Symantec Mail Security for Microsoft Exchange Server 2007/Server 2010

Transcription

1 Symantec Mail Security for Microsoft Exchange Server 2007/Server 2010 Implementation Guide v7.0

2 Symantec Mail Security for Microsoft Exchange Implementation Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version 7.0 Legal Notice Copyright 2012 Symantec Corporation. All rights reserved. Federal acquisitions: Commercial Software - Government Users Subject to Standard License Terms and Conditions. Symantec, the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be "commercial computer software" and "commercial computer software documentation" as defined in FAR Sections and DFARS Section Symantec Corporation 350 Ellis Street Mountain View CA USA

3 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product feature and function, installation, and configuration. The Technical Support group also authors content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s maintenance offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization A telephone and web-based support that provides rapid response and up-to-the-minute information Upgrade insurance that delivers automatic software upgrade protection Global support that is available 24 hours a day, 7 days a week worldwide. Support is provided in a variety of languages for those customers that are enrolled in the Platinum Support program Advanced features, including Technical Account Management For information about Symantec s Maintenance Programs, you can visit our Web site at the following URL: Select your country or language under Global Support. The specific features that are available may vary based on the level of maintenance that was purchased and the specific product that you are using. Customers with a current maintenance agreement may access Technical Support information at the following URL: Select your region or language under Global Support. Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to recreate the problem.

4 When you contact Technical Support, please have the following information available: Product release level Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Select your region or language under Global Support, and then select the Licensing and Registration page. Customer service information is available at the following URL: Select your country or language under Global Support. Customer Service is available to assist with the following types of issues: Questions regarding product licensing or serialization Product registration updates such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade insurance and maintenance contracts Information about the Symantec Value License Program

5 Advice about Symantec's technical support options Nontechnical presales questions Maintenance agreement resources Additional Enterprise services Issues that are related to CD-ROMs or manuals If you want to contact Symantec regarding an existing maintenance agreement, please contact the maintenance agreement administration team for your region as follows: Asia-Pacific and Japan: Europe, Middle-East, and Africa: North America and Latin America: Symantec offers a comprehensive set of services that allow you to maximize your investment in Symantec products and to develop your knowledge, expertise, and global insight, which enable you to manage your business risks proactively. Enterprise services that are available include the following: Symantec Early Warning Solutions Managed Security Services Consulting Services Educational Services These solutions provide early warning of cyber attacks, comprehensive threat analysis, and countermeasures to prevent attacks before they occur. These services remove the burden of managing and monitoring security devices and events, ensuring rapid response to real threats. Symantec Consulting Services provide on-site technical expertise from Symantec and its trusted partners. Symantec Consulting Services offer a variety of prepackaged and customizable options that include assessment, design, implementation, monitoring and management capabilities, each focused on establishing and maintaining the integrity and availability of your IT resources. Educational Services provide a full array of technical training, security education, security certification, and awareness communication programs.

6 To access more information about Enterprise services, please visit our Web site at the following URL: Select your country or language from the site index.

7 Contents Technical Support... 3 Chapter 1 Chapter 2 Introducing Symantec Mail Security for Microsoft Exchange About Symantec Mail Security for Microsoft Exchange Server 2007/Server What's new in Mail Security Components of Mail Security How Mail Security works What you can do with Mail Security Where to get more information about Mail Security Installing Symantec Mail Security for Microsoft Exchange Before you install Software component locations About security and access permissions System requirements Server system requirements Console system requirements Port requirements Installation options Installing Mail Security on a local server Installing the Mail Security console About installing Mail Security on remote servers Silently installing Mail Security using an automated installation tool About installing Mail Security in a Microsoft Cluster About installing Mail Security on a Veritas Cluster Server Post-installation tasks Implementing SSL communications Accessing the Mail Security console About using Mail Security with other antivirus products Configuring Mail Security transport agents Setting scanning threads and number of scan processes... 64

8 8 Contents Uninstalling Mail Security Removing the Mail Security resource instance from the Veritas Cluster Server Chapter 3 Activating licenses About licensing About activating the Mail Security license About the Mail Security license serial number Obtaining a license file Installing license files About renewing the Mail Security license Chapter 4 Managing your Exchange servers About managing your Exchange servers Deploying settings and changes to a server or group How to manage servers and server groups Logging onto servers Configuring Symantec Mail Security for Exchange 2010 on DAG setup Modifying or viewing server or server group settings Viewing the status of a server Creating a user-defined server group Adding servers to a group Moving a server to another user-defined server group Synchronizing group settings to a server Restoring default settings to a server or group Removing a server from group management Removing a server group Exporting and importing settings Modifying the port and communication properties of a server Creating and assigning a custom throttling policy to the Mail Security service account user Chapter 5 Quarantining messages and attachments About the quarantine Forwarding quarantined items to the Quarantine Server Establishing local quarantine thresholds Viewing the contents of the local quarantine Specifying an action to take when a quarantine threshold is met About releasing messages from the local quarantine... 96

9 Contents 9 Releasing messages from the local quarantine by Releasing messages from the local quarantine to a file Deleting items from the local quarantine Chapter 6 Protecting your server from risks About Mail Security policies About protecting your server from risks How Mail Security detects risks Configuring threat detection Configuring security risk detection Configuring file scanning limits Configuring rules to address unscannable and encrypted files Chapter 7 Identifying spam About spam detection How Mail Security detects and processes spam Configuring whitelists How to detect spam using Symantec Premium AntiSpam About registering Symantec Premium AntiSpam through an ISA server Configuring your proxy server to download spam definition updates Configuring Symantec Premium AntiSpam to detect spam Processing suspected spam messages Processing suspected spam messages that exceed a SCL threshold Processing spam messages About applying X-headers to messages for archiving Chapter 8 Filtering content About filtering content About default content filtering rules About creating a content filtering rule Configuring the conditions of a content filtering rule Specifying the users and groups to which the rule applies Specifying who to notify if a content filtering rule is violated Configuring rule actions What you can do with content filtering rules Enabling or disabling content filtering for auto-protect scanning

10 10 Contents Prioritizing content filtering rules Deleting a content filtering rule Specifying inbound SMTP domains Refreshing the Active Directory group cache How to enforce attachment policies Blocking attachments by file name Configuring multimedia file detection Configuring executable file detection About match lists Creating or editing a match list Deleting a match list About DOS wildcard style expressions About regular expressions About content filtering policy templates Editing a content filtering policy template Chapter 9 Scanning your Exchange servers for threats and violations About the types of scanning that you can perform How Mail Security scans messages on Exchange Server 2007/2010 roles How Mail Security offloads Mailbox server scanning for Exchange Server 2007/ How Mail Security optimizes scanning performance for Exchange Server 2007/ Configuring auto-protect scanning Configuring background scanning Configuring advanced scanning options for auto-protect and background scanning About manual scans Configuring the manual scan parameters Performing a manual scan Stopping manual scans Viewing manual scan results About scheduling a scan Creating a scheduled scan Editing a scheduled scan Configuring scheduled scan options Enabling a scheduled scan Deleting a scheduled scan Configuring notification settings for scan violations

11 Contents 11 Chapter 10 Managing outbreaks About outbreak management About the criteria that defines an outbreak About outbreak triggers Best practices for managing outbreak conditions Enabling outbreak management Configuring outbreak triggers Configuring outbreak notifications Clearing outbreak notifications Chapter 11 Logging events and generating reports About logging events Viewing the Mail Security Event log Specifying the duration for storing data in the Reports database Purging the Reports database About logging performance counters to the MMC Performance console About generating reports About report templates About report output formats Creating or modifying a Summary report template Creating or modifying a Detailed report template Deleting a report template What you can do with reports Configuring the initial set up of the report consolidation feature Generating a consolidated report Generating a report on demand Accessing a report Printing a report Saving report data Deleting a report Resetting statistics Chapter 12 Keeping your product up to date Monitoring your version support status About keeping your server protected About setting up your own LiveUpdate server Configuring a proxy server to permit LiveUpdate definitions

12 12 Contents How to update definitions Updating definitions on demand Scheduling definition updates About enhancing performance when updating definitions Distributing definitions to multiple servers About alert notifications for out-of-date virus definitions Appendix A Using variables to customize alerts and notifications Alert and notification variables Appendix B Troubleshooting Why a file triggers the Unscannable File Rule Reducing the incidence of malformed MIME false positives Common error messages Resolving installation issues Resolving scanning issues About the Symantec Diagnostic and Product Advisor utility Index

