McAfee Endpoint Security

Transcription

1 Installation Guide McAfee Endpoint Security For use with epolicy Orchestrator software and the McAfee SecurityCenter

2 COPYRIGHT Copyright 2015 McAfee, Inc., 2821 Mission College Boulevard, Santa Clara, CA 95054, , TRADEMARK ATTRIBUTIONS Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence, McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Endpoint Security Installation Guide

3 Contents Preface 5 About this guide Audience Conventions Find product documentation Product overview 7 What's in the product New features and enhancements Features introduced in Endpoint Security Features introduced in Endpoint Security How the product works The role of the security management platform Security management options Self-management Management with McAfee epo Management with McAfee epo Cloud Management with the SecurityCenter Where to go from here Pre-installation 21 System and hardware requirements Supported Internet browsers Supported security management platforms Other virus-detection and firewall software Preconfiguring the product Upgrading an existing version of the product Are you ready to install? Installation for systems managed with McAfee epo and McAfee epo Cloud 27 Installation overview Upgrade the McAfee Agent Install the product files on the management server Download Endpoint Security content files Deploy to multiple systems with deployment tasks Install on local systems with an installation URL Create an installation URL Install with an installation URL Verify the installation Uninstall from systems managed with McAfee epo or McAfee epo Cloud Installation for systems managed with the McAfee SecurityCenter 37 Installation overview for systems managed with the SecurityCenter Install on local systems with an installation URL Install on the administrative system McAfee Endpoint Security Installation Guide 3

4 Contents Send an installation URL to other managed systems Install with an installation URL Deploy silently to local systems Overview of silent installation Requirements for silent installation Install with silent installation Designate a relay server Verify the installation on the SecurityCenter Uninstall from systems managed with the SecurityCenter Installation for self-managed systems 45 Installation overview for self-managed systems Upgrade the McAfee Agent on self-managed systems Install with the installation wizard Install from the command line Verify the installation Uninstall from a self-managed system Troubleshooting and reference 51 Troubleshooting installation problems Test malware detection Troubleshoot general installation problems (SecurityCenter-managed systems) Using the MER tool for troubleshooting Resolving error codes and messages Using command-line options SETUP command-line options (McAfee epo and McAfee epo Cloud deployment tasks) SETUP command-line options (self-managed) VSSETUP command-line options (SecurityCenter systems) Log files A Threat Intelligence installation 61 System requirements for Threat Intelligence Threat Intelligence network overview Download and check in the components to McAfee epo Install the TIE server appliance Deploy DXL and Threat Intelligence Verify the installation Configure the TIE server extension Configure the TIE server policy Create a new registered server Troubleshooting the installation Verify installed components Accessing the log files Reconfiguring the installation using scripts Index 73 4 McAfee Endpoint Security Installation Guide

5 Preface This guide provides the information you need to work with your McAfee product. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Conventions This guide uses these typographical conventions and icons. Book title, term, emphasis Bold User input, code, message Interface text Hypertext blue Title of a book, chapter, or topic; a new term; emphasis. Text that is strongly emphasized. Commands and other text that the user types; a code sample; a displayed message. Words from the product interface like options, menus, buttons, and dialog boxes. A link to a topic or to an external website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. McAfee Endpoint Security Installation Guide 5

6 Preface Find product documentation Find product documentation On the ServicePortal, you can find Information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, select Product Documentation. 3 Select a product and version, then click Search to display a list of documents. 6 McAfee Endpoint Security Installation Guide

7 1 1 Product overview McAfee Endpoint Security is a fully integrated security solution that protects servers, endpoint computer systems, laptops, and tablets against a full spectrum of threats. These threats include malware, suspicious communications, unsafe websites, and downloaded files. Endpoint Security intercepts threats, monitors overall system health, and reports detection and status information. The product can be installed on self-managed (standalone) systems or systems managed by these security management platforms: McAfee epolicy Orchestrator (McAfee epo ) version 5.3 or McAfee epolicy Orchestrator Cloud (McAfee epo Cloud) version 5.4 or 5.2 McAfee SecurityCenter Contents What's in the product New features and enhancements How the product works Security management options Where to go from here What's in the product McAfee Endpoint Security leverages a streamlined design that protects your systems with an arsenal of features optimized for efficiency, ease of use, and high performance. The product includes automated installation and setup processes for multiple management environments, including management from the cloud. McAfee Endpoint Security Installation Guide 7

8 1 Product overview What's in the product Comprehensive protection Endpoint Security provides a level of protection that previously required three separate products. Integrated modules work in tandem to protect systems from a wide range of threats from software, communications, and websites. McAfee Endpoint Security Threat Prevention Checks for viruses, spyware, unwanted programs, and other threats by scanning items automatically when users access them or on demand. Threat Prevention detects threats, then takes the actions that have been configured to protect systems. Based on McAfee VirusScan Enterprise. McAfee Endpoint Security Firewall Monitors communication between the computer and resources on the network and the Internet. Intercepts suspicious communications. Based on McAfee Host Intrusion Prevention. McAfee Endpoint Security Web Control Displays safety ratings and reports for websites during online browsing and searching. Blocks access to websites according to safety rating or content. Based on McAfee SiteAdvisor Enterprise. Automated installation and deployment Multiple installation methods ensure that you can select the level of automation or customization that best suits your needs. Automated wizards Install and deploy the product with preconfigured, default settings and minimal interaction during installation. Customized options Configure feature settings before deployment to managed systems. Specify installation features, such as installing silently. Single or multiple targets Install on local systems or deploy remotely to all managed systems. Easy upgrades New features make it easy to manage multiple product versions and upgrade previously installed product versions. Inline installation Install and manage new products side by side with previous versions. Management of multiple client versions Use McAfee epo and McAfee epo Cloud with the McAfee Agent to manage both 10.0 and 10.1 versions of the Endpoint Security Client. Migration of custom settings Migrate your settings from legacy products for use with Endpoint Security. On self-managed systems The installation wizard preserves your settings during the upgrade process, by default. You can specify the products to upgrade. On McAfee epo-managed systems The Endpoint Migration Assistant provides two migration paths. You can migrate all your settings automatically, or select settings to migrate manually, such as policies and client tasks, then configure them before migration if needed. 8 McAfee Endpoint Security Installation Guide

9 Product overview New features and enhancements 1 New features and enhancements These features were introduced or enhanced in the Endpoint Security 10.0 and 10.1 releases. Features introduced in Endpoint Security 10.0 Endpoint Security 10.0 includes these new and enhanced features. Collaborative data sharing Integration of Web Control and Threat Prevention allows you to scan a file downloaded from a browser using McAfee Global Threat Intelligence (McAfee GTI). Dashboards and monitors Endpoint Security includes dashboards and monitors in McAfee epo for each of the modules (Threat Prevention, Firewall, and Web Control). Dashboards in the Common module report on all installed modules, including: Compliance Status Installation Status Content Status Scan Duration Detection Status Threat Behavior Environmental Health Threat Event Origins Exploit Prevention capability Exploit Prevention stops exploited buffer overflows from executing arbitrary code. This feature monitors user-mode API calls and recognizes when they are called as a result of a buffer overflow. Threat Prevention uses the Exploit Prevention content file to protect applications such as Internet Explorer, Microsoft Outlook, Outlook Express, and Microsoft Word. Improved logging and troubleshooting Endpoint Security logs threat data, including threat origin and duration before detection, in natural language. You can easily access this information from management consoles and the Endpoint Security Client in the Event Log. McAfee Endpoint Security for Mac support (Patch 1) Endpoint Security for Mac provides a comprehensive security mechanism that includes Self Protection, a feature of the Common module, Threat Prevention, Firewall, and Web Control. Its scalable security solution minimizes the risk of exposing your Macintosh system to vulnerabilities. You can use Endpoint Security to manage both your Microsoft Windows and Macintosh systems. Use the Endpoint Security extensions in McAfee epo to configure and deploy policies. Endpoint Security for Mac does not support the McAfee GTI or Endpoint Security Threat Intelligence module. Multi-mode client user interface You can configure the Endpoint Security Client to run in one of three modes: McAfee Endpoint Security Installation Guide 9

10 1 Product overview New features and enhancements Full access Standard access Lock client interface Enables access to all features. This mode is the default setting for self-managed systems. Displays protection status and allows access to most features except settings. This mode is the default setting for managed systems. From Standard access interface mode, you can log on as administrator to access all features, including all settings. Requires a password to access the client. Once you unlock the client interface, you can access all features. The default password is mcafee. On-premise, cloud, or self-management You can manage Endpoint Security using: McAfee epo McAfee epo Cloud McAfee SecurityCenter (cloud) Local self-management (also called unmanaged or standalone) with Endpoint Security Client Threat forensics Endpoint Security provides forensic data for threat events. Dashboards and monitors in McAfee epo and McAfee epo Cloud provide information about detection status, threat behavior, and threat event origins. Zero-impact scanning Threat Prevention offers the ability to scan only when your system is idle. When this option is selected, Threat Prevention automatically pauses the scan when it detects disk or user activity, such as access with the keyboard or mouse. Threat Prevention resumes the scan when the user hasn't accessed the system for 3 minutes. Features introduced in Endpoint Security 10.1 Endpoint Security 10.1 includes these new and enhanced features. Enhanced support for enterprise-level protection This release adds enterprise-level protection features that achieve parity with legacy products. These features are added to Threat Prevention to achieve parity with VirusScan Enterprise: Task settings in Endpoint Security Client: Custom On-Demand Scan tasks Mirror tasks Update tasks Enhanced task schedule Heuristics settings for On-Access Scan 10 McAfee Endpoint Security Installation Guide

11 Product overview New features and enhancements 1 Proactive data analysis Exploit Prevention Block and Report Enhancements to Exploit Prevention exclusions Access Protection user-defined rules New predefined Access Protection rules Enhanced Access Protection inclusions and exclusions These features are added to Endpoint Security Firewall to achieve parity with McAfee Host IPS Firewall: FTP protocol inspection User-based policies Scheduling of rules and groups Timed groups Host Intrusion Prevention side-by-side support Run Host Intrusion Prevention side by side with Endpoint Security Endpoint Security 10.1 can be installed on the same system as Host Intrusion Prevention 8.0. If McAfee Host IPS and Firewall are enabled, Exploit Prevention and Endpoint Security Firewall are disabled even if enabled in the policy settings. Improved Access Protection configuration Access Protection restricts access to files, shares, registry keys, and registry values to prevent unwanted changes to client systems. This release lets you configure protection for more elements. User-defined Access Protection rules Specify files, registry keys, and registry values to protect by using options in policies and the Endpoint Security Client. More ways to include and exclude processes Specify the path and file name, an MD5 hash, or a digital signature. Integration with Endpoint Security Threat Intelligence McAfee Endpoint Security Threat Intelligence (TI ENS) provides a security ecosystem that allows instant communication between Endpoint Security Threat Intelligence and devices in your McAfee epo environment. The communication is made possible with McAfee Data Exchange Layer (DXL) framework. You can see the specific system where a threat was first detected, see where it went from there, and stop it immediately. The Threat Intelligence Exchange server stores information about file and certificate reputations, then passes that information to other systems in your environment. For more information, see the McAfee Threat Intelligence Help. Threat Intelligence is supported only in McAfee epo environments. New Web Control user experience A new toolbar provides an updated look and feel. McAfee Endpoint Security Installation Guide 11

