McAfee Agent Interface Reference Guide. (McAfee epolicy Orchestrator Cloud)

McAfee Agent 5.5.0 Interface Reference Guide (McAfee epolicy Orchestrator Cloud)

COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

Contents 1 Working with McAfee Agent from McAfee epo 5 System properties reported by McAfee Agent........................ 5 Processes used by McAfee Agent 5.0.0........................... 6 2 Interface Reference 9 Agent Deployment URL................................ 9 McAfee Agent Properties page.............................. 9 Client Task Catalog pages............................... 10 Product Deployment page............................ 10 Product Update page.............................. 11 McAfee Agent Statistics page........................... 12 Custom Properties page............................. 12 Policy Catalog pages................................. 13 General tab................................. 14 SuperAgent tab................................ 15 Events tab.................................. 15 Logging tab................................. 16 Updates tab................................. 16 Peer-to-Peer tab................................ 17 Proxy tab.................................. 18 Troubleshooting tab.............................. 18 Custom Properties tab............................. 19 Index 21 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 3

Contents 4 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

1 1 Working with McAfee Agent from McAfee epo Contents System properties reported by McAfee Agent Processes used by McAfee Agent 5.0.0 System properties reported by McAfee Agent McAfee Agent reports system properties from the managed systems to McAfee epolicy Orchestrator Cloud (McAfee epo Cloud). The properties reported, vary by operating system. System properties This list shows the system data that is reported to McAfee epo Cloud. Review the details about your system before concluding that system properties are incorrectly reported. Agent GUID CPU Serial Number CPU Speed (MHz) CPU Type Custom 1 4 Communication Type Default Language Description DNS Name Domain Name Excluded Tags Free Disk Space Free Memory Free System Drive Space Installed Products IP Address IPX Address Is 64 Bit OS Is Laptop Last Communication Last Sequence Error LDAP Location MAC Address Managed State Management Type Number Of CPUs Operating System OS Build Number OS OEM Identifier OS Platform OS Service Pack Version OS Type OS Version Server Key Sequence Errors Subnet Address Subnet Mask System Description System Location System Name System Tree Sorting Tags Time Zone To Be Transferred Total Disk Space Total Physical Memory Used Disk Space User Name Vdi McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 5

1 Working with McAfee Agent from McAfee epo Processes used by McAfee Agent 5.0.0 Agent properties Each McAfee product designates the properties it reports to McAfee epo Cloud and, of those properties, which ones are included in a set of minimal properties. This list shows the types of product data that are reported to McAfee epo Cloud by the McAfee Agent software installed on your system. If you find errors in the reported values, review the details of your products before concluding that they are incorrectly reported. Agent Install Time Agent GUID Agent-Server Secure Communication Key Hash Agent-to-Server Communication Interval Cluster Node Cluster Service State Cluster Name Cluster Host Cluster Member Nodes Cluster Quorum Resource Path Cluster IP Address Force Automatic Reboot After Installed Path Language Last Policy Enforcement Status Last Property Collection Status Peer-to-Peer Peer-to-Peer Repository Directory Prompt User When a Reboot is Required Policy Enforcement Interval Product Version Plugin Version RelayServer Show McAfee Tray Icon SMBiosUUID UserProperty1 8 Processes used by McAfee Agent 5.0.0 McAfee Agent provides options such as updating your DAT files, policy enforcement, scheduling tasks, and user interface for updates. This requires Windows processes or file systems. The table lists the processes used by McAfee Agent 5.0.0. Table 1-1 Processes used by McAfee Agent 5.0.0 Windows Process/ Application Service name Service display name masvc.exe masvc McAfee Agent Service macmnsvc.exe macmnsvc McAfee Agent Common Services macompatsvc.exe McAfeeFramework McAfee Agent Backwards Compatibility Service Description Performs functions such as property collection, policy enforcement, scheduling of tasks, agent-server communication, and trigger update session. Hosts multiple McAfee Agent services such as peer-to-peer server, wake-up, and RelayServer. This executable is the compatibility service for the McAfee Agent service. McAfee Agent service starts this service and communicates to the managed product plug-ins. 6 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

