Zemana Endpoint Security Administration Guide. Version

Transcription

1 Zemana Endpoint Security Administration Guide Version

2 Introduction 4 What is Zemana Endpoint Security? 4 What is Zemana Control Center? 4 How do Endpoint Agents and Control Center communicate with each other? 4 Features 5 Support 6 Getting Started 7 Server Requirements for Zemana Control Center 7 Endpoint Requirements for Zemana Endpoint Security Agents 7 Installation 8 Step 1: Installing Control Center 8 Step 2: Deployment of Endpoint Agents 9 Manual Deployment 9 Deployment via Group Policy Object 9 Creating a Machine Startup Script for use with Active Directory 9 Registering the Machine Startup Script with a Group Policy Object 10 Mail Deployment 10 Remote Deployment 11 Optional Step 3: Installing Failover Server 11 Administration 13 Logging into Control Center 13 Modules 13 Dashboard 13 Network 13 Groups Pane 13 Endpoints Pane 14 Endpoints Pane Context Menu 14 Filters 15 Endpoint Actions Bar 15 Endpoint Details Dialog 15 Tasks 16 Policies 16 Quarantine 16 Reports 16 Deployment 17 Notifications 18 Audit Logs 18 Settings 18 Failover Servers 19 1

3 User Management 20 User Types 20 Roles 20 Update Servers 21 How to install an Update Server? 21 How to check the status of Update Servers? 21 How to uninstall an Update Server? 21 Policy 23 General Settings 23 Anti-Virus Settings 23 Content Control Settings 24 ID Theft Protection Settings 25 Frequently Asked Questions 27 How do I create a backup of Zemana Control Center? 27 How do I restore Zemana Control Center? 27 How do I create a support tool output? 27 How do I enable SSL on Zemana Control Center? 28 Enabling SSL in IIS Manager 28 Enabling SSL in Control Center 28 How do I migrate Zemana Control Center to a new server? 28 Migrating Control Center to a new server 28 Forwarding Endpoint Agents to New Control Center 28 What ports are used by Endpoint Agents and Control Center? 29 External URLs used by Endpoint Agents and Control Center? 29 How do I uninstall Endpoint Agents? 29 How do I uninstall a group of Endpoint Agents? 30 How do I send feedback about the product? 30 2

4 Introduction 3

5 Introduction Thank you for choosing Zemana Endpoint Security. This document will guide you through all the features of Zemana Endpoint Security and Control Center. What is Zemana Endpoint Security? Zemana Endpoint Security is a client-server solution which protects your physical or virtual machines against all types of threats including phishing, malware, cryptolocker while providing you with the best user experience on managing your entire network. What is Zemana Control Center? Zemana Control Center is a web-based management console for managing endpoint security agents installed on your network. How do Endpoint Agents and Control Center communicate with each other? Endpoint Agents connect to Zemana Control Center using a one-way communication channel over predefined ports which are automatically allowed by the installation packages. In case you are using different VLANs for Agents and Control Center, please make sure these ports are properly forwarded from Agent VLAN to Control Center VLAN. 4

6 Features Zemana Endpoint Security combines the following features and lets you manage these features through a web-based management console for ease of use: AntiMalware protection (On-Demand and On-Access scans) Zero-day malware protection Identity Theft Protection Cryptolocker protection Advanced rootkit and bootkit remediation Web Control for blocking access to harmful web sites Keyword filtering for blocking access to websites containing provided keywords Application blocking Search advisor for browsers Policy based centralized management Scheduled Scans Active Directory integration Out-of-box SIEM integration Advanced Reporting module Internal update mirrors for low-bandwidth usage 5

7 Support Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. In case you need technical assistance, please contact with the following information available: Product version Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description with the following information: Error messages and log files (located at C:\zemana_logs) Support tool output ( click here for more information about creating a support tool output) Recent software configuration changes and network changes 6

