exports settings for Threat Prevention and Firewall to the file C:\ENS\preconfigured.policy. Basic options ESConfigTool.exe /export <file_name> [/module <TP FW WC ESP> ] [/unlock <password> ] [/plaintext ] 26 McAfee Endpoint Security Installation Guide

27 Pre-installation tasks Create a custom policy to import 4 Option /export <file_path_and_name> Definition Saves settings to a file with the specified name and location. Example: /export C:\My Programs\Endpoint\preconfigured.policy Exports settings to the file preconfigured.policy in the C:\My Programs\Endpoint folder. Save this file to a folder that is not protected by McAfee. The folder containing ESConfigTool is protected, so the export location should be a different, writable location. /module <TP FW WC ESP> Specifies which product module settings to export. TP Threat Prevention FW Firewall WC Web Control ESP Resources shared by product modules. Example: /module TP FW WC ESP Exports settings for all product modules. /unlock <password> /plaintext Sets the password for unlocking the client UI. Specifies descriptive comments in human-readable format. See also Command-line options for deploying the software on page 32 McAfee Endpoint Security Installation Guide 27

28 4 Pre-installation tasks Create a custom policy to import 28 McAfee Endpoint Security Installation Guide

29 5 Install 5 or upgrade the software Contents Upgrade McAfee Agent Install the product software on the management server Download Endpoint Security content files Deploy software to managed systems remotely Create an installation URL Install software locally with an installation URL Upgrade McAfee Agent Endpoint Security requires McAfee Agent or later (version is recommended). On managed systems running an earlier version, you need to upgrade the McAfee Agent manually before deployment. On Windows systems, communication is blocked between McAfee epo and the agent when McAfee Host IPS 8.0 (Patch 4 or earlier) and McAfee Agent version 5.0 (or later) are running. See KB82869 for instructions to resolve this issue. Task 1 Download and deploy the package. 2 Log on to McAfee epo as administrator. 3 Select Menu Extensions, click Install Extension, and select the EPOAGENTMETA.zip file. 4 Select Menu Master Repository, click Check In Package, and select the MA-WIN zip file or the latest recommended version (5.5.0). 5 Deploy the new McAfee Agent using one of these methods: Create a deployment task to push the new package to the client systems: Select New Product Deployment, then click New Deployment. Create and distribute a new deployment URL. When you check in the new McAfee Agent, which overwrites the previous version, any deployment URL created with the previous version no longer works. You must create and distribute a new URL with the new McAfee Agent. 1 Select Menu System Tree, then select the subgroup that contains the systems to deploy to. 2 On the Agent Deployment tab, click Create Agent Deployment URL. McAfee Endpoint Security Installation Guide 29

30 5 Install or upgrade the software Install the product software on the management server 3 Enter the URL name, verify the agent version, then click OK. 4 Distribute the URL for new deployments. For more information about deployment, see the McAfee epo product documentation. Install the product software on the management server Install the server-side Endpoint Security components on the McAfee epo server as the first step in the installation process. This task installs two types of product components on the management server: Product management extensions Add Endpoint Security management features (such as queries and client tasks) to the McAfee epo server that enable you to manage the client product from the console. Product deployment package Add client software files to the Master Repository. You can then deploy them to managed systems. If you have already installed a custom package that you created with Endpoint Security Package Designer as part of the preconfiguration process, you do not need to perform this task. Task 1 On the McAfee epo console, select Menu Dashboards, then select Guided Configuration from the drop-down list. 2 On the Guided Configuration screen, click Begin. 3 Click Software Selection, then: a Under the Software Not Checked In product category, click Licensed to display available products. b c In the Software table, select Endpoint Security as the product you want to check in. The product description and all available components are displayed in the table below. Click Check In All to install the product files on your McAfee epo server and check in the product package to your Master Repository. When installation is complete, the extensions are listed on the Extensions page and the package is listed in the Master Repository. 4 When you've checked in all the required software, click Next to proceed. You can now deploy the product to managed systems. Download Endpoint Security content files You must manually update your McAfee epo server with the latest AMCore, Exploit Prevention, and Adaptive Threat Protection content files required for Endpoint Security. Before you begin The Endpoint Security packages are checked in to the Master Repository on your McAfee epo server. 30 McAfee Endpoint Security Installation Guide