12 1 Product overview New features and enhancements Upgrade and migration features This release provides new features for upgrading and migrating previous versions of the product. You can install the new Endpoint Security module extensions in McAfee epo side by side with your existing product extensions. You can continue to use both product versions until you are ready to remove the older ones. You can use the McAfee Agent to manage systems running both version 10.0 and version 10.1 of the Endpoint Security Client. In McAfee epo, installing the Endpoint Security 10.1 module extensions automatically upgrades your 10.0.x extensions. Endpoint Security 10.1 extensions co-exist with the VirusScan Enterprise, Host Intrusion Prevention, and SiteAdvisor Enterprise product extensions. On the client system, deploying Endpoint Security 10.1: Removes the VirusScan Enterprise and SiteAdvisor Enterprise products. Migrates settings from the older products to Endpoint Security. Migrates McAfee Host IPS Firewall settings to Endpoint Security Firewall. McAfee Host IPS remains installed side by side with Endpoint Security. In McAfee epo environments, you can migrate custom settings when you upgrade these legacy products on managed systems running Microsoft Windows: McAfee VirusScan Enterprise 8.8 McAfee Host Intrusion Prevention Firewall 8.0 Only settings for the Firewall are migrated. You can continue to manage McAfee Host IPS as a separate extension. McAfee SiteAdvisor Enterprise 3.5 The Migration Assistant merges legacy policy settings with new product defaults and feature categories, then creates Endpoint Security policies. You can let the Migration Assistant migrate all your settings automatically, or you can select which policies to migrate, then configure new settings manually. The Migration Assistant also migrates client tasks and other settings. For more information, see the McAfee Endpoint Security Migration Guide and Help. Endpoint Security for Mac policy migration is not supported in Endpoint Security On self-managed systems, you have the opportunity to preserve custom settings when you upgrade supported legacy products. Windows 10 support This release adds support for Microsoft Windows 10. Updated components This release of Endpoint Security includes these updated versions of components. Component Version VSCore 15.4 McAfee Agent AMCore McAfee Endpoint Security Installation Guide

13 Product overview How the product works 1 How the product works Endpoint Security detects, resolves, and logs information about detected threats. Software called McAfee Endpoint Security Client (the client software) is installed on each system to perform these tasks. For self-managed systems A local system user installs the client software, customizes the features, and manages detections. For managed systems Typically, an administrator installs the software on client computers, manages detections, and sets up security rules, called policies, that determine how product features work. Depending on the policies configured by the administrator, users might be able to customize some product features. The role of the client software Endpoint Security Client protects systems with regular upgrades, continuous monitoring, and detailed reporting. 1 It silently monitors all file input and output, downloads, program executions, inbound and outbound communications, visits to websites, and other system related activities on managed systems, then: Deletes or quarantines detected viruses. Removes potentially unwanted programs, such as spyware or adware. Blocks or warns of suspicious activity, depending on product settings. Indicates unsafe websites with a color coded button or icon in the browser window or search results page. These indicators provide access to safety reports that detail site-specific threats. Blocks or warns of unsafe websites, depending on product settings. McAfee Endpoint Security Installation Guide 13

14 1 Product overview How the product works 2 It regularly connects to a local or remote McAfee epo server or directly to a site on the Internet to check for: Updates to content files, which contain information that Endpoint Security uses to detect threats. These files are updated as new threats are discovered to ensure that systems are always protected against the latest threats. Upgrades to software components. If new versions are available, the client software downloads them. 3 It logs security information for each managed system, including protection status and details about detections. Users can view this information in the client console on self-managed systems and on managed systems where policy settings are configured to allow it. 4 (Managed systems only) It regularly communicates with a security management server to: Send logged security information. Receive new policy assignments. The role of the security management platform Administrators can use a network security management platform to manage security for all network systems from a centralized console. If you're an administrator using a supported security management platform, you can perform these network security tasks: Deploy product software to managed systems. Manage and enforce network security using policy assignments and automated tasks. Update the product components and required security content to ensure that managed systems are secure. Create reports that display informative, user-configured charts and tables containing your network security data. Management strategies vary according to the number and location of managed systems and the way they are used. Enterprise networks for industry and government typically employ a team of IT administrators to monitor and regulate security full time. Smaller businesses might ask an employee to dedicate an hour or two a week to monitoring security, subscribe to management software hosted on a server "in the cloud," or let individual users manage security on their own systems. Endpoint Security adapts to any of these environments. 14 McAfee Endpoint Security Installation Guide

15 Product overview Security management options 1 Security management options Endpoint Security adapts to various users and settings by supporting multiple security management options. Select the right type of management for your needs based on your network's resources, the number and location of the managed systems, and the way systems are used. Self-managed systems On systems not managed with a security management platform, Endpoint Security: Supports desktops and laptops. Requires no management server or server-side components. Is installed on the local system by local users. Is configured and managed from the client console on the local system. Managed systems Endpoint Security supports these features on managed systems: Features System support Security Management Platform McAfee epo McAfee epo Cloud SecurityCenter Servers, desktops, laptops, and tablets Yes Yes Yes Located on premise with the management server Installation Yes* No No Administrators install server-side components Yes No No Administrators can install client software remotely to multiple systems Users can install client software on local systems with a URL Management Yes Yes No** Yes Yes Yes Administrator uses console Web-based Web-based Web-based Users use local client console (Optional) Yes Yes Yes * Can also manage remote devices ** Requires third-party deployment tools Self-management Install and manage the product directly on a local system that is not connected to a network or managed from a centralized security management platform. In this case, users run the installation wizard directly on the local system. After installation is complete, they can manage the security settings and product features directly from the client console. For example, they can schedule scans, view reports, and check for updates as needed. McAfee Endpoint Security Installation Guide 15

16 1 Product overview Security management options Management with McAfee epo Use McAfee epo to deploy and manage the product on systems located at sites with local McAfee epo servers and at remote sites managed by those servers. In this case, one or more administrators typically manage the server and the network systems where the product is installed. McAfee epo was designed for large enterprise networks, and includes new features to facilitate ease of use and to enhance extensibility for many network configurations. Managed systems follow the classic client-server model, in which they call into the management (McAfee epo) server for instructions. (To facilitate this call, a McAfee Agent is deployed to each system in the network. Once an agent is deployed to a system, the system can be managed by McAfee epo, and client software for managed products can communicate with the server.) The following figure shows how Endpoint Security integrates into a secure McAfee epo environment. 1 The administrator sets up the McAfee epo server-side components, then deploys the McAfee Agent to managed systems. The McAfee epo database stores all data about the managed systems on the network, including: System properties Policy information Directory structure Threat events (information about detections) All other relevant data that the server needs to keep managed systems up to date 16 McAfee Endpoint Security Installation Guide

17 Product overview Security management options 1 The McAfee Agent deployed to each system facilitates: Policy enforcement Product deployments and updates Reporting on managed systems 2 The administrator deploys Endpoint Security Client to managed systems. 3 The McAfee epo server connects to the McAfee update server to pull down the latest security content. The McAfee update server hosts the latest security content, so the McAfee epo software can pull the content at scheduled intervals. 4 Agent-server secure communication (ASSC) occurs at regular intervals between the systems and the McAfee epo server. Then: McAfee epo sends any available new policy assignments or product updates for Endpoint Security Client to the managed systems. This communication occurs shortly after the client software is installed and at regular intervals thereafter. Endpoint Security Client sends the security information it has logged to the server. 5 The administrator logs on to the McAfee epo console to perform security management tasks, such as running queries to report on security status or working with managed software security policies. Management with McAfee epo Cloud Use McAfee epo Cloud to deploy and manage the product on systems located at sites that do not have their own management server. In this case, McAfee hosts the server. McAfee epo Cloud was designed for small and medium networks that do not have a dedicated security management team or infrastructure in place. McAfee sets up the McAfee epo Cloud server and database "in the cloud," creates an account, makes products available to install on managed systems, and sends logon credentials to an account administrator. Managed systems follow the classic client-server model, in which they call into the management (McAfee epo Cloud) server for instructions. (To facilitate this call, a McAfee Agent is deployed to each system in the network. Once an agent is deployed to a system, the system can be managed by McAfee epo Cloud, and client software for managed products can communicate with McAfee epo Cloud.) McAfee Endpoint Security Installation Guide 17

18 1 Product overview Security management options The following figure shows how Endpoint Security integrates into a secure McAfee epo Cloud environment. 1 McAfee sets up the server-side components "in the cloud," including the McAfee epo Cloud server and database, then sends the URL and logon information to the administrator. 2 The McAfee epo Cloud server connects to the McAfee update server to pull down the latest security content. The McAfee update server hosts the latest security content, so the McAfee epo Cloud software can pull the content at scheduled intervals. 3 The administrator uses a browser to log on to McAfee epo Cloud, creates an installation URL, and sends it to users along with instructions for installing the Endpoint Security Client on their systems. The URL installs the McAfee Agent (if it is not already installed) and Endpoint Security Client. The system communicates back to McAfee epo Cloud and is then managed and protected by McAfee epo Cloud. 4 Agent-server secure communication (ASSC) occurs at regular intervals between the systems and the McAfee epo server. Then: McAfee epo Cloud sends any available new policy assignments or product updates for Endpoint Security Client to the managed systems. This occurs shortly after the client software is installed and at regular intervals thereafter. Endpoint Security Client sends the security information it has logged to the server. 5 The administrator uses a browser to log on to McAfee epo Cloud and perform security management tasks, such as running queries to report on security status or configuring managed software security policies. Management with the SecurityCenter Use the McAfee SecurityCenter administrative website to deploy and manage the product on systems managed with a subscription to McAfee small and medium business products, such as McAfee SaaS 18 McAfee Endpoint Security Installation Guide