8 Getting Started Server Requirements for Zemana Control Center Supported operating systems: Minimum required server version is Windows Server 2008 R2 64bit Hardware requirements: 64 bit Intel 1 GHz or higher (or equivalent) 8 GB available RAM 20 GB free space on the hard drive Internet connection (required for product activation and some update features) Endpoint Requirements for Zemana Endpoint Security Agents Supported operating systems: Minimum required version is Windows XP Hardware requirements: Intel Pentium 300 MHz or higher (or equivalent) 1 GB available RAM 4 GB free space on the hard drive 7

9 Installation Installation of Zemana Endpoint Security is divided into two steps. The first step is the Control Center Installation, which provides you with the endpoint installation packages and continues on the second step of installation, which is Endpoint Agents Installation. Once the two steps are completed, you will be able to login to Control Center and start managing the computers in your network. Step 1: Installing Control Center 1. Download the latest version of Zemana Control Center Installer using the link below: 2. Double-click on the installer and accept UAC Prompt if prompted so, 3. Accept the User License Agreement and click Next, 4. Check Create Desktop Shortcut for easy access to Zemana Control Center from your desktop and click Next, 5. Wait for the installer to extract installation files, 6. Click Install Control Center option and click Next, 7. Choose either Direct Internet Connection option or Use Proxy for Connecting to Internet option, 8. Enter a valid license for Zemana Control Center. If you don t have one, please contact support@zemana.com, 9. Provide a Domain Name or a Static IP address for Control Center to use. This is the address you will enter into your browser s address bar. If you use an IP address here, make sure it is static. NOTE: For testing purposes, you can use as the IP address but you need to change it before starting the deployment of endpoint agents, 10. Enter Administrator and a password for managing Zemana Control Center. This account will be used for logging into the Control Center and it will also be set as the Control Center s System Administrator account (most privileged account type), 11. If you use Active Directory in your company, select Use Active Directory for managing computers in my network option or skip this step by choosing Skip Active Directory integration option. The account you provide in this step will *only* be used for synchronization purposes, 12. Wait for Setup to download packages and complete all the steps, IMPORTANT NOTE: This step could take a few minutes due to downloading of endpoint installation packages and other installation media. 13. Once this step is completed, setup will automatically open your browser and direct you to Login Page, 8

10 14. Click Finish to complete setup and use the Administrator and Password you have provided in the previous steps to login into Zemana Control Center. Step 2: Deployment of Endpoint Agents Deployment of endpoint agents can be performed in two alternate ways: Manual Deployment and Deployment via GPO. Manual Deployment a. Open the browser in the machine you would like to install endpoint agent to, b. Navigate to Deploy Page. This URL doesn t require authentication to make deployment of endpoint agents into your network as easy as possible, c. This page will provide you with 32bit and 64bit versions of Endpoint Setup Packages as ZIP files, d. Download the appropriate package and extract the ZIP archive to a directory. This will extract the contents of ZIP file which should contain installer exes and configuration files, e. Double click the installer32.exe or installer64.exe to start installation of Agent, f. Once installation is completed, you will be able to see the endpoint in Network Page. Deployment via Group Policy Object Deployment via GPO is composed of two steps. First, you need to create a deployment script using Control Center and then you should set this script as a machine startup script by the help of GPO. 1. Creating a Machine Startup Script for use with Active Directory a. Navigate to page, b. You will be provided with 32bit and 64bit versions of Endpoint Setup Packages as ZIP files, c. Download both ZIP files to your computer and extract them to separate directories, d. Create a shared folder either in one of your Domain Controllers or in a file server, e. Give Everyone read access to this folder and copy installer32.exe and installer64.exe into this folder, f. Copy the path of shared folder as a UNC path. As an example, if you have created a folder named Shared, the UNC path should be \\SomeServer\Shared g. Click Create Deployment Script button in Deployment Page, h. Paste the shared folder path into Shared Folder Path textbox in the dialog, i. Choose preference for removing competitor products, 9