13 Chapter 1 Introducing Symantec Mail Security for Microsoft Exchange This chapter includes the following topics: About Symantec Mail Security for Microsoft Exchange Server 2007/Server 2010 What's new in Mail Security Components of Mail Security How Mail Security works What you can do with Mail Security Where to get more information about Mail Security About Symantec Mail Security for Microsoft Exchange Server 2007/Server 2010 Symantec Mail Security for Microsoft Exchange Server 2007/Server 2010 (Mail Security) provides a complete, customizable, and scalable solution that scans the s that transit or reside on the Microsoft Exchange Server. Mail Security protects your Exchange server from the following: Threats (such as viruses, Trojan horses, worms, and denial-of-service attacks) Security risks (such as adware and spyware) Unwanted content

14 14 Introducing Symantec Mail Security for Microsoft Exchange What's new in Mail Security Unwanted file attachments Unsolicited messages (spam) Mail Security also lets you manage the protection of one or more Exchange servers from a single console. See What you can do with Mail Security on page 19. The Exchange environment is only one avenue by which a threat or a security risk can penetrate a network. For complete protection, ensure that you protect every computer and workstation by an antivirus solution. See About using Mail Security with other antivirus products on page 61. What's new in Mail Security Table 1-1 lists the new and the enhanced features in Mail Security. Table 1-1 Feature New and enhanced features Description Content filtering policy templates Mail Security provides some predefined content filtering policy templates that you can use to create enhanced content filtering rules. These templates are a combination of match lists. See About content filtering policy templates on page 180. Quarantine entire message and replace with text Mail Security provides the Quarantine entire message and replace with text option for processing the messages that trigger any policy rule violation. However, Mail Security does not support the Quarantine entire message and replace with text action for Auto-Protect, Manual, Scheduled, or Background scanning. If a violation is detected during these scans, Mail Security quarantines the message by parts although you specify the action as Quarantine entire message and replace with text for a policy.

15 Introducing Symantec Mail Security for Microsoft Exchange What's new in Mail Security 15 Table 1-1 Feature New and enhanced features (continued) Description Enhancement in Alert and Notification Mail Security 7.0 sends an notification to an administrator when manual or scheduled scan failure occurs. Mail Security 7.0 sends notifications to an administrator 60, 30, and 10 days before expiration of Antivirus and Symantec Premium AntiSpam licenses. In earlier version of Mail Security, an administrator would receive an notification from Mail Security only once i.e. 60 days before license expiration. Performance improvement in manual or scheduled scans Enhancement in content filtering Performance improvement in content filtering Continuous protection scheduled scan The manual or scheduled scan performance is improved with the implementation of multithreaded scanning. The scanning time that is required for manual or scheduled scan is now reduced. In Mail Security 7.0, you do not need to create multiple content filtering rules to scan different parts in a message. You can create a single content filtering rule to scan all message parts. The content filtering performance is improved in terms of CPU utilization and the overall response time that is required to run the requested commands. This improvement is visible for all types of content scanning. This feature is applicable only for Exchange Server VSAPI is removed from Exchange Server Therefore, Mail Security provides an alternate solution for continuous protection in the form of a scheduled scan. Advanced heuristics Mail Security provides an advanced heuristics-based detection for enhanced antivirus effectiveness.

16 16 Introducing Symantec Mail Security for Microsoft Exchange Components of Mail Security Table 1-1 Feature New and enhanced features (continued) Description Addition of a Global Group for Exchange Server 2013 Support for Microsoft System Center Operations Manager 2007 R2 (SCOM) Global Group consists of all the servers that are managed through Mail Security console. When you configure and apply Global Group settings, the changes are propagated to all the servers in all the groups. Changes that are made at the Global Group level overwrite group settings of all individual and user-defined servers. Mail Security for Microsoft Exchange Management Pack lets you integrate Symantec Mail Security for Microsoft Exchange events with SCOM 2007 R2. Preconfigured Computer Groups, Rule Groups, and Providers are automatically created when you import the management pack. These rules monitor specific Symantec Mail Security for Microsoft Exchange events in the Windows event log and the Windows Performance Monitor. For more information, see the Symantec Mail Security for Microsoft Exchange Management Pack. Note: Mail Security 7.0 does not support Windows 2000/2003 (32-bit), Exchange Server 2000, and Exchange Server Components of Mail Security Table 1-2 lists the components of Mail Security.

17 Introducing Symantec Mail Security for Microsoft Exchange Components of Mail Security 17 Table 1-2 Component Product components Description Location on the product CD Symantec Mail Security for Microsoft Exchange LiveUpdate Administration Utility This software protects your Exchange servers from threats (such as viruses and denial-of-service attacks), security risks (such as adware and spyware). It also detects spam messages and unwanted attachments. This utility lets you configure one or more intranet FTP, HTTP, or LAN servers to act as internal LiveUpdate servers. LiveUpdate lets Symantec products download program and definition file updates directly from Symantec or from a LiveUpdate server. For more information, see the LiveUpdate Administrator documentation on the Mail Security product CD in the following location: \DOCS\LUA\ \SMSMSE\Install\ \ADMTOOLS\LUA\

18 18 Introducing Symantec Mail Security for Microsoft Exchange Components of Mail Security Table 1-2 Component Symantec Central Quarantine Product components (continued) Description This utility lets Mail Security forward infected messages and messages that contain certain types of violations from the local quarantine to the Central Quarantine, which acts as a central repository. For more information, see the Symantec Central Quarantine Administrator's Guide on the Mail Security product CD in the following location: \DOCS\DIS\CentQuar.pdf Location on the product CD \ADMTOOLS\DIS Mail Security for Microsoft Exchange Management Pack This component lets you integrate Symantec Mail Security for Microsoft Exchange events with Microsoft System Center Operations Manager 2007 R2 (SCOM). Pre-configured Computer Groups, Rule Groups, and Providers are automatically created when you import the management pack. These rules monitor specific Symantec Mail Security for Microsoft Exchange events in the Windows Event Log and the Windows Performance Monitor. \ADMTOOLS\Mgmt_Pack For more information, see the Symantec Mail Security for Microsoft Exchange Management Pack.

19 Introducing Symantec Mail Security for Microsoft Exchange How Mail Security works 19 How Mail Security works Mail Security can scan messages and their attachments to detect the following: Risks Risks are comprised of threats and security risks Threats Threats include viruses, worms, and Trojan horses See Configuring threat detection on page 104. Security risks Security risks include adware, spyware, and malware See Configuring security risk detection on page 107. Spam See About spam detection on page attachment violations Content filtering rule violations See About filtering content on page 133. Mail Security takes the actions that you specify in the respective policies when a violation is detected. See About Mail Security policies on page 101. Mail Security contains a decomposer that extracts container files so that they can be scanned. The decomposer continues to extract container files until it reaches the base file or until it reaches its extraction limit. If the decomposer reaches the set limit before the base file is reached, the scanning process stops. Mail Security then logs the violation to the specified logging destinations, and the file is handled according to Unscannable File Rule. See Configuring rules to address unscannable and encrypted files on page 111. What you can do with Mail Security Table 1-3 lists the tasks that you can perform with Mail Security.

20 20 Introducing Symantec Mail Security for Microsoft Exchange What you can do with Mail Security Table 1-3 Task What you can do with Mail Security Description Manage your Exchange environment by using policies You can configure Mail Security for Microsoft Exchange 2007/2010 to scan messages and their attachments for threats such as viruses, Trojan horses, adware, spyware, and spam. You can define policies to detect potential risks to your Microsoft Exchange system and process messages and attachments that contain threats. See About Mail Security policies on page 101. Scan your Exchange server for risks and violations You can keep your server protected by performing any of the following types of scans: Auto-Protect scans Manual scans Scheduled scans Background scans See About the types of scanning that you can perform on page 187. Protect against threats Symantec engineers track reported outbreaks of threats (such as viruses, Trojan horses, and worms) to identify new risks. After a threat is identified, information about the threat (a signature) is stored in a definition file. This file contains information to detect and eliminate the threat. When Mail Security scans for threats, it searches for these signatures. Definition files are downloaded using LiveUpdate or Rapid Release. See About keeping your server protected on page 248. Mail Security also uses Symantec Bloodhound heuristics technology to scan for threats for which no known definitions exist. Bloodhound heuristics technology scans for unusual behaviors such as self-replication to target potentially infected message bodies and attachments. See Configuring threat detection on page 104.

