McAfee Endpoint Security

Transcription

1 Installation Guide McAfee Endpoint Security For use with McAfee epolicy Orchestrator

2 COPYRIGHT 2016 Intel Corporation TRADEMARK ATTRIBUTIONS Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence, McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Endpoint Security Installation Guide

3 Contents Preface 5 About this guide Audience Conventions Find product documentation Product overview 7 Endpoint Security modules Easy installation and upgrades New features How the product works The role of the security management platform Security management options Self-management Management with McAfee epo Management with McAfee epo Cloud Where to go from here Pre-installation 17 System requirements Supported Internet browsers Supported security management platforms Other virus-detection and firewall software Preconfiguring the product Create custom packages with Endpoint Security Package Designer Install custom packages with McAfee epo Upgrading an existing version of the product Are you ready to install? Installation for systems managed with McAfee epo and McAfee epo Cloud 25 Installation overview Upgrade the McAfee Agent on McAfee epo-managed systems Install the product files on the management server Download Endpoint Security content files Deploy to multiple systems with deployment tasks Install on local systems with an installation URL Create an installation URL Install with an installation URL Verify the installation Uninstall from systems managed with McAfee epo or McAfee epo Cloud Installation for self-managed systems 35 Installation overview for self-managed systems Upgrade the McAfee Agent on self-managed systems Install with the installation wizard McAfee Endpoint Security Installation Guide 3

4 Contents Install from the command line Verify the installation Uninstall from a self-managed system Troubleshooting and reference 41 Troubleshooting installation problems Test malware detection Using the MER tool for troubleshooting Resolving error codes and messages Using command-line options SETUP command-line options (McAfee epo and McAfee epo Cloud deployment tasks) SETUP command-line options (self-managed) Log files A Threat Intelligence installation 49 About Threat Intelligence System requirements for Threat Intelligence Overview of Threat Intelligence installation process Download and check in the components to McAfee epo Deploy DXL and Threat Intelligence Verify the deployment Where to go from here Index 55 4 McAfee Endpoint Security Installation Guide

5 Preface This guide provides the information you need to work with your McAfee product. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Conventions This guide uses these typographical conventions and icons. Italic Bold Monospace Narrow Bold Title of a book, chapter, or topic; a new term; emphasis Text that is emphasized Commands and other text that the user types; a code sample; a displayed message Words from the product interface like options, menus, buttons, and dialog boxes Hypertext blue A link to a topic or to an external website Note: Extra information to emphasize a point, remind the reader of something, or provide an alternative method Tip: Best practice information Caution: Important advice to protect your computer system, software installation, network, business, or data Warning: Critical advice to prevent bodily harm when using a hardware product McAfee Endpoint Security Installation Guide 5

6 Preface Find product documentation Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. 6 McAfee Endpoint Security Installation Guide

7 1 Product 1 overview McAfee Endpoint Security is a fully integrated security solution that protects servers, endpoint computer systems, laptops, and tablets against a full spectrum of threats. These threats include malware, suspicious communications, unsafe websites, and downloaded files. Endpoint Security intercepts threats, monitors overall system health, and reports detection and status information. The product can be installed on self-managed (standalone) systems or systems managed by these security management platforms: McAfee epolicy Orchestrator (McAfee epo ) version and later McAfee epolicy Orchestrator Cloud (McAfee epo Cloud) For the latest Endpoint Security management license and entitlement information, see KB Contents Endpoint Security modules Easy installation and upgrades New features How the product works Security management options Where to go from here Endpoint Security modules The administrator configures and installs one or more Endpoint Security modules on client computers. Threat Prevention Checks for viruses, spyware, unwanted programs, and other threats by scanning items automatically when users access them or on demand at any time. Firewall Monitors communication between the computer and resources on the network and the Internet. Intercepts suspicious communications. Web Control Displays safety ratings and reports for websites during online browsing and searching. Web Control enables the site administrator to block access to websites based on safety rating or content. Threat Intelligence Provides context-aware adaptive security for your network environment. Endpoint Security Threat Intelligence is an optional Endpoint Security module. For additional threat intelligence sources and functionality, deploy the Threat Intelligence Exchange server. For information, contact your reseller or sales representative. Threat Intelligence isn't supported on McAfee epo Cloud-managed systems. In addition, the Common module provides settings for common features, such as interface security and logging. This module is installed automatically if any other module is installed. McAfee Endpoint Security Installation Guide 7

8 1 Product overview Easy installation and upgrades Easy installation and upgrades McAfee Endpoint Security includes automated installation and setup processes for multiple management environments. Automated installation and deployment Select the level of automation or customization that best suits your needs. Automated wizards Install and deploy the product with preconfigured, default settings and minimal interaction during installation. Customized options Use the Endpoint Security Package Designer to create custom product packages that include preconfigured policy settings. Specify installation features, such as installing silently. Single or multiple targets Install on local systems or deploy remotely to all managed systems. Side-by-side management and upgrades Install, manage, and upgrade multiple product versions and operating system platforms using a single management platform. Inline installation Install and manage new products side by side with previous versions. Management of multiple client versions and platforms Use McAfee epo and McAfee epo Cloud with the McAfee Agent to manage versions of the Endpoint Security Client on Windows systems and compatible client software on Mac and Linux systems. Migration of custom settings Migrate your settings from legacy products for use with Endpoint Security. On self-managed systems The installation wizard preserves your settings during the upgrade process, by default. You can specify the products to upgrade. On McAfee epo-managed systems The Endpoint Migration Assistant provides two migration paths. You can migrate all your settings automatically, or select settings to migrate manually, then configure some of them before migration if needed. New features This release of the product includes these new features. For information about new features introduced in McAfee Endpoint Security , see PD Dynamic Application Containment Run applications in a container based on reputation threshold The new Dynamic Application Containment technology in the Threat Intelligence module enables you to specify that applications with specific reputations run contained. Based on the reputation threshold, Threat Intelligence requests that the application is contained. Contained applications are denied or allowed to perform certain actions, as specified by containment rules. 8 McAfee Endpoint Security Installation Guide

9 Product overview New features 1 This release includes the ability to: Specify the reputation threshold for triggering application containment. Configure containment rules to block, log, or block and log actions that contained applications can perform. Globally exclude applications from containment. Access Protection Enhanced IPS functionality Specify user names that the rule applies to. Protect processes with custom subrules. Specify additional operations for file and registry protection: Files subrules Rename and Change permissions operations Registry key subrules Change permissions operation Exploit Prevention enhancements Support for Generic Privilege Escalation Prevention (GPEP) for 32-bit systems only. GPEP uses GPEP signatures in the Exploit Prevention Content to provide coverage for privilege escalation exploits in kernel mode and user mode. Define Exploit Prevention exclusions by hash, path, or certificate. Firewall enhancements Manage trusted networks and trusted executables from the Endpoint Security Client. Block all untrusted executables executables that are not signed or have an unknown McAfee Global Threat Intelligence (McAfee GTI) reputation. Require justification from users before they can disable Firewall or manage timed groups from the McAfee system tray icon. Enhanced support for proxy. Web Control enhancements Support for file download enforcement on Chrome browsers. Configure web gateway interlock settings to use a DNS name, IP addresses, or both for the internal landmark. Ability to block all IP addresses in the local private network from the Web Control module in McAfee epo. You can allow specific sites by adding them to the Block and Allow List. McAfee Endpoint Security Installation Guide 9