19 Product overview Security management options 1 Endpoint Protection or McAfee Security-as-a-Service (McAfee SaaS). In this case, McAfee or another service provider hosts the management server at a remote location. Products managed with the SecurityCenter were designed for hands-off, fully automated security management in small businesses. Newer features enable greater administrative oversight and provide viewing options for larger numbers of managed systems. Like the McAfee epo Cloud environment, the SecurityCenter management server and database are located "in the cloud." McAfee or another service provider sets up each account, then sends information for logging on and installing the product to the administrator. Typically, an administrator receives a summary of the account's protection status in weekly status s sent by McAfee or another service provider in many cases, no other action is required. Administrators who want to be more proactive can log on to the SecurityCenter to manage detections and policies. The SecurityCenter can also send security information to a McAfee epo account, where the administrator can view it in reports. (Requires the McAfee Security-as-a-Service extension.) 1 McAfee or another service provider sets up the server-side components "in the cloud" and sends the installation URL and logon information to the administrator, who then sends the URL to users with instructions for installing the client software on local systems. The McAfee Agent is also installed if it is not already present on the system. 2 The client software downloads the latest content (threat information) files from an update server. It also checks for policy assignments from the SecurityCenter. McAfee Endpoint Security Installation Guide 19

20 1 Product overview Where to go from here 3 The client software uploads security information about each managed system to the SecurityCenter for use in status s and administrative reports. 4 (Optional) If the account includes McAfee SaaS protection services, they run on separate servers and report security information to a SaaS protection portal for use in status s and administrative reports. The administrator can view the reports using the SecurityCenter. 5 The administrator checks a weekly status sent by McAfee or another service provider. It contains information reported to the SecurityCenter by the client software. 6 (Optional) The administrator uses a web browser to log on to the SecurityCenter and view detection reports or configure policies and assign them to managed systems. 7 (Optional) The administrator downloads and installs the McAfee Security-as-a-Service extension, then views basic SecurityCenter detection and status data in the McAfee epo security management console. (Not available for McAfee epo Cloud accounts.) Where to go from here This guide explains how to install or upgrade the product on centrally managed and self-managed systems. When you are ready to begin, follow this process. 1 Check the information in Chapter 2 to ensure that your systems and environment meet the requirements to install and run the product. Chapter 2 also describes requirements for migrating legacy products. 2 Follow the instructions in the chapter for your management environment. To install on systems managed with... Go to... McAfee epo or McAfee epo Cloud Chapter 3 McAfee SecurityCenter Chapter 4 Self-management (no security management platform) Chapter 5 3 See Chapter 6 for reference or troubleshooting information. 4 (Optional) To install and configure Endpoint Security Threat Intelligence, see Appendix A. 20 McAfee Endpoint Security Installation Guide

21 2 Pre-installation Your managed systems must have specific hardware and software to run McAfee Endpoint Security. Review these requirements and recommendations before installing your Endpoint Security software to make sure that your installation is successful. Contents System and hardware requirements Supported Internet browsers Supported security management platforms Other virus-detection and firewall software Preconfiguring the product Upgrading an existing version of the product Are you ready to install? System and hardware requirements Make sure that each server or workstation you want to protect is running a supported Microsoft Windows operating system and conforms to these requirements. Hardware requirements Dual Core 1 GHz processor or later Check the Microsoft website for requirements that are specific to each operating system. For example, Windows Small Business Server 2011 requires at least a Quad Core, 1.4 GHz 64-bit (x64) processor. 40 GB HDD or later Microsoft mouse or compatible pointing device 256-color or higher VGA monitor Internet connection from which you can install or download software For a complete list of current system requirements, see KB Workstation requirements Operating system Service pack Minimum 32-bit 64-bit Processor speed RAM Hard disk space Windows 10 Yes Yes 2 GHz 3 GB 1 GB Windows 8.1 Yes Yes 2 GHz 3 GB 1 GB McAfee Endpoint Security Installation Guide 21

22 2 Pre-installation System and hardware requirements Operating system Service pack Minimum 32-bit 64-bit Processor speed RAM Hard disk space Windows 8 Yes Yes 2 GHz 3 GB 1 GB Windows 7 SP1 Yes Yes 1.4 GHz 2 GB 1 GB Windows Vista SP2 Yes Yes 1.4 GHz 2 GB 1 GB Windows Embedded 8.1 and 8 (Pro, Standard, Industry) Windows Embedded Standard 7 Windows Embedded for Point of Service (WEPOS) Yes 1 GHz 2 GB 1 GB Yes 1 GHz 2 GB 1 GB Yes 1 GHz 2 GB 1 GB Server requirements Operating system Windows Server 2012 R2 Update 1 Windows Server 2012 R2 Essentials/Standard/Datacenter (including Server Core mode) Windows Server 2012 Essentials/Standard/Datacenter (including Server Core mode) Windows Server 2008 and 2008 R2 Standard/Datacenter/ Enterprise/Web (including Server Core mode) Windows Small Business Server 2011 Windows Small Business Server 2008 Windows Embedded Standard 2009 Windows Point of Service Ready 2009 Service pack Minimum 32-bit 64-bit Processor speed RAM Hard disk space Yes 2 GHz 3 GB 1 GB Yes 2 GHz 3 GB 1 GB Yes 2 GHz 3 GB 1 GB SP2 Yes Yes 1.4 GHz 2 GB 1 GB Yes 1.4 GHz 2 GB 1 GB Yes 1.4 GHz 2 GB 1 GB Yes 1 GHz 2 GB 1 GB Yes 1 GHz 2 GB 1 GB Windows Point of Service 1.1 Yes 1 GHz 2 GB 1 GB Macintosh support You can use Endpoint Security to manage both your Microsoft Windows and Macintosh systems. Use the Endpoint Security extensions in McAfee epo to configure and deploy policies for managed systems running Endpoint Security for Mac. For instructions about installing and using Endpoint Security for Mac, see the product documentation. See KB84934 for current system, platform, and network requirements. 22 McAfee Endpoint Security Installation Guide

23 Pre-installation Supported Internet browsers 2 Supported Internet browsers Product features have been verified to function correctly on these versions of popular browsers. URL installation requires one of these browsers and an Internet connection. Mozilla Firefox (versions 3.0 and later) Google Chrome (versions 4.0 and later) Microsoft Internet Explorer (versions 8, 9, 10, and 11) Web Control supports Internet Explorer 7 for connecting with the SecurityCenter only. The installation wizard works with the default security level for Internet Explorer. For other browsers, select a security level that enables Javascript. See the web browser's documentation for instructions on configuring the security level if you must change it. Supported security management platforms If you plan to manage security for network systems, you must first set up a supported management platform and place the network systems under its management. Make sure that your environment meets these requirements for the management platform: Management platform McAfee epo McAfee epo Cloud SecurityCenter None (self-managed) Requirements An administrator has: Installed McAfee epo 5.3 or Deployed McAfee Agent 5.0 Patch 2 or later to managed systems. See the McAfee epolicy Orchestrator Installation Guide for instructions. McAfee or another service provider has set up your account, installed server-side components, and sent you logon credentials for McAfee epo Cloud 5.4 or 5.2. An administrator has deployed McAfee Agent 5.0 Patch 2 or later to managed systems. See the McAfee epolicy Orchestrator Cloud Installation Guide for instructions. An administrator: Has logon credentials for an administrative SecurityCenter account. Is using it to manage the network systems where McAfee SaaS Endpoint Protection is installed. You have installed McAfee Agent 4.0 or later on your system. Endpoint Security 10.1 requires McAfee Agent 5.0 Patch 2 or later. Endpoint Security 10.1 automatically upgrades versions 4.0 and later of the agent to version 5.0 Patch 2. You can also manually upgrade the agent. See also Upgrade the McAfee Agent on page 28 Upgrade the McAfee Agent on self-managed systems on page 46 McAfee Endpoint Security Installation Guide 23

24 2 Pre-installation Other virus-detection and firewall software Other virus-detection and firewall software It is not necessary to uninstall existing virus-detection and firewall products on managed systems before installing Endpoint Security. The installation wizard detects these products and resolves most conflicts automatically. If the Windows firewall is enabled The wizard disables the Windows firewall automatically to prevent conflicts. If incompatible virus detection or firewall software is installed The wizard attempts to uninstall the software. If it can't, it prompts the user to cancel the installation, uninstall the incompatible software manually from the Windows Control Panel, then resume the installation. Installation resumes where it left off. See KB85522 for a list of the software products uninstalled automatically. If you have incompatible software that does not appear on this list, manually uninstall it before installing Endpoint Security. Users might be prompted to reboot their systems after uninstalling firewall software. If McAfee Host Intrusion Prevention is installed The Endpoint Security Firewall replaces the Host Intrusion Prevention Firewall, and you can also migrate your Host Intrusion Prevention Firewall settings to the new Endpoint Security Firewall. Host Intrusion Prevention (without its firewall module) can run side by side with the Endpoint Security Firewall. You are not required to upgrade to Endpoint Security Firewall or migrate your settings. You can continue to run the McAfee Host IPS Firewall after installing Endpoint Security Firewall. Whenever McAfee Host IPS Firewall is installed and enabled, Endpoint Security Firewall is disabled even if enabled in the policy settings. If McAfee Deep Defender is installed You must remove this conflicting product manually or with a client task before installing Endpoint Security. Preconfiguring the product You can customize settings for product features before deploying the product to managed systems. This customization enables you to meet specific requirements, for example, in environments with security compliance standards. Preconfigured policy settings take effect upon installation. McAfee preconfigures features with default settings that protect systems in medium-risk environments. These settings ensure that the system can access important websites and applications until the user has a chance to revise the settings. To preconfigure product features, first create a policy and configure it with the settings required for your environment. Then assign this policy to managed systems when you deploy the client software. See your management platform's product guide for instructions about configuring and assigning policies. See the Endpoint Security Help for information about the features you can configure. When preconfiguring product features, McAfee recommends that you configure the following information: Where and how managed systems get updates. When managed systems check for updates. Access to required websites and applications without interruption. 24 McAfee Endpoint Security Installation Guide

25 Pre-installation Upgrading an existing version of the product 2 Upgrading an existing version of the product If a previous supported version of one or more product modules is installed currently in your environment, you can upgrade to Endpoint Security. If you are upgrading legacy products, such as VirusScan Enterprise, you can also migrate your custom settings. Upgrading Endpoint Security Use the installation wizard to install the new Endpoint Security product modules side by side with your existing products. You can continue to use both product versions until you are ready to remove the older ones. You can use the McAfee Agent to manage systems running both version 10.0 and version 10.1 of the Endpoint Security Client. Migrating or preserving legacy product settings When you upgrade these legacy products, you can migrate (or preserve) your custom product settings: McAfee VirusScan Enterprise, version 8.8 McAfee Host Intrusion Prevention Firewall, version 8.0 Only the Firewall module is migrated. You can continue to manage McAfee Host IPS as a separate extension. McAfee SiteAdvisor Enterprise, version 3.5 Before migrating, McAfee recommends that you review your legacy settings to ensure they are up to date, then consolidate, remove duplicates, and remove unused settings, policies, and client tasks. On self-managed systems The installation wizard allows you to preserve your legacy settings when you upgrade to Endpoint Security. In McAfee epo environments Use the Endpoint Migration Assistant to create new Endpoint Security policies based on your current legacy product settings. You can let the Migration Assistant migrate all your settings automatically, or you can select which policies to migrate, then configure new settings manually. The Migration Assistant also migrates client tasks and other settings. For more information, see the McAfee Endpoint Security Migration Guide and Help. McAfee Endpoint Security Installation Guide 25