11 j. Click Download Script button in the dialog and save the resulting BAT file into your computer. 2. Registering the Machine Startup Script with a Group Policy Object a. Open Group Policy Management Console in your Domain Controller, b. Create a GPO for deploying Endpoint Agent into your network, c. Right click on the created GPO and select Edit, d. In the opened Group Policy Management Editor window, select Computer Configuration > Policies > Windows Settings > Scripts (Startup / Shutdown) section, e. In the right pane, double click Startup item, f. In the opened Startup Properties page, click Show Files button. This will open the startup scripts directory in Explorer, g. Copy the Machine Startup Script you have created in the previous step into the folder, h. Close the Explorer window and click Add button in Startup Properties page. This will bring up Add Script dialog, i. Click Browse in the Add Script dialog and select the previously copied Deployment Script and click OK j. Machines using this GPO will automatically install Endpoint Agent after they are restarted. Mail Deployment a. Open the browser and access Control Center, b. Navigate to Deployment Page. c. Click Send via from left menu under Setup Packages, d. Add recipient addresses to List To Send box, e. Review mail content in the editor and click Send, f. Recipients will receive deployment mail which contains Endpoint Agent download links. WARNING: This feature requires a configured Server on Control Center Settings. 10

12 Remote Deployment a. Find Zemana Deploy Manager icon on the desktop of Zemana Endpoint Security Control Center installed machine, double click to execute (Default path : "C:\Program Files\Zemana Control Center\Zemana.EPS.Console.DeployManager.exe"), b. To target Active Directory computers click Deploy using Active Directory, or to target computers on your network using computer name or IP address click Deploy using Computer Name / IP Address, c. On current window a computer selection list or a text area to type computer names or IP addresses (each should be entered line by line) is displayed according to your previous choice. Select target machines or type computer name / IP address of target machines then click Proceed, d. Type local administrator credentials in order to start deployment on your target computers, e. Choose preference for removing competitor products, f. Click Start Deployment to start deployment process. g. Deployment will be initiated on target computers remotely. Deployment statuses will be displayed on current window. Deployment process will be conducted silently. WARNING: Administrative Share and File Sharing permissions should be allowed on target machines. Remote Deployment uses 135, 139 and 445 ports, these ports should be accessible as well. Optional Step 3: Installing Failover Server 1. Download the latest version of Zemana Control Center Installer to a server, which will be used as a Failover Server, using the link below: 2. Double-click on the installer and accept UAC Prompt if prompted so 3. Accept the User License Agreement and click Next, 4. Check Create Desktop Shortcut for easy access to Zemana Control Center from your desktop and click Next, 5. Wait for the installer to extract installation files, 6. Click Install Failover / Mirror Server option and click Next, 7. Failover server will be automatically installed, click Finish. Failover server management will be explained in detail in Failover Servers section of Administration chapter. 11

13 Administration 12

14 Administration Zemana Control Center is a web-based management console for administering Zemana Endpoint Security agents. This chapter will guide you through all the features of Zemana Control Center. Logging into Control Center You can log in to Control Center using one of the account types below: Local Accounts Active Directory Accounts At least one local account is created during the installation process but you are free to add any number of Local or Active Directory accounts after logging into the Control Center. On a fresh installation, login page only allows you to use Local Accounts. You can add Active Directory accounts by navigating to User Management by clicking the dropdown menu at the topmost right of Control Center. NOTE: Control Center logins have a session timeout limit which is 30 minutes by default. Modules Dashboard Dashboard is the first page you will see after a successful login. This page contains charts for endpoints, issues and licensing as well as a Threats Timeline and a list of Critical Endpoints. Threats Timeline lets you view the security events which take place on endpoints on a daily basis. You can click on a specific day to get a detailed Threat Report. Reports will be explained in detail in Reports section of this chapter. Network Network page is where you will see all of the endpoints in your network. It contains a Groups Pane for displaying custom endpoint groups and Active Directory domain groups, and a right pane which lists the contents of the selected group. If no endpoint group is selected, right pane displays all endpoints. Groups Pane This pane is located at the leftmost side of Network Page and contains a top level group named Computers which acts as the default container for individual endpoints which do 13