10 1 Product overview New features Threat Intelligence enhancements Endpoint Security Threat Intelligence is an optional Endpoint Security module. For additional threat intelligence sources and functionality, deploy the Threat Intelligence Exchange server. For information, contact your reseller or sales representative. Secure sandbox sample posting When submitting samples, Threat Intelligence now uses HTTPS instead of HTTP. HTTPS provides another layer of security for sample submission to later TIE server versions. To support older TIE server versions, Threat Intelligence continues to use HTTP as a fallback method for communication. File hash flexibility The Threat Intelligence module now fully supports submitting multiple hashes (MD5, SHA-1, and SHA-256) while requesting file reputation. As a result, the TIE server now makes full use of any hashes in its database and provides more accurate responses. Endpoint Security Package Designer Create custom packages Endpoint Security Package Designer is a standalone tool (not included with the Endpoint Security package) that you can download. Use this tool to create a custom package using existing Endpoint Security settings or customized settings on a client system. You can then deploy the custom package files as a standalone installer or using McAfee epo or a third-party network deployment tool. For information about installing and using Package Designer, see KB Endpoint Migration Assistant enhancements Migrate these settings from the IPS Rules and IPS Protection policies in McAfee Host Intrusion Prevention 8.0 to the Threat Prevention Access Protection policy: IPS custom signature subrules for files, registry, and programs IPS Application Protection Rules IPS Exception Rules Allow optional selection of Mac during automatic migration. Endpoint Security for Mac support enhancements This release includes enhanced support for managing McAfee Endpoint Protection for Mac client systems from McAfee epo with Endpoint Security extensions, including: Support for the McAfee GTI heuristic network lookup for suspicious files. Additional options allow you to run an on-demand scan when the system is idle or not running on battery power. Protect your Mac from web-based threats when you browse sites using Chrome browser. Integration with the McAfee Agent status monitor for displaying information, and initiating communication with McAfee epolicy Orchestrator (McAfee epo ) manually from the managed system. 10 McAfee Endpoint Security Installation Guide

11 Product overview How the product works 1 How the product works Endpoint Security detects, resolves, and logs information about detected threats. Client software is installed on each managed system to perform these tasks. For self-managed systems A local system user installs the client software, customizes the features, and manages detections. For managed systems Typically, an administrator installs the client software, manages detections, and sets up security rules, called policies, that determine how product features work. Depending on the policies configured by the administrator, users might be able to customize some product features. The role of the client software The client software protects systems with regular upgrades, continuous monitoring, and detailed reporting. 1 It silently monitors all file input and output, downloads, program executions, inbound and outbound communications, visits to websites, and other system related activities on managed systems, then: Deletes or quarantines detected viruses. Removes potentially unwanted programs, such as spyware or adware. Blocks or warns of suspicious activity, depending on product settings. Indicates unsafe websites with a color coded button or icon in the browser window or search results page. These indicators provide access to safety reports that detail site-specific threats. Blocks or warns of unsafe websites, depending on product settings. McAfee Endpoint Security Installation Guide 11

12 1 Product overview How the product works 2 It regularly connects to a local or remote McAfee epo server or directly to a site on the Internet to check for: Updates to content files, which contain information that Endpoint Security uses to detect threats. These files are updated as new threats are discovered to ensure that systems are always protected against the latest threats. Upgrades to software components. If new versions are available, the client software downloads them. 3 It logs security information for each managed system, including protection status and details about detections. Users can view this information in the client console on self-managed systems and on managed systems where policy settings are configured to allow it. 4 (Managed systems only) It regularly communicates with a security management server to: Send logged security information. Receive new policy assignments. The role of the security management platform Administrators can use a network security management platform to manage security for all network systems from a centralized console. If you're an administrator using a supported security management platform, you can perform these network security tasks: Deploy product software to managed systems. Manage and enforce network security using policy assignments and automated tasks. Manage protection for systems running on multiple operating system platforms. Update the product components and required security content to ensure that managed systems are secure. Create reports that display informative, user-configured charts and tables containing your network security data. Management strategies vary according to the number and location of managed systems and the way they are used. Enterprise networks for industry and government typically employ a team of IT administrators to monitor and regulate security full time. Smaller businesses might ask an employee to dedicate an hour or two a week to monitoring security, subscribe to management software hosted on a server "in the cloud," or let individual users manage security on their own systems. Endpoint Security adapts to any of these environments. 12 McAfee Endpoint Security Installation Guide

13 Product overview Security management options 1 Security management options Endpoint Security adapts to various users and settings by supporting multiple security management options. Select the right type of management for your needs based on your network's resources, the number and location of the managed systems, and the way systems are used. Self-managed systems On systems not managed with a security management platform, Endpoint Security: Supports desktops and laptops. Requires no management server or server-side components. Is installed on the local system by local users. Is configured and managed from the client console on the local system. Managed systems McAfee epo and McAfee epo Cloud enable access to additional management features, which include a management server and administrative console. Features System support Supported devices Located on premise with the management server Installation Managed with McAfee epo Servers, desktops, laptops, and tablets Yes (also manages remote devices) Managed with McAfee epo Cloud Servers, desktops, and laptops No Administrators install server-side components Yes No Administrators can install client software remotely to multiple systems Users can install client software on local systems with a URL Management Yes Yes Yes Yes Administrator uses web-based console Yes Yes Users use local client console (Optional) Yes Yes Self-management Install and manage the product directly on a local system that is not connected to a network or managed from a centralized security management platform. In this case, users run the installation wizard directly on the local system. After installation is complete, they can manage the security settings and product features directly from the client console. For example, they can schedule scans, view reports, and check for updates as needed. Management with McAfee epo Use McAfee epo to deploy and manage the product on systems located at sites with local McAfee epo servers and at remote sites managed by those servers. In this case, one or more administrators typically manage the server and the network systems where the product is installed. McAfee epo was designed for large enterprise networks, and includes new features to facilitate ease of use and to enhance extensibility for many network configurations. McAfee Endpoint Security Installation Guide 13

14 1 Product overview Security management options Managed systems follow the classic client-server model, in which they call into the management (McAfee epo) server for instructions. (To facilitate this call, a McAfee Agent is deployed to each system in the network. Once an agent is deployed to a system, the system can be managed by McAfee epo, and client software for managed products can communicate with the server.) The following figure shows how Endpoint Security integrates into a secure McAfee epo environment. 1 The administrator sets up the McAfee epo server-side components, then deploys the McAfee Agent to managed systems. The McAfee epo database stores all data about the managed systems on the network, including: System properties Policy information Directory structure Threat events (information about detections) All other relevant data that the server needs to keep managed systems up to date The McAfee Agent deployed to each system facilitates: Policy enforcement Product deployments and updates Reporting on managed systems 2 The administrator deploys client software to managed systems. Endpoint Security Client is the client software for Windows systems. McAfee epo extensions for Endpoint Security can also manage supported client software installed on Mac and Linux systems. 14 McAfee Endpoint Security Installation Guide

15 Product overview Security management options 1 3 The McAfee epo server connects to the McAfee update server to pull down the latest security content. The McAfee epo update server hosts the latest security content, so the McAfee epo software can pull the content at scheduled intervals. 4 Agent-server secure communication (ASSC) occurs at regular intervals between the systems and the McAfee epo server. Then: McAfee epo sends any available new policy assignments or product updates for the client software to the managed systems. This communication occurs shortly after the client software is installed and at regular intervals thereafter. The client software sends the security information it has logged to the server. 5 The administrator logs on to the McAfee epo console to perform security management tasks, such as running queries to report on security status or working with managed software security policies. Management with McAfee epo Cloud Use McAfee epo Cloud to deploy and manage the product on systems located at sites that do not have their own management server. In this case, McAfee hosts the server. McAfee epo Cloud was designed for small and medium networks that do not have a dedicated security management team or infrastructure in place. McAfee sets up the McAfee epo Cloud server and database "in the cloud," creates an account, makes products available to install on managed systems, and sends logon credentials to an account administrator. Managed systems follow the classic client-server model, in which they call into the management (McAfee epo Cloud) server for instructions. (To facilitate this call, a McAfee Agent is deployed to each system in the network. Once an agent is deployed to a system, the system can be managed by McAfee epo Cloud, and client software for managed products can communicate with McAfee epo Cloud.) The following figure shows how Endpoint Security integrates into a secure McAfee epo Cloud environment. McAfee Endpoint Security Installation Guide 15