31 Install or upgrade the software Deploy software to managed systems remotely 5 Task 1 In McAfee epo, select Menu Automation Server Tasks to open the Server Task Catalog. 2 Edit the Update Master Repository server task. 3 Click the Actions tab. 4 For the Repository Pull action, ensure that the following are set: Source site: McAfeeHttp Package types: All packages 5 Click Save to save the task. 6 For the Update Master Repository server task, click Run. The Master Repository now includes the AMCore Content Package and the Endpoint Security Exploit Prevention Content package required by Endpoint Security. Deploy software to managed systems remotely Install the client software on managed systems with a product deployment task, which deploys remotely and doesn't require any user assistance. Before you begin Make sure that the product's server-side components are checked in to the McAfee epo server. Make sure that systems where you want to install the product meet all requirements. Task 1 From the McAfee epo console, click Menu Software Product Deployment. 2 On the Product Deployment page, click New Deployment. 3 On the New Deployment page, configure these settings, then click Save at the top of the page. Option Name and Description Type Description Type a name and description for this deployment. This name appears on the Deployment page after the deployment is saved. Select the type of deployment. Fixed Deploys only to the selected systems. Continuous Deploys to systems based on System Tree groups or tags. This allows these systems to change over time as they are added or removed from the groups or tags. If you want to automatically install product updates when they are available, select Auto Update. This option deploys the hotfixes and patches for your product automatically. Package Select a product module to deploy. Deploy each module separately. The Common module installs automatically with the first module you install. You must install Threat Prevention before Adaptive Threat Protection. McAfee Endpoint Security Installation Guide 31

32 5 Install or upgrade the software Deploy software to managed systems remotely Option Language and Branch Command line Select the systems Description If needed, select the language and branch, if not using the defaults. In the text field, specify options for the product you are deploying. If you don't enter any options, all product modules are deployed. Select the systems where you want to deploy the client software. If needed, configure the following: Run at every policy enforcement (Windows only) Allow end users to postpone this deployment (Windows only) Maximum number of postponements allowed Option to postpone expires after Display this text Select a start time Select a start time or schedule for your deployment: Run Immediately Starts the deployment task the next time the systems check for updates from the management server. Once Opens the scheduler so you can configure the start date, time, and randomization. The Product Deployment page opens with your new project added to the list of deployments. Also, a client task is automatically created with the deployment settings. 4 Check the status of the deployment on the Product Deployment page. Click the deployment task in the list on the left-hand side of the page to display its details on the right-hand side of the page. Command-line options for deploying the software Use these command-line options when creating a deployment task to install the product on managed systems. Type supported options in the Command line box. Options are not case-sensitive. Examples INSTALLDIR="D:\Installed Programs" /l"d:\installed Programs\Logs" Installs the product files to a folder on drive D under Installed Programs and saves the installation log files to a folder under Installed Programs\Logs. ADDLOCAL="tp,wc" Installs Threat Prevention and Web Control, and automatically installs the Common module. 32 McAfee Endpoint Security Installation Guide