26 2 Pre-installation Are you ready to install? Are you ready to install? When your environment meets the requirements specified in this chapter, you are ready to begin installation. These components... All systems where you want to install the product Managed systems only Management server Meet these requirements Hardware components meet or exceed minimum requirements. Supported Windows operating system is installed. Supported web browser is installed. Required agent or software is installed and communicating with the management server. (Upgrade) Supported version of software is installed. Supported management platform is installed. (Optional) You have preconfigured policy settings for product features as needed. (Upgrade) Supported version of extension is installed. If you plan to migrate your custom settings for legacy products in McAfee epo environments, check requirements in the McAfee Endpoint Security Migration Guide. 26 McAfee Endpoint Security Installation Guide

27 3 Installation 3 for systems managed with McAfee epo and McAfee epo Cloud Use this information to install the product on systems managed with McAfee epo and McAfee epo Cloud. Contents Installation overview Upgrade the McAfee Agent Install the product files on the management server Download Endpoint Security content files Deploy to multiple systems with deployment tasks Install on local systems with an installation URL Verify the installation Uninstall from systems managed with McAfee epo or McAfee epo Cloud Installation overview In McAfee epo and McAfee epo Cloud environments, administrators can deploy the product software remotely to managed systems or ask users to install it locally. For McAfee epo, they must also install product software on the management server. Management environment characteristics The primary differences in managing the two environments are: McAfee epo Administrators install product components on the management server, then they typically configure feature settings and deploy the client software to multiple managed systems using deployment tasks. McAfee epo Cloud McAfee or another service provider sets up each McAfee epo Cloud account on an offsite management server and notifies the local administrator when products are ready to install on managed systems. Local administrators then typically create and send an installation URL to users for installation on local systems. In McAfee epo Cloud environments, you must have administrative logon credentials for a McAfee epo Cloud account before installing the product. McAfee or your service provider sends these to you in an . If you have not previously activated and configured an account, see the McAfee epo Cloud product guide for instructions. Endpoint Security supports both URL installation and deployment tasks in either environment. As an administrator, you can choose the method that best suits your needs. McAfee Endpoint Security Installation Guide 27

28 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Upgrade the McAfee Agent Installation and upgrade process Task Description 1 Ensure that all managed systems meet the requirements described in Chapter 2, Pre-installation. McAfee epo or McAfee epo Cloud Both Notes 2 Upgrade McAfee Agent, if needed. McAfee epo Endpoint Security 10.1 requires McAfee Agent 5.0 Patch 2. If running an earlier version, upgrade the agent manually. 3 Review and revise your settings to eliminate unused, outdated, and duplicate settings. 4 Open the management console. (Open your web browser and log on to your account.) McAfee epo Both 5 Install the product files on the McAfee epo server. McAfee epo 6 Manually update your McAfee epo server with the latest AMCore and Exploit Prevention content files required for Endpoint Security. 7 Migrate policies, client tasks, and other settings from supported legacy products. McAfee epo McAfee epo 8 Configure policies as needed. Both Optional 9 Deploy the client software with default or custom settings to managed systems in one of these ways: Remotely to multiple managed systems with deployment tasks Preferred for McAfee epo. Locally on managed systems with an installation URL Preferred for McAfee epo Cloud. We recommend that you reboot the managed system after installing this release of the product. Both Only for migration Only for migration See the McAfee Endpoint Security Migration Guide for more information. 10 Verify that the client software is installed and up to date on all managed systems. Both Upgrade the McAfee Agent Endpoint Security 10.1 requires McAfee Agent 5.0 Patch 2. On managed systems running an earlier version, you need to upgrade the McAfee Agent manually before deployment. For McAfee epo Cloud, no action is required to upgrade McAfee Agent. The new agent is installed automatically on managed systems from the McAfee epo Cloud installation URL sent to users. 28 McAfee Endpoint Security Installation Guide

29 Installation for systems managed with McAfee epo and McAfee epo Cloud Install the product files on the management server 3 Task For option definitions, click? in the interface. 1 Download the McAfee Agent extension and client package from the download site. 2 In McAfee epo: 1 Select Menu Extensions, click Install Extension, and select EPOAGENTMETA.zip. 2 Select Menu Master Repository, click Check In Package, and select the MA-WIN zip file. 3 Deploy the new McAfee Agent using one of these methods: Create a deployment task to push the new package to the client systems. 1 Select Menu Product Deployment. 2 Click New Deployment. Create and distribute a new deployment URL. When you check in the new McAfee Agent, overwriting the previous version, any deployment URL created with the previous version no longer works. You must create and distribute a new URL with the new McAfee Agent. 1 Select Menu System Tree, then select the subgroup containing the systems to deploy to. 2 On the Agent Deployment tab, click Create Agent Deployment URL. 3 Enter the URL name, verify the agent version, then click OK. 4 Distribute the URL for new deployments. For more information about deployment, see the McAfee epo Help. Install the product files on the management server In McAfee epo environments only, install server-side components for Endpoint Security on the McAfee epo server as the first step in the installation process. Before you begin Your network security management platform must meet the requirements described in Chapter 2, Pre-installation. This task installs two types of product components on the management server: McAfee Endpoint Security Installation Guide 29

30 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Download Endpoint Security content files Product management extensions Add Endpoint Security Client management features (such as queries, client tasks, and online Help) to the McAfee epo server. These enable you to manage the product from the console. Product deployment packages Add Endpoint Security Client software files to the Master Repository, which you can deploy to managed systems. Task For option definitions, click? in the interface. 1 On the security management console, select Menu Dashboards, then select Guided Configuration from the drop-down list. 2 On the Guided Configuration screen, click Begin. 3 Click Software Selection, then: a Under the Software Not Checked In product category, click Licensed to display available products. b c In the Software table, select the product you want to check in. The product description and all available components are displayed in the table below. Click Check In All to check in product extensions to your McAfee epo server, and product packages to your Master Repository. When installation is complete, the extensions are listed on the Extensions page and the packages are listed in the Master Repository. You can now deploy the product to managed systems. Download Endpoint Security content files You must manually update your McAfee epo server with the latest AMCore and Exploit Prevention content files required for Endpoint Security. Before you begin The Endpoint Security 10.1 packages are checked in to the Master Repository on your McAfee epo server. Task For option definitions, click? in the interface. 1 In McAfee epo, select Menu Automation Server Tasks to open the Server Task Catalog. 2 Edit the Update Master Repository server task. 3 Click the Actions tab. 4 For the Repository Pull action, ensure that the following are set: Source site: McAfeeHttp Package types: All packages 5 Click Save to save the task. 6 For the Update Master Repository server task, click Run. 30 McAfee Endpoint Security Installation Guide

31 Installation for systems managed with McAfee epo and McAfee epo Cloud Deploy to multiple systems with deployment tasks 3 The Master Repository now includes the AMCore Content Package and the Endpoint Security Exploit Prevention Content package required by Endpoint Security. Deploy to multiple systems with deployment tasks Automated tasks simplify the processes for deploying the client software to managed systems. This method deploys remotely from the security management console and does not require any user assistance. Before you begin The systems where you want to install the product must meet the requirements described in Chapter 2, Pre-installation. In a McAfee epo environment, you must have installed the product's server-side components on the McAfee epo server. In a McAfee epo Cloud environment, you must have administrative logon credentials for a McAfee epo Cloud account. McAfee or your service provider sends these in an . Task You can use two types of automated tasks to deploy product software to multiple managed systems: product deployment tasks and client tasks. Product deployment tasks are simpler to set up, and this guide explains the process. See the McAfee epo or McAfee epo Cloud product guide for more information about configuring and running product deployment tasks and client tasks. 1 On the security management console, select Menu Software Product Deployment. 2 On the Product Deployment page, click New Deployment. 3 On the New Deployment page, configure these settings, then click Save at the top of the page. Option Name and Description Type Package Language and Branch Description Type a name and description for this deployment. This name appears on the Deployment page after the deployment is saved. From the list, select the type of deployment. Fixed Deploys only to the selected systems. Continuous Deploys to systems based on System Tree groups or tags. This option allows these systems to change over time as they are added or removed from the groups or tags. If you want to automatically install product updates when they are available, select Auto Update. This option deploys the hotfixes and patches for your product automatically. From the list, select McAfee Endpoint Security. If needed, select the Language and Branch, if not using the defaults. McAfee Endpoint Security Installation Guide 31

32 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Install on local systems with an installation URL Option Command line Select the systems Select a start time Description In the text field, specify a command line with installation options for the module you are installing. These options are supported: /INSTALLDIR="install_path" /l"install_log_path" /l*v"install_log_path" /nocontentupdate See SETUP command-line options (McAfee epo and McAfee epo Cloud deployment tasks) in Chapter 6, Troubleshooting and reference, for option descriptions. Click Select Systems to open the System Selection dialog box and select the systems where you want to deploy the client software. If needed, configure the following: Run at every policy enforcement (Windows only) Allow end users to postpone this deployment (Windows only) Maximum number of postponements allowed Option to postpone expires after Display this text Select a start time or schedule for your deployment: Run Immediately Starts the deployment task the next time the systems check for updates from the management server. Once Opens the scheduler so you can configure the start date, time, and randomization. The Product Deployment page opens with your new project added to the list of deployments. Also, a client task is automatically created with the deployment settings. 4 Check the status of the deployment on the Product Deployment page. Click the deployment task in the list on the left side of the page to display its details on the right side of the page. See also SETUP command-line options (McAfee epo and McAfee epo Cloud deployment tasks) on page 55 Install on local systems with an installation URL Typically, McAfee epo Cloud administrators create an installation URL that can be used to install Endpoint Security Client on managed systems. They can: Use this URL to install the client software locally on their own system. Send this URL to users with instructions for installing the client software on their local systems. McAfee epo also supports URL installation. 32 McAfee Endpoint Security Installation Guide