15 not belong to any Active Directory Domain. If Active Directory is not set up, this is the only top level group you will see in Network Page. After configuring Active Directory synchronization from Settings, each domain in Active Directory will be another top level group in this pane. Active Directory synchronization feature will mirror the exact same structure of your domains including organizational units and groups and computers. Endpoints Pane This is the pane which displays the contents of selected Group in your network. Endpoints are listed in a grid alongside some useful information such as the issues and online status of endpoint. At any given time, an endpoint could be in one of the three management states: 1. Managed : Endpoint is managed by the Control Center and it is ready to accept tasks and policies. 2. UnManaged : Endpoint is discovered through the Active Directory but it hasn t got Endpoint Security Agent installed yet. 3. Deploy Failed : Endpoint Security Agent installation failed on this endpoint. This could be due to a number of reasons such as the failure to uninstall a competitor AntiVirus solution and etc. These type of endpoints require manual installation and inspection. In normal cases, endpoint should not have any issues but in case something goes wrong in an endpoint, you will see the issues in this pane as well. Issue types for endpoints are as listed below: 1. Update Failed : Endpoint can not get product or signature updates. 2. Outdated : Endpoint s last update time is older than 3 days which can be changed in Settings. 3. Feature Status Mismatch : Status of protection modules on endpoint does not comply with the policy applied to the endpoint. 4. Infected : Endpoint is infected with a malware and it was not possible to clean the endpoint. 5. Scan Failed : Scheduled or on demand scan task failed to complete. 6. Reboot Required : Endpoint agent requires reboot to perform some tasks such as boot deleting malware or completing an update. 7. Unreachable : Endpoint didn t connect to Control Center for more than 7 days which can be changed in Settings. Endpoints Pane Context Menu This is the right click context menu which lets the Administrator perform endpoint related tasks and set labels for endpoints. Tasks listed here can also be found in Quick Actions bar in Endpoint Details Dialog. 14

16 Filters This buttons brings up a dialog in which you can change the settings related to viewing of endpoints in Endpoints Pane. Normal behavior of Endpoints Pane is displaying the contents of the selected group without including the endpoints which reside in sub-groups of the selected group. You can change this behavior by choosing a Group and then selecting All Groups Recursively option in Filter dialog. Default behavior of Endpoint Pane when no group is selected is displaying all endpoints in all groups including Active Directory domains and Computers top level group. This is why, when no group is selected, Filters dialog will not have All Groups Recursively option until you select a Group from the Groups Pane. You can also provide a computer name for filtering all computer names containing the provided string. After setting the required filter options, you should click Save for activating the filter options. Endpoint Actions Bar This bar is located at the upper side of Groups Pane and it lets the IT Admin perform endpoint and group related tasks such as creating a new group, renaming an already existing group and deleting an endpoint. Please note that, group related actions in this bar are only applicable to groups created beneath Computers top level group and they will be disabled when an Active Directory Domain group is selected. This is because Active Directory Domain groups are synchronized directly from the provided domain and IT Admin has to make changes in the domain itself (in domain controller) and click Sync Active Directory button in this bar to fetch updated domain structure. In order to use Sync Active Directory feature, you should configure Control Center to use Active Directory from Settings page. Endpoint Details Dialog Endpoints Pane displays a summary of information about each endpoint. In case you need to get more information about the endpoint, you should click on the name of the endpoint which will bring up Endpoint Details Dialog. This dialog contains detailed information about the selected endpoint and it also provides you with a Quick Actions bar for performing endpoint related tasks. Tabs in this dialog are as follows: 1. General Tab : Displays most of the information about the Endpoint. 2. Endpoint Tab : Displays the status of protection modules. 3. Policy Tab : Displays the last assigned policy of endpoint and assignment status / type of the policy. Assignment type of policy can either be Inherited or Direct. Inherited indicates that endpoint inherited its policy from its parent group so no direct assignment is made by the IT Admin. 4. Events Tab : Displays all type of events which was sent by the Endpoint Agent. 15