21 Introducing Symantec Mail Security for Microsoft Exchange What you can do with Mail Security 21 Table 1-3 Task What you can do with Mail Security (continued) Description Keep your protection up-to-date Mail Security relies on up-to-date information to detect and eliminate risks. One of the most common reasons computers are vulnerable to attacks is that definition files are out-of-date. Symantec regularly supplies updated definition files. Using LiveUpdate, Mail Security connects to a Symantec server over the Internet and automatically determines if definitions need to be updated. If they do, the definition files are downloaded to the proper location and installed. If you need a quicker response for emerging threats, you can enable Rapid Release to get the most current definitions that are available. See About keeping your server protected on page 248. See About using Mail Security with other antivirus products on page 61. Note: You must have a valid license to update definitions. See About licensing on page 67. Identify spam Spam is unsolicited bulk , which most often advertises messages for a product or service. It wastes productivity, time, and network bandwidth. Symantec Premium AntiSpam provides continuous updates to the premium antispam filters to ensures that your Exchange server has the most current spam detection filters. See How to detect spam using Symantec Premium AntiSpam on page 118. See Configuring whitelists on page 117. You must have a valid Symantec Premium AntiSpam license to enable Symantec Premium AntiSpam. See About licensing on page 67. Filter undesirable message content and attachments Mail Security lets you create the content filtering rules that you can use to filter messages and attachments. Mail Security provides some predefined file filtering rules that you can use to enforce attachment policies. Mail Security also uses match lists to filter messages and attachments for specific words, terms, and phrases. Mail Security also provides the predefined content filtering policy templates that help prevent data leakage. See About filtering content on page 133.

22 22 Introducing Symantec Mail Security for Microsoft Exchange What you can do with Mail Security Table 1-3 Task What you can do with Mail Security (continued) Description Apply X-headers to messages for archiving Mail Security provides default X-headers that you can apply to the messages that contain content filtering rule violations or are spam or suspected spam. You can modify the default X-headers, or you can create your own. See About applying X-headers to messages for archiving on page 130. Manage outbreaks An outbreak occurs when the number of threats to the Microsoft Exchange system that are detected over a period of time exceeds a specified limit. Mail Security lets you manage outbreaks quickly and effectively by setting outbreak rules and sending notifications when an outbreak is detected. You can also select an action to take when an outbreak is detected, such as the following: Delete the entire message. Delete the attachment or the message body. Quarantine entire message and replace with text. Quarantine the attachment or the message body. Log the event. Add Tag to the beginning of the subject line. You can set rules to define an outbreak based on event. For example, the same threat occurs a specified number of times within a specified time period. You can also configure Mail Security to send notifications and alerts in the case of an outbreak. See About outbreak management on page 213. Quarantine infected message bodies and attachments Mail Security for Microsoft Exchange includes a local quarantine that can store the infected message bodies and attachments that are detected during scans. You can configure Mail Security to quarantine threats and security risks, and file filtering violations in the local quarantine. The quarantined items that contain threats can be forwarded to the Symantec Central Quarantine, if it is installed. The Symantec Central Quarantine program is available on the Mail Security product CD. You can quarantine the entire message or by parts. See About the quarantine on page 91.

23 Introducing Symantec Mail Security for Microsoft Exchange What you can do with Mail Security 23 Table 1-3 Task What you can do with Mail Security (continued) Description Monitor Mail Security events Mail Security logs events to the Windows Application Event Log. You can view the events that are logged to the Windows Application Event Log from the console. See Viewing the Mail Security Event log on page 224. Mail Security logs extensive report data on threats, security risks, violations, spam, and server information to the reports database. You can use this data to generate summary or detailed reports based on different subsets of the data. See About logging events on page 223. See Creating or modifying a Summary report template on page 230. See Creating or modifying a Detailed report template on page 236. Generate reports Mail Security collects scan data from your Exchange servers and generates reports. Mail Security provides the preconfigured report templates that you can modify. You can also create your own report templates. You can create the following types of report templates: Summary Detailed See About generating reports on page 229. Send notifications when a threat or violation is detected Mail Security provides several options for notifying administrators, internal senders, and recipients of threats and violations. Mail Security lets you define the conditions in which to send an alert. You can also customize the alert message text for each alert condition that you define. See Configuring rules to address unscannable and encrypted files on page 111. See Configuring threat detection on page 104. See Configuring notification settings for scan violations on page 210.

24 24 Introducing Symantec Mail Security for Microsoft Exchange Where to get more information about Mail Security Table 1-3 Task What you can do with Mail Security (continued) Description Manage single and multiple Exchange servers Mail Security can protect one or more Exchange servers. If your organization has multiple Exchange servers, you can manage all the servers from the same console that you use to manage a single server. By switching between the server view and group view, you can manage the following: Configuration settings for individual servers All servers in a specific location See About managing your Exchange servers on page 73. Where to get more information about Mail Security Mail Security includes a comprehensive help system that contains conceptual, procedural, and context-sensitive information. Press F1 to access information about the page on which you are working. If you want more information about features that are associated with the page, select a More Information link in the Help page, or use the Table of Contents, Index, or Search tabs in the Help viewer to locate a topic. You can visit the Symantec Web site for more information about your product; the following online resources are available: Provides access to the technical support Knowledge Base, newsgroups, contact information, downloads, and mailing list subscriptions Provides information about registration, frequently asked questions, how to respond to error messages, and how to contact Symantec License Administration Provides product news and updates Provides access to the Threat Explorer, which contains information about all known threats

25 Chapter 2 Installing Symantec Mail Security for Microsoft Exchange This chapter includes the following topics: Before you install System requirements Installation options Post-installation tasks Uninstalling Mail Security Before you install Ensure that you meet all system requirements before you install Mail Security. Select the installation plan that best matches your organization's needs, and ensure that you have met the pre-installation requirements. See System requirements on page 30. See Installation options on page 34. See Uninstalling Mail Security on page 65. Install Mail Security on all of the following server roles in your organization: Edge Transport servers, if available Hub Transport servers Mailbox servers

26 26 Installing Symantec Mail Security for Microsoft Exchange Before you install You must uninstall and reinstall the product if you change the server role on which Mail Security is installed. Do the following before you install the product: If you are running Symantec Brightmail AntiSpam on the same server on which you want to install Mail Security, you must uninstall Symantec Brightmail AntiSpam before you install Mail Security. It is recommended that you not run Mail Security on the same server as Symantec Brightmail AntiSpam. If you are using the optional tools feature of Symantec Endpoint Protection (SEP) or Symantec AntiVirus Corporate Edition (SAV-CE), you must uninstall the feature before you install Mail Security. These tools are not compatible with Mail Security or Microsoft Exchange. If you are running any antivirus software that is on the server on which you want to install Mail Security, you must disable it before you install Mail Security. After installation but before you re-enable the antivirus protection, configure your other antivirus programs to exclude certain folders from scanning. See About using Mail Security with other antivirus products on page 61. Log on as a Windows domain administrator to install Mail Security components correctly. See Software component locations on page 27. Modify your screen resolution to a minimum of 1024 x 768. Mail Security does not support a resolution less than 1024 x 768. Configure the default receive connector for the Exchange Hub Transport server to permit connections from anonymous users. Before you install Mail Security on Exchange 2010 mailbox role, you must specify a domain user account. The domain user account must fulfill the following criteria. Mail Security uses the domain user account as a service account and this account must have a mailbox. The user must be a member of Organization Management group under the Microsoft Exchange Security Groups Organizational Unit. By default, Organization Management group is a member of the local Administrators group on all the exchange servers in the organization. If not, then add the user to the local Administrators group. You may use different user account for installations of Mail Security on other Exchange 2010 mailbox servers within that domain for better performance.