33 Install or upgrade the software Deploy software to managed systems remotely 5 Option ADDLOCAL="tp,fw,wc" Definition Selects the product modules to install: tp Threat Prevention fw Firewall wc Web Control fw,tp,wc Install all three modules. The shared Endpoint Security Platform (Common module) is also installed automatically when any product module is installed. Example: ADDLOCAL="tp,wc" Installs Threat Prevention, Web Control, and Common. CAVA="number_of_scanning_threads" Installs Endpoint Security with support for the Common AntiVirus Agent (CAVA). Requires Threat Prevention. Disables the blocking cache in the On-Access Scanner (OAS), increases the number of OAS scanning threads to 200, and enables network scanning, to ensure the OAS scans all files from CAVA. Optionally, you can specify a different number of scanning threads. See KB88973 for more information. When upgrading from a previous version of Endpoint Security with CAVA, you must use the CAVA command-line option. Otherwise, the installation removes CAVA from the upgraded system. INSTALLDIR="install_path" /log"install_log_path" or / l"install_log_path" /l*v"install_log_path" Specifies where to install the product files on the system. The installation wizard creates an Endpoint folder at the specified location and installs the product to this folder. Example: INSTALLDIR="D:\Installed Programs" Installs the product modules under D:\Installed Programs \Mcafee\Endpoint Security. By default, product files are installed in the folder C:\Program Files\McAfee\Endpoint Security. Specifies where to save the installation log files for tracking installation events. The installation wizard creates an Endpoint folder at the specified location and saves the log files to this folder. Example: /l"d:\log Files" Installs the product log files under D:\Log Files. By default, log files are saved in the Windows System TEMP folder C:\windows\Temp\McAfeeLogs. *v Specifies verbose (more descriptive) logging entries. McAfee Endpoint Security Installation Guide 33

34 5 Install or upgrade the software Deploy software to managed systems remotely Option /nocontentupdate Definition Does not automatically update product content files on the managed system as part of the installation process. Content files include the latest AMCore, Exploit Prevention, and Adaptive Threat Protection content files required for Endpoint Security. Update content files to ensure that the system is fully protected. If you don't update them during installation, schedule an update as soon as possible. /override"program_name" /quarantinefolder="directory path" Overrides and removes the specified conflicting products: hips McAfee Host Intrusion Prevention Example: /override"hips" Removes McAfee Host Intrusion Prevention automatically during installation. Specifies the location of the Quarantine folder where detected threats are placed. The folder path is limited to 190 characters. Example: /quarantinefolder="d:/reports" Creates a Quarantine folder at D:\reports\Quarantine. By default, the Quarantine folder is located in the folder <SYSTEM_DRIVE>\Quarantine. 34 McAfee Endpoint Security Installation Guide

35 Install or upgrade the software Create an installation URL 5 Option /import <file_name> Definition Imports settings from the specified file. Example: Must be used from a Windows command line with the SetupEP utility. SetupEP /import mysettings Imports settings from the file called mysettings. Best practice: To create custom packages that include custom policies and client software for deployment with McAfee epo, use Endpoint Security Package Designer. /module <TP FW WC ESP> Applies imported settings to the specified product modules. TP Threat Prevention FW Firewall WC Web Control ESP Resources shared by product modules. Example: Must be used from a Windows command line with the SetupEP utility. SetupEP /import mysettings /module TP FW Imports settings from the file called mysettings to Threat Prevention and Firewall. Best practice: To create custom packages that include custom policies and client software for deployment with McAfee epo, use Endpoint Security Package Designer. See also Checking installation log files on page 48 Compatibility with other virus-detection and firewall products on page 17 Download Endpoint Security content files on page 30 Create custom packages with Endpoint Security Package Designer on page 23 Create a custom policy to import on page 25 Create an installation URL Create a URL that users can click to install the client software on their systems. Before you begin Make sure that the product extensions are installed on the McAfee epo server. Make sure that the product package file is available in the Master Repository. McAfee Endpoint Security Installation Guide 35