17 Tasks Tasks are the main unit of work for Endpoint Agents. Tasks are assigned to Endpoint Agents by the Control Center in response to Administrator's actions. They can be assigned to a single or multiple endpoint agents and lets the administrator view status of the task on each endpoint. Tasks module keeps a record of each assigned task and sets the status of task to Pending until the all the endpoints connects to the Control Center and gets the task. In this case, task status is switched to In Progress. After the task completes in all endpoints, task will be marked as Completed. For further inspection about the status of task on each endpoint, you can click on the numbers in the Status column. Policies Policy is a group of settings which can be applied to a single or a group of endpoints. Policies include all types of settings an endpoint should comply with. Control Center is shipped with a default / optimized policy which is called First Policy and this policy is set as Default Policy so any endpoint which joins into the managed group of computers receives this policy as their active policy. You can create any number of policies using Create Policy button in the actions toolbar and you can also create a copy of the policy by selecting the source policy and clicking the Clone Policy button. NOTE: Please refer to Policy Section for more information. Quarantine This module lists the files which are quarantined by Endpoint Agents and provides you with the following options: Restore : Restore the quarantined file to the endpoint. This is what Administrator should do to revert the quarantine action and let the user use the file in question. Delete File : This option deletes the file from quarantine. Delete Record : This options removes the quarantine entry from Control Center and doesn't do anything on the endpoint side. This is useful for deleting quarantine entries which are submitted from unreachable endpoints. Reports This module allows you to create instant or scheduled reports from the Control Center. 16

18 Main grid of this page lists the previously registered Scheduled Reports. You can edit or delete a previously created report by highlighting the report and clicking the appropriate action button in the action toolbar. Report types are: 1. Threat Report: Displays all detections including malware detections and content control detections. This report type is a merged view of "Malware Detection Report" and "Content Control Report". 2. Malware Detection Report: Displays malware detection events on all endpoints. 3. Content Control Report: Displays content control related detections on all endpoints such as blocked web pages and keywords. 4. Endpoint Protection Status Report: Displays the protection status of each endpoint with latest scan results. 5. Endpoint Feature Status Report: Displays the ON/OFF status of each protection module for endpoints. 6. Endpoint Update Status Report: Displays the update status of each endpoint. 7. Endpoint Policy Report: Displays the policy name of each endpoint. 8. Endpoint Issue Report: Displays all types of issues encountered on each endpoint. 9. Endpoint Management Status Report: Displays the management status of each endpoint. Specifying addresses while creating Scheduled Reports lets report content to be sent to specified addresses upon creation of periodic reports. Deployment WARNING: In order to receive scheduled reports with , Server should be configured on Control Center settings. Deployment page lets you download setup packages for Endpoint Agents and Update Servers. This page also has a separate tab named Update Servers which let s you view the currently in use update servers. This page is only for viewing active update servers for information purposes. Setup Packages Endpoint Agent and Update Server packages can be downloaded by clicking the appropriate link in this section. Setup packages are archive files which contain an installer and a configuration file. Update Servers This section lists the active Update Servers of Control Center for information purposes only. Uninstalling an Update Server will automatically delete its entry from this list. 17

19 Notifications This module lists the notifications about Control Center and informs the Administrator about important events. Currently supported notifications are: Active Directory Synchronization Failed Backup Failed Notification Failed due to SMTP settings New Control Center Update is available Update Server Capacity Exceeded License Related Notifications Audit Logs This module lets you view all of the important activities performed by Control Center users. It is viewable by Administrators and System Administrator only. Settings This module contains all configurations for Zemana Control Center to function properly and it is the most critical part of the system. Control Center General Control Center Address: Address of Control Center which should be either an IP Address or a domain name. Control Center Language: User interface language for Control Center management console. Endpoint Language: User interface language for endpoint agents. Timezone: Timezone information for the Control Center. All the information in Control Center database is saved in UTC+0 by default and converted to the timezone you provide in this field. Proxy: Proxy configuration for Control Center. Server: SMTP server settings which will be used for sending critical events to Administrators via . Advanced Use SSL: Endpoint agents will use HTTP by default. Enabling this option forces endpoint agents to use HTTPS for connecting to Control Center. IMPORTANT: You should add an SSL certificate to Control Center before enabling this option. Please check this section for more information. 18