16 1 Product overview Where to go from here 1 McAfee sets up the server-side components "in the cloud," including the McAfee epo Cloud server and database, then sends the URL and logon information to the administrator. 2 The McAfee epo Cloud server connects to the McAfee update server to pull down the latest security content. The McAfee update server hosts the latest security content, so the McAfee epo Cloud software can pull the content at scheduled intervals. 3 The administrator uses a browser to log on to McAfee epo Cloud, creates an installation URL, and sends it to users along with instructions for installing the client software on their systems. Endpoint Security Client is the client software for Windows systems. Endpoint Security server-side components can also manage supported client software installed on Mac and Linux systems. The URL installs the McAfee Agent (if it is not already installed) and Endpoint Security Client. The system communicates back to McAfee epo Cloud and is then managed and protected by McAfee epo Cloud. 4 Agent-server secure communication (ASSC) occurs at regular intervals between the systems and the McAfee server. Then: McAfee epo Cloud sends any available new policy assignments or product updates for the client software to the managed systems. This occurs shortly after the client software is installed and at regular intervals thereafter. The client software sends the security information it has logged to the server. 5 The administrator uses a browser to log on to McAfee epo Cloud and perform security management tasks, such as running queries to report on security status or configuring managed software security policies. Where to go from here This guide explains how to install or upgrade Endpoint Security on centrally managed and self-managed Windows systems. To install client software for Endpoint Security for Mac or Endpoint Security for Linux, see the product documentation. When you are ready to begin, follow this process. 1 Check the information in Chapter 2 to ensure that your systems and environment meet the requirements to install and run the product. Chapter 2 also describes requirements for migrating legacy products. 2 Follow the instructions in the chapter for your management environment. To install on systems managed with... Go to... McAfee epo or McAfee epo Cloud Chapter 3 Self-management (no security management platform) Chapter 4 3 See Chapter 5 for reference or troubleshooting information. 4 (Optional) For information about installing Endpoint Security Threat Intelligence, see Appendix A, Threat Intelligence installation. 16 McAfee Endpoint Security Installation Guide

17 2 Pre-installation 2 Your managed systems must have specific hardware and software to run McAfee Endpoint Security. Review these requirements and recommendations before installing your Endpoint Security software to make sure that your installation is successful. Contents System requirements Supported Internet browsers Supported security management platforms Other virus-detection and firewall software Preconfiguring the product Upgrading an existing version of the product Are you ready to install? System requirements This release supports deploying Endpoint Security to Windows operating systems. You can manage Windows, Mac, and Linux clients from McAfee epo using Endpoint Security extensions. System and hardware requirements For a complete list of current system requirements: Endpoint Security KB82761 Endpoint Security for Mac KB84934 Endpoint Security for Linux KB87073 Products no longer supported McAfee Agent Supported Internet browsers Product features have been verified to function correctly on these versions of popular browsers. URL installation requires one of these browsers and an Internet connection. Mozilla Firefox (versions 3.0 and later) Google Chrome (versions 4.0 and later) McAfee Endpoint Security Installation Guide 17

18 2 Pre-installation Supported security management platforms Microsoft Internet Explorer (versions 8, 9, 10, and 11) Safari, versions (7.1.x, 8.0.x, and 9.0.x) Endpoint Security for Mac The installation wizard works with the default security level for Internet Explorer. For other browsers, select a security level that enables Javascript. See the web browser's documentation for instructions on configuring the security level if you must change it. Supported security management platforms If you plan to manage security for network systems, you must first set up a supported management platform and place the network systems under its management. Make sure that your environment meets these requirements for the management platform: Management platform McAfee epo McAfee epo Cloud None (self-managed) Requirements An administrator has: Installed McAfee epo or later. (McAfee epo or later is recommended.) Deployed McAfee Agent or later to managed systems. See the McAfee epolicy Orchestrator Installation Guide for instructions. McAfee or another service provider has set up your account, installed server-side components, and sent you logon credentials for McAfee epo Cloud. An administrator has deployed McAfee Agent or later to managed systems. For the latest Endpoint Security management license and entitlement information, see KB See the McAfee epolicy Orchestrator Cloud Installation Guide for instructions. You have installed McAfee Agent 4.0 or later on your system. Endpoint Security 10.2 requires McAfee Agent or later. Endpoint Security 10.2 automatically upgrades version 4.0 and later of the agent to version during product upgrades. You can also upgrade the agent manually. See also Upgrade the McAfee Agent on McAfee epo-managed systems on page 27 Upgrade the McAfee Agent on self-managed systems on page McAfee Endpoint Security Installation Guide

19 Pre-installation Other virus-detection and firewall software 2 Other virus-detection and firewall software It is not necessary to uninstall existing virus-detection and firewall products on managed systems before installing Endpoint Security. The installation wizard detects these products and resolves most conflicts automatically. If the Windows firewall is enabled The wizard disables the Windows firewall automatically to prevent conflicts. If incompatible virus detection or firewall software is installed The wizard attempts to uninstall the software. If it can't, it prompts the user to cancel the installation, uninstall the incompatible software manually from the Windows Control Panel, then resume the installation. Installation resumes where it left off. See KB85522 for a list of the software products uninstalled automatically. If you have incompatible software that does not appear on this list, manually uninstall it before installing Endpoint Security. Users might be prompted to reboot their systems after uninstalling firewall software. If McAfee Host Intrusion Prevention is installed The Endpoint Security Firewall replaces the Host Intrusion Prevention Firewall, and you can also migrate your Host Intrusion Prevention Firewall settings to the new Endpoint Security Firewall. Host Intrusion Prevention (without its firewall module) can run side by side with the Endpoint Security Firewall. You are not required to upgrade to Endpoint Security Firewall or migrate your settings. You can continue to run the McAfee Host IPS Firewall after installing Endpoint Security Firewall. Whenever McAfee Host IPS Firewall is installed and enabled, Endpoint Security Firewall is disabled even if enabled in the policy settings. If McAfee Deep Defender is installed You must remove this conflicting product manually or with a client task before installing Endpoint Security. Preconfiguring the product You can customize settings for product features before deploying the product to managed systems. Preconfiguration enables you to meet specific requirements, for example, in environments with security compliance standards. Preconfigured policy settings take effect on installation. Overview of preconfiguration process The process of preconfiguring policy settings includes these tasks: 1 Customize policies with the settings required for your environment. 2 Create a custom product package that includes the preconfigured policies. The Endpoint Security Package Designer steps you through this process. 3 Check in components from the custom product package to a location accessible by your deployment software. For McAfee epo, this is the Master Repository. 4 Deploy the policy settings to managed systems. Use McAfee epo or a third-party deployment tool. See your management platform's product guide for instructions about configuring and assigning policies. See the Endpoint Security Help for information about the features you can configure. If you migrate settings from legacy products to Endpoint Security, policies included in a custom package take precedence over legacy policies. In these cases, the custom policy settings are applied instead of the legacy settings. McAfee Endpoint Security Installation Guide 19