27 Installing Symantec Mail Security for Microsoft Exchange Before you install 27 When the user updates the password, the same password must be provided to the Mail Security Service on all Exchange 2010 mailbox role servers. Note: While installing Mail Security on local Exchange 2010 Mailbox server, in the Logon Information screen, specify the domain user credentials in the User name and Password fields. Mail Security provides this user account Application Impersonation and Logon as service rights. Ensure that the following IIS Role Service components are installed when you install Mail Security on Windows Server 2008 for Exchange 2007 and 2010 servers. This installation is applicable for both remote installation and local installation. Application Development - ASP.NET Security - Windows Authentication, Basic Authentication, Digest Authentication Management Tools - IIS management console, IIS 6 Scripting Tools Software component locations Table 2-1 lists the default locations in which Mail Security installs software components. Table 2-1 Software component locations Component Mail Security program files Quarantined items in encrypted format Note: Configure all antivirus file system scanners to exclude the quarantine directory from scanning. The system scanners might try to scan and delete Mail Security files that are placed in the quarantine directory. Reporting data Data files for reports that are generated Location C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \Quarantine C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \Reports C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \Reports\<report name>

28 28 Installing Symantec Mail Security for Microsoft Exchange Before you install Table 2-1 Component Report templates Match list files Software component locations (continued) Location C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \Reports\Templates C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \MatchLists Allowed senders files and Symantec Premium AntiSpam configuration files C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \SpamPrevention Location where Mail Security scans items Note: Configure all antivirus products that scan files to exclude the Temp directory from scanning. The system scanners might try to scan and delete Mail Security files that are placed in the Temp directory during the scanning process. C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \Temp Dynamic-link libraries for Symantec Premium AntiSpam Manual and scheduled scan mailbox configuration data Configuration files for allowed and blocked senders for Symantec Premium AntiSpam Component logs for Symantec Premium AntiSpam Statistical information on the effectiveness of Symantec Premium AntiSpam rules Console files Component to update virus definitions C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \bin C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \Config C:\Program Files (x86)\symantec\ SMSMSE\7.0\Server \etc C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \logs C:\Program Files (x86)\ Symantec\SMSMSE\7.0\ Server \stats C:\Program Files (x86)\ Symantec\CMaF\2.2 C:\Program Files (x86)\ Symantec\LiveUpdate

29 Installing Symantec Mail Security for Microsoft Exchange Before you install 29 Table 2-1 Component Definitions License files Software component locations (continued) Location Windows Server 2003 (x64) - C:\Program Files (x86)\common Files\Symantec Shared\SymcData\virusdefs32 C:\ProgramData\Symantec Shared\Licenses This license file location only applies to Windows Server C:\Program Files (x86)\ Common Files\Symantec Shared\Licenses Verity content extraction component Mail Security Web service components Content filtering rules Scan job configuration Symantec Mail Security Management Service Component C:\Program Files (x86)\ Symantec\ SMSMSE\7.0\Server\ Verity\bin C:\Program Files (x86)\symantec\cmaf\2.2\ bin C:\Program Files (x86)\symantec\ SMSMSE\7.0\Server \Policies C:\Program Files (x86)\symantec\ SMSMSE\7.0\Server \ScanJobs C:\Program Files (x86)\symantec\smsmsespc\1.0 About security and access permissions Mail Security automatically creates the following user groups and assigns them access when you install the product:

30 30 Installing Symantec Mail Security for Microsoft Exchange System requirements SMSMSE Admins Permits read and write access to all Mail Security components and features. Users in this group can change settings for Mail Security through the console. The user who installs Mail Security is automatically added to the SMSMSE Admins group. SMSMSE Viewers Permits read-only access to Mail Security components and features. Users in this group cannot change settings for Mail Security. Users can view reports, event logs, and settings through console-only installations. See Installing the Mail Security console on page 40. System requirements The user groups are domain-wide for Active Directory. You can use the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in to change membership in the groups. Users must be designated in one of the SMSMSE user groups to access the product. For example, administrators who are not in one of the SMSMSE user groups are not granted access to Mail Security. Adding a user to the SMSMSE Admins group does not automatically grant the user Windows Local Administrator, Windows Domain Administrator, or Exchange administrator rights. Security is also set for the Mail Security registry key and file folders during the security set-up process. You must have administrator access to the local servers and domain administrator rights for the security set-up to proceed. Ensure that you meet the appropriate system requirements for the type of installation that you are performing. If you do not have Internet connection on your system, then installing Mail Security may take a long time to complete. Mail Security tries to examine the certificate revocation list (CRL) to verify the code signing certificate each time that Mail Security compiles an assembly into managed code. When Mail Security is not connected to the Internet, each CRL request may time out before the installation can continue and increases the installation time.

31 Installing Symantec Mail Security for Microsoft Exchange System requirements 31 To reduce installation time 1 Start Internet Explorer. 2 On the Tools menu, click Internet Options. 3 Click the Advanced tab, and then locate the Security section. 4 Uncheck Check for publisher s certificate revocation and then click OK. 5 After the installation is complete, check Check for publisher s certificate revocation. Note: The Check for publisher's certificate revocation option is set on a per-account basis. See Installation options on page 34. Server system requirements You must have domain administrator-level privileges to install Mail Security. The server system requirements are as follows: Operating system The minimum operating system requirements for Microsoft Exchange 2010 are as follows: Windows Server 2008 with SP2 (64-bit) Standard or Enterprise Edition Windows Server 2008 R2 (64-bit) Standard or Enterprise Edition The minimum operating system requirements for Microsoft Exchange 2007 are as follows: Windows Server 2008 with SP1or later (64-bit) Standard or Enterprise Edition Windows Server 2003 with SP2 (64-bit) Standard or Enterprise Edition Windows Server 2003 R2 (64-bit) Standard or Enterprise Edition Exchange platform Exchange Server 2007 SP1/SP2 Exchange Server 2010

32 32 Installing Symantec Mail Security for Microsoft Exchange System requirements Minimum system requirements x64 architecture-based processor that supports Intel Extended Memory 64 Technology (Intel EM64T) x64 architecture-based computer with AMD 64-bit processor that supports AMD64 platform Exchange Server MAPI client and Collaboration Data Objects Requirement for mailbox role of Exchange Server 2007 only 1 GB of memory for Mail Security besides the minimum requirements for the operating system and Exchange. Approximately 4GB or more of memory is required. 1 GB disk space is required for Mail Security. This space does not include disk space required for items such as quarantined messages and attachments, reports, and log data..net Framework version 3.5 MDAC 2.8 or higher DirectX 9 or higher Microsoft Internet Information Services (IIS) Manager Microsoft.NET Framework 3.5 and Microsoft Windows Powershell 2.0 Requirement for Exchange Server 2010 only Ensure that the components.net Framework, MDAC, and DirectX are installed before you install Mail Security. Adobe Acrobat Reader is not a requirement to install and run Mail Security. However, it is required to view the reports that are generated in.pdf format. You can download Adobe Acrobat Reader from You must also have Internet Explorer 8.0 or later to view the reports. See Installing Mail Security on a local server on page 35. See Silently installing Mail Security using an automated installation tool on page 45. See About installing Mail Security on remote servers on page 41. See About installing Mail Security in a Microsoft Cluster on page 46. Console system requirements You can install the Mail Security console on a computer on which Mail Security is not installed. Table 2-2 describes the Mail Security console system requirements.

33 Installing Symantec Mail Security for Microsoft Exchange System requirements 33 Table 2-2 Requirement Operating system Console system requirements Description Mail Security supports the following operating systems: Windows Server 2003 Windows Server 2003 R2 Windows XP Windows Vista Windows Server 2008 Windows Server 2008 R2 Windows 7 Mail Security supports 32-bit processors on all supported operating systems. Mail Security supports 64-bit processors on all supported operating systems except Windows XP. Memory Available disk space 1 GB 1 GB This requirement does not include the space that Mail Security requires for items such as quarantined messages and attachments, reports, and log data..net Framework Version 2.0 Ensure that.net Framework is installed before you install Mail Security. Microsoft Internet Information Services (IIS) Manager Version 6 or later You only need IIS if you install Mail Security Console on a 64-bit operating system. Adobe Acrobat Reader is not a requirement to install and run the Mail Security Console. However, it is required to view the reports that are generated in.pdf format. You can download Adobe Acrobat Reader from You must also have Internet Explorer 8.0 or later to view the reports. See Installing the Mail Security console on page 40. Port requirements Symantec Mail Security for Microsoft Exchange scans SMTP mail traffic that passes through Exchange servers on port 25. Mail Security does not interact with MAPI or any other mail protocols, such as POP3 on port 110 or IMAP on port 143. Some of the components of Mail Security require certain ports for communication.

34 34 Installing Symantec Mail Security for Microsoft Exchange Installation options Table 2-3 lists the ports that Mail Security components use by default. Table 2-3 Ports used by Mail Security components Mail Security component Port Process Purpose Rapid Release Definitions 21 ftp.exe Frequent antivirus definition updates Conduit 443 Conduit.exe Continuous Premium AntiSpam updates DEXL Service 8081 Process ID: 0 or 4 (System) Console communications CmafReportSrv CmafReportSrv.exe Reporting database Note: If Symantec Premium AntiSpam is enabled, ensure that you open port 443 on the firewall for bi-directional traffic to aztec.brightmail.com. If Symantec Premium AntiSpam is not licensed and enabled, Mail Security will not initiate activity on port 443. Similarly, if the optional Rapid Release feature is not enabled, Mail Security will not initiate activity on port 21. The port used for communication with Mail Security Console can be configured during installation or at any time after the installation. Activity will only be seen on these ports when using the console to administer a remote server. Note: There are no port conflicts or incompatibility between Mail Security and Symantec Endpoint Protection 11.x or the Symantec Endpoint Protection Manager. Installation options Use any of the following installation procedures, depending on the type of installation that you want to perform: Local server You can install or upgrade Mail Security on a local computer that is running the Microsoft Exchange server. See Installing Mail Security on a local server on page 35. Remote server You can install Mail Security on remote servers through the product console. See About installing Mail Security on remote servers on page 41.