33 Installation for systems managed with McAfee epo and McAfee epo Cloud Install on local systems with an installation URL 3 Tasks Create an installation URL on page 33 Create a URL for installing the client software on a local system. Then use it to install the client software on your own local system or send it to end users to install the client software on their systems. Install with an installation URL on page 34 Install the product on a local system with an installation URL. Create an installation URL Create a URL for installing the client software on a local system. Then use it to install the client software on your own local system or send it to end users to install the client software on their systems. Before you begin In a McAfee epo environment, the product extensions must be installed on the McAfee epo server, and the product content must be available in the Master Repository. In a McAfee epo Cloud environment, you must have administrative logon credentials for a McAfee epo Cloud account. McAfee or your service provider sends these to you in an . Task For option definitions, click? in the interface. 1 Open the security management console and begin the deployment in one of these ways. On this platform... McAfee epo Perform these steps... 1 Open your browser and log on to McAfee epo. 2 Select Menu Dashboards, then click Getting Started with epolicy Orchestrator. The product modules installed on managed systems are listed under Product. 3 Click Start Deployment. The Product Deployment page opens. McAfee epo Cloud 1 Open your browser and log on to McAfee epo Cloud. 2 Select Menu Dashboards, then click Getting Started with epolicy Orchestrator. The product modules installed on managed systems are listed under Product. The Welcome to McAfee Security page opens. 2 Create an installation URL with default or custom settings. McAfee Endpoint Security Installation Guide 33

34 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Install on local systems with an installation URL To do this... In McAfee epo In McAfee epo Cloud Deploy all product modules with their default security settings Customize the deployment Click Deploy. The Welcome to epolicy Orchestrator page displays the software deployment URL. 1 Click Customize. 2 Configure these settings: Group Name Select the default group name or enter a custom group name. Operating System Select McAfee Agent for Windows. Software and Policies Select McAfee Endpoint Security product modules to install and, if needed, click McAfee Default Policies and Tasks to select an alternative preconfigured policy. Auto Update Specify whether to download the latest version of the software automatically whenever an update occurs. Click Install Protection on Other Computers. A page displays the software deployment URL. 1 Click Customize Installation. 2 Configure these settings, then click Done: Group Name Select the default group name or enter a custom group name. Operating System Select McAfee Agent for Windows. Software and Policies Select McAfee Endpoint Security product modules to install and, if needed, click McAfee Default Policies and Tasks to select an alternative preconfigured policy. Auto Update Specify whether to download the latest version of the software automatically whenever an update occurs. 3 Click Deploy. A page displays the software deployment URL. 3 Click Install Protection on Other Computers. A page displays the software deployment URL. 3 (McAfee epo Cloud only) Install the product on your local system using one of these methods: Click Install Protection on This Computer. Copy and past the URL into a new browser window. A window opens with a web-based installation wizard. 4 Send the URL to users. a Copy this URL to a text file, then click OK to close the dialog box. b Send the URL in an message with any special instructions for installing on local systems. Install with an installation URL Install the product on a local system with an installation URL. Before you begin The system where you install the product must meet the requirements described in Chapter 2, Pre-installation. You must have an installation URL that you created or received from your administrator. 34 McAfee Endpoint Security Installation Guide

35 Installation for systems managed with McAfee epo and McAfee epo Cloud Verify the installation 3 Task For option definitions, click? in the interface. 1 Open a web browser window and paste in the installation URL. 2 Follow the instructions on the screen to install. If the installation does not start automatically, click Install. Click Run if prompted to run or save. Click Run if prompted to verify the installation. A dialog box displays the progress of the installation and indicates when it is complete. If needed, you can click Cancel to stop the installation. The installation log, McAfeeSmartInstall_<date>_<time>.log, is saved in <LocalTempDir> \McAfeeLogs (for example, C:\Windows\Temp\McAfeeLogs). We recommend that you reboot the managed system after installing this release of the product. Verify the installation After deployment, verify that the client software installed and updated correctly on managed systems. After a URL installation, verify that the list of systems matches the list of users you sent the installation URL to. Task For option definitions, click? in the interface. 1 Wait for client systems to report back to the security management platform (typically after an hour or two). 2 On the security management console, select Menu Dashboards, then select Endpoint Security: Installation Status for a complete listing of the managed systems where the software was installed and their status. Uninstall from systems managed with McAfee epo or McAfee epo Cloud You can remove product modules from managed systems remotely from the management console or locally at the managed system. You might do this for testing or before reinstalling the client software. If you uninstall the client software, the managed system is no longer protected against threats. We recommend that you reinstall as soon as possible. Task For option definitions, click? in the interface. Remove the client software using one of these methods. McAfee Endpoint Security Installation Guide 35

36 3 Installation for systems managed with McAfee epo and McAfee epo Cloud Uninstall from systems managed with McAfee epo or McAfee epo Cloud To uninstall... From multiple systems remotely Do this... Run a product deployment task: 1 On the security management console, select Menu Policy Product Deployment. 2 Duplicate the task you used to install the product modules, then specify Remove as the Action. 3 After the task has completed, verify that the client software was uninstalled from the selected systems. Click Dashboards, then select Endpoint Security: Installation Status. See the McAfee epo or McAfee epo Cloud product guide for more information about using product deployment tasks. At the local managed system Uninstall from the Windows Control Panel: 1 Open the Windows Control Panel, then go to the Uninstall Programs screen. 2 In the list of programs, select each product module, then click Uninstall. McAfee Endpoint Security Firewall 10.1 McAfee Endpoint Security Threat Prevention 10.1 McAfee Endpoint Security Web Control If prompted, enter a password for each module. By default, the password is mcafee. If you do not know the password, ask your administrator for assistance. 36 McAfee Endpoint Security Installation Guide

37 4 4 Installation for systems managed with the McAfee SecurityCenter Use this information to install the product on systems managed with the McAfee SecurityCenter. Contents Installation overview for systems managed with the SecurityCenter Install on local systems with an installation URL Deploy silently to local systems Verify the installation on the SecurityCenter Uninstall from systems managed with the SecurityCenter Installation overview for systems managed with the SecurityCenter The SecurityCenter is hosted on a remote server "in the clouds," and a local administrator manages security for network systems. As a local administrator, you only need to install the client software and configure custom settings, if needed. McAfee or another service provider sets up the management server offsite and notifies you when products are ready to install on managed systems. You then create and send an installation URL to users for installation on local systems. You can also deploy the client software to managed systems silently without notifying users. You must have administrative credentials for a SecurityCenter account. McAfee or your service provider sends these to you in an . 1 Make sure that all managed systems meet the requirements described in Chapter 2, Pre-installation. 2 Open your web browser and log on to your SecurityCenter account. 3 (Optional) Configure basic options (groups and policies). 4 Install the client software on the administrative system. This is the system you use to monitor security status for managed systems. The McAfee Agent is installed if it has not already been installed on the system. McAfee Endpoint Security Installation Guide 37

38 4 Installation for systems managed with the McAfee SecurityCenter Install on local systems with an installation URL 5 Deploy the client software (and the McAfee Agent, if it not already installed) with default or custom settings to managed systems in one of these ways. Locally on managed systems Create an installation URL, then it to users, along with instructions about installing the product on their systems. Silently Deploy the client software with no user interaction. 6 Verify that the client software is installed and up to date on all managed systems. Install on local systems with an installation URL Typically, administrators create an installation URL that can be used to install Endpoint Security locally on managed systems. They send this URL to users with instructions. Tasks Install on the administrative system on page 38 Install the product directly on the system you use to manage your network's computers with the SecurityCenter. Send an installation URL to other managed systems on page 39 As an administrator, you can obtain the company-specific installation URL in two ways. Install with an installation URL on page 40 Install the client software with an installation URL that your administrator has sent to you. Install on the administrative system Install the product directly on the system you use to manage your network's computers with the SecurityCenter. Before you begin You must have administrative credentials for a SecurityCenter account. McAfee or your service provider sends these to you in an . Task For option definitions, click? in the interface. At the administrative computer, install using one of these methods. 38 McAfee Endpoint Security Installation Guide

39 Installation for systems managed with the McAfee SecurityCenter Install on local systems with an installation URL 4 If you want to Install all modules in your subscription with their default settings Specify custom settings or install from the SecurityCenter Perform these steps 1 Open the welcome that contains the installation URL. 2 Click the installation URL or copy and paste it into a web browser. 1 In your web browser, log on to the SecurityCenter. 2 From the Dashboard or Computers page, click Install Protection. 3 Select the appropriate options: The group in which to place the client computers The policy to assign to the computers The product modules to install The language for the software 4 Click Install on this computer. Send an installation URL to other managed systems As an administrator, you can obtain the company-specific installation URL in two ways. Before you begin You must have administrative credentials for a SecurityCenter account. McAfee or your service provider sends these to you in an . When you subscribe to Endpoint Security, you receive an message containing the installation URL that has been set up for your company. This URL installs the products you have subscribed to into your account s default group in its default language. You can copy this URL to an message and send it to other managed systems at your company. You can log on to the SecurityCenter and create a custom URL to send to users. This enables them to install selected products in a designated group and language. Follow these steps to create a custom installation URL and send it to users. Task For option definitions, click? in the interface. 1 In your web browser, log on to the SecurityCenter. 2 From the Dashboard or Computers page, click Install Protection. 3 Select Obtain a URL for installing on other computers. 4 Select the appropriate options: The group in which to place the client computers The policy to assign to the computers The protection services to install The language for the software 5 Click Get URL. A custom URL is displayed, along with simple instructions for users. McAfee Endpoint Security Installation Guide 39

40 4 Installation for systems managed with the McAfee SecurityCenter Deploy silently to local systems 6 Click Select Text and Copy to Clipboard, then click . An message opens. The text and URL you copied appear in the message. 7 Type addresses into the message, revise the instructions if needed, then click Send. Install with an installation URL Install the client software with an installation URL that your administrator has sent to you. Before you begin The system where you install the product must meet the requirements described in Chapter 2, Pre-installation. When installation is complete, the product downloads the content (threat definition) files in the background. You don't have to wait for a lengthy download to complete. The managed system is not fully protected until the product content files are downloaded. Do not turn off the managed system or disconnect the Internet connection until the download is complete. Task For option definitions, click? in the interface. 1 Open the message containing the URL on the managed system. 2 Select the URL or copy and paste it in a browser window to begin installation. When entering the URL in a browser, make sure to enter the entire URL without spaces. 3 Type your address in the or identifier field, and click Continue. The information entered here identifies the managed system in reports. If reports indicate a problem with the managed system, the administrator uses the address to notify the person who uses the managed system. If you do not enter an address, it is important that the administrator knows the correct contact information. 4 When prompted, click Install. 5 In the File Download dialog box, click Run. 6 Click Yes or Continue if you are prompted to allow the software to make changes to your managed system. Deploy silently to local systems You can run the VSSETUP utility to install the client software on managed systems with no user interaction. Tasks Install with silent installation on page 41 Use this task to install the client software silently to a local managed system from an administrative system. Designate a relay server on page 42 Specify whether a managed system functions as a relay server. 40 McAfee Endpoint Security Installation Guide