20 2 Pre-installation Preconfiguring the product Best practice McAfee preconfigures features with default settings that protect systems in medium-risk environments. These settings ensure that systems can access important websites and applications until there is time to customize the settings. When customizing product features, make sure to configure: Where and how managed systems get updates. How often and what time of day managed systems check for updates. Access to required websites and applications without interruption. Create custom packages with Endpoint Security Package Designer The Endpoint Security Package Designer steps you through the process of creating a product package.zip file that contains preconfigured custom policies. Before you begin You have installed Endpoint Security on managed systems. Package Designer checks to verify that it is installed. You have a source package to customize, if needed, as part of this process. You have downloaded and installed Package Designer. Endpoint Security Package Designer is a standalone tool (not included with Endpoint Security) that you can download. Use this tool to create a custom package using existing Endpoint Security settings or customized settings on a client system. You can then deploy the custom package files in one of these ways: As a standalone installer Using McAfee epo Using a third-party network deployment tool For information about installing and using Package Designer, see KB Task For details about product features, usage, and best practices, click? or Help. 1 Open the Package Designer wizard. 2 On the Select Folders screen, select the source package file and destination folder for the custom package. a Browse to the package you want to create. b c d Browse to the folder where you want to create the package. (Optional) Specify a custom name for the package. The.zip file extension is appended to the file name automatically. Click Next. 3 On the Modify Package screen, click Edit Settings and make changes to the settings if needed, then click Next. 20 McAfee Endpoint Security Installation Guide

21 Pre-installation Preconfiguring the product 2 4 On the Create Package screen, review and verify your selections and the content of the custom package, then click Create. A progress bar displays the status of your request. 5 On the Package Completed screen, select an option: Open Package Location Navigates to the folder where the package was created. From there, you can check in the package to the Master Repository in McAfee epo for deployment or deploy it by using third-party software. Best practice: Test custom packages before deploying them to your McAfee epo environment. Finish Exits the wizard. Install custom packages with McAfee epo Use McAfee epo to install a custom package that you created with the Endpoint Security Package Designer. Before you begin You have created a package with custom policies and copied it to a location that is accessible from your McAfee epo server. You can use a third-party network deployment tool to deploy custom package files. See its product documentation for more information. Task For details about product features, usage, and best practices, click? or Help. 1 Navigate to the folder where you created the custom package, then extract the files. From the Package Designer, click Open Package Location in the Package Completed screen, or navigate to the location manually. 2 In McAfee epo, go to the Master Repository, then click Check In Package. 3 On the Package tab of the Check In Package screen, select the package to check in. a b c For Package type, select Product or Update (.ZIP). For File path, click Choose File, navigate to the custom package, then click Open. Click Next. 4 On the Package Options tab, verify the package information and select the branch where you want to install the package, then click Save. 5 Repeat steps 2 4 for each.zip file you extracted from the custom package. 6 To install the files you have checked in on managed systems, create a client deployment task. McAfee Endpoint Security Installation Guide 21

22 2 Pre-installation Upgrading an existing version of the product Upgrading an existing version of the product If a previous supported version of one or more product modules is installed currently in your environment, you can upgrade to Endpoint Security. If you are upgrading legacy products, such as VirusScan Enterprise, you can also migrate your custom settings. Upgrading Endpoint Security Use the installation wizard to install the new Endpoint Security product modules side by side with your existing products. You can continue to use both product versions until you are ready to remove the older ones. You can use the McAfee Agent to manage systems running versions of the Endpoint Security Client. Migrating or preserving legacy product settings When you upgrade these legacy products, you can migrate (or preserve) some of your custom product settings: Products that migrate (all patch levels) McAfee VirusScan Enterprise 8.8 McAfee Host Intrusion Prevention Firewall 8.0 McAfee Host Intrusion Prevention 8.0 McAfee SiteAdvisor Enterprise 3.5 McAfee Endpoint Protection for Mac 2.3 McAfee VirusScan for Mac 9.8 McAfee VirusScan Enterprise for Linux Settings that migrate Policies Migrate workstation and server policies separately if you have both defined. Client tasks Host IPS Catalog Renamed Firewall Catalog in Endpoint Security. Firewall and General policies IPS Rules policy: Excluded Application Protection Rules IPS Exceptions Custom signatures IPS Protection policy Policies Client tasks Anti-malware policy: On-access Scan Exclusions: On-access Scan On-Access Scanning policy On-Demand Scanning client tasks Best practice: Before migrating, review your legacy settings to make sure that they are up to date, then consolidate, remove duplicates, and remove unused settings, policies, and client tasks. 22 McAfee Endpoint Security Installation Guide

23 Pre-installation Are you ready to install? 2 On self-managed systems The installation wizard allows you to preserve your legacy settings when you upgrade to Endpoint Security. In McAfee epo environments Use the Endpoint Migration Assistant to create Endpoint Security policies based on your current legacy product settings. You can let the Migration Assistant migrate all your settings automatically, or you can select which policies to migrate, then configure new settings manually. The Migration Assistant also migrates client tasks and other settings. For more information, see the McAfee Endpoint Security Migration Guide and Help. Are you ready to install? When your environment meets the requirements specified in this chapter, you are ready to begin installation. These components... All systems where you want to install the product Meet these requirements Hardware components meet or exceed minimum requirements. Supported operating system is installed. Supported web browser is installed. Managed systems only Management server Required agent is installed and communicating with the management server. (Upgrade) Supported version of software is installed. Supported management platform is installed. (Optional) You have preconfigured policy settings for product features as needed. (Upgrade) Supported version of extension is installed. (Optional) Your environment meets the requirements for Threat Intelligence, and you are prepared to install and configure its components. If you plan to: Migrate your custom settings for legacy products in McAfee epo environments Check requirements in the McAfee Endpoint Security Migration Guide. Install Threat Intelligence See Appendix A, Threat Intelligence installation, for information about installing and setting up the components. Threat Intelligence is an optional Endpoint Security module. Install compatible client software on Mac and Linux systems See the product documentation for Endpoint Security for Mac and Endpoint Security for Linux. McAfee Endpoint Security Installation Guide 23

24 2 Pre-installation Are you ready to install? 24 McAfee Endpoint Security Installation Guide

25 3 Installation 3 for systems managed with McAfee epo and McAfee epo Cloud Use this information to install the product on Windows systems managed with McAfee epo and McAfee epo Cloud. Contents Installation overview Upgrade the McAfee Agent on McAfee epo-managed systems Install the product files on the management server Download Endpoint Security content files Deploy to multiple systems with deployment tasks Install on local systems with an installation URL Verify the installation Uninstall from systems managed with McAfee epo or McAfee epo Cloud Installation overview In McAfee epo and McAfee epo Cloud environments, administrators can deploy the product software remotely to managed systems or ask users to install it locally. For McAfee epo, they must also install product software on the management server. Management environment characteristics The primary differences in managing the two environments are: McAfee epo Administrators install product components on the management server, then they typically configure feature settings and deploy the client software to multiple managed systems using deployment tasks. McAfee epo Cloud McAfee or another service provider sets up each McAfee epo Cloud account on an offsite management server and notifies the local administrator when products are ready to install on managed systems. Local administrators then typically create and send an installation URL to users for installation on local systems. In McAfee epo Cloud environments, you must have administrative logon credentials for a McAfee epo Cloud account before installing the product. McAfee or your service provider sends these to you in an . If you have not previously activated and configured an account, see the McAfee epo Cloud product guide for instructions. For the latest Endpoint Security management license and entitlement information, see KB McAfee Endpoint Security Installation Guide 25