35 Installing Symantec Mail Security for Microsoft Exchange Installation options 35 Console You can install the product console on a computer that is not running Mail Security. This lets you manage your servers from any computer that has access to your Exchange servers. See Installing the Mail Security console on page 40. Silent/automated installation Microsoft cluster server Veritas cluster server You can install Mail Security using automated installation tools. See Silently installing Mail Security using an automated installation tool on page 45. You can install Mail Security in a Microsoft Cluster environment. See About installing Mail Security in a Microsoft Cluster on page 46. You can install Mail Security in a Veritas cluster environment. See About installing Mail Security on a Veritas Cluster Server on page 51. Installing Mail Security on a local server Ensure that you have met the system requirements before you begin the installation process. See System requirements on page 30. Note: Symantec automatically installs MSXML 6.0 during installation if the installer does not detect this component. You must be logged on as a member of the administrator group on the local computer and have domain administrator privileges on the computer on which you want to install Mail Security. Computers must support 8dot3 formatted filenames for all NTFS file systems. To install Mail Security on a local server, do the following:

36 36 Installing Symantec Mail Security for Microsoft Exchange Installation options Begin the installation process You can use the installation wizard to guide you though the installation process of selecting the product installation folder location and the type of installation that you want to perform. You can choose to retain your existing settings or use the new default settings if you are upgrading from a prior version of Mail Security. When Mail Security detects a prior version of the product, it automatically uninstalls the prior version and then installs the new version. Note: If you choose to retain your existing settings, then Mail Security saves the existing items in the quarantine at the following temporary directory: C:\Program Files(x86)\Symantec\ SMSMSEServerUpgradeTemp\Quarantine This temporary directory is typically not configured as an exclusion for the virus scanning software. As a result, the virus scanning software detects and flags any viruses or security threats in the quarantine. To avoid this situation, configure your virus scanning software to exclude this temporary directory from scanning or delete all the items from the directory. Configure additional setup options and confirm settings Install your licenses You can specify if you want to automatically restart the Exchange Transport Service after installation, specify the Web service set-up values, designate an notification address and SMTP server address, and review your setup configurations. You can install your licenses during installation. See About licensing on page 67. If you install a valid license, Mail Security lets you perform a LiveUpdate to obtain the most current definitions. See About keeping your server protected on page 248.

37 Installing Symantec Mail Security for Microsoft Exchange Installation options 37 To begin the installation process 1 Insert the Mail Security product CD in the CD-ROM drive. The installation program launches automatically. If it does not, run cdstart.exe from the product CD. 2 Click Install Symantec Mail Security for Microsoft Exchange. 3 In the InstallShield wizard, click Next. 4 Click Next until you reach the License Agreement panel. 5 In the License Agreement panel, click I accept the terms in the license agreement, and then click Next. You must accept the terms of the license agreement for the installation to continue. 6 In the Existing Settings panel, select one of the following: Retain existing settings Retains the existing settings that are supported for migration to the new version. This is the default setting. Install with default settings Installs the product with the default settings, as if you were installing Mail Security for the first time. This panel appears only if you are upgrading from a prior version of Mail Security. 7 In the Destination Folder panel, do one of the following: To install the product in the default location, click Next. The default directory is as follows: C:\Program Files (x86)\symantec\ To install the product in a different location, click Change, select the location of the installation folder, click OK, and then click Next. Mail Security does not support directory names that contain multi-byte characters. If you intend to use the Symantec Premium AntiSpam, you cannot install the product to a directory whose name contains high ASCII characters.

38 38 Installing Symantec Mail Security for Microsoft Exchange Installation options 8 In the Setup Type panel, click Complete, and then click Next. 9 In the Symantec Endpoint Protection or Symantec AntiVirus Corporate Edition Users warning dialog box, click OK. To configure additional setup options 1 In the Exchange Transport Service Reset Options panel, click Next to accept the default setting to automatically restart the Exchange Transport Service after installation. If you choose not to automatically restart the Exchange Transport Service after installation, you must do so manually. Otherwise, Mail Security will not function properly. 2 In the Web Service Setup panel, do one of the following: Click Next to accept the default values. Modify the following settings, and then click Next: IP/Name By default, the computer name resolves to the primary external network identification card (NIC). You can also use an IP address. The IP address validates the availability of the port. Port # By default, port 8081 is the port number for the Web service that is used by Mail Security. A different default port number appears if port 8081 is being used by another application. Use a port number that is not used by another application if you change the port number. You should not use port 80. Port 80 is the port number that is used by the default Web service, which is hosted by IIS. 3 In the Notification Address panel, do one of the following to specify the address from which notifications are sent and to which notifications to the administrator are sent: Click Next to accept the default value. The default value is: Administrator Modify the originator address, and then click Next. The Edge Transport server does not have access to Active Directory, so abbreviated addresses cannot be resolved. If you are installing Mail Security on the Edge Transport server role, type a fully qualified address (for example, user@mycompany.com). You can modify the address after installation is complete. See Configuring notification settings for scan violations on page 210.

39 Installing Symantec Mail Security for Microsoft Exchange Installation options 39 4 In the SMTP Server Host panel, specify the SMTP server address for sending messages. If you install Mail Security on a Mailbox server only, you must specify an SMTP Transport server address. The Hub Transport server and Edge Transport server contain an SMTP transport that can receive . The default server address is as follows: localhost. 5 In the Service Account Information panel, specify the user name and password of the domain user account. Do not specify the user name and password of the domain administrator account. 6 In the Setup Summary panel, review the information, and then click Next. If you need to make any modifications, click Back to return to the appropriate panel. 7 In the Ready to Install the Program panel, click Install. To install a license and update definitions 1 In the Install Content License File panel, do one of the following: To install a license file Do the following: Click Browse, locate the license file, and then click Open. Click Install, and in the confirmation dialog box, click OK. Click Next. To install a license file later through the console Click Skip, and then click Next. See About licensing on page In the LiveUpdate panel, do one of the following: To perform a LiveUpdate Click Yes, and then click Next. In the LiveUpdate Options window, click Start. When LiveUpdate is complete, click Close. To perform a LiveUpdate at a later time Click No, and then click Next. See About keeping your server protected on page 248. This panel appears only if you installed a valid license.

40 40 Installing Symantec Mail Security for Microsoft Exchange Installation options 3 Click Finish. Show the readme file is checked by default. The Readme file contains information that is not available in the product documentation. A Mail Security icon is placed on the computer desktop when installation is complete. 4 In the User Credential Refresh Required panel, click OK. 5 Log off and log on again. See Post-installation tasks on page 56. Installing the Mail Security console The Mail Security console is a Windows application. The console lets you manage local and remote installations of Mail Security from a single computer. You can install and use the console on a computer on which Mail Security is not installed. This lets you manage Mail Security from a convenient location. Ensure that you meet the system requirements before you install the console. See Console system requirements on page 32. A Mail Security icon is placed on the computer desktop when installation is complete. To install the Mail Security console 1 Insert the Mail Security product CD in the CD-ROM drive. The installation program launches automatically. If it does not, run cdstart.exe from the Mail Security product CD. 2 Click Install Multiserver Console. If the installation program detects that you have Windows XP or that there is no version of the Exchange server installed, the installation program defaults to console only installation options. 3 Click Next until you reach the License Agreement panel. 4 In the License Agreement panel, check I accept the Terms in the license agreement, and then click Next. 5 In the Destination Folder panel, do one of the following: To install the product in the default location, click Next. The default destination directory is as follows: C:\Program Files (x86)\symantec\

41 Installing Symantec Mail Security for Microsoft Exchange Installation options 41 To install the product in a different location, click Change, select the location of the installation folder, click OK, and then click Next. Mail Security does not support directory names that contain multi-byte characters. If you intend to use the Symantec Premium AntiSpam service, you cannot install the product to a directory whose name contains high ASCII characters. 6 Click Next until you reach the Notification Address panel. 7 In the Notification Address panel, do one of the following to specify the address from which notifications are sent and to which notifications to the administrator are sent: Click Next to accept the default value. The default value is: Administrator Modify the originator address, and then click Next. The Edge Transport server does not have access to Active Directory, so abbreviated addresses cannot be resolved. If you are installing Mail Security on the Edge Transport server role, type a fully qualified address (for example, user@mycompany.com). You can modify the address after installation is complete. See Configuring notification settings for scan violations on page In the Setup Summary panel, review the information, and then click Next. If you need to make any modifications, click Back to return to the appropriate panel. 9 Click Finish. The option Show the readme file is checked by default. The Readme file contains information that is not available in the product documentation. 10 In the User Credential Refresh Required panel, click OK. 11 Log off and log on again. See Post-installation tasks on page 56. About installing Mail Security on remote servers After you install Mail Security on a local server or install the console, you can install the Mail Security server component on remote servers. Review the pre-installation information and system requirements before you install the product on remote servers. See Before you install on page 25.

