McAfee MVISION Endpoint 1808 Installation Guide

Transcription

1 McAfee MVISION Endpoint 1808 Installation Guide

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee MVISION Endpoint 1808 Installation Guide

3 Contents 1 Installation overview 5 Which type of installation do you need? Planning your installation 7 Microsoft Windows Defender Antivirus group policies Windows Defender Antivirus signature updates System requirements 9 4 Pre-installation tasks 11 Prepare your environment Remove Endpoint Security from the endpoints Install the software 13 Install the extensions Install the software using the Software Catalog Check in the client software package Deploy the software to managed systems Upgrade from VirusScan Enterprise Verify your installation Verify that Windows Defender Antivirus is running Test malware detection Testing software detection Troubleshooting installation 19 Examine the log files Remove the software 21 Remove the software from the endpoint Remove the software from McAfee epo Remove the extensions from McAfee epo McAfee MVISION Endpoint 1808 Installation Guide 3

4 Contents 4 McAfee MVISION Endpoint 1808 Installation Guide

5 1 Installation 1 overview The McAfee MVISION Endpoint software is installed on Microsoft Windows 10 systems and managed by McAfee epolicy Orchestrator (McAfee epo ) and later. You only need to install two components to run MVISION Endpoint software. A.zip file with the five MVISION Endpoint extensions, installed on the McAfee epo server The MVISION Endpoint client, installed on your managed endpoints Install the MVISION Endpoint extensions on the McAfee epo server and the MVISION Endpoint client package (MVISION_Endpoint_Installer_x64_Release_1808_18.x.x.xx.zip) on your managed endpoints. The MVISION Endpoint extensions are packaged in a.zip file (MVISION_Endpoint_bundled_ePO_extensions_1808_18.x.x.xx.zip) which includes five product extensions: MVISION_Endpoint_epo_extn_1808_18.x.x.xx.zip This extension is for product installation and deployment. Quarantine_Mgmt_epo_extn_1808_18.x.x.xx.zip This extension enables quarantine management functionality. ProtectionWorkspace-services_1.0.0.xxx.zip This extension enables Protection Workspace services on the McAfee epo server. ProtectionWorkspace_1.0.0.xxx.zip This extension installs Protection Workspace on the McAfee epo server. MVISION_Endpoint_Updater_1.0.0.xx.zip This extension allows you to keep extensions and packages up to date as McAfee releases new versions of the product. Which type of installation do you need? MVISION Endpoint is installed and managed on McAfee epo. To install MVISION Endpoint, log on to McAfee epo as an administrator, install the extensions, check in the client package, and deploy MVISION Endpoint to managed systems. First-time installation For first-time installation, you can manage MVISION Endpoint with: On-premise McAfee epo For information about how to install on-premise McAfee epo, see the McAfee epolicy Orchestrator Product Guide. Hosted McAfee epo on Amazon Web Services (AWS) For information about how to install McAfee epo on AWS, see and the McAfee epolicy Orchestrator Installation Guide. McAfee MVISION epo SaaS For information about how to activate your MVISION epo account and log on to McAfee MVISION epo, see the McAfee MVISION epo Product Guide. McAfee MVISION Endpoint 1808 Installation Guide 5

6 1 Installation overview Which type of installation do you need? Upgrade from older products You can upgrade from: McAfee Endpoint Security McAfee VirusScan Enterprise McAfee SiteAdvisor Enterprise McAfee Host Intrusion Prevention The MVISION Endpoint software packages and extensions must be installed on McAfee epo before you can deploy MVISION Endpoint to managed endpoints and configure MVISION Endpoint policies. If MVISION Endpoint is installed on the endpoint, installation of McAfee Endpoint Security or McAfee Endpoint Security Threat Prevention is not blocked. If you install Endpoint Security or VirusScan Enterprise on an endpoint with MVISION Endpoint already installed, you will experience performance problems on the endpoint. Restart the system to deactivate MVISION Endpoint. If you then uninstall Endpoint Security or VirusScan Enterprise, restart the system to activate MVISION Endpoint. 6 McAfee MVISION Endpoint 1808 Installation Guide

7 2 2 Planning your installation Microsoft Windows Defender Antivirus group policies The Windows Defender Antivirus client is installed as a core part of Windows 10. It is important to consider group policies that are configured for Windows Defender Antivirus on your endpoints, and how they affect the MVISION Endpoint implementation. When you install MVISION Endpoint on managed endpoints, and a Windows Defender Antivirus policy setting conflicts with an MVISION Endpoint policy setting, the settings that were applied most recently prevail. For information about Windows Defender Antivirus deployments and policy configuration, see the documentation for the product. Windows Defender Antivirus signature updates You can configure the sources used by Windows Defender Antivirus to check for signature updates. Windows Defender Antivirus uses several methods to check for and download signature updates. Updates distributed from WSUS Updates distributed from Microsoft Update Updates distributed from Micrososft Malware Protection Center Updates from UNC file shares Select the methods you want to use in the MVISION Endpoint policy settings. To check for signature updates from UNC files shares, enter the UNC paths to be checked. See the McAfee MVISION Endpoint Product Guide for more information. McAfee MVISION Endpoint 1808 Installation Guide 7