26 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Installation overview Endpoint Security supports both URL installation and deployment tasks in either environment. As an administrator, you can choose the method that best suits your needs. If you are installing Threat Intelligence, see Appendix A, Threat Intelligence installation, for additional steps. Threat Intelligence is an optional Endpoint Security module. Installation and upgrade process Task Description 1 Ensure that all managed systems meet the requirements described in Chapter 2, Pre-installation. McAfee epo or McAfee epo Cloud Both Notes 2 Upgrade McAfee Agent, if needed. McAfee epo Endpoint Security 10.2 requires McAfee Agent or later. If running an earlier version, upgrade the agent manually. 3 Prepare policies as needed. If you are migrating legacy policies Review and revise your settings to eliminate unused, outdated, and duplicate settings. If you are preconfiguring policies Create a custom package. McAfee epo Only for migration or preconfigured settings 4 Open the management console. (Open your web browser and log on to your account.) Both 5 Install the product files on the McAfee epo server. McAfee epo 6 Manually update your McAfee epo server with the latest content files required for Endpoint Security: AMCore, Exploit Prevention, and (if applicable) Threat Intelligence content files. 7 Migrate policies, client tasks, and other settings from supported legacy products. McAfee epo McAfee epo Only for migration See the McAfee Endpoint Security Migration Guide for more information. 8 Configure policies as needed. Both Optional 9 Deploy the client software with default or custom settings to managed systems in one of these ways: Remotely to multiple managed systems with deployment tasks Preferred for McAfee epo. Locally on managed systems with an installation URL Preferred for McAfee epo Cloud. Best practice: Reboot the managed system after installing this release of the product. Both 10 Verify that the client software is installed and up to date on all managed systems. Both See also Create custom packages with Endpoint Security Package Designer on page 20 Preconfiguring the product on page McAfee Endpoint Security Installation Guide

27 Installation for systems managed with McAfee epo and McAfee epo Cloud Upgrade the McAfee Agent on McAfee epo-managed systems 3 Upgrade the McAfee Agent on McAfee epo-managed systems Endpoint Security 10.2 requires McAfee Agent or later. On managed systems running an earlier version, you need to upgrade the McAfee Agent manually before deployment. For McAfee epo Cloud, no action is required to upgrade McAfee Agent. The new agent is installed automatically on managed systems from the McAfee epo Cloud installation URL sent to users. For Windows systems, running McAfee Host IPS 8.0 (Patch 4 or earlier) and McAfee Agent version 5.0 (or later) causes communication between McAfee epo and the agent to be blocked. See KB82869 for instructions to resolve this issue. Task For details about product features, usage, and best practices, click? or Help. 1 Download and deploy the package. 2 Log on to McAfee epo as administrator: 3 Select Menu Extensions, click Install Extension, and select the EPOAGENTMETA.zip file. 4 Select Menu Master Repository, click Check In Package, and select the MA-WIN zip file. 5 Deploy the new McAfee Agent using one of these methods: Create a deployment task to push the new package to the client systems: Select New Product Deployment, then click New Deployment. Create and distribute a new deployment URL. When you check in the new McAfee Agent, which overwrites the previous version, any deployment URL created with the previous version no longer works. You must create and distribute a new URL with the new McAfee Agent. 1 Select Menu System Tree, then select the subgroup that contains the systems to deploy to. 2 On the Agent Deployment tab, click Create Agent Deployment URL. 3 Enter the URL name, verify the agent version, then click OK. 4 Distribute the URL for new deployments. For more information about deployment, see the McAfee epo Help. Install the product files on the management server In McAfee epo environments only, install server-side components for Endpoint Security on the McAfee epo server as the first step in the installation process. Before you begin Your network security management platform must meet the requirements described in Chapter 2, Pre-installation. This task installs two types of product components on the management server: McAfee Endpoint Security Installation Guide 27

28 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Download Endpoint Security content files Product management extensions Add Endpoint Security Client management features (such as queries, client tasks, and online Help) to the McAfee epo server. These enable you to manage the product from the console. Product deployment packages Add Endpoint Security Client software files to the Master Repository. You can then deploy them to managed systems. Task For details about product features, usage, and best practices, click? or Help. 1 On the security management console, select Menu Dashboards, then select Guided Configuration from the drop-down list. 2 On the Guided Configuration screen, click Begin. 3 Click Software Selection, then: a Under the Software Not Checked In product category, click Licensed to display available products. b c In the Software table, select the product you want to check in. The product description and all available components are displayed in the table below. Click Check In All to check in product extensions to your McAfee epo server, and product packages to your Master Repository. When installation is complete, the extensions are listed on the Extensions page and the packages are listed in the Master Repository. You can now deploy the product to managed systems. Download Endpoint Security content files You must manually update your McAfee epo server with the latest AMCore, Exploit Prevention, and Threat Intelligence content files required for Endpoint Security. Before you begin The Endpoint Security 10.2 packages are checked in to the Master Repository on your McAfee epo server. Task For details about product features, usage, and best practices, click? or Help. 1 In McAfee epo, select Menu Automation Server Tasks to open the Server Task Catalog. 2 Edit the Update Master Repository server task. 3 Click the Actions tab. 4 For the Repository Pull action, ensure that the following are set: Source site: McAfeeHttp Package types: All packages 5 Click Save to save the task. 6 For the Update Master Repository server task, click Run. 28 McAfee Endpoint Security Installation Guide

29 Installation for systems managed with McAfee epo and McAfee epo Cloud Deploy to multiple systems with deployment tasks 3 The Master Repository now includes the AMCore Content Package and the Endpoint Security Exploit Prevention Content package required by Endpoint Security. If you have installed Endpoint Security Threat Intelligence, it also includes the Endpoint Security Threat Intelligence Content package. Deploy to multiple systems with deployment tasks Automated tasks simplify the processes for deploying the client software to managed systems. This method deploys remotely from the security management console and does not require any user assistance. Before you begin The systems where you want to install the product must meet the requirements described in Chapter 2, Pre-installation. In a McAfee epo environment, you must have installed the product's server-side components on the McAfee epo server. In a McAfee epo Cloud environment, you must have administrative logon credentials for a McAfee epo Cloud account. McAfee or your service provider sends these in an . Task You can use two types of automated tasks to deploy product software to multiple managed systems: product deployment tasks and client tasks. Product deployment tasks are simpler to set up, and this guide explains the process. See the McAfee epo or McAfee epo Cloud product guide for more information about configuring and running product deployment tasks and client tasks. 1 On the security management console, select Menu Software Product Deployment. 2 On the Product Deployment page, click New Deployment. 3 On the New Deployment page, configure these settings, then click Save at the top of the page. Option Name and Description Type Package Language and Branch Description Type a name and description for this deployment. This name appears on the Deployment page after the deployment is saved. From the list, select the type of deployment. Fixed Deploys only to the selected systems. Continuous Deploys to systems based on System Tree groups or tags. This option allows these systems to change over time as they are added or removed from the groups or tags. If you want to automatically install product updates when they are available, select Auto Update. This option deploys the hotfixes and patches for your product automatically. From the list, select McAfee Endpoint Security. If needed, select the Language and Branch, if not using the defaults. McAfee Endpoint Security Installation Guide 29

30 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Install on local systems with an installation URL Option Command line Select the systems Select a start time Description In the text field, specify a command line with installation options for the module you are installing. These options are supported: /INSTALLDIR="install_path" /l"install_log_path" /l*v"install_log_path" /nocontentupdate Click Select Systems to open the System Selection dialog box and select the systems where you want to deploy the client software. If needed, configure the following: Run at every policy enforcement (Windows only) Allow end users to postpone this deployment (Windows only) Maximum number of postponements allowed Option to postpone expires after Display this text Select a start time or schedule for your deployment: Run Immediately Starts the deployment task the next time the systems check for updates from the management server. Once Opens the scheduler so you can configure the start date, time, and randomization. The Product Deployment page opens with your new project added to the list of deployments. Also, a client task is automatically created with the deployment settings. 4 Check the status of the deployment on the Product Deployment page. Click the deployment task in the list on the left side of the page to display its details on the right side of the page. See also SETUP command-line options (McAfee epo and McAfee epo Cloud deployment tasks) on page 44 Install on local systems with an installation URL Typically, McAfee epo Cloud administrators create an installation URL that can be used to install Endpoint Security Client on managed systems. They can: Use this URL to install the client software locally on their own system. Send this URL to users with instructions for installing the client software on their local systems. McAfee epo also supports URL installation. 30 McAfee Endpoint Security Installation Guide