42 42 Installing Symantec Mail Security for Microsoft Exchange Installation options See System requirements on page 30. To install Mail Security on remote servers, do the following: Customize installation settings, if needed. Remote servers are installed with default installation settings. If you want to customize the installation settings and apply them to a remote server, you can add the custom features to the vpremote.dat file. See Customizing remote server installation settings on page 42. Install Mail Security on remote servers. See Installing Mail Security on a remote server on page 44. Note: Installing Mail Security remotely on cluster servers is not recommended for Exchange 2007 cluster, but is supported on Exchange 2010 DAG setup. Customizing remote server installation settings There may be cases in which you want to customize the installation of Mail Security on a remote Exchange server. For example, you might want to change the following settings: Installation location Default address for notifications Stop/start of IIS Table 2-4 lists the remote customization options that you can modify. Table 2-4 Remote customization options Property Description Default value Optional value ADDRESS= Serves as the address of the domain administrator for the Address of sender and Administrator and others to notify Notification/Alert settings. N/A ( address of domain administrator) EXISTING SETTING GROUP= Controls whether to retain a previous version's settings or apply the default settings of the new version. Retain Restore

43 Installing Symantec Mail Security for Microsoft Exchange Installation options 43 Table 2-4 Remote customization options (continued) Property Description Default value Optional value IIS_RESET Controls whether to stop and restart Microsoft Exchange Transport Service during installation. This setting is only available if the Exchange Transport Service is installed. Yes No INSTALLDIR= Serves as the default product installation directory. \Program Files (x86)\symantec\ CMaF\2.2\ (Any valid path) PORTNUMBER= Serves as the port that is used by the product for Web services (Any valid port) SMSMSE_SMTP_ SERVER_HOST Serves as the host through which notifications are sent using SMTP. localhost (Any valid host) CONSOLE_ONLY Specifies that installation should be for the console only. 0 Set to 1 to perform a console installation. REMOTEINSTALL Controls whether the console appears during installation. 0 Set to 1 to perform a silent installation. REINSTALLMODE Controls the mechanism for re-install. N/A Set to voums to perform a silent installation. REINSTALL Controls what features to install during re-install. ALL Set to 1 to perform a silent installation. Warning: The following entry should not be changed: {setup.exe /s /v" NOT_FROM_ARP=1 REMOTEINSTALL=ALL REINSTALLMODE=voums REINSTALL=ALL }. You can append the entry. For example, setup.exe /s /v" NOT_FROM_ARP=1 REMOTEINSTALL=1 REINSTALLMODE=voums REINSTALL=ALL PORTNUMBER=1010

44 44 Installing Symantec Mail Security for Microsoft Exchange Installation options To customize remote server installation settings 1 Locate the folder that contains the Mail Security console files. The default location is as follows: \Program Files (x86)\symantec\cmaf\2.2\bin\products\smsmse\7.0\remote Install Files\vpremote.dat 2 Using WordPad or a similar tool, open the following file: vpremote.dat 3 Insert one or more properties by doing the following: Type a space after the previous or existing entry inside the quotation marks. Type the new property. The property portion of each entry is case sensitive. Type the value immediately after the = sign with no space. The values are not case sensitive. For example, to specify a silent installation, the entry would appear as follows: {setup.exe /s /v" NOT_FROM_ARP=1 REMOTEINSTALL=1 REINSTALLMODE=voums REINSTALL=1 } Installing Mail Security on a remote server During remote installation, the Windows Login screen prompts you to provide administrator or domain user credentials. The domain user must fulfill all pre-requisites before installing on a remote server. See Before you install on page 25. When installation is complete, a Mail Security icon is placed on the computer desktop. You should not use the remote installation procedures if you are installing the product on cluster server nodes. See About installing Mail Security in a Microsoft Cluster on page 46. To install Mail Security on a remote server 1 In the console on the toolbar, click Assets. 2 In the Asset Management window, in the sidebar under Tasks, click Install/Upgrade server(s).

45 Installing Symantec Mail Security for Microsoft Exchange Installation options 45 3 In the Select Server(s) window, in the Servers and server groups list, highlight one or more servers and click the >> command icon. 4 Under Server options, check Keep installation files on server(s) to maintain the installation files on the server. 5 Check Send group settings to apply group settings. If unchecked, existing server settings are retained. Future changes that are made to the server group are applied to the server. 6 Click OK. 7 In the Windows Login window, provide user name and password of a domain user who is a member of the Organization Management Exchange group and click OK. Note: Remote install must be performed from the computer which is part of the same domain. See Post-installation tasks on page 56. Silently installing Mail Security using an automated installation tool Mail Security supports installing the product using automated installation tools, such as Microsoft Systems Management Server. Ensure that you have met the system requirements before you perform a silent installation. See System requirements on page 30. You can modify certain installation properties to configure Mail Security installations, or you can provide command line properties during manual or automated installation using an automated installation tool. Modify the installation properties for Mail Security in the following file: \Program Files (x86)\symantec\cmaf\2.2\bin\products\smsmse\7.0\remote Install Files\vpremote.dat Table 2-4 lists the customization options that you can modify. Note: After the Mail Security silent installation, the Symantec Mail Security Utility Service and the Symantec Mail Security for Microsoft Exchange services do not start automatically. You must start these services manually.

46 46 Installing Symantec Mail Security for Microsoft Exchange Installation options To silently install Mail Security using an automated installation tool 1 Copy the installation media in its entirety to the location from which installation will be launched. For example: xcopy [Drive]:\*.* /s [DestinationDrive] 2 Launch setup.exe using the following command to initiate a silent installation: [DestinationDrive]:\setup.exe /v"/lvx* c:\smsmse_install.log NOT_FROM_ARP=1 REMOTEINSTALL=1 REINSTALLMODE=voums REINSTALL=ALL" /s Where "c:\smsmse_install.log" is the path of installation log file that gets generated during installation. To silently install Mail Security using an automated installation tool on mailbox role of Exchange Copy the installation media in its entirety to the location from which installation will be launched. For example: xcopy [Drive]:\*.* /s [DestinationDrive] 2 Launch setup.exe using the following command to initiate a silent installation: [DestinationDrive]:\setup.exe /v"/lvx* "c:\smsmse_install.log" NOT_FROM_ARP=1 REMOTEINSTALL=1 REINSTALLMODE=voums REINSTALL=ALL SMSMSE_RBAC_USERNAME=<username> SMSMSE_RBAC_PASSWORD=<password>" /s where "c:\smsmse_install.log" is the path of installation log file that will be generated during installation. About installing Mail Security in a Microsoft Cluster You can install Mail Security on the following types of Microsoft cluster configurations (these configuration types have different installation setups): Single Copy Clusters (SCC) See About installing Mail Security on a Single Copy Cluster node on page 48. Clustered Continuous Replication (CCR) See Installing Mail Security on a Clustered Continuous Replication cluster on page 51. Note: Mail Security only supports clustering when the product is installed on a Mailbox server role.

47 Installing Symantec Mail Security for Microsoft Exchange Installation options 47 Install Mail Security individually on each node of the cluster when you install it in a cluster environment. The remote installation feature should not be used. Do the following to install Mail Security in a cluster environment: Ensure that your environment meets the pre-installation requirements. See Considerations before you install on a Microsoft Exchange cluster on page 47. Install Mail Security using the procedures for your cluster configuration. See About installing Mail Security on a Single Copy Cluster node on page 48. See Installing Mail Security on a Clustered Continuous Replication cluster on page 51. Configure the cluster resource if you are using a single copy cluster configuration only. See Configuring the cluster resource on page 49. Considerations before you install on a Microsoft Exchange cluster Table 2-5 describes the items that you should consider before you install Mail Security in a cluster environment.