41 Installation for systems managed with the McAfee SecurityCenter Deploy silently to local systems 4 Overview of silent installation Silent installation uses the VSSETUP utility. 1 Download the utility from the SecurityCenter. 2 Deploy to each system where you want to install the client software. 3 On the local system, open a Command Prompt window and run the VSSETUP command using the appropriate command-line options. Requirements for silent installation Make sure that you meet these requirements before using the silent installation method. You must have a method for installing executable files on your network computers. For example: A third-party deployment tool, such as Novell NAL, ZenWorks, Microsoft Systems Management Server (SMS) installer, or Tivoli IT Director. A login script. A link to an executable file in an message. A portable medium such as a CD. You must run this program using an account with sufficient rights to install the product. Typically local administrator rights are required, and some methods require remote execution rights. You must know your company key (the series of characters in the installation URL after the characters CK=). The company key appears on the Product Installation page and the Keys tab of the My Licenses page in the SecurityCenter. Install with silent installation Use this task to install the client software silently to a local managed system from an administrative system. Before you begin You must have administrative credentials for a SecurityCenter account. The systems where you install the software must meet the requirements described in Chapter 2, Pre-installation. Task For option definitions, click? in the interface. 1 In your web browser, log on to the SecurityCenter. 2 From the Dashboard or Computers page, click Install Protection. 3 Select Desktop protection, then click Next. 4 Under Additional Installation Options Select advanced options, click Silent install. 5 Select a language, select the correct version of the utility, then click Download. Operating system 32-bit Windows 64-bit Windows Version of utility VSSETUP_X86.EXE VSSETUP_X64.EXE McAfee Endpoint Security Installation Guide 41

42 4 Installation for systems managed with the McAfee SecurityCenter Verify the installation on the SecurityCenter 6 Deploy the program to each client computer using your customary deployment tool. 7 Open a command prompt on a client computer and run this command: 32-bit Windows: VSSETUP_X86.EXE /CK=<your company key> /<parameters> 64-bit Windows: VSSETUP_X64.EXE /CK=<your company key> /<parameters> As shown, you must include your company key (CK) as a parameter. On the Install Protection page, click More to display your company key and a link to a list of command-line options for VSSETUP. Your company key also appears on the Keys tab of the My Licenses page in the SecurityCenter. For a list of command-line options, see Chapter 6, Troubleshooting and reference. See also VSSETUP command-line options (SecurityCenter systems) on page 58 Designate a relay server Specify whether a managed system functions as a relay server. Relay servers retrieve updates directly from the McAfee update site, then make them available to managed systems that do not have an Internet connection. Task Use a VSSETUP command-line option to specify whether a computer is a relay server. To do this... During installation, specify that a managed system is a relay server Use this parameter VSSETUP_86.EXE /RelayServer=1 or VSSETUP_64.EXE /RelayServer=1 If you do not specify this option, the default is 0 and the computer is not a relay server. Modify an existing installation to specify that a managed system is a relay server Modify an existing installation to specify that a managed system is not a relay server VSSETUP_86.EXE /SetRelayServerEnable=1 or VSSETUP_64.EXE /SetRelayServerEnable=1 VSSETUP_86.EXE /SetRelayServerEnable=0 or VSSETUP_64.EXE /SetRelayServerEnable=0 Verify the installation on the SecurityCenter Check the SecurityCenter to verify that the product installed and updated correctly on managed systems. 42 McAfee Endpoint Security Installation Guide

43 Installation for systems managed with the McAfee SecurityCenter Uninstall from systems managed with the SecurityCenter 4 Task For option definitions, click? in the interface. 1 Wait for managed systems to report back to the SecurityCenter (typically about 20 minutes). 2 In your web browser, log on to the SecurityCenter. 3 Click Computers to open the Computers page. Check that each managed system appears in the listing. Check that a current date is listed under Last Connect and DAT Date. Red entries in these columns indicate that the managed system is out of date and needs to run an update. Uninstall from systems managed with the SecurityCenter You can remove protection services locally from a managed system. You might do this for testing or before reinstalling the client software. If you remove all the Endpoint Security services, and no other protection services are installed on the system, you also need to uninstall the McAfee Agent. If you uninstall the client software, the managed system is no longer protected against threats. We recommend that you reinstall as soon as possible. Task 1 Open the Windows Control Panel, then go to the Uninstall Programs screen. 2 In the list of programs, select each product module, then click Uninstall. McAfee Endpoint Security Firewall 10.1 McAfee Endpoint Security Threat Prevention 10.1 McAfee Endpoint Security Web Control If prompted, enter a password for each module. By default, the password is disabled. To enable, edit, or view the password, go to the Client Settings policy page in the SecurityCenter, or ask your administrator for assistance. 4 Wait for the wizard to report that it has uninstalled the support components. If you do not see a notification, check the Event Log to verify that the Endpoint Security Platform and the TPS Connector were removed successfully. 5 If no other protection services are installed, select McAfee Agent in the Uninstall Programs screen of the Windows Control Panel, then click Uninstall. 6 Restart the computer, if prompted. McAfee Endpoint Security Installation Guide 43

44 4 Installation for systems managed with the McAfee SecurityCenter Uninstall from systems managed with the SecurityCenter 44 McAfee Endpoint Security Installation Guide

45 5 Installation 5 for self-managed systems Use this information to install the product on systems that are not managed by a centralized network management tool. Contents Installation overview for self-managed systems Upgrade the McAfee Agent on self-managed systems Install with the installation wizard Install from the command line Verify the installation Uninstall from a self-managed system Installation overview for self-managed systems Local system users perform these high-level tasks to install or upgrade the product on self-managed systems. 1 Make sure that the system meets the requirements described in Chapter 2, Pre-installation. 2 (Optional) If you are upgrading legacy products and plan to preserve your settings, review and revise them as needed. See Upgrading an existing version of the product for a list of legacy products you can upgrade. 3 Upgrade the McAfee Agent, if needed. Endpoint Security 10.1 requires McAfee Agent 5.0 Patch 2. Endpoint Security 10.1 automatically upgrades 4.0 and later versions of the agent to 5.0 Patch 2 during product upgrades. You can also upgrade the agent manually. 4 Copy the product files to the self-managed system. Depending on how you purchased the product, you might need to download product files from a download site or copy them from a disc. 5 Launch the installation wizard to install or upgrade the product. 6 Verify that the client software is installed and up to date. 7 (Optional) If you upgraded from legacy products and preserved your settings, verify that the settings were preserved. We recommend that you reboot the system after installing this release of the product. See also Upgrading an existing version of the product on page 25 McAfee Endpoint Security Installation Guide 45

46 5 Installation for self-managed systems Upgrade the McAfee Agent on self-managed systems Upgrade the McAfee Agent on self-managed systems Endpoint Security 10.1 requires McAfee Agent 5.0 Patch 2 or later. Endpoint Security 10.1 automatically upgrades version 4.0 and later of the agent to version 5.0 Patch 2 during product upgrades. You can also upgrade the agent manually. Task For option definitions, click? in the interface. 1 Download the McAfee Agent client package from the download site. 2 Unzip the McAfee Agent package and locate the FramePkg_Upd.exe file. 3 Right-click FramePkg_UPD.exe, then select Run as administrator. Install with the installation wizard The installation wizard automates much of the process for installing and upgrading the product on self-managed systems. Before you begin The systems where you install the product must meet the requirements described in Chapter 2, Pre-installation. Task For option definitions, click? in the interface. 1 Obtain your copy of the product software, then launch the installation wizard on the self-managed system. For this product format... Download Perform these steps... Download the Endpoint Security.zip file, unzip the contents of the file, then double-click setupep.exe. If you purchase the product online, McAfee or another provider sends instructions and a URL for downloading the product. CD or DVD Insert the disc into a drive, open the contents, then double-click setupep.exe. If there is a product license number on the disc label or packaging, make sure that you have a copy for reference. 2 On the License Agreement page, click Accept. 3 Resolve any conflicts detected by the wizard. The wizard attempts to uninstall conflicting virus-detection and firewall software products automatically. If it can't, it prompts you to uninstall them manually, then prompts you to reboot. If you reboot immediately, installation resumes after the system restarts. If you reboot later, run the installation wizard again at your earliest convenience. See KB85522 for a list of the software products uninstalled automatically. 46 McAfee Endpoint Security Installation Guide

47 Installation for self-managed systems Install from the command line 5 4 On the Install Options page, select the modules to install. Install all product modules that you purchased with their default settings, or select options to customize your installation. 5 If you are upgrading VirusScan Enterprise 8.8, Host Intrusion Protection 8.0, or SiteAdvisor Enterprise 3.5, select whether to preserve your settings. 6 Click Install. A dialog box shows the progress of the installation and notifies you when it is complete. You can cancel the installation at any time, if needed. 7 Click Finish to close the wizard. We recommend that you reboot the system after installing this release of the product. See also Other virus-detection and firewall software on page 24 Install from the command line You can run the installation wizard from the command line, which lets you select additional options, such as silent installation. (By default, installation is interactive.) Before you begin The system where you install the product must meet the requirements described in Chapter 2, Pre-installation. For silent installation, the wizard displays no feedback. All information is available in logs. For interactive command-line installation, the wizard displays a progress window and allows you to cancel the installation, if needed. All information is available in logs. Task 1 Copy the product files to the self-managed system. Depending on how you purchased the product, you might need to download product files from a download site or copy them from a disc. 2 Open a Command Prompt window, navigate to the folder where you copied the files, then type this command and any applicable parameters, which are not case-sensitive: setupep.exe /parameters Type setupep.exe /help for a complete list of command-line options for the SETUP utility, or see SETUP command-line options (self-managed). We recommend that you reboot the system after installing this release of the product. See also SETUP command-line options (self-managed) on page 56 McAfee Endpoint Security Installation Guide 47

48 5 Installation for self-managed systems Verify the installation Verify the installation After installation is complete, verify that the modules installed successfully and the system is up to date. If you migrated settings from legacy products, verify that your settings migrated correctly. Task For option definitions, click? in the interface. 1 Open the Windows Control Panel and verify that the name of each module you selected to install appears and that version 10.1 is installed. McAfee Endpoint Security Firewall McAfee Endpoint Security Threat Prevention McAfee Endpoint Security Web Control 2 Open the installation log file and make sure that no errors or failure messages appear. By default, the installation wizard installs the installation log files in the user Temp folder as %Temp% \McAfeeLogs (for example, C:\Users\username\AppData\Local\Temp\McAfeeLogs). 3 Open the Endpoint Security Client, then click Update Now to ensure that the system is up to date. If your system is up to date, the page displays No Updates Available and the date and time of the last update. 4 (Upgrade only) If you upgraded legacy products with preserved settings, check the client Settings page for each product module to verify that legacy settings were migrated. Uninstall from a self-managed system You can remove product modules on a self-managed system from the Windows Control Panel. You might do this for testing or before reinstalling the client software. You can also uninstall the product modules from a command line. See SETUP command-line options (self-managed) in Chapter 6, Troubleshooting and reference. If you uninstall the client software, the system is no longer protected against threats. We recommend that you reinstall as soon as possible. Task 1 Open the Windows Control Panel, then go to the Uninstall Programs screen. 2 In the list of programs, select each product module, then click Uninstall. McAfee Endpoint Security Firewall McAfee Endpoint Security Threat Prevention McAfee Endpoint Security Web Control 3 If prompted, enter a password for each module. By default, the password is mcafee. 48 McAfee Endpoint Security Installation Guide