Working with McAfee Agent from McAfee epo Processes used by McAfee Agent 5.0.0 1 Table 1-1 Processes used by McAfee Agent 5.0.0 (continued) Windows Process/ Application Service name Service display name Description cmdagent.exe N/A N/A This is a command-line program that invokes McAfee Agent. To know more about switches available with this command, use cmdagent.exe -h FrmInst.exe N/A N/A McAfee Agent installation program. To know more about switches available with this command, use FrmInst.exe /? maconfig.exe N/A N/A This is a command-line program used to configure different options of McAfee Agent To know more about switches available with this command, use maconfig help McScanCheck.exe N/A N/A Command-line program used by McScript_InUse.exe to perform DAT or engine updates. McScript_InUse.exe N/A N/A Runs scripts for updating DAT files, engines, service packs, or any other component checked in to a repository. This process loads when update task is started. UpdaterUI.exe N/A N/A Provides user interface for updates. It also controls the McAfee Agent icon in the system tray and is loaded using the Run key in the Windows registry. mctray.exe N/A N/A System tray icon management tool. It runs under the same user session and is started by UdaterUI.exe. McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 7

1 Working with McAfee Agent from McAfee epo Processes used by McAfee Agent 5.0.0 8 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

2 Interface Reference Contents Agent Deployment URL McAfee Agent Properties page Client Task Catalog pages Policy Catalog pages Agent Deployment URL Specify a customized URL for clients to download and install the McAfee Agent. Table 2-1 definitions Agent Deployment URL The custom URL used to download the McAfee Agent installer. Copy the URL and share it with managed system users for manual installation. McAfee Agent Properties page View the information related to the system and applications installed on managed systems. Table 2-2 definitions Agent Install Time Agent GUID Agent-Server Secure Communication Key Hash Agent-to-Server Communication Interval Cluster Node Cluster Service State Cluster Name Cluster Host Cluster Member Nodes Cluster Quorum Resource Path The time at which the agent is installed. The GUID used by McAfee Agent for secure agent-server communication. The key hash for secure agent-server communication. Specifies how often, in minutes, McAfee Agent calls into the server. McAfee Agent calls into the server at the end of each interval, sending properties and events to the server and collecting any policy changes. Specifies if the client system is a cluster setup. Specifies whether the cluster service has started, stopped, or is in any other state. The name of the cluster. The IP address of the client system that acts as a host for the cluster. The IP address or name of the client system included in the cluster. The path of the client system that runs continuously to keep the cluster active. McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 9

2 Interface Reference Client Task Catalog pages Table 2-2 definitions (continued) Cluster IP Address Force Automatic Reboot After Installed Path Language Last Policy Enforcement Status Last Property Collection Status Peer-to-Peer Peer-to-Peer Repository Directory Plugin Version Policy Enforcement Interval Product Version Prompt User When a Reboot is Required RelayServer Run Now Supported Show McAfee Tray Icon SMBiosUUID UserProperty1 8 The IP address of the cluster. Specifies whether the managed system is forced to reboot once the specified time, in seconds, has elapsed after the installation finishes. The path where the agent is installed. The language used by McAfee Agent. The status of the last policy enforcement on the client system. The status of the last McAfee Agent property collection from the client system. Specifies if the peer-to-peer client and server are enabled. Specifies the path of the folder on the peer-to-peer server system allocated for caching the updates. The plug-in version of McAfee Agent. Specifies how often, in minutes, McAfee Agent enforces product policies on the managed system. The version of McAfee Agent. Specifies whether the user of a managed system is prompted to reboot the system after a software installation that requires a reboot of the system. Specifies if the relay capability is enabled on McAfee Agent. Specifies whether Run Client Task Now is supported on the client system. Specifies whether the McAfee icon appears in the system tray of the managed system. The unique ID for the System Management BIOS. The number of custom properties available that are used for tagging, queries, and quick find features. Client Task Catalog pages Contents Product Deployment page Product Update page McAfee Agent Statistics page Custom Properties page Product Deployment page Define the deployment tasks for installing products on managed systems. Product packages must be checked in before deploying them. Table 2-3 definitions Task Name Description Target platforms Name of the task. An optional description of the purpose of the task. All platforms where these packages are deployed. 10 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