36 5 Install or upgrade the software Install software locally with an installation URL Task 1 From the McAfee epo console, click Menu Dashboards, then click Welcome to McAfee Security from the drop-down list. The product modules you have installed on the server are listed under Product. 2 Click Start Deployment. 3 From the Product Deployment page, do one of the following to open the Welcome to epolicy Orchestrator page and display the software installation URL. Deploy all the product modules with their default security settings Click Deploy. Customize the deployment Click Customize, configure the settings, then click Deploy. Group Name Select the default group name or enter a custom group name. Operating System Select McAfee Agent for Windows. Software and Policies Select the product modules to install and, if needed, click McAfee Default Policies and Tasks to configure security settings. Auto Update Specify whether to download the latest version of the software automatically whenever an update occurs. 4 Copy and the installation URL to each managed system user, along with instructions for installing. Users can click the URL in the message to install the client software. Install software locally with an installation URL On the system where you want to install the software, click an installation URL to begin the installation. Before you begin Make sure that the system where you want to install the product meets all requirements. You have created an installation URL or received one from your administrator. Task 1 Open a web browser window and paste in the installation URL. 2 Follow the instructions on the screen to install. If the installation does not start automatically, click Install. A dialog box displays the progress of the installation and indicates when it is complete. The installation log, McAfeeSmartInstall_<date>_<time>.log, is saved in <LocalTempDir> \McAfeeLogs (for example, C:\Windows\Temp\McAfeeLogs). 36 McAfee Endpoint Security Installation Guide

37 6 Upgrade 6 with McAfee installation tools McAfee provides tools to assist with product upgrades that have additional requirements. Save custom settings from legacy products McAfee Endpoint Migration Assistant migrates custom policy settings when you upgrade legacy products to Endpoint Security. You can let Migration Assistant migrate all your settings and assignments automatically, based on your current settings and new product defaults, or you can select and configure them manually. Simplify and automate upgrades McAfee Endpoint Upgrade Assistant analyzes your environment to determine which systems are ready for automatic upgrades, then lets you upgrade them with a single deployment task. You can also use this tool to plan, deploy, and track manual upgrades throughout complex environments. Endpoint Upgrade Assistant makes sure that other McAfee products in your environment remain compatible when you upgrade to Endpoint Security, by upgrading them when needed or guiding you through the required manual upgrades. Contents Migrating custom settings when upgrading legacy software Upgrading with Endpoint Upgrade Assistant Migrating custom settings when upgrading legacy software When you upgrade supported legacy products to Endpoint Security, McAfee Endpoint Security for Mac, and McAfee Endpoint Security for Linux, you can optionally save (or migrate) your custom settings and assignments. Endpoint Migration Assistant guides you through the migration process. Because Endpoint Security centralizes many shared protection features, some of the policy settings in legacy products have changed. Migration Assistant ensures that the settings in legacy policies are moved to the correct policies in Endpoint Security. In some cases, they are merged with other Endpoint Security settings, and in others, new default settings are applied to support updated technologies. Supported migration path You can migrate supported versions of legacy products directly to Endpoint Security version Setting up Endpoint Migration Assistant You must download the Migration Assistant extension from Software Manager and install it on your McAfee epo server. McAfee Endpoint Security Installation Guide 37