31 Installation for systems managed with McAfee epo and McAfee epo Cloud Install on local systems with an installation URL 3 Tasks Create an installation URL on page 31 Create a URL for installing the client software on a local system. Then use it to install the client software on your own local system or send it to end users to install the client software on their systems. Install with an installation URL on page 32 Install the product on a local system with an installation URL. Create an installation URL Create a URL for installing the client software on a local system. Then use it to install the client software on your own local system or send it to end users to install the client software on their systems. Before you begin In a McAfee epo environment, the product extensions must be installed on the McAfee epo server, and the product content must be available in the Master Repository. In a McAfee epo Cloud environment, you must have administrative logon credentials for a McAfee epo Cloud account. McAfee or your service provider sends these to you in an . Task For details about product features, usage, and best practices, click? or Help. 1 Open the security management console and begin the deployment in one of these ways. On this platform... McAfee epo Perform these steps... 1 Open your browser and log on to McAfee epo. 2 Select Menu Dashboards, then click Getting Started with epolicy Orchestrator. The product modules installed on managed systems are listed under Product. 3 Click Start Deployment. The Product Deployment page opens. McAfee epo Cloud 1 Open your browser and log on to McAfee epo Cloud. 2 Select Menu Dashboards, then click Getting Started with epolicy Orchestrator. The product modules installed on managed systems are listed under Product. The Welcome to McAfee Security page opens. 2 Create an installation URL with default or custom settings. McAfee Endpoint Security Installation Guide 31

32 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Install on local systems with an installation URL To do this... In McAfee epo In McAfee epo Cloud Deploy all product modules with their default security settings Customize the deployment Click Deploy. The Welcome to epolicy Orchestrator page displays the software deployment URL. 1 Click Customize. 2 Configure these settings: Group Name Select the default group name or enter a custom group name. Operating System Select McAfee Agent for Windows. Software and Policies Select McAfee Endpoint Security product modules to install and, if needed, click McAfee Default Policies and Tasks to select an alternative preconfigured policy. Auto Update Specify whether to download the latest version of the software automatically whenever an update occurs. Click Install Protection on Other Computers. A page displays the software deployment URL. 1 Click Customize Installation. 2 Configure these settings, then click Done: Group Name Select the default group name or enter a custom group name. Operating System Select McAfee Agent for Windows. Software and Policies Select McAfee Endpoint Security product modules to install and, if needed, click McAfee Default Policies and Tasks to select an alternative preconfigured policy. Auto Update Specify whether to download the latest version of the software automatically whenever an update occurs. 3 Click Deploy. A page displays the software deployment URL. 3 Click Install Protection on Other Computers. A page displays the software deployment URL. 3 (McAfee epo Cloud only) Install the product on your local system using one of these methods: Click Install Protection on This Computer. Copy and past the URL into a new browser window. A window opens with a web-based installation wizard. 4 Send the URL to users. a Copy this URL to a text file, then click OK to close the dialog box. b Send the URL in an message with any special instructions for installing on local systems. Install with an installation URL Install the product on a local system with an installation URL. Before you begin The system where you install the product must meet the requirements described in Chapter 2, Pre-installation. You must have an installation URL that you created or received from your administrator. 32 McAfee Endpoint Security Installation Guide

33 Installation for systems managed with McAfee epo and McAfee epo Cloud Verify the installation 3 Task For details about product features, usage, and best practices, click? or Help. 1 Open a web browser window and paste in the installation URL. 2 Follow the instructions on the screen to install. If the installation does not start automatically, click Install. Click Run if prompted to run or save. Click Run if prompted to verify the installation. A dialog box displays the progress of the installation and indicates when it is complete. If needed, you can click Cancel to stop the installation. The installation log, McAfeeSmartInstall_<date>_<time>.log, is saved in <LocalTempDir> \McAfeeLogs (for example, C:\Windows\Temp\McAfeeLogs). Verify the installation After deployment, verify that the client software installed and updated correctly on managed systems. After a URL installation, verify that the list of systems matches the list of users you sent the installation URL to. Task For details about product features, usage, and best practices, click? or Help. 1 Wait for client systems to report back to the security management platform (typically after an hour or two). 2 On the security management console, select Menu Dashboards, then select Endpoint Security: Installation Status for a complete listing of the managed systems where the software was installed and their status. Uninstall from systems managed with McAfee epo or McAfee epo Cloud You can remove product modules from managed systems remotely from the management console or locally at the managed system. You might do this for testing or before reinstalling the client software. Best practice: Reinstall the client software as soon as possible. When it is uninstalled, the system is not protected against threats. Task For details about product features, usage, and best practices, click? or Help. Remove the client software using one of these methods. McAfee Endpoint Security Installation Guide 33

34 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Uninstall from systems managed with McAfee epo or McAfee epo Cloud To uninstall... From multiple systems remotely Do this... Run a product deployment task: 1 On the security management console, select Menu Policy Product Deployment. 2 Duplicate the task you used to install the product modules, then specify Remove as the Action. 3 After the task has completed, verify that the client software was uninstalled from the selected systems. Click Dashboards, then select Endpoint Security: Installation Status. See the McAfee epo or McAfee epo Cloud product guide for more information about using product deployment tasks. At the local managed system Uninstall from the Windows Control Panel: 1 Open the Windows Control Panel, then go to the Uninstall Programs screen. 2 In the list of programs, select each product module, then click Uninstall. McAfee Endpoint Security Firewall 10.2 McAfee Endpoint Security Threat Prevention 10.2 McAfee Endpoint Security Web Control 10.2 McAfee Endpoint Security Platform 10.2 Endpoint Security Platform (Common module) is uninstalled automatically with the last product module. 3 If prompted, enter a password for each module. By default, no password is required. 34 McAfee Endpoint Security Installation Guide

35 4 Installation 4 for self-managed systems Use this information to install the product on systems that are not managed by a centralized network management tool. Contents Installation overview for self-managed systems Upgrade the McAfee Agent on self-managed systems Install with the installation wizard Install from the command line Verify the installation Uninstall from a self-managed system Installation overview for self-managed systems Local system users perform these high-level tasks to install or upgrade the product on self-managed systems. 1 Make sure that the system meets the requirements described in Chapter 2, Pre-installation. 2 (Optional) If you are upgrading legacy products and plan to preserve your settings, review and revise them as needed. 3 Upgrade the McAfee Agent, if needed. Endpoint Security 10.2 requires McAfee Agent or later. Endpoint Security 10.2 automatically upgrades version 4.0 and later of the agent to version during product upgrades. You can also upgrade the agent manually. 4 Copy the product files to the self-managed system. Depending on how you purchased the product, you might need to download product files from a download site or copy them from a disc. 5 Launch the installation wizard to install or upgrade the product. 6 Verify that the client software is installed and up to date. 7 (Optional) If you upgraded from legacy products and preserved your settings, verify that the settings were preserved. Best practice: Reboot the system after installing this release of the product. See also Upgrading an existing version of the product on page 22 McAfee Endpoint Security Installation Guide 35