49 Installation for self-managed systems Uninstall from a self-managed system 5 4 Wait for the wizard to report that it has uninstalled the support components. If you do not see a notification, check the Event Log to verify that the Endpoint Security Platform was removed successfully. 5 If no other protection services are installed, select McAfee Agent in the Uninstall Programs screen of the Windows Control Panel, then click Uninstall. See also SETUP command-line options (self-managed) on page 56 McAfee Endpoint Security Installation Guide 49

50 5 Installation for self-managed systems Uninstall from a self-managed system 50 McAfee Endpoint Security Installation Guide

51 6 Troubleshooting 6 and reference Use this information for basic product maintenance, troubleshooting, and reference. Contents Troubleshooting installation problems Resolving error codes and messages Using command-line options Log files Troubleshooting installation problems Follow troubleshooting procedures to resolve problems related to installing and uninstalling the product, and capture the required system information. Test malware detection Test the virus detection feature of Threat Prevention by downloading the EICAR Standard AntiVirus Test File to the local system. Although it is designed to be detected as a virus, the EICAR test file is not a virus. Task 1 Download the EICAR file from this location: If installed properly, Threat Prevention interrupts the download and displays a threat detection dialog box. 2 Click OK. If not installed properly, Threat Prevention does not detect the virus or interrupt the download process. In this case, use Windows Explorer to delete the EICAR test file from the client computer, then reinstall the product and test the new installation. Troubleshoot general installation problems (SecurityCentermanaged systems) Resolve problems that do not generate an error message during installation. If you can't identify and resolve the problem after each step, proceed to the next step. McAfee Endpoint Security Installation Guide 51

52 6 Troubleshooting and reference Troubleshooting installation problems Task For option definitions, click? in the interface. 1 Check that the computer meets the system requirements described in Chapter 2, Pre-installation. 2 Check the McAfee Support KnowledgeBase to see if the problem is documented there. For a quick reference listing of KB articles related to many common issues, including installation and uninstallation, see KB Uninstall the software by using the Uninstall Programs feature of the Windows Control Panel, then reinstall the software. Uninstalling the software might require a password. If you do not have it, ask your site administrator for assistance. 4 If the software does not install correctly and you do not have administrator credentials, ask your site administrator for assistance with completing the remaining steps. 5 Run the MER tool here? Explain where to download and how to run it. 6 Download and run the Cleanup utility (also called the uninstall utility, mvsuninst.exe). The utility is available on the SecurityCenter, on the Optimization tab of the Utilities page. See KB55238 for instructions about using the utility to remove any extra registry files and other components that might have been left behind. 7 If you still can't install the client software, contact McAfee support. Be sure to collect MER data to send them so they can determine the problem. Using the MER tool for troubleshooting The MER (Minimum Escalation Requirements) tool collects McAfee data from Endpoint Security and other McAfee products from your computer. McAfee support uses this data to analyze and resolve your problem. The information collected by the MER tool includes: Registry details Event logs File version details Process details Files McAfee provides two versions of MER: WebMER runs on the client computer. See How to use MER tools with supported McAfee products. MER tool for McAfee epo uses McAfee epo to run the MER tool on client computers. See How to use the MER tool for McAfee epo. 52 McAfee Endpoint Security Installation Guide

53 Troubleshooting and reference Resolving error codes and messages 6 Resolving error codes and messages Error messages are displayed by programs when an unexpected condition occurs that can't be fixed by the program itself. Use this list to find an error message, an explanation of the condition, and any action you can take to correct it. Depending on how you launched the installation wizard, it displays a description of the error or an error code. Message Description Solution Conflicting McAfee product(s) found. Error code: The installation wizard detected one or more conflicting McAfee products (such as Deep Defender) on the system that it can't remove automatically. Uninstall the conflicting products, then try installing again. Administrator rights required. Error code: You must have administrator rights to run the installation wizard. Log on as an administrator, then launch the installation wizard. Invalid Package. Error code: Removal failed. Error code: Invalid package found. Please verify that you have a valid package. The installation wizard couldn't remove a previous version of this product (such as a beta version) or a legacy product (such as VirusScan Enterprise or SiteAdvisor Enterprise) from the system. Download a valid package file, then try installing the product again. Remove these products manually before installing Endpoint Security. Contact support if the issue persists. Installer failed to launch. Error code: The installation wizard was not able to launch. Contact McAfee support. Restart required Error code: Restart required Error code: Restart pending Error code: The installation wizard requires a system restart to continue the installation. The installation wizard requires a system restart to complete the installation. A system restart from a previous installation or removal operation is pending. Restart the system to continue with the installation. Restart the system to complete the installation. Restart the system to continue with the installation. Incompatible software removal failed. Error code: The installation wizard tried and failed to remove one or more incompatible software products it detected on the system. Remove these products manually before installing Endpoint Security. Installation canceled. Error code: The user canceled the installation before it completed. The installation wizard made no changes to the user's system. Run the installation wizard again. McAfee Endpoint Security Installation Guide 53

54 6 Troubleshooting and reference Resolving error codes and messages Message Description Solution Migration failed. Error code: The installation wizard tried to migrate settings from a legacy product, but it encountered an error. Run the installation wizard again at a later time. Installation failed. Error code: Your system is not protected. Your previous security software was uninstalled, but the installer was interrupted before McAfee Endpoint Security was installed. Call McAfee support for assistance as soon as possible. Your system is not fully protected. The installer could not install [product name]. Call McAfee support for assistance. The installation wizard was interrupted before it finished installing Endpoint Security. It made no changes to your system. Error code: 16029, 16030, The installation wizard was interrupted before Endpoint Security was installed. Your previous software was uninstalled, but no other changes were made to your system. Error code: Policy import failed. Error code: Policy import failed. Error code: Installation failed and then rollback failed. Installation canceled and then rollback failed. One or more Endpoint Security product modules failed to install. Your previous software was uninstalled. The installation wizard installed Endpoint Security successfully, but couldn't import the specified policy. The installation wizard couldn't import the specified policy. Error code: The installation wizard couldn't install Endpoint Security or roll back the changes it made to the user's system. Error code: The installation was canceled before it completed. The installation wizard couldn't roll back the changes it made to the user's system. Run the installation wizard again at a later time. To protect your system against threats, contact McAfee support as soon as possible. To fully protect your system against threats, call McAfee support as soon as possible. Check that you selected the proper data to import. Contact support if the issue persists. Check that you selected the proper data to import. Contact McAfee support if the issue persists. Check the installation logs on the system and contact McAfee support for assistance. Check the installation logs on the system and contact McAfee support for assistance. Another installation wizard is already running. Installation failed. Error code: 1618 Another installation is already in progress. Error code: various The installation wizard couldn't install Endpoint Security. It made no changes to the user's system. Complete that installation before proceeding with the new installation. See MsiExec.exe and InstMsi.exe Error Messages for descriptions of specific error codes. If the issue persists, contact McAfee support. 54 McAfee Endpoint Security Installation Guide

55 Troubleshooting and reference Using command-line options 6 Using command-line options Use command-line options to customize product installation and uninstallation from the command line. Supported options differ by product platform. SETUP command-line options (McAfee epo and McAfee epo Cloud deployment tasks) Use these command-line options within a deployment task to install the product on systems managed with McAfee epo and McAfee epo Cloud. For each product module selected in a product deployment task, type supported options in the corresponding Command line window. (Do not type the command, type only the options.) Options are not case-sensitive. Example INSTALLDIR="D:\Installed Programs" /l"d:\installed Programs\logs" Installs the product files to a folder on drive D under My Programs and saves the installation log files to a folder under My Log Files. Option INSTALLDIR="install_path" Definition Specifies where to install the product files on the computer. The installation wizard creates an Endpoint folder at the specified location and installs the product to this folder. Example: INSTALLDIR="D:\Installed Programs" Installs the product modules under D:\Installed Programs \EndPoint\. By default, product files are installed in the folder C:\windows \Temp\McAfeeLogs. /log"install_log_path" or / l"install_log_path" /l*v"install_log_path" Specifies where to save the installation log files for tracking installation events. The installation wizard creates an Endpoint folder at the specified location and saves the log files to this folder. Example: /l"d:\log Files" Installs the product log files under D:\Log Files\EndPoint\. By default, log files are saved in the Windows System TEMP folder C:\windows\Temp\McAfeeLogs. *v Specifies verbose (more descriptive) logging entries. /nocontentupdate Does not update product content files automatically as part of the installation process. The managed system is not fully protected until the product content files are downloaded. Schedule an update as soon as possible. See also Download Endpoint Security content files on page 30 Log files on page 59 McAfee Endpoint Security Installation Guide 55

56 6 Troubleshooting and reference Using command-line options SETUP command-line options (self-managed) Use these options with the SETUP utility to install the product from a command line. Open a Command Prompt window, then run the SETUP command using the appropriate command-line options. Options are not case-sensitive. Example setupep.exe INSTALLDIR="D:\My Programs" /l"d:\my Log Files" Installs the product files to a folder on drive D under My Programs and saves the installation log files to a folder under My Log Files. Basic options setupep.exe ADDLOCAL="tp,fw,wc" [INSTALLDIR="install_path"][/qb][/qb!][/ l*v"install_log_path"] All options setupep.exe ADDLOCAL="tp,fw,wc" [INSTALLDIR="install_path"][/qb][/qb!][/ l"install_log_path"][/l*v"install_log_path"] [/autorestart] [/import <file_name>] [/ module <TP FW WC ESP>] [/nopreservesettings] [/policyname <name>] [/unlock <password>] Option ADDLOCAL="tp,fw,wc" Definition Selects the product modules to install: tp Threat Prevention fw Firewall wc Web Control tp,fw,wc Install all three modules. Example: ADDLOCAL="tp,wc" installs Threat Prevention and Web Control. INSTALLDIR="install_path" Specifies where to install the product files on the computer. The installation wizard creates an Endpoint folder at the specified location and installs the product to this folder. Example: INSTALLDIR="D:\Installed Programs" Installs the product modules under D:\Installed Programs \EndPoint\. By default, product files are installed in the folder C:\windows \Temp\McAfeeLogs. 56 McAfee Endpoint Security Installation Guide