48 48 Installing Symantec Mail Security for Microsoft Exchange Installation options Table 2-5 Configuration Single copy cluster Cluster installation considerations Considerations Mail Security must be installed on all active and passive nodes of a cluster. Only one Clustered Mailbox Server (CMS) can run on any cluster node at any time. If two CMSs try to run on the same node, the results are undefined. Ensure that the following requirements are met before you install Mail Security on an Exchange cluster with one or more passive nodes: There must be an available passive node to fail to. Multiple failovers are supported only if multiple passive nodes are available. Mail Security must be installed with the same configuration and in the same locations on all nodes of the cluster. Mail Security checks for the presence of a cluster environment during installation. You are prompted to register a cluster resource DLL (SMSMSEClusterResource.dll) if the installation is running in a cluster environment. This DLL must be registered on only one of the cluster nodes. Mail Security runs on all of the nodes (even passive nodes) immediately after installation. After the first instance of the cluster resource is configured, the service runs on only the active node(s). Clustered continuous replication You do not need to configure a cluster resource for this type of cluster. About installing Mail Security on a Single Copy Cluster node You can install Mail Security on Exchange servers that are running Microsoft Single Copy Cluster. Mail Security settings are stored in the registry and local hard drive of each individual server. The settings are duplicated on the hard drive of the shared storage that is used as a dependency for the Mail Security resource each time settings are changed. The passive node checks for settings on the shared hard disk storage any time the active node goes down and control transfers to the passive node. The settings are then downloaded to the passive node (which is now active) and applied.

49 Installing Symantec Mail Security for Microsoft Exchange Installation options 49 Mail Security is Microsoft cluster aware and does not require any specific settings prior to installing the product on a cluster with one or more passive nodes. Mail Security requires its own cluster resource. You must use IP addresses or names of the Clustered Mailbox Server nodes instead of the actual server IP addresses or names for managing Mail Security through the console. When the CMS group and Mail Security cluster resource move from one node to another, the following items are not transferred: Virus definitions and spam rules Report database and generated reports Spam statistics Mailbox and public folder lists The Mail Security quarantine is stored on the shared storage. Exclude the quarantine from all antivirus scanning. Settings are copied to the shared storage when you deploy your changes. Ensure there is sufficient room on the volume for the Mail Security shared settings and quarantine. Configure LiveUpdate to perform regularly scheduled updates on each node in the cluster to ensure that your definitions stay current. Definitions are updated and stored locally, not on the shared storage. Configuring the cluster resource Create a new resource after Mail Security is installed on each node of the cluster. This resource provides high availability by monitoring and controlling Mail Security. Create the resource in each Clustered Mailbox Server group. You must add the cluster service account to the SMSMSE Admins Group before the cluster service is restarted on the cluster nodes. The cluster service must be restarted on all the nodes of the cluster before the SMSMSE Resource is brought online. If it is not, the SMSMSE Resource may not start. For more information about how to add a cluster service to a group, see your Microsoft server documentation. See About installing Mail Security on remote servers on page 41. The Mail Security service on all nodes is stopped and service startup is changed to manual as the Mail Security resource is created. This occurs because the service is running under the control of the Mail Security cluster resource. The Mail Security cluster resource is responsible for all of the following tasks: Handling cluster events Saving Mail Security settings for each Clustered Mailbox Server to shared storage

50 50 Installing Symantec Mail Security for Microsoft Exchange Installation options Retrieving settings from shared storage and making them active on a given cluster node Managing the Mail Security service To configure the cluster resource 1 On the Windows taskbar, click Start > Programs > Administrative Tools > Cluster Administrator. 2 Select the CMS group and launch the New Resource Wizard. 3 Name the resource. You must assign a unique name to each resource. 4 Select Mail Security for Microsoft Exchange as the resource type, and then click Next. 5 Choose the nodes for which the resource is being created, and then click Next. The nodes must be the same as those on which CMS can operate. 6 Choose the dependencies for this resource. The required dependencies are as follows: Physical Disk Resource (disk on which the settings are saved) CMS Network Name resource 7 Repeat steps 2 through 6 for each CMS server group. To configure the cluster resource on Windows 2008 Server 1 On the Windows taskbar, click Start > Programs > Administrative Tools > Failover Cluster Management. 2 Right click the CMS group and select Add a resource > More resources > Add Symantec Mail Security for Microsoft Exchange. 3 Select Mail Security for Microsoft Exchange as the resource type. 4 Choose the dependencies for this resource. The required dependencies are as follows: Physical Disk Resource (disk on which the settings are saved) CMS Network Name resource 5 To set dependencies and nodes, right click the resource and select Properties. 6 Under the Dependencies tab, add Physical Disk Resource and CMS Network Name Resource.

51 Installing Symantec Mail Security for Microsoft Exchange Installation options 51 7 Under the Advanced Policies tab, select the nodes for which the resource is being created The nodes must be the same as those on which CMS can operate. 8 Select Apply and OK. 9 Repeat steps 2 through 8 for each CMS server group. Installing Mail Security on a Clustered Continuous Replication cluster You can install Mail Security on a Clustered Continuous Replication cluster. To install Mail Security on a Clustered Continuous Replication cluster 1 Log on to a node using an Administrator account that is a member of the Domain and Local Admin groups. 2 Insert the Mail Security product CD into the CD-ROM drive. The installation directory should be on a local node (non-shared drive). 3 In the Web Service wizard, type the IP address of the externally accessible network card of the current node (if not already present). The Virtual Server IP address, the cluster IP address, or name of the node are invalid entries. 4 Repeat steps 2 and 3 to install Mail Security on the remaining node. 5 Restart the cluster service after you install Mail Security on each node of the cluster. 6 Add each node to asset management so that you can manage the node from the console. Mail Security does not automatically detect the nodes in a cluster. Nodes must be added to asset management using their IP address. See Adding servers to a group on page 83. See Configuring the cluster resource on page 49. See Post-installation tasks on page 56. About installing Mail Security on a Veritas Cluster Server Mail Security is integrated with the active/passive Veritas Cluster Server environment. When you install Mail Security, the product detects that it is being installed in a Veritas Cluster Server environment. The product automatically registers a cluster resource with the Veritas Cluster Server.

52 52 Installing Symantec Mail Security for Microsoft Exchange Installation options The corresponding Mail Security cluster agent does the following: Monitors the Mail Security service Stops and restarts the service, as necessary Ensures that the product settings and quarantine data are copied to the SMSMSE folder on the shared storage Mail Security supports the following Veritas Cluster Server configurations: Active/passive N-to-1 Active/passive N+1 Active/passive N-to-N Some considerations about using the Veritas Cluster Server with Mail Security are as follows: Mail Security does not support active/active Veritas Cluster Server configurations Upgrades from Mail Security 5.0 to Mail Security 6.0, 6.5, and 7.0 are not supported on a Veritas Cluster Server configuration Mail Security does not support Veritas Cluster Server on Exchange Mail Security supports Veritas Cluster Server versions 5.0 with the latest service patch, and 5.1. Before you install on a Veritas Cluster Server Consider the following before you install Mail Security on a Veritas Cluster Server: Ensure there is sufficient room on the volume for the Mail Security shared settings and quarantine. Settings are copied to the shared storage when you deploy your changes. Exclude the quarantine from all scanning. The Mail Security quarantine is stored on the shared storage. Install Mail Security on all of the nodes in the cluster. You are prompted to register the resource on only one node. Use an IP address to specify the computer since the name of the server is usually used when installing to a cluster. If you are using IP addresses, use the IP address of the computer and not the IP address of the cluster or virtual server. Install Mail Security on each of the passive nodes first. Then failover an active node to a passive node and install Mail Security on it. Repeat this process until you install Mail Security on all of the active nodes and passive nodes.

53 Installing Symantec Mail Security for Microsoft Exchange Installation options 53 This process lets you install the product cleanly on all of the nodes. Uninstallation of the product should be handled the same way. See Uninstalling Mail Security on page 65. You can install Mail Security in any of the following types of Veritas Cluster Server environments: Local clusters Campus/metropolitan clusters Replicated data clusters Wide area clusters Global clusters Configure LiveUpdate to perform regularly scheduled updates on each node in the cluster to ensure that your definitions stay current. Definitions are updated and stored locally, not on the shared storage. You should not use the remote installation procedures when you are installing the product on cluster server nodes. Configuring Mail Security in the Exchange Service Group Do the following to properly configure Mail Security in the Exchange Service Group: Create a MountV resource. Create a mount resource if you are using NetApps. Create a Mail Security resource. Specify dependencies. Bring the resources online. Note: You do not need to cluster the Symantec Mail Security Utility service. The Mail Security cluster agent does not monitor the Symantec Mail Security Utility service. Figure 2-1 diagrams the typical Mail Security resource type, resource instance, and resource dependency with other resources within the Exchange service group.

