McAfee Total Protection for Endpoint

Lab Evaluation Guide

COPYRIGHT

Copyright © 2009 McAfee, Inc. All Rights Reserved.

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form

or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE

EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN,

WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH

TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS

THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,

A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU

DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN

THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

License Attributions

Refer to the product Release Notes.

McAfee Total Protection for Endpoint Lab Evaluation Guide2

Contents

Logging on to ePolicy Orchestrator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Set Up the ePolicy Orchestrator Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Add Systems to Manage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Setting Policies for Endpoints. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Setting Policies for Email Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Set Tasks for Endpoints. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Deploy the McAfee Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Using Dashboards and Queries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

3McAfee Total Protection for Endpoint Lab Evaluation Guide

defense against the threats that businesses know about, and the threats they can't see coming.

This guide is organized so you can evaluate McAfee Total Protection for Endpoint in a pilot

environment consisting of one ePolicy Orchestrator

computers. The guide covers the basic steps required to install ePolicy Orchestrator quickly,

configure basic policies and tasks, and deploy these McAfee products for client protection:

• VirusScan

• AntiSpyware Enterprise 8.7

• Host Intrusion Prevention 7.0

every possible deployment scenario, nor examine every feature. For complete information on

all aspects of the products included in Total Protection for Endpoint, see their respective product

guides.

Full product documentation is available on the McAfee KnowledgeBase.

Under Self Service, click Product Documentation, choose a product and version, then

choose a document.

Product descriptions

The products in Total Protection for Endpoint are grouped into these categories:

• Management solution

• Endpoint protection

against malicious threats and attacks. ePolicy Orchestrator combines

unmatched global policy control with a single agent and a central console

with custom reporting to easily manage your system security

environment.

McAfee Total Protection for Endpoint Lab Evaluation Guide4

DescriptionProduct

McAfee Agent is the client-side framework that supports the McAfee

security management infrastructure. It provides secure communication

McAfee Agent 4.5

between point-products and ePolicy Orchestrator, and local services to

point-products. As a framework, the McAfee Agent enables

point-products to focus on enforcing their policies, while delivering an

advanced, proactive protection for PCs and servers. Businesses rely on

the key features of VirusScan Enterprise during an outbreak, including:

cleaning memory, rootkits, the registry and files, as well as preventing

propagation of malicious code to other systems. VirusScan Enterprise

also contains functionality from anti-virus, intrusion prevention, and

firewalls for protection from known and unknown attacks.

AntiSpyware Enterprise Module, the leading enterprise anti-spyware

software solution, uses true on-access scanning to identify, proactively

McAfee AntiSpyware Enterprise 8.7

block, and safely eliminate potentially unwanted programs (PUPs) for

your assets improves the availability, confidentiality, and integrity of

your business processes. A single agent makes it easy to deploy,

configure, and manage, and patching becomes less frequent and less

urgent.

SiteAdvisor Enterprise Plus allows your employees to surf and search

the web safely as threats like spyware, adware, phishing scams, and

McAfee SiteAdvisor

®

Enterprise Plus 3.0

more are blocked. Integrated into McAfee solutions, SiteAdvisor

Enterprise technology adds web security to your comprehensive

protection, guiding and shielding users from online threats.

scans for viruses, automatically manages outbreaks, and prevents

malicious code from disrupting your systems. The GroupShield content

filter blocks or quarantines messages that contain specific words and

phrases that violate content rules.

McAfee Security for Lotus Domino protects your email and other

documents as they enter and leave your Domino server. McAfee

McAfee Security for Lotus Domino, v7.5 on

Windows

Security for Lotus Domino proactively scans for viruses, automatically

manages outbreaks, and prevents malicious code from disrupting your

systems. The McAfee Security for Lotus Domino content filter blocks

or quarantines messages that contain specific words and phrases that

5McAfee Total Protection for Endpoint Lab Evaluation Guide

DescriptionProduct

Security for Lotus Domino to reduce resource usage on your busy mail

servers.

When you are ready to deploy products to your environment, like VirusScan Enterprise or Host

Intrusion Prevention, you will use ePolicy Orchestrator and the McAfee Agent to handle the

deployment and updates. McAfee recommends that you use the workflow in the following

sections to get started with the solution.

McAfee Total Protection for Endpoint Lab Evaluation Guide6

Before setting up McAfee Total Protection for Endpoint software, verify that each component

meets the minimum system requirements that are listed below:

• Server

• Database

7McAfee Total Protection for Endpoint Lab Evaluation Guide

McAfee Total Protection for Endpoint Lab Evaluation Guide8

Firefox 3.0

Redistributable

9McAfee Total Protection for Endpoint Lab Evaluation Guide

for client systems on your network, you must add those systems to your System Tree.

There are several methods of organizing and populating the System Tree:

The workflow in this section uses the manual approach to create a simple structure for evaluation.

a useful way to add a small number of systems in your test network. You can try the other

approaches once you become familiar with ePolicy Orchestrator.

Creating your System Tree groups

Use this task to add groups to your System Tree. For this exercise, we are creating two groups,

and

.

1 Click Menu | Systems | System Tree, then click Group Details on the menu bar.

2 Highlight My Organization, then click New Subgroup.

3 Type Test Group, then click OK. The new group appears in the System Tree.

4 Highlight Test Group, click New Subgroup, type Servers, and click OK.

page, highlight Test Group. Your Servers and Workstations groups are listed on the Group

2 For How to Add Systems, select Add systems to the current group, but do not

deploy agents.

3 For Systems to Add, type the NetBIOS name for each system in the text box, separated

by commas, spaces, or line breaks. You can also click Browse to select systems.

4 Verify that System Tree sorting is disabled.

McAfee Total Protection for Endpoint Lab Evaluation Guide16

Organizing new systems into your groups

By performing the tasks in the previous sections, you now have several groups and systems in

your System Tree. In a live production environment, new systems contact the ePolicy

Orchestrator server, and need to be placed in the System Tree. This occurs if you installed the

McAfee Agent on new systems, through use of Rogue System Detection, or through another

ePolicy Orchestrator has a powerful group sorting function that allows you to set up rules about

how systems sort themselves into your System Tree when they first contact the ePO server.

1 Click Menu | Systems | System Tree, then click Group Details on the menu bar.

2 Highlight Test Group.

3 At the top of the Group page, locate the label Sorting Criteria and click Edit.

4 Select Systems that match any of the criteria below (IP addresses and/or tags).

The page expands with additional options.

5 Click Add Tag.

6 From the drop-down menu, select Server, click the plus sign (+), then select Workstation.

7 Click Save.

8 In the System Tree, highlight My Organization.

9 In the Sorting Order list, find the entry for Test Group. In the Actions column, click

17McAfee Total Protection for Endpoint Lab Evaluation Guide

policies based on the role or function of systems.

you will know how to make policies specific to your environment.

If you install all products in Total Protection for Endpoint, McAfee recommends that you perform

the ePO Server. It is also possible to remotely see a client’s Agent log through your browser.

ePolicy Orchestrator every 180 minutes, which is eight times a day rather than the default of

24. For this case, you might create a policy called "Low bandwidth" or "3 hour polling" and

McAfee Total Protection for Endpoint Lab Evaluation Guide18

NOTE: To view the Agent Log on a remote system, using a web-browser type: http://<computer

8 Make sure the Settings for option is set to Workstation.

9 For User interface password, select Password protection for all items listed.

10 Type a password in the boxes provided, then click Save.

Creating file exclusions on a server

19McAfee Total Protection for Endpoint Lab Evaluation Guide

McAfee Total Protection for Endpoint Lab Evaluation Guide20