20 Send error reports to Zemana: Submits error reports to Zemana automatically when enabled. Enable Debug Logging for trouble shooting: Reserved for Zemana support personnel's use. Threat endpoints as outdated after: Indicates how many days should pass before marking an endpoint as Outdated. Threat endpoints as unreachable after: Indicates how many days should pass before marking an endpoint as Unreachable. Backup: Options for automatic backup creation. Current version supports file system shares and FTP upload options. In order to create a manual backup, please refer to this section. Active Directory: When enabled, Control Center connects to the provided Active Directory domain and synchronizes the directory structure as well as computers directly into the network module. This is performed with a background job which fires twice in an hour. License: Provides information about the currently in use license. Event Notifications: Provides configuration for sending events to System Administrator via and SIEM and Syslog. When enabled, Control Center sends the selected events to System Administrator s and/or provided SIEM server. WARNING: In order to receive event notifications with , Server should be configured on Control Center settings. Failover Servers This module allows user to register, unregister and overview Zemana Failover Servers. If Control Center has one or more failover servers registered, Endpoint Agents will connect those servers in case their connection to Control Center fails. Failover Server Registration To register a failover server, navigate to Failover Servers Page, click Add Failover Server and type failover server address then click OK. If targeted failover server is eligible it will be added to failover servers list. IMPORTANT: Registration requires a server with Zemana Failover Server installed. Failover Server Unregistration To unregister a failover server, navigate to Failover Servers Page, hover over an existing failover server and click Delete then click Yes. Targeted failover server will be deleted from failover servers list. 19

21 User Management User Types Local Users : This account type is for customers who do not use Active Directory in their network. Active Directory Users: Active Directory provided users which will be used for managing Roles Control Center. Since, Active Directory user passwords are managed by Active Directory itself, Control Center doesn't need any password information for this type. Creating an Active Directory user only approves the user as a valid Control Center account. 1. System Administrator: This role can be applied to a single user only and defines the most privileged user in Control Center. This user is the sole owner of the system and there are no restrictions for this role. 2. Administrator: This is a less privileged administrator role which is capable of managing the Control Center. The only restriction is that this role cannot change the Control Center settings. 3. Report Manager: a. View only access to Network page, b. View only access to Tasks page, c. View only access to Quarantine page. d. Full access to Reports page. 4. Maintenance Manager: a. View only access to Network page, b. Ability to manage endpoints, c. View only access to Tasks page, d. View only access to Policy page, e. Full access to Quarantine page, f. Limited access to Reports page (can create instant reports and view scheduled reports) g. Full access to Deployment page, 5. Monitoring Engineer a. View only access to Network page, b. View only access to Reports page. In case a user forgets account password, Forgot your password? button on Login page can be used to retrieve user credentials to their address. 20

22 Update Servers Internal Update Servers are separate setup packages which can be used by Zemana Control Center to centralize delivery of signature and product updates. Control Center automatically loads balances update servers and distributes them to endpoints in a round robin manner. Each Update Server can handle endpoints. Once this limit is exceeded, Control Center notifies Administrator to install more update servers. How to install an Update Server? In order to install an internal update server, please follow the steps below: 1. Set a static IP address to the server which will be used as an update mirror, 2. Open your preferred browser and navigate to Deployment page, 3. Download the appropriate update server package by clicking either 32-bit or 64 bit links, 4. Extract the Update Server Setup Package contents to a directory, 5. Run installation file and follow the on-screen prompts. Upon installation, update server will automatically connect to Control Center and register itself as an active update server. How to check the status of Update Servers? 1. Navigate to Deployment page and click "Update Servers" tab, 2. You can see the active update servers and their statuses here. How to uninstall an Update Server? Update Servers are normal installation packages which can be uninstalled using "Control Panel > Programs And Features" panel. Upon uninstallation, Update Server entry will be removed from the Control Center automatically and endpoint agents will be notified to use other Update Servers by using this Update Server as their Update Source NOTE: If there are no update servers left in the Control Center, the system will automatically set Update Source settings to "Internet" in all policies. 21