54 54 Installing Symantec Mail Security for Microsoft Exchange Installation options Figure 2-1 Resource dependencies SMSMSEVCSClusterResource-Instance SMSMSEVCSClusterResource Lanman- ExchangeServiceGrp Lanman MountV SMSMSEMountV- Instance IP- ExchangeServiceGrp NIC- ExchangeService Grp IP NIC VMDg VMDg- ExchangeServiceGrp For more information, see the Veritas Cluster Server documentation. To create a MountV resource 1 Add a new MountV resource. MountV resource is an option in the Resource Type list. 2 Type a name for the resource. 3 Assign the following resource attributes: MountPath VolumeName VMDGResName The drive letter or the folder name of the volume that you created The volume name that you created The name of the volume manager diskgroup resource on which the MountV resource depends 4 Ensure that the resource is not set to "Critical." This ensures that the Exchange service group will not failover to another node if either of the resources fail during setup.

55 Installing Symantec Mail Security for Microsoft Exchange Installation options 55 To create a Mail Security resource 1 Add a new SMSMSEVCSClusterResource. SMSMSEVCSClusterResource is an option in the Resource Type list. 2 Type a name for the resource. 3 Assign the following resource attributes: LanmanResName MountResName The resource name of the Lanman resource that exists in the Exchange service group The resource name of the MountV that you created 4 Ensure that the resource is not set to "Critical." This ensures that the Exchange service group will not failover to another node if either of the resources fail during setup. To specify dependencies Create the following dependencies: SMSMSEVCSClusterResource is a parent to the MountV resource that you created. SMSMSEVCSClusterResource is a parent to the Lanman resource. The MountV resource that you created is a parent to the VMDg resource. To bring the resources online 1 Enable the MountV resource that you created. 2 Set the resource back to "Critical," if desired. 3 Online the MountV resource on the active Exchange node. 4 Enable the SMSMSEVCSClusterResource. 5 Set the resource back to "Critical," if desired. 6 Bring the SMSMSEVCSClusterResource on the active Exchange node online. 7 Save and close the configuration. Creating the shared storage volume Create the shared storage volume after you install Mail Security on all of the nodes in a cluster using the Veritas Enterprise Administrator. See your Veritas Cluster

56 56 Installing Symantec Mail Security for Microsoft Exchange Post-installation tasks Server documentation for more information about the Veritas Enterprise Administrator. To create a shared storage volume 1 In the Veritas Enterprise Administrator, create a new volume for Mail Security data as part of the existing clustered Exchange Disk Group. This shared storage volume needs enough space to contain product settings and quarantine data. 2 Assign the volume a drive letter or a New Technology File System (NTFS) folder name and a volume name. A drive letter or NTFS folder name and the volume name are necessary to create a MountV resource. Post-installation tasks After you install Mail Security, you can perform the following post-installation tasks: Implement SSL communications. See Implementing SSL communications on page 57. Install license files if they were not installed during setup. See About licensing on page 67. Update definitions if a LiveUpdate was not performed during setup. See About keeping your server protected on page 248. Access the Mail Security console. See Accessing the Mail Security console on page 58. Configure other antivirus products that are on the same computer as Mail Security. See About using Mail Security with other antivirus products on page 61. Configure Mail Security transport agents. See Configuring Mail Security transport agents on page 62. Configure the number of scanning threads and scan processes, if necessary. See Setting scanning threads and number of scan processes on page 64. Reduce the launch time of Mail Security console. See Resolving installation issues on page 266.

57 Installing Symantec Mail Security for Microsoft Exchange Post-installation tasks 57 Implementing SSL communications You can configure Mail Security to use Secure Sockets Layer (SSL) communications by using a valid server certificate. You can create your own server certificate using Microsoft Certificate Services 2.0 or request one from a certificate authority. After you implement SSL, you must enable SSL from the console and specify the SSL port for each server. See Modifying the port and communication properties of a server on page 88. To install a server certificate 1 On the computer on which Mail Security is installed, click Start > Administrative Tools > Internet Information Services (IIS) Manager. 2 In the server list, expand the folder for the server that is hosting Mail Security. 3 In the Web sites folder, right-click Symantec Mail Security for Microsoft Exchange, and then click Properties. 4 Under Secure communications, select the Directory Security tab, and click Server Certificate. 5 Follow the instructions in the Web server Certificate wizard to install the server certificate. To implement SSL communications 1 Ensure that a valid server certificate is installed. 2 Under Secure Communications, select the Directory Security tab, and click Edit. 3 In the Secure Communications dialog box, check Require secure channel (SSL), and then click OK. 4 On the Web Site tab, under Web site identification, in the IP Address text box, type the IP address of the Mail Security server. 5 In the SSL Port text box, type the port to use for SSL communications. 6 Click OK to close the Mail Security Properties window. To implement SSL communications on Windows 2008 Server 1 On the local computer, ensure that a valid server certificate is installed in Trusted Root Certification Authorities. 2 Click Start > Administrative Tools > Internet Information Services (IIS) Manager. 3 In the Web sites folder, right-click Symantec Mail Security for Microsoft Exchange, click Edit Bindings and select Add.

58 58 Installing Symantec Mail Security for Microsoft Exchange Post-installation tasks 4 From the drop-down list, select https and All Unassigned for Type and IP addresses respectively. 5 In the SSL Port text box, type the port number, for instance, 8082, to use for SSL communications. Note: To avoid port conflict, do not use the ports used by exchange server, like TCP port 80 and SSL port From the SSL certificate, select the certificate installed and restart the Symantec Mail Security for Microsoft Exchange Web site. 7 In the right pane, double-click Authentication and ensure that Windows Authentication and ASP.NET Impersonation are enabled. 8 From the Web sites folder, select Symantec Mail Security for Microsoft Exchange. In the right pane, double-click SSL Settings, check Require SSL and Require 128-bit SSL. 9 Click Apply to apply the changes. To implement SSL communications on client computer 1 Export the server certificate from the server and install it to the client computer where Mail Security console is installed in Trusted Root Certification Authorities. 2 Open the Certificatesnap-in and ensure that the certificate resides in Trusted Root Certification Authorities. 3 On the Mail Security console, click the Assets tab and click Add server(s) to add a server. 4 Right click on the server added, click Properties. Provide the SSL port number configured on the server. 5 Check the UseSSL checkbox, and click OK. You can now connect to the server from the console using the SSL connection. Accessing the Mail Security console You can access the Mail Security console from the Windows Start menu or from your desktop. You must have the appropriate administrator or viewer rights to open the console. If you do not, the following error message appears: "You either have insufficient permissions to access this application or your user credentials are not refreshed. Try logging off and logging in again to reload the user credentials. You either have insufficient permissions to access this application

59 Installing Symantec Mail Security for Microsoft Exchange Post-installation tasks 59 or your user credentials are not refreshed. Try logging off and logging in again to reload the user credentials." You can only access servers that are running Mail Security 7.0 from the Mail Security 7.0 console. See About security and access permissions on page 29. To access the Mail Security console Do one of the following: On the desktop, click the SMSMSE 7.0 icon. On the Windows menu, click Start > Programs > Symantec Mail Security for Microsoft Exchange > Server Management Console. See About the Mail Security console on page 59. About the Mail Security console Figure 2-2 shows the Mail Security console. Figure 2-2 Mail Security Server Home page view Menu bar Tool bar Primary navigation bar Content area Figure 2-3 shows additional console elements.

60 60 Installing Symantec Mail Security for Microsoft Exchange Post-installation tasks Figure 2-3 Additional console elements List pane Sidebar Preview pane Resizing bars About the primary navigation bar Management operations are grouped into the following categories on the primary navigation bar: Home Policies Lets you view server status, recent activities, and violations statistics Lets you create and configure sets of rules that are implemented by specific scans Monitors Lets you configure notification addresses and quarantine settings and monitor quarantine data and events Scans Reports Admin Lets you create, configure, schedule, and run scans Lets you view and print data collected by Mail Security Lets you update definitions, configure system settings, and install licenses