57 Troubleshooting and reference Using command-line options 6 Option /log"install_log_path" or / l"install_log_path" /l*v"install_log_path" /qn or /quiet /qb! or /passive /qb /autorestart /import <file_name> /module <TP FW WC ESP> Definition Specifies where to save the installation log files for tracking installation events. The installation wizard creates an Endpoint folder at the specified location and saves the log files to this folder. Example: /l"d:\log Files" Installs the product log files under D:\Log Files\EndPoint\. By default, log files are saved in the User TEMP folder C: \users\username\appdata\local\temp\mcafeelogs. *v Specifies verbose (more descriptive) logging entries. Specifies how the users can interact with the installation wizard: qn Hide all installation notifications (silent mode). Users have no interaction. qb! Show only a progress bar without a Cancel button. Users cannot cancel the installation while it is in progress (passive mode). qb Show only a progress bar with a Cancel button. Users can cancel the installation while it is in progress, if needed. Restarts system automatically during installation. Imports policy settings from the specified file. Applies imported policy settings to the specified product modules. TP Threat Prevention FW Firewall WC Web Control ESP Resources shared by product modules. /nocontentupdate Do not update product content files automatically as part of the installation process. The managed system is not fully protected until the product content files are downloaded. Schedule an update as soon as possible. /nopreservesettings /policyname <name> /unlock <password> Do not migrate your product settings to Endpoint Security. By default, settings are preserved. Assigns the specified policy to systems where the product is installed. Sets the password for unlocking the client UI. See also Download Endpoint Security content files on page 30 Log files on page 59 McAfee Endpoint Security Installation Guide 57

58 6 Troubleshooting and reference Using command-line options VSSETUP command-line options (SecurityCenter systems) You can use these options with the VSSETUP utility to install the client software silently on systems managed with the SecurityCenter. On the local system, open a Command Prompt window, then use this command line and any of the following parameters (which are not case-sensitive): For 32-bit Windows: VSSETUP_X86.EXE /CK=<your company key> /<parameters> For 64-bit Windows: VSSETUP_X64.EXE /CK=<your company key> /<parameters> Parameter /CK=XYZ / =x@y.com Description Required. Launches VSSETUP using the company key. Your company key is listed on the SecurityCenter, on the Keys tab of the My Licenses page. Identifies the user s address in administrative reports. Despite its name, the variable does not need to be an address. This can be a simple text identifier, such as a location or computer name. However, do not use a string containing non-standard characters, because they might be displayed incorrectly in reports. /Uninstall /SetRelayServerEnable=1 /Reinstall /Groupid=[group number] Uninstalls the client software. Sets a system with a connection to the Internet as a relay server. If the computer is not used as a relay server, set to 0. Reinstalls the client software, leaving the previous values for company key, address, and machine ID intact. Places the managed system into any group you have created. You can find the number associated with a group by checking the Computer Profiles report or by generating a custom URL. The group ID is at the end of the URL in the format G=xx. If you designate a group that does not exist, systems are placed in the Default Group or the group that you have designated as your default group. /Policyid=[policynumber] Assigns a policy to the managed system. If you designate a policy that does not exist, the McAfee Default policy or the policy you have designated as your default is assigned. /P=b /P=f /P=v Selects the product modules to install: b Web Control f Firewall v Threat Prevention If you omit the /P parameter, only the Threat Prevention module is installed. /ScanComputer Performs a Full Scan on the managed system as soon as the installation is completed and product content files are downloaded successfully. 58 McAfee Endpoint Security Installation Guide

59 Troubleshooting and reference Log files 6 Examples VSSETUP.EXE /P=vfb /CK=abcd / =joe@example.com /Groupid=3 The threat prevention, firewall protection, and web control services are installed. Threat Prevention, Firewall, and Web Control are installed. The company key is abcd, the user s address is joe@example.com for reporting purposes, and the computer is placed in an existing group represented by the number 3. Check the Computer Profiles report to find the correct numeric groupid. VSSETUP.EXE /CK=abcd / =joe@example.com Only Threat Prevention is installed. The company key is abcd and the user s address is joe@example.com for reporting purposes. The computer is placed in the default group. Log files The installation wizard tracks details about installation, uninstallation, and migration in log files that you can use to verify results and troubleshoot problems. Default location of installation log files By default, the installation wizard installs the installation log files in a TEMP folder. Use command-line options to change the location for the log files. Management platform McAfee epo McAfee epo Cloud SecurityCenter (cloud) Self-managed Installation log file location Windows System TEMP folder (C:\Windows\TEMP\McAfeeLogs by default) User TEMP folder %Temp%\McAfeeLogs (C:\Users\username\AppData\Local\Temp\McAfeeLogs by default) Types of log files Check these log files for details about installation, uninstallation, and migration. Log file name McAfee_<module>_Install_XX.log Type of information Installation log for each product module. Example: McAfee_TP_Install_XX.log McAfee_<Module>_Bootstrapper_XX.log McAfee_Endpoint_BootStrapper_XX.log McAfee_<Module>_CustomAction_Install_XX.log McAfee_Endpoint_CompetitorUninstaller.log McAfee_<Module>_UnInstall_XX.log Bootstrapper for each product module. Bootstrapper for self-managed Master SETUPEP. MSI Custom Action for each product module. Removal of incompatible virus-protection and firewall products. Uninstallation log for each product module. McAfee_<Module>_CustomAction_Uninstall_XX.log MSI Custom Action for each product module for uninstallation. McAfee_Endpoint_Security_Migration_xxx.log Removal of legacy products. Example: McAfee_Endpoint_Security_Migration_McAfee VirusScan Enterprise_8.8_ log McAfee Endpoint Security Installation Guide 59

60 6 Troubleshooting and reference Log files Log file name McAfee_<module>_Migration_Plugin.log McAfee_ESP_Migration_Plugin.log Type of information Preserve and restore status of migrated legacy settings, per module. Example: McAfee_TP_Migration_Plugin.log Legacy settings migrated to the Common Options policy. 60 McAfee Endpoint Security Installation Guide

61 A Threat Intelligence installation Endpoint Security Threat Intelligence has two components: a TIE server and the Threat Intelligence module. Endpoint Security Threat Intelligence is supported on McAfee epo-managed systems only. It is not supported on McAfee epo Cloud, SecurityCenter, or self-managed systems. Install each component in the order presented here. When you are finished, these items are added to your network: Two McAfee epo managed extensions TIE server extension Threat Intelligence module extension The TIE server A Threat Intelligence module and Data Exchange Layer (DXL) Client on each managed system in your network Contents System requirements for Threat Intelligence Threat Intelligence network overview Download and check in the components to McAfee epo Install the TIE server appliance Deploy DXL and Threat Intelligence Verify the installation Configure the TIE server extension Configure the TIE server policy Create a new registered server Troubleshooting the installation System requirements for Threat Intelligence Make sure that your system environment meets these requirements and that you have administrator rights. Products Components Version Notes VMware vsphere Threat Intelligence Exchange TIE server with VMWare vsphere ESXi 5.1 or later Required to install TIE server. McAfee Endpoint Security Installation Guide 61

62 A Threat Intelligence installation System requirements for Threat Intelligence Products Components Version Notes McAfee epo server (on-premise only) McAfee epo product packages (checked in to the Master Repository) McAfee epo product extensions (installed in Extensions) Products deployed to your managed systems Data Exchange Layer Client package Endpoint Security Platform Endpoint Security Threat Prevention Threat Intelligence for Endpoint Security McAfee Agent for Windows Endpoint Security Platform Endpoint Security Threat Prevention extension 5.1.1, This package is checked in automatically when you check in the Endpoint Security product to McAfee epo This package is checked in automatically when you check in the Endpoint Security product to McAfee epo TIE Server extension 1.1 Endpoint Security Threat Intelligence extension McAfee Agent extension This package is checked in automatically when you check in the Endpoint Security product to McAfee epo This extension is checked in automatically when you check in the Endpoint Security product to McAfee epo 10.1 This extension is checked in automatically when you check in the Endpoint Security product to McAfee epo This extension is checked in automatically when you check in the Endpoint Security product to McAfee epo. McAfee Agent For more information about this component, see the McAfee Agent Product Guide. Endpoint Security Platform Threat Prevention Data Exchange Layer Client package Threat Intelligence 10.1 This package can be deployed as part of the Endpoint Security deployment Operating systems Threat Intelligence supports all operating systems that Endpoint Security supports except Windows Vista. See also System and hardware requirements on page McAfee Endpoint Security Installation Guide

63 Threat Intelligence installation Threat Intelligence network overview A Threat Intelligence network overview Threat Intelligence uses these network protocols and ports. Make sure that these ports are open and available for use with Threat Intelligence. We recommend using the default configuration of the ports. This table describes the endpoints, network protocols, and ports of the diagram, from top to bottom, left to right. McAfee Web Gateway Server and Advanced Threat Defense communicate with the TIE Server through DXL. Table A-1 Ports for use with Threat Intelligence Network components Port Global Threat Intelligence (McAfee GTI) HTTPS 443 SQL Server JDBC/SSL and ADO/SSL 1433 epolicy Orchestrator Server HTTPS 8443 (Install), 8444; HTTP 80; DXL/TLS 8883 Agent Handler HTTP 80 and HTTPS 443 DXL Broker DXL\TLS 8883 TIE Server HTTP 8081; HTTP 80; HTTPS 443; DXL\TLS 8883; ATD File 80; HTTP 5432 (Reporting); HTTPS 8443 (Install) Advanced Threat Defense Server ATD File REST 443; DXL\TLS 8883 McAfee Endpoint Security Installation Guide 63

64 A Threat Intelligence installation Download and check in the components to McAfee epo Download and check in the components to McAfee epo Check in the required Threat Intelligence components to the McAfee epo server. Task For option definitions, click? in the interface. 1 In McAfee epo, select Menu Software Software Manager. 2 Download the TIE Server Appliance package. a From Management Solutions, select McAfee Threat Intelligence Exchange 1.2. b Download the Server Appliance package. The server appliance is installed using VMware vsphere. Download the server appliance file and save it locally before continuing. The following tasks include detailed instructions for installing the server. 3 Check in the TIE Server Management extension. a From Management Solutions, select McAfee Threat Intelligence Exchange 1.2. b Check in the Server Management extension. 4 Check in the McAfee Data Exchange Layer package: a From Management Solutions, select McAfee Data Exchange Layer 2.0. b Check in the DXL Bundle package. 5 Check in the Threat Intelligence package: a From Endpoint Security, select McAfee Endpoint Security b Check in the Threat Intelligence for Endpoint Security package. Install the TIE server appliance Install and configure the TIE server and the Data Exchange Layer brokers. Task 1 Deploy the OVF template: a Extract the TIE Server Appliance.zip file that you downloaded from McAfee epo Software Manager. b c d Open the VMware vsphere client, then click File Deploy OVF Template. Browse to and select the TIE.ova file on your computer, then click Next to start the installation wizard. Complete the steps in the wizard, accepting the default values or entering different values as needed. 2 When finished, select Power On to turn on the virtual machine and open a Console window. 64 McAfee Endpoint Security Installation Guide