Interface Reference Client Task Catalog pages 2 Table 2-3 definitions (continued) Products and components Select the products and components to deploy when this task runs. If you do not see the product you want to deploy listed here, you must first check in that product s software package. Select Add (+) or Delete (-) to add or delete products from the list. For each product: Specify the Action, Language, and Branch. ally, specify command-line update options by typing the required command in Command-line. s "Postpone Deployment" dialog box (Windows systems only) Select Run at every policy enforcement to ensure the deployment occurs again at the policy enforcement interval if a user has removed the product or component. Select Allow end users to postpone this update to give the user the option to postpone the update. For example, if users are in the middle of an important task, they can postpone the update to finish the task, or at least close any open applications. Maximum number of postpones allowed Specifies the number of times a user can postpone the update. Defaults to 1. to postpone expires after (seconds) Specifies how long the option to postpone exists. Once this threshold is passed, the update begins. Defaults to 20 seconds. Display this text Specifies a message displayed in the Postpone Update dialog box. Product Update page Configure how the agent updates packages, signatures, and engines on managed systems. Table 2-4 definitions Task Name Description "Update in Progress" dialog box (Windows systems only) Name of the task. An optional description of the purpose of the task. Show "Update in Progress" dialog box on managed systems Select to display a dialog box informing the user an update is taking place. Allow end users to postpone this update Select to give the user the option to postpone the update. For example, if users are in the middle of an important task, they can postpone the update to finish the task, or at least close any open applications. Maximum number of postpones allowed Specifies the number of times a user can postpone the update. Defaults to 1. to postpone expires after (seconds) Specifies how long the option to postpone exists. Once this threshold is passed, the update begins. Defaults to 20 seconds. Display this text Specifies a message displayed in the Postpone Update dialog box. McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 11

2 Interface Reference Client Task Catalog pages Table 2-4 definitions (continued) Package Selection Package types Specifies which update package types are deployed when this task runs. All packages Select to update all package types listed on the page from the Master Repository. Selected packages Allows you to select the specific package types that you want updated from the Master Repository. Signatures and engines Select the signatures and engines you want to update. Patches and service packs Select the items you want to update. McAfee Agent Statistics page Collect RelayServer statistics and network bandwidth saved by Peer-to-Peer communication. Table 2-5 definitions Task Name Description Statistics s Specifies the name of the client task. Specifies any description for the client task. RelayServer Statistics Collects these statistics from the client systems: Number of failed connections to the RelayServer Number of attempts made to connect to the RelayServer after the maximum allowed connections Peer-to-Peer Statistics Collects the network bandwidth saved by use of Peer-to-Peer communication. Custom Properties page Configure the level of access control that you need on the client system. Table 2-6 definitions Task Name Description Custom Properties Type a name for the task. An optional description of the purpose of the task. Set Values Enable or disable setting custom property value through a task. Custom Property (1 8) Custom Properties keys available for the policy. Overwrite client system values If enabled, a new value overwrites the existing value regardless of the value set on the client system. If disabled, and the property is empty on the client system, a new value is set. Value A new value that needs to be set on the client system. Grant one-time edit permission Enable or disable McAfee epo Cloud administrator to grant one-time edit permission through a task. One-time edit permission Grant one-time permission for system administrators to edit a particular custom property on the client system. 12 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

Interface Reference Policy Catalog pages 2 Policy Catalog pages Contents General tab SuperAgent tab Events tab Logging tab Updates tab Peer-to-Peer tab Proxy tab Troubleshooting tab Custom Properties tab McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 13

2 Interface Reference Policy Catalog pages General tab Change the basic settings related to policy enforcement, server communication, and administrator tasks. Table 2-7 definitions General options Policy enforcement interval (minutes) Specifies how often McAfee Agent enforces policies on the managed system. Because policy enforcement occurs on the managed system, network traffic is not impacted by the frequency of the policy enforcement interval. Show the McAfee system tray icon (Windows only) Specifies whether the McAfee icon appears in the system tray of the managed system. Allow end users to update security from the McAfee system tray menu Allows the end user to use the McAfee Agent tray icon to trigger all updates from the repository defined in McAfee Agent policy. This feature is available if you are running McAfee Agent 4.5 or later. Enable McAfee system tray icon in a remote desktop session Allows the end user to enable McAfee system tray icon in a remote desktop session. Run agent processes at lower CPU priority (Windows only) Allows McAfee Agent to run at a lower priority, thus having less impact on system performance. This option lowers the priority of the macompatsvc.exe and McScript_InUse.exe processes only. Enable self protection Restricts client system users or software from changing McAfee Agent processes, services, and registry keys. This is supported only on Windows client systems. Enable msgbus authentication using test certificates Allows certified third-party software to communicate with McAfee Agent. Reboot options after product deployment (Windows only) Agent-server communication Prompt user when a reboot is required Specifies whether the user of a managed system should be prompted to reboot the system after a software installation that requires a reboot of the system. When using McAfee epo Cloud to deploy and install products on systems, the installation occurs silently, without user interaction. Selecting this allows the user to reboot after such an installation. Force automatic reboot after (seconds) Specifies the interval after which the managed system is forced to reboot, after the installation finishes. Enable agent-to-server communication Enables agent-server communication. Do not disable this without a specific and needed reason as systems with agent-server communication are only updated manually. Agent-to-server communication interval (minutes) Specifies how often, in minutes, McAfee Agent calls into the server. McAfee Agent calls into the server at the end of each interval, sending properties and events to the server and collecting any policy changes. The occurrence of the first communication session is randomized to reduce bandwidth and resource impact. Initiate agent-to-server communication within 10 minutes after startup if policies are older than (days) Specifies a threshold, in days, for out-dated policies. McAfee Agent with policies older 14 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