23 Policy 22

24 Policy General Settings These are general settings which affect the way endpoints work. Details Policy Name : Name of the policy Product Settings Settings Display alert pop-ups : Displays alerts to a user and asks for user's decision. If unchecked, endpoint agents will automatically choose the best possible action without asking the user anything. Display notification pop-ups: Displays informational pop-ups such as update notifications. Show product icon in System Tray: Displays Endpoint Agent icon in Windows System Tray. Update Server Settings: Endpoint Agents require either an active Internet connection or an update mirror address for grabbing product and signature updates from. By default all endpoints use Internet for their update source but you can install an Internal Update Mirror anytime and instruct the endpoints to use this mirror. Control Center maintains a list of active update mirrors and distributes these to the endpoints in an optimized way. Uninstall/Repair Password: This is the password which will be asked from a user in case a manual repair or uninstall operation is initiated by the user manually. Remote tasks ignore this password and do not need any user interaction. Proxy Settings: Endpoint proxy settings for connecting to the Internet. Anti-Virus Settings Anti-virus related settings for endpoints. On-Access Settings: Enables or disables real time protection module of Zemana Endpoint Security Agent. This switch acts as a master switch for all of the settings below. Limit File Size: Sets the maximum size limit for real time malware scanning. Unchecking this option removes the size limit and enables real time scanning of all files. Scan Archives Archive maximum size limit: Enables or disables scanning or Archive files. Archive maximum depth: Level of recursion in archive content scanning. Miscellaneous Scan Boot Sectors: Enables/disables scanning of boot records such as MBR and VBRs. 23

25 Scan Network Traffic: Scans the network traffic against malicious files and blocks the content before it is delivered to the requesting application. Scan Potentially Unwanted Applications (PUA): Enabling this option activates scanning of not harmful but potentially unwanted applications such as sticky toolbars in browsers. On-Demand Settings: Enables or disables scan settings for removable devices such as USB drives, CD ROMs etc. as well as providing support for scheduled scans. Scan Tasks: Scheduled scans with Quick and Full scan options. Scan tasks registered here start at the provided time at endpoint's local time zone. Device Scan Settings Scan CD/DVD ROM: Enable/disable scanning of CD/DVD ROM devices. Scan Network Devices: Enable/disable scanning of network devices such as network file shares. Scan Removable Devices: Enable/disable scanning of removable drives such as USB sticks. Heuristics: Configures the level of Zemana Heuristic Threat Control. Currently 4 levels are supported: Paranoid, Aggressive, Default, Permissive. Setting this option to a level above Default will increase the heuristics based protection against unknown files but may lead to false positives. Exclusions: Excludes the specified Directory, File or Extensions from all AntiMalware modules including On-Access, On-Demand, Heuristic. Quarantine Settings: Configures the amount of days a quarantined file is kept on an endpoint. Content Control Settings Configures content based protection options such as URL filtering and keyword filtering. Settings General Enable Anti-Phishing and Anti-Fraud Protection: Enables/disables scanning of web content against possible phishing attempts. Scan SSL Traffic: Enables/disables scanning of SSL protected pages. Web Access Control: Functions as a master switch for enabling/disabling web access control related settings. Blocked Web Addresses: Blocks the access to provided web addresses on endpoints. Access blocking is not specific to browsers and covers all type of applications trying to access the blocked web site. Blocked Keywords: Blocks the web content which contains the provided keywords. Blocked Processes: Blocks the specified processes by name. Exclusions: Excludes specified URL, IP Address or Process Names from content control access restrictions. 24

26 ID Theft Protection Settings Settings for enabling/disabling ID Theft Protection Module. Settings Enable Identity Theft Protection : Enables/disables ID Theft Protection feature. 25

27 Frequently Asked Questions 26

28 Frequently Asked Questions How do I create a backup of Zemana Control Center? In order to create a manual backup of Zemana Control Center, please follow the steps below: 1. Open "Explorer" in the Zemana Control Center server machine, 2. Navigate to "C:\Program Files\Zemana Control Center\utils" folder, 3. Run "Backup Zemana Control Center" as Administrator, 4. Choose a folder for saving the backup file, 5. Click OK. This will create a snapshot of all the database and settings of Zemana Control Center and save them as a ZIP file to the selected folder. How do I restore Zemana Control Center? In order to restore Zemana Control Center from a backup, please follow the steps below: 1. Open "Explorer" in the Zemana Control Center server machine, 2. Navigate to "C:\Program Files\Zemana Control Center\utils" folder, 3. Run "Restore Zemana Control Center" as Administrator, 4. Choose a previously created backup file, 5. Click OK. How do I create a support tool output? Before contacting the support, please follow the steps below and create a support tool output which will be saved to your desktop: 1. Open Explorer in your computer, 2. Navigate to "C:\Windows\zestools" folder, 3. Run "SupportTool.exe" and follow the on-screen prompts. 27