38 6 Upgrade with McAfee installation tools Upgrading with Endpoint Upgrade Assistant Endpoint Migration Assistant documentation See the McAfee Endpoint Security 10.6 Migration Guide for detailed information about saving your custom legacy product settings. See also Products that you can upgrade on page 16 Upgrade legacy software with migrated settings workflow on page 9 Overview of migration tasks As part of the workflow for upgrading a legacy version of the software, use McAfee Endpoint Migration Assistant to migrate your custom settings to Endpoint Security policies before upgrading your legacy software. 1 Review your custom settings and prepare them for migration. 2 Download and install the Migration Assistant extension on the McAfee epo server. 3 Open Migration Assistant, select an automatic or manual path, then follow the instructions on the screen. Automatic migration Migrates all supported legacy settings for all supported Windows products installed on all your managed systems or only the systems in one group. Optionally migrates all supported settings for supported Mac and Linux products. Keeps assignments. Manual migration Lets you select the settings to migrate, then edit the policies if needed. Does not keep assignments. 4 (Manual migration only) Repeat step 3 to select and migrate additional settings. 5 Verify that your settings were migrated successfully. See the McAfee Endpoint Security 10.6 Migration Guide for detailed information. See also Upgrade legacy software with migrated settings workflow on page 9 Upgrading with Endpoint Upgrade Assistant Endpoint Upgrade Assistant simplifies and automates many of the tasks required to upgrade managed systems to Endpoint Security in complex environments. Best practice: Use Endpoint Upgrade Assistant for upgrades in environments where you must maintain compatibility with other McAfee products and need to upgrade them along with Endpoint Security. You can use Endpoint Upgrade Assistant to: Analyze managed systems Detect the supported McAfee products that are installed and determine the minimum requirements for upgrading. Identify the systems that are ready to upgrade Create a single deployment task to upgrade all of them at the same time. Plan, implement, and track product upgrades throughout your environment Select groups of systems to upgrade, to ensure maximum efficiency and minimal impact for your environment. Maintain compatibility on systems running multiple McAfee products and versions Endpoint Upgrade Assistant can install compatible versions of other supported products. Deploy using McAfee epo or third-party tools Create a McAfee epo deployment task from Endpoint Upgrade Assistant or use the Endpoint Upgrade Assistant Package Creator tool to create installers for deployment with third-party tools. 38 McAfee Endpoint Security Installation Guide

39 Upgrade with McAfee installation tools Upgrading with Endpoint Upgrade Assistant 6 Endpoint Upgrade Assistant is bundled with the Upgrade Automation client software, which runs on managed systems to manage the upgrade process. Upgrade Automation lets you upgrade all the systems that are ready with one deployment task. Supported products In addition to upgrading legacy products and previous versions of Endpoint Security, you can use Endpoint Upgrade Assistant to install or upgrade other McAfee products, such as: McAfee Agent McAfee Data Loss Prevention (McAfee DLP) Endpoint Security Adaptive Threat Protection McAfee Active Response Data Exchange Layer Endpoint Upgrade Assistant continues to add support for additional products. For the latest information, see KB Setting up Endpoint Upgrade Assistant Endpoint Upgrade Assistant includes these McAfee epo components: Endpoint Upgrade Assistant extension Install on the McAfee epo server. Provides the features for analyzing, preparing, and tracking McAfee product upgrades for your environment. Endpoint Upgrade Assistant does not change the McAfee epo environment. It collects and analyzes the data about an environment, then provides tools to assist with upgrading the environment to Endpoint Security. Endpoint Upgrade Automation client package Deploy to managed endpoints. Provides ability to remove, upgrade, and install products. Upgrade Automation does change the environment. It removes existing products and installs new product versions. Endpoint Upgrade Assistant also works with the Endpoint Upgrade Assistant Package Creator tool, which you can download separately to create custom, deployable product packages for use with McAfee epo or third-party tools. Endpoint Upgrade Assistant documentation See the McAfee Endpoint Upgrade Assistant Product Guide for detailed information. See also Upgrade with Endpoint Upgrade Assistant workflow on page 11 How Endpoint Upgrade Assistant works Endpoint Upgrade Assistant analyzes your environment, reports the information you need to plan your upgrade strategy, and provides features for deploying upgrades and tracking their status. Best practice: Deploy upgrades in a test environment or to a test group, then verify the results before deploying upgrades to the larger environment. Tabs guide you through all the tasks required to upgrade. 1 Specify what to upgrade Select the version of Endpoint Security to install and the System Tree groups. 2 Analyze your environment Discover systems that require upgrades and systems that can't be analyzed. 3 Check in and install the required software Check it in to the McAfee epo server to make it available for deployment tasks using Software Manager. McAfee Endpoint Security Installation Guide 39