Interface Reference Policy Catalog pages 2 Table 2-7 definitions (continued) than the specified threshold calls into the server every 10 minutes until policies are up to date. Retrieve all system and product properties (recommended). If unchecked retrieve only a subset of properties. McAfee Agent receives full properties to the server at each ASCI. If deselected, retrieve only a subset of properties. Reduced property collection is only supported by some products. SuperAgent tab Enable and customize RelayServer as required in your network environment. Table 2-8 definitions Relay Client options RelayServer options Enable Relay Communication Enables McAfee Agent to discover RelayServer in the network. Disable Discovery Stops broadcasting messages to discover McAfee Agent with relay capabilities in its network. IP Address/Host Name : Port Specifies the RelayServer IP address (or Host name) and port number through which the agent communicates with McAfee epo Cloud in the network. Enable RelayServer Enables McAfee epo Cloud to bridge communication between McAfee epo Cloud and the McAfee epo Cloud server when McAfee epo Cloud can't directly contact McAfee epo Cloud server due to network limitations. Service Manager port (RelayServer) Specifies the port number through which the RelayServer communicates in your network. This communication port is used by previous versions of McAfee Agent RelayServers. Events tab Configure how and when the agent sends priority events to McAfee epo Cloud. Event priority is predefined by the installed product. Table 2-9 definitions Enable priority event forwarding Forwards priority events (according to user-selected level of priority) immediately. Other events are sent at the scheduled agent-server communication interval. Forward events with a priority equal or greater than Specify the priority of events to be forwarded immediately. Set this to send only what you consider the most important events to reduce network traffic. Interval between uploads (minutes) Specifies the interval at which priority event uploads are forwarded to the server after the first upload. Non-priority events (such as those reporting DAT updates) are sent at the next agent-server communication. Maximum number of events per upload Specifies the maximum number of individual events allowed in each upload. Priority events that exceed this number are not forwarded until the next upload. McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 15

2 Interface Reference Policy Catalog pages Logging tab Change the settings for creating and accessing activity logs on managed systems. Table 2-10 definitions Application logging Enable application logging Allows McAfee Agent to record its activities in the log files (enabled by default). McAfee recommends that you enable this log file. Enable detailed logging Enables the detailed McAfee Agent log. This log file can grow large. McAfee recommends enabling this log file only when you are troubleshooting issues. Log file size limit (MB) Specifies a limit on the size of the log file. Once the log file size reaches the specified limit, the log content is backed up in a file <service name>_backup<n>.log. McAfee Agent continues to record the new log content in the same file until it reaches the specified limit. Default value is 2 MB Roll over count Specifies the number of backup files that McAfee Agent can create for logs. Default value is 1-log file. Updates tab Configure the options for updating signatures, engines, patches, and service packs. Table 2-11 definitions Product update log file Post-update options DAT file downgrades Specifies the location for the user update log file. This file logs update activity. Specifies the path to any executable you want to run on managed systems after updates are performed. Scripts can be run, but applications cannot be run interactively. Select Run only after successful updates to prevent the specified executable or script from running if an update fails. Allows the agent to update with DAT files from the repository when the DAT files are older than those already installed on the managed system. If a new DAT file causes issues in your environment, this feature allows you to roll back to a previous DAT file version. To install a previous DAT file version, select this option, apply the policy change, and distribute the previous version of the DAT file. When you are done, deselect this option to prevent unwanted downgrading to older DATs in the future. 16 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