29 How do I enable SSL on Zemana Control Center? Control Center uses HTTP as its default communication protocol but you can change this behaviour any time by adding an SSL certificate to the Control Center. Here are the steps you should follow for activating SSL on Control Center and Endpoint Agents: 1. Enabling SSL in IIS Manager i. Click "Start Menu", ii. Type "IIS" and click "Internet Information Services (IIS) Manager", iii. Expand the directory view at the left side of IIS Manager, iv. Right click to "Sites > ZemanaControlCenter" v. On the "Site Bindings" dialog, select second entry "HTTPS" and click "Edit", vi. On the "Edit Site Bindings" dialog choose an SSL Certificate, vii. Click OK to save changes. 2. Enabling SSL in Control Center i. Once SSL is enabled in IIS Manager, navigate to Settings > Advanced Settings, ii. Enable "Use SSL" feature, iii. Click "Save" to apply settings. How do I migrate Zemana Control Center to a new server? Migrating an already running instance of Control Center requires two steps: 1. Migrating Control Center to a new server i. Create a backup of Zemana Control Center by following the steps described in FAQ, ii. Install Zemana Control Center to a new server, iii. Navigate to "C:\Program Files\Zemana Control Center\utils" folder on the new server, iv. Run "Restore Zemana Control Center" as Administrator, v. Choose the backup file you have created in the step 1, vi. Click OK. 2. Forwarding Endpoint Agents to New Control Center i. Once migration is done, you will have an exact copy of old Control Center in your new server, ii. Make sure old instance can access the new Control Center. If not, configure Firewall settings to allow access from old instance's to new instance's address, iii. Disable Active Directory Synchronization on the old instance, iv. Navigate to Settings page on old instance, v. Set "Control Center Address" to new instance's IP or Domain name, vi. Save settings. 28

30 IMPORTANT NOTE: Disabling Active Directory synchronization is required to detect endpoints which are still using the old instance. Endpoints will report to the old instance that they started using the new server which will delete them from the endpoints list on the old instance. This way, you can see endpoints waiting for migration and once all the endpoints are migrated, you can shutdown the old Control Center instance. What ports are used by Endpoint Agents and Control Center? - TCP 55555: Default HTTP port for agent to control center connections. - TCP 55556: HTTPS port. Only usable if Enable SSL setting is ON. - TCP 7074: Signature and product update port , 139, 445 : Remote deployment - 80 : License check (HTTP) : License check (HTTPS) - 389, 636, 3268, 3269 : (LDAP) Active Directory authentication External URLs used by Endpoint Agents and Control Center? How do I uninstall Endpoint Agents? Setup packages are basically windows installation files and they can be uninstalled just like any other application. The important thing to note about the uninstallation is that each setup package may install a few other additional packages. Deciding which package to uninstall plays an important role for the complete uninstall. In order to completely uninstall an endpoint agent, please follow the steps below: 1. Click Start button and type Programs and Features, 2. Find Zemana Endpoint Security Agent entry in the list, 3. Right click on the entry and select Uninstall option, 4. Enter the uninstall password if requested so, 5. Follow the on-screen instructions. 29

31 How do I uninstall a group of Endpoint Agents? Please follow the steps below for uninstalling a group of computers: 1. Go to Network page, 2. Right click on the group you would like to uninstall, 3. Choose Tasks > Uninstall Agent from the context menu, 4. Assign a descriptive name to the uninstallation task, 5. Click OK. How do I send feedback about the product? In order to send a feedback about the product, please scroll down in any page and click Send Feedback link at the footer. 30