36 4 Installation for self-managed systems Upgrade the McAfee Agent on self-managed systems Upgrade the McAfee Agent on self-managed systems Endpoint Security 10.2 requires McAfee Agent or later. Endpoint Security 10.2 automatically upgrades version 4.0 and later of the agent to version during product upgrades. You can also upgrade the agent manually. Task For details about product features, usage, and best practices, click? or Help. 1 Download the McAfee Agent client package from the download site. 2 Unzip the McAfee Agent package and locate the FramePkg_Upd.exe file. 3 Right-click FramePkg_UPD.exe, then select Run as administrator. Install with the installation wizard The installation wizard automates much of the process for installing and upgrading the product on self-managed systems. Before you begin The systems where you install the product must meet the requirements described in Chapter 2, Pre-installation. Task For details about product features, usage, and best practices, click? or Help. 1 Obtain your copy of the product software, then launch the installation wizard on the self-managed system. For this product format... Download Perform these steps... Download the Endpoint Security.zip file, unzip the contents of the file, then double-click setupep.exe. If you purchase the product online, McAfee or another provider sends instructions and a URL for downloading the product. CD or DVD Insert the disc into a drive, open the contents, then double-click setupep.exe. If there is a product license number on the disc label or packaging, make sure that you have a copy for reference. 2 On the License Agreement page, click Accept. 3 Resolve any conflicts detected by the wizard. The wizard attempts to uninstall conflicting virus-detection and firewall software products automatically. If it can't, it prompts you to uninstall them manually, then prompts you to reboot. If you reboot immediately, installation resumes after the system restarts. If you reboot later, run the installation wizard again at your earliest convenience. See KB85522 for a list of the software products uninstalled automatically. 36 McAfee Endpoint Security Installation Guide

37 Installation for self-managed systems Install from the command line 4 4 On the Install Options page, select the modules to install. Install all product modules that you purchased with their default settings, or select options to customize your installation. 5 If you are upgrading VirusScan Enterprise 8.8, Host Intrusion Protection 8.0, or SiteAdvisor Enterprise 3.5, select whether to preserve your settings. 6 Click Install. A dialog box shows the progress of the installation and notifies you when it is complete. You can cancel the installation at any time, if needed. 7 Click Finish to close the wizard. See also Other virus-detection and firewall software on page 19 Install from the command line You can run the installation wizard from the command line, which lets you select additional options, such as silent installation. (By default, installation is interactive.) Before you begin The system where you install the product must meet the requirements described in Chapter 2, Pre-installation. For silent installation, the wizard displays no feedback. All information is available in logs. For interactive command-line installation, the wizard displays a progress window and allows you to cancel the installation, if needed. All information is available in logs. Task 1 Copy the product files to the self-managed system. Depending on how you purchased the product, you might need to download product files from a download site or copy them from a disc. 2 Open a Command Prompt window, navigate to the folder where you copied the files, then type this command and any applicable parameters, which are not case-sensitive: setupep.exe /parameters Type setupep.exe /help for a complete list of command-line options for the SETUP utility, or see SETUP command-line options (self-managed). Best practice: Reboot the system after installing this release of the product. See also SETUP command-line options (self-managed) on page 45 Verify the installation After installation is complete, verify that the modules installed successfully and the system is up to date. If you migrated settings from legacy products, verify that your settings migrated correctly. McAfee Endpoint Security Installation Guide 37

38 4 Installation for self-managed systems Uninstall from a self-managed system Task For details about product features, usage, and best practices, click? or Help. 1 Open the Windows Control Panel and verify that the name of each module you selected to install appears and that version 10.2 is installed. McAfee Endpoint Security Firewall McAfee Endpoint Security Threat Prevention McAfee Endpoint Security Web Control McAfee Endpoint Security Platform 2 Open the installation log file and make sure that no errors or failure messages appear. By default, the installation wizard installs the installation log files in the user Temp folder as %Temp% \McAfeeLogs (for example, C:\Users\username\AppData\Local\Temp\McAfeeLogs). 3 Open the Endpoint Security Client, then click Update Now to ensure that the system is up to date. If your system is up to date, the page displays No Updates Available and the date and time of the last update. 4 (Upgrade only) If you upgraded legacy products with preserved settings, check the client Settings page for each product module to verify that legacy settings were migrated. Uninstall from a self-managed system You can remove product modules on a self-managed system from the Windows Control Panel. You might do this for testing or before reinstalling the client software. You can also uninstall the product modules from a command line. See SETUP command-line options (self-managed) in Chapter 6, Troubleshooting and reference. Best practice: Reinstall the client software as soon as possible. When it is uninstalled, the system is not protected against threats. Task 1 Open the Windows Control Panel, then go to the Uninstall Programs screen. 2 In the list of programs, select each product module, then click Uninstall. McAfee Endpoint Security Firewall McAfee Endpoint Security Threat Prevention McAfee Endpoint Security Web Control McAfee Endpoint Security Platform Endpoint Security Platform (Common module) is uninstalled automatically with the last product module. 3 If prompted, enter a password for each module. By default, no password is required. 38 McAfee Endpoint Security Installation Guide

39 Installation for self-managed systems Uninstall from a self-managed system 4 4 Wait for the wizard to report that it has uninstalled the support components. If you do not see a notification, check the Event Log to verify that the Endpoint Security Platform was removed successfully. 5 If no other protection services are installed, select McAfee Agent in the Uninstall Programs screen of the Windows Control Panel, then click Uninstall. See also SETUP command-line options (self-managed) on page 45 McAfee Endpoint Security Installation Guide 39

40 4 Installation for self-managed systems Uninstall from a self-managed system 40 McAfee Endpoint Security Installation Guide

41 5 Troubleshooting 5 and reference Use this information for basic product maintenance, troubleshooting, and reference. Contents Troubleshooting installation problems Resolving error codes and messages Using command-line options Log files Troubleshooting installation problems Follow troubleshooting procedures to resolve problems related to installing and uninstalling the product, and capture the required system information. Test malware detection Test the virus detection feature of Threat Prevention by downloading the EICAR Standard AntiVirus Test File to the local system. Although it is designed to be detected as a virus, the EICAR test file is not a virus. Task 1 Download the EICAR file from this location: If installed properly, Threat Prevention interrupts the download and displays a threat detection dialog box. 2 Click OK. If not installed properly, Threat Prevention does not detect the virus or interrupt the download process. In this case, use Windows Explorer to delete the EICAR test file from the client computer, then reinstall the product and test the new installation. Using the MER tool for troubleshooting The MER (Minimum Escalation Requirements) tool collects McAfee data from Endpoint Security and other McAfee products from your computer. McAfee support uses this data to analyze and resolve your problem. McAfee Endpoint Security Installation Guide 41

42 5 Troubleshooting and reference Resolving error codes and messages The information collected by the MER tool includes: Registry details Event logs File version details Process details Files McAfee provides two versions of MER: WebMER runs on the client computer. See How to use MER tools with supported McAfee products. MER tool for McAfee epo uses McAfee epo to run the MER tool on client computers. See How to use the MER tool for McAfee epo. Resolving error codes and messages Error messages are displayed by programs when an unexpected condition occurs that can't be fixed by the program itself. Use this list to find an error message, an explanation of the condition, and any action you can take to correct it. Depending on how you launched the installation wizard, it displays a description of the error or an error code. Message Description Solution Conflicting McAfee product(s) found. Error code: The installation wizard detected one or more conflicting McAfee products (such as Deep Defender) on the system that it can't remove automatically. Uninstall the conflicting products, then try installing again. Administrator rights required. Error code: You must have administrator rights to run the installation wizard. Log on as an administrator, then launch the installation wizard. Invalid Package. Error code: Removal failed. Error code: Invalid package found. Please verify that you have a valid package. The installation wizard couldn't remove a previous version of this product (such as a beta version) or a legacy product (such as VirusScan Enterprise or SiteAdvisor Enterprise) from the system. Download a valid package file, then try installing the product again. Remove these products manually before installing Endpoint Security. Contact support if the issue persists. Installer failed to launch. Error code: The installation wizard was not able to launch. Contact McAfee support. Restart required Error code: Restart required Error code: The installation wizard requires a system restart to continue the installation. The installation wizard requires a system restart to complete the installation. Restart the system to continue with the installation. Restart the system to complete the installation. 42 McAfee Endpoint Security Installation Guide