Interface Reference Policy Catalog pages 2 Table 2-11 definitions (continued) Update options Update type and Repository branch to use Allows the end user to perform updates post deployment of products. This policy is enabled by default. Automatic updates happen as usual, post deployment. Allows you to select the update type and repository branch. The selected update type is considered only when you: Enable Update options to perform updates post deployment of McAfee products. Run Update Security using the system tray icon. When you run update tasks such as Update Now, Run Client Task Now, and Scheduled Update from McAfee epo Cloud, the selected packages on its page are only considered superseding the selected update type on the Update policy page. By default, updating occurs from the Current branch. If you are using the Previous or Evaluation repository branches to test new DAT files and engine updates, specify the repository branch from which the agent updates. If DAT file downgrades is enabled, you can cause a DAT rollback by changing repository branches. The ability to deploy patches and service packs from the Evaluation or Previous repositories is designed to allow update testing on a limited subset of systems before doing a broader deployment. McAfee recommends moving approved patches and service packs to the Current repository when they are ready for general deployment. Peer-to-Peer tab Enable the agent to download updates from peer agents in the same subnet. Table 2-12 definitions Peer-to-Peer s Enable Peer-to-Peer Communication Allows the McAfee Agent to discover the peer-to-peer servers in the subnet. Enable Peer-to-Peer Serving Enables McAfee Agent to serve content updates to peer a McAfee Agent. Repository path (Windows) Specifies the path of the folder on the peer-to-peer Windows Server system allocated for caching the updates. Default path is <Agent data path>\data\mcafeep2p Repository path (Unix) Specifies the path of the folder on the peer-to-peer server system allocated for caching the updates. The path is applicable to client systems that follow UNIX file path (for example, Linux, Macintosh, or UNIX systems). Default path is <Agent data path>/data/mcafeep2p Max disk quota (MB) Specifies the disk space on the peer-to-peer server system allocated for caching the updates. The default disk space is 512 MB. Purge Interval (Days) Specifies how often updates cached in the local disk are purged. Default value is 30 days. McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 17

2 Interface Reference Policy Catalog pages Proxy tab Configure the proxy server settings that the agent must use to retrieve updates from fallback repositories through a proxy server. definitions Do not use a proxy Use Internet Explorer settings (for Windows) / System Preferences settings (for Mac OSX) Manually configure the proxy settings Specifies not to use any proxy settings. Choose this if systems do not access the Internet directly. This is the default setting. Specifies the proxy settings in Internet Explorer for Windows and System Preferences for Macintosh client systems. A user must be logged on to the server system for server tasks requiring proxy settings to run. If a user is not logged on to the system, the system cannot access the Internet. If appropriate, select Allow user to configure proxy settings. Specifies custom proxy settings. Provide the DNS Name or IPv4 or IPv6 address of the target. Use these settings for all proxy types Select this to use the specified settings for all proxy servers. Specify exceptions Specify update servers or subnets that aren t required to use the defined proxy settings. This exceptions list is limited to 4000 characters, and each item is limited to 255 characters. Use HTTP proxy authentication Select this and provide the logon credentials for the proxy server. Use FTP proxy authentication Select this and provide the logon credentials for the proxy server. Troubleshooting tab Configure the language to be used by the agent on a client system for both the user interface and log file entries. Table 2-13 definitions Language options Select language used by agent: If selected, activates a drop-down list with all languages supported by the agent. If not selected, the agent uses the UI Default Language. The UI Default Language is the default language for the user that installed the agent on that client system. This feature is only supported for agents on Windows and Mac OS X platforms. Some log entries are displayed in English, regardless of this language setting, to help McAfee in diagnosing customer issues. 18 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

Interface Reference Policy Catalog pages 2 Custom Properties tab Set custom properties on the client system. Table 2-14 definitions End user access to Custom Properties Custom Properties (1 8) Custom Properties keys available for the policy. Allow view Enable or disable system administrators to view a particular custom property. Allow edit Enable or disable system administrators to edit a particular custom property. McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 19

2 Interface Reference Policy Catalog pages 20 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide

Index P properties product 5 properties (continued) system 5 McAfee Agent 5.5.0 Interface Reference Guide Reference Guide 21

0-00