8 2 Planning your installation Microsoft Windows Defender Antivirus group policies 8 McAfee MVISION Endpoint 1808 Installation Guide

9 3 3 System requirements Check that the minimum system requirements are met before you install the MVISION Endpoint components. Operating system requirements MVISION Endpoint supports only 64-bit operating systems. Windows 10 RS3 64-bit Windows 10 RS4 64-bit Platform support McAfee epo 5.9.x and later McAfee Agent and later McAfee Data Exchange Layer (DXL) 4.0 and later For more information about MVISION Endpoint supported platforms, environments, and operating systems, see KB Minimum hardware requirements The following processor specifications are a recommended guideline, but are not a requirement: Memory size (RAM) 8 GB Processor (CPU) Intel i5-6xx McAfee epo scalability Make sure McAfee epo has sufficient capacity to manage the number of endpoints you want to deploy MVISION Endpoint to before you install the software. See the McAfee epolicy Orchestrator Installation Guide for information about McAfee epo scalability. McAfee MVISION Endpoint 1808 Installation Guide 9

10 3 System requirements 10 McAfee MVISION Endpoint 1808 Installation Guide

11 4 Pre-installation 4 tasks Contents Prepare your environment Remove Endpoint Security from the endpoints Prepare your environment Before you install the software, make sure your environment is ready. 1 Check system requirements for information about products that are compatible with MVISION Endpoint. Make sure any managed endpoints where you deploy MVISION Endpoint meet these requirements. 2 Make sure McAfee Agent or later is installed on all endpoints where you deploy the software. 3 Make sure that you are logged on to McAfee epo as an administrator. 4 Check if VirusScan Enterprise, McAfee Endpoint Security Web Control, or McAfee Endpoint Security Firewall are installed on the endpoints where you deploy MVISION Endpoint. These products are automatically uninstalled on the system when you deploy the software. 5 Check if Endpoint Security is installed on the endpoint before you deploy MVISION Endpoint. If it is, remove the software before you deploy MVISION Endpoint. 6 If you want to use the quarantine management functionality, make sure that McAfee Data Exchange Layer (DXL) 4.0 or later is installed on all endpoints where you deploy MVISION Endpoint. Designing and configuring the DXL fabric can be a complex process. See the McAfee Data Exchange Layer Installation Guide for information about how to install DXL. 7 Review the known issues for this release. For a full list of known issues for MVISION Endpoint, see KB Remove Endpoint Security from the endpoints If Endpoint Security is installed on your endpoints, and you want to install MVISION Endpoint, remove the Endpoint Security software first, and then install MVISION Endpoint. Before you begin Disable Endpoint Security Exploit Prevention before you uninstall Endpoint Security. Remove all Endpoint Security software and Endpoint Security Platform Common modules before you deploy MVISION Endpoint, including: McAfee MVISION Endpoint 1808 Installation Guide 11

12 4 Pre-installation tasks Remove Endpoint Security from the endpoints McAfee Endpoint Security Threat Prevention McAfee Endpoint Security Firewall McAfee Endpoint Security Web Control McAfee Endpoint Security Adaptive Threat Protection (ATP) If you are migrating from Endpoint Security endpoint products to MVISION Endpoint, you must carefully review any client deployment tasks that cause Endpoint Security to be redeployed. If McAfee Endpoint Security Threat Prevention exclusions are configured as part of your environment, you must convert the exclusions to the MVISION Endpoint policy. For information about MVISION Endpoint exclusions policies, see the McAfee MVISION Endpoint Product Guide. 1 Select Menu Client s Client Catalog. 2 From the McAfee Agent navigation tree, select Product Deployment. 3 Click New and select Product Deployment from the Types drop-down list. 4 Complete the Name and Description fields. Windows is automatically selected as the target platform. 5 From the Products and components drop-down list, select the Endpoint Security module to remove. Click + to remove multiple software packages. 6 From the Action drop-down, select Remove. 7 Click Save. The new task appears in the Product Deployment list. 8 Click Assign, then select the system or group of systems that you want to apply the client task to. You can apply this task to a single system or to groups of managed systems in the System Tree. 9 Click OK. 10 Select the required options in Client Assignment Builder and click Save. Endpoint Security is removed from the endpoint. When you remove Endpoint Security from the endpoint, Windows Defender Antivirus is automatically re-enabled. Windows Firewall is not automatically re-enabled. You must re-enable Windows Firewall on each endpoint that you remove Endpoint Security from to ensure a consistent level of protection. 12 McAfee MVISION Endpoint 1808 Installation Guide