40 6 Upgrade with McAfee installation tools Upgrading with Endpoint Upgrade Assistant 4 Tag systems to upgrade Create one tag for all the systems you want to upgrade with a single deployment task. You can tag all the systems that are ready for Upgrade Automation. You can also tag endpoints that require manual upgrades. 5 Deploy and track upgrades Deploy using Upgrade Automation or manually configure McAfee epo deployment tasks. You can also use Endpoint Upgrade Assistant Package Creator to create installers for third-party tools. See the McAfee Endpoint Upgrade Assistant Product Guide for detailed information. See also Upgrade with Endpoint Upgrade Assistant workflow on page McAfee Endpoint Security Installation Guide

41 7 Post-installation 7 tasks Contents Verify the installation Test malware detection Test Real Protect scanning Verify the installation Verify that the client software is installed and up to date on managed systems. Task 1 Wait for client systems to report back to McAfee epo (typically takes about an hour). 2 Log on to McAfee epo. 3 From the console, select Menu Dashboards, then select Endpoint Security: Installation Status for a complete listing of the managed systems where the software was installed and their status. Test malware detection Test the virus-detection feature of Threat Prevention by downloading the EICAR Standard AntiVirus Test File to the local system. Although it is designed to be detected as a virus, the EICAR test file is not a virus. Task 1 Download the EICAR file from this location: If installed properly, Threat Prevention interrupts the download and displays a threat detection dialog box. 2 Click OK. If not installed properly, Threat Prevention does not detect the virus or interrupt the download process. In this case, use Windows Explorer to delete the EICAR test file from the client computer, then reinstall the product and test the new installation. McAfee Endpoint Security Installation Guide 41

42 7 Post-installation tasks Test Real Protect scanning Test Real Protect scanning Test that the Real Protect scanning features in Adaptive Threat Protection are installed correctly and that systems can communicate with the McAfee cloud for detections. Before you begin Real Protect can connect to McAfee GTI or the TIE server to send queries to the domain: realprotect1.mcafee.com. This test uses password-protected files to check Real Protect client and cloud-based detections. Although they are designed to be detected as threats, they are harmless. Download the test files to a different location each time you run this test. Real Protect does not detect the files on subsequent attempts to run them from the same location. See KB88828 for information about testing the Real Protect scanning features. Task 1 On the client system, download the compressed test file from this location: KB The password for the.zip file is clean. Password protection ensures that the.zip file is not blocked if you send it in an . 2 Navigate to the folder where you downloaded the file, then unzip the file. 3 To test client detections, double-click RP-S TestFile.exe. If Real Protect client scanning is functioning correctly in Endpoint Security, it detects the file and prevents the file from running. 4 To test cloud detections, double-click RP-Ds TestFile.exe. The RP-D TestFile.exe must run for a minute for the detection to trigger. If Real Protect cloud scanning is functioning correctly in Endpoint Security, it detects the file and prevents the file from running. If Real Protect does not detect the file and prevent it from running, check the Adaptive Threat Protection Activity log file and troubleshoot the problem, then run the test again. See also Checking Real Protect log file entries on page McAfee Endpoint Security Installation Guide

43 8 Remove the software Contents Remove the software from managed systems remotely Remove the software from systems locally Remove the software from managed systems remotely Remove client software from multiple managed systems at the same time by running a client deployment task. You might need to do this for testing or before reinstalling the client software. Reinstall the client software as soon as possible. When it is uninstalled, the system is not protected against threats. Task 1 On the security management console, select Menu Policy Product Deployment/Client Tasks. 2 Create a deployment task for the client, then select each product module you want to uninstall and specify Remove as the action. Best practice: Duplicate the task you used to install the product modules, then change the Action to Remove. 3 When the task is complete, verify that the client software was removed from the selected systems: click Dashboards, then select Endpoint Security: Installation Status. See also Command-line options for deploying the software on page 32 Remove the software from systems locally Remove client software on a system by using the Windows Control Panel. You might do this for testing or before reinstalling the client software. Reinstall the client software as soon as possible. When it is uninstalled, the system is not protected against threats. McAfee Endpoint Security Installation Guide 43