43 Troubleshooting and reference Resolving error codes and messages 5 Message Description Solution Restart pending Error code: A system restart from a previous installation or removal operation is pending. Restart the system to continue with the installation. Incompatible software removal failed. Error code: The installation wizard tried and failed to remove one or more incompatible software products it detected on the system. Remove these products manually before installing Endpoint Security. Installation canceled. Error code: Migration failed. Error code: Installation failed. Error code: Your system is not protected. Your previous security software was uninstalled, but the installer was interrupted before McAfee Endpoint Security was installed. Call McAfee support for assistance as soon as possible. Your system is not fully protected. The installer could not install [product name]. Call McAfee support for assistance. The user canceled the installation before it completed. The installation wizard made no changes to the user's system. The installation wizard tried to migrate settings from a legacy product, but it encountered an error. The installation wizard was interrupted before it finished installing Endpoint Security. It made no changes to your system. Error code: 16029, 16030, The installation wizard was interrupted before Endpoint Security was installed. Your previous software was uninstalled, but no other changes were made to your system. Error code: Policy import failed. Error code: Policy import failed. Error code: Installation failed and then rollback failed. One or more Endpoint Security product modules failed to install. Your previous software was uninstalled. The installation wizard installed Endpoint Security successfully, but couldn't import the specified policy. The installation wizard couldn't import the specified policy. Error code: The installation wizard couldn't install Endpoint Security or roll back the changes it made to the user's system. Run the installation wizard again. Run the installation wizard again at a later time. Run the installation wizard again at a later time. To protect your system against threats, contact McAfee support as soon as possible. To fully protect your system against threats, call McAfee support as soon as possible. Check that you selected the proper data to import. Contact support if the issue persists. Check that you selected the proper data to import. Contact McAfee support if the issue persists. Check the installation logs on the system and contact McAfee support for assistance. McAfee Endpoint Security Installation Guide 43

44 5 Troubleshooting and reference Using command-line options Message Description Solution Installation canceled and then rollback failed. Error code: The installation was canceled before it completed. The installation wizard couldn't roll back the changes it made to the user's system. Check the installation logs on the system and contact McAfee support for assistance. Another installation wizard is already running. Installation failed. Error code: 1618 Another installation is already in progress. Error code: various The installation wizard couldn't install Endpoint Security. It made no changes to the user's system. Complete that installation before proceeding with the new installation. See MsiExec.exe and InstMsi.exe Error Messages for descriptions of specific error codes. If the issue persists, contact McAfee support. Using command-line options Use command-line options to customize product installation and uninstallation from the command line. Supported options differ by product platform. SETUP command-line options (McAfee epo and McAfee epo Cloud deployment tasks) Use these command-line options within a deployment task to install the product on systems managed with McAfee epo and McAfee epo Cloud. For each product module selected in a product deployment task, type supported options in the corresponding Command line window. (Do not type the command, type only the options.) Options are not case-sensitive. Example INSTALLDIR="D:\Installed Programs" /l"d:\installed Programs\logs" Installs the product files to a folder on drive D under My Programs and saves the installation log files to a folder under My Log Files. 44 McAfee Endpoint Security Installation Guide

45 Troubleshooting and reference Using command-line options 5 Option INSTALLDIR="install_path" /log"install_log_path" or / l"install_log_path" /l*v"install_log_path" /nocontentupdate Definition Specifies where to install the product files on the computer. The installation wizard creates an Endpoint folder at the specified location and installs the product to this folder. Example: INSTALLDIR="D:\Installed Programs" Installs the product modules under D:\Installed Programs \EndPoint\. By default, product files are installed in the folder C:\windows \Temp\McAfeeLogs. Specifies where to save the installation log files for tracking installation events. The installation wizard creates an Endpoint folder at the specified location and saves the log files to this folder. Example: /l"d:\log Files" Installs the product log files under D:\Log Files\EndPoint\. By default, log files are saved in the Windows System TEMP folder C:\windows\Temp\McAfeeLogs. *v Specifies verbose (more descriptive) logging entries. Does not update product content files automatically as part of the installation process. The managed system is not fully protected until the product content files are downloaded. Schedule an update as soon as possible. See also Download Endpoint Security content files on page 28 Log files on page 47 SETUP command-line options (self-managed) Use these options with the SETUP utility to install the product from a command line. Open a Command Prompt window, then run the SETUP command using the appropriate command-line options. Options are not case-sensitive. Example setupep.exe INSTALLDIR="D:\My Programs" /l"d:\my Log Files" Installs the product files to a folder on drive D under My Programs and saves the installation log files to a folder under My Log Files. Basic options setupep.exe ADDLOCAL="tp,fw,wc" [INSTALLDIR="install_path"][/qb][/qb!][/ l*v"install_log_path"] All options McAfee Endpoint Security Installation Guide 45

46 5 Troubleshooting and reference Using command-line options setupep.exe ADDLOCAL="tp,fw,wc" [INSTALLDIR="install_path"][/qb][/qb!][/ l"install_log_path"][/l*v"install_log_path"] [/autorestart] [/import <file_name>] [/ module <TP FW WC ESP>] [/nopreservesettings] [/policyname <name>] [/unlock <password>] Option ADDLOCAL="tp,fw,wc" Definition Selects the product modules to install: tp Threat Prevention fw Firewall wc Web Control tp,fw,wc Install all three modules. Example: ADDLOCAL="tp,wc" installs Threat Prevention and Web Control. INSTALLDIR="install_path" /log"install_log_path" or / l"install_log_path" /l*v"install_log_path" /qn or /quiet /qb! or /passive /qb /autorestart /import <file_name> Specifies where to install the product files on the computer. The installation wizard creates an Endpoint folder at the specified location and installs the product to this folder. Example: INSTALLDIR="D:\Installed Programs" Installs the product modules under D:\Installed Programs \EndPoint\. By default, product files are installed in the folder C:\windows \Temp\McAfeeLogs. Specifies where to save the installation log files for tracking installation events. The installation wizard creates an Endpoint folder at the specified location and saves the log files to this folder. Example: /l"d:\log Files" Installs the product log files under D:\Log Files\EndPoint\. By default, log files are saved in the User TEMP folder C: \users\username\appdata\local\temp\mcafeelogs. *v Specifies verbose (more descriptive) logging entries. Specifies how the users can interact with the installation wizard: qn Hide all installation notifications (silent mode). Users have no interaction. qb! Show only a progress bar without a Cancel button. Users cannot cancel the installation while it is in progress (passive mode). qb Show only a progress bar with a Cancel button. Users can cancel the installation while it is in progress, if needed. Restarts system automatically during installation. Imports policy settings from the specified file. 46 McAfee Endpoint Security Installation Guide

47 Troubleshooting and reference Log files 5 Option /module <TP FW WC ESP> Definition Applies imported policy settings to the specified product modules. TP Threat Prevention FW Firewall WC Web Control ESP Resources shared by product modules. /nocontentupdate Do not update product content files automatically as part of the installation process. The managed system is not fully protected until the product content files are downloaded. Schedule an update as soon as possible. /nopreservesettings /policyname <name> /unlock <password> Do not migrate your product settings to Endpoint Security. By default, settings are preserved. Assigns the specified policy to systems where the product is installed. Sets the password for unlocking the client UI. See also Download Endpoint Security content files on page 28 Log files on page 47 Log files The installation wizard tracks details about installation, uninstallation, and migration in log files that you can use to verify results and troubleshoot problems. Default location of installation log files By default, the installation wizard installs the installation log files in a TEMP folder. Use command-line options to change the location for the log files. Management platform McAfee epo McAfee epo Cloud Self-managed Installation log file location Windows System TEMP folder (C:\Windows\TEMP\McAfeeLogs by default) User TEMP folder %Temp%\McAfeeLogs (C:\Users\username\AppData\Local\Temp\McAfeeLogs by default) Types of log files Check these log files for details about installation, uninstallation, and migration. McAfee Endpoint Security Installation Guide 47