13 5 Install 5 the software Contents Install the extensions Check in the client software package Deploy the software to managed systems Upgrade from VirusScan Enterprise Verify your installation Verify that Windows Defender Antivirus is running Test malware detection Testing software detection Install the extensions You must install the MVISION Endpoint extensions on the McAfee epo server before the product can be managed. The.zip file (MVISION_Endpoint_bundled_ePO_extensions_1808_18.8.x.xx.zip) contains the extensions required to install MVISION Endpoint successfully. 1 From the McAfee epo console, select Menu Software Extensions Install Extension. 2 Browse to select the.zip extension file (MVISION_Endpoint_bundled_ePO_extensions_1808_18.8.x.xx.zip), then click OK. 3 Verify that the extensions appear in the Extensions list. a Select McAfee MVISION Endpoint 1808 to view MVISION Endpoint and Quarantine Management extensions. b Select epolicy Orchestrator to view Protection Workspace and MVISION Endpoint Updater extensions. s Install the software using the Software Catalog on page 13 You can use the Software Catalog to install, upgrade, and remove the software. Install the software using the Software Catalog You can use the Software Catalog to install, upgrade, and remove the software. McAfee MVISION Endpoint 1808 Installation Guide 13

14 5 Install the software Check in the client software package 1 In McAfee epo, select Menu Software Software Catalog. 2 Select the checkbox next to MVISION Endpoint. 3 Click Check In All. The MVISION Endpoint extensions and endpoint package are installed on the McAfee epo server. Check in the client software package Check in the MVISION Endpoint client package to the Master Repository so that McAfee epo can deploy the software to your managed endpoints. Before you begin Make sure that the MVISION Endpoint client package is in an accessible location on the network. 1 Select Menu Software Master Repository. 2 Click Check in package. 3 Select the package type, then browse to and select the package file. 4 Click Next. 5 Click Save to begin checking in the package, then wait while the package is checked in. The package is checked in and appears in the Master Repository. Deploy the software to managed systems Deploy MVISION Endpoint to your Windows 10 endpoints to install the package on your endpoint. Before you begin You must install the MVISION Endpoint extensions and check in the MVISION Endpoint package before you deploy the software to managed endpoints. An MVISION Endpoint product deployment task is created automatically when you install MVISION Endpoint. When you assign this task to a system, the latest version of the client package that is checked in to McAfee epo is deployed to that system. 1 Select Menu Client s Client Catalog. 2 From the McAfee Agent navigation tree, select Product Deployment. The MVISION Endpoint client task Deploy MVISION Endpoint appears in the list. 3 Click Assign, then select the system or group of systems you want to apply the client task. 14 McAfee MVISION Endpoint 1808 Installation Guide

15 Install the software Upgrade from VirusScan Enterprise 5 4 Click OK. 5 Select the required options in the Client Assignment Builder. a Select Enabled in Schedule status. b Select Schedule type from the drop-down list. 6 Click Save. Upgrade from VirusScan Enterprise If VirusScan Enterprise, SiteAdvisor Enterprise, or Host Intrusion Prevention are installed on your endpoints, and you want to install MVISION Endpoint, you do not need to manually remove the existing software. The older products are automatically uninstalled on the endpoint when you install MVISION Endpoint. 1 Install the.zip extension file (MVISION_Endpoint_bundled_ePO_extensions_1808_18.8.x.xx.zip) on the McAfee epo server. 2 Check in the MVISION Endpoint client package to the Master Repository. 3 Deploy MVISION Endpoint to endpoints. 4 Select Menu Software Product Deployment to view the deployment status. The status indicates that the software deployment is successful. MVISION Endpoint is installed on the endpoint. VirusScan Enterprise policies are not migrated to MVISION Endpoint. Verify your installation Use McAfee epo to check that MVISION Endpoint is installed on the endpoint. 1 Log on to McAfee epo. 2 Select Menu Systems System Tree. 3 Select the system you want to check. 4 Click the Products tab. 5 Verify that the version of MVISION Endpoint you installed appears in the list of products and that the status is successful. MVISION Endpoint is deployed to the endpoint successfully. McAfee MVISION Endpoint 1808 Installation Guide 15

16 5 Install the software Verify that Windows Defender Antivirus is running Verify that Windows Defender Antivirus is running After MVISION Endpoint is installed, Windows Defender Antivirus is enabled automatically on the endpoint. Before you begin Check that Windows Defender Antivirus is enabled on the endpoint. 1 Open the Local Group Policy Editor on the endpoint. 2 Select Computer Configuration Administrative Templates Windows Components Windows Defender Antivirus from the policy tree. The Turn off Windows Defender Antivirus policy setting is under the Windows Defender Antivirus folders. 3 Open the Turn off Windows Defender Antivirus policy setting and make sure it's set to Disabled or Not configured. Test malware detection Check that MVISION Endpoint reports threat detections. Before you begin Enforce MVISION Endpoint default policies on endpoints. 1 Connect to the endpoint where MVISION Endpoint is deployed. 2 Navigate to 3 Find the EICAR (European Institute for Computer Antivirus Research) Sample Virus. a Click Anti-Malware Testfile. b Navigate to The Anti-Malware Testfile section. c Copy the sample, which begins with X50. 4 Use Windows notepad to save the EICAR file to your Windows desktop. 5 Navigate to the McAfee epo dashboard. The Protection Workspace appears. 6 Expand Resolved Threats. 7 Click the Resolved Threats total or the Basic total. 8 Confirm that the sample file is listed as a threat in the activity list. Windows Defender Antivirus detects the threat. This information is listed under Analyzer. You can click the threat for Threat Details. 16 McAfee MVISION Endpoint 1808 Installation Guide

17 Install the software Testing software detection 5 Testing software detection Make sure that MVISION Endpoint is installed correctly and can communicate with McAfee epo for detections. MVISION Endpoint Real Protect must be installed correctly to ensure endpoints can communicate with the McAfee cloud for detections. For information about how to test MVISION Endpoint detections, see KB McAfee MVISION Endpoint 1808 Installation Guide 17

18 5 Install the software Testing software detection 18 McAfee MVISION Endpoint 1808 Installation Guide

19 6 6 Troubleshooting installation Examine the log files Examine the log files to identify why MVISION Endpoint fails to install or uninstall. If the software installation or software removal fails, check the log files on the endpoint. 1 Navigate to c:\windows\temp\mcafeelogs. 2 Open the log files: MveInstall.log (processes performed by the installer) and MVEUninstall log (processes performed by the uninstaller). These log files are both saved as text files and are the primary MVISION Endpoint install and uninstall log files. They document each process that the MVISION Endpoint installer or uninstaller performs. 3 Examine the log files and identify the errors that occurred. Starting from the top of the file, you can see the MVISION Endpoint product installer start. The installer then runs preinstall actions and removes incompatible products. For each process, you can see the command line, registry entries, and return codes. McAfee MVISION Endpoint 1808 Installation Guide 19

20 6 Troubleshooting installation Examine the log files 20 McAfee MVISION Endpoint 1808 Installation Guide

21 7 7 Remove the software Contents Remove the software from the endpoint Remove the software from McAfee epo Remove the extensions from McAfee epo Remove the software from the endpoint Use McAfee epo to uninstall MVISION Endpoint from managed endpoints. Create a task in McAfee epo to uninstall MVISION Endpoint. 1 Select Menu Client s Client Catalog. 2 From the McAfee Agent navigation tree, select Product Deployment. 3 Click New and select Product Deployment from the Types drop-down list. a Complete the Name and Description fields. Windows is automatically selected as the target platform. b c d From the Products and components drop-down list, select MVISION Endpoint 18.8.x.xx. From the Action drop-down, select Remove. Click Save. The new task appears in the Product Deployment list. 4 Click Assign, then select the system or group of systems where you want to apply the client task. 5 Click OK. 6 Select the required options in Client Assignment Builder and click Save. Check the Windows 10 Control Panel on the endpoint to verify that the product is removed from. McAfee MVISION Endpoint 1808 Installation Guide 21

22 7 Remove the software Remove the software from McAfee epo Remove the software from McAfee epo Remove the MVISION Endpoint software package from the McAfee epo server. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Software Master Repository. The Master Repository page displays the list of software packages and their details. 3 Select the software and click Actions Delete Package. The software is removed from the McAfee epo server. Remove the extensions from McAfee epo Remove MVISION Endpoint and Protection Workspace extensions from the McAfee epo server. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Software Extensions. Click MVISION Endpoint to view MVISION Endpoint and Quarantine Management extensions. Click epolicy Orchestrator to view Protection Workspace extensions. The Extensions page appears with the extension name and version details. 3 Click Remove next to the extensions you want to remove. 4 When prompted to confirm, click OK. 22 McAfee MVISION Endpoint 1808 Installation Guide

23 0-00