Getting Started Guide

Transcription

1 Security Services Enforced Client Anti-Virus Kaspersky Contents This guide provides platform compatibility information and installation instructions for SonicWALL Enforced Client Anti-Virus Kaspersky. Several ways to install SonicWALL Enforced Client on your desktop or laptop systems are described. Platform Compatibility... 1 Block Page Installation... 2 URL Based Installation... 7 Command Line Installation Domain Group Policy Installation Platform Compatibility SonicWALL Enforced Client Anti-Virus is supported on the Windows versions, machine hardware, and browser versions listed below. Windows Clients: SonicWALL Enforced Client is supported on 32-bit and 64-bit versions of Microsoft Windows: Windows Server 2008 Windows Server 2003 Windows 7 Vista Windows XP (Service Pack 2 and above) Client Hardware Requirements: For Windows XP: Processor: 800 MHz or higher 1 GB RAM For Windows 7 and Vista: Processor: 2 GHz or higher (32-bit/64-bit) 2 GB RAM or higher Browsers: SonicWALL Enforced Client installation is supported on the following versions of Internet Explorer: Internet Explorer 9 Internet Explorer 8 Internet Explorer 7 Internet Explorer 6

2 Block Page Installation Getting Started Guide This method allows installation of SonicWALL Enforced Client Anti-Virus via a link on the block page displayed by the SonicWALL firewall. When a client tries to communicate with an untrusted zone and anti-virus enforcement is enabled on the firewall, the firewall uses the enforcement protocol to determine if the end point (the client machine) has installed the SonicWALL Enforced Client Anti-Virus. If SonicWALL Enforced Client AV is not installed, then the firewall displays a block page with a link to click for installing it. You must be logged into the client system as an administrator. If the client system is running Windows Server 2003 or 2008, you will need to disable enhanced security on IE ESC (Enhanced Security Configuration). To do so, perform these steps: 1. Close all instances of Internet Explorer. 2. Click Start, point to Administrative Tools, and then click Server Manager. 3. If a User Account Control dialog box appears, click Continue. 4. Under Security Information, click Configure IE ESC. 5. Click Off for Administrators and/or Users, and then click OK. 2

3 To proceed with the installation, perform the following steps: 1. In Internet Explorer 9, click the Install button at the bottom of the window: 2. Earlier versions of Internet Explorer provide a sequence of windows that require interaction before the installation begins: Click Close on the Information Bar alert: 3

4 3. Click within the yellow Information Bar: 4. Click Install ActiveX Control in the Information Bar popup: 4

5 5. Click Install in the Security Warning popup: 6. Wait until the download and the silent installation complete, and the SonicWALL Enforced Client application is running. The page displays the download progress and the installation steps and status. 5

6 7. Double-click the SonicWALL Enforced Client icon when it appears in your system tray. The client application opens to the Summary page. Right after installation, the red banner indicates that no policy information has been retrieved from the policy server. This condition will only last a few seconds while the system contacts the SonicWALL License Manager and retrieves the license, then contacts the policy server and downloads the policy: 8. The Logs page displays messages for the events as the policy is downloaded. 6

7 9. The green banner confirms that the installation was successful and the license, policy, and signature database are up to date. Restart your client system to complete the update. URL Based Installation To use a URL based method to install the SonicWALL Enforced Client Anti-Virus on a client system, obtain the URL using the following steps: 1. In the SonicOS management interface, navigate to the System > Diagnostics page and click Download Report to generate a TSR file. The file name will be techsupport_ followed by the last 6 characters of the serial number and then the month and date. 2. Open the TSR file and search for Anti-Virus. 3. Below Anti-Virus, locate the line beginning with kavdownloadurl and copy the value into your clipboard or make a note of it. 4. Log in to the client system as an administrator. 5. If the client system is running Windows Server 2003 or 2008, you will need to disable enhanced security on IE ESC (Enhanced Security Configuration). To do so, perform these steps: a) Close all instances of Internet Explorer. b) Click Start, point to Administrative Tools, and then click Server Manager. c) If a User Account Control dialog box appears, click Continue. d) Under Security Information, click Configure IE ESC. e) Click Off for Administrators and/or Users, and then click OK. 7

8 6. In an Internet Explorer browser, type or paste the URL from the SonicWALL appliance TSR file into the locator bar, then press Enter. The site attempts to download the ActiveX installer and may display related warnings. 7. In Internet Explorer 9, click the Install button at the bottom of the window: 8. Earlier versions of Internet Explorer provide a sequence of windows that require interaction before the installation begins. Click OK in the popup and then click in the yellow Information Bar at the top of the window and select Install ActiveX Control. 8

9 9. Click Install in the Security Warning popup: 10. Wait until the download and the silent installation complete, and the SonicWALL Enforced Client application is running. The page displays the download progress and the installation steps and status. 9

10 11. Double-click the SonicWALL Enforced Client icon when it appears in your system tray. The client application opens to the Summary page. Right after installation, the red banner indicates that no policy information has been retrieved from the policy server. This condition will only last a few seconds while the system contacts the SonicWALL License Manager and retrieves the license, then contacts the policy server and downloads the policy: 12. The Logs page displays messages for the events as the policy is downloaded. 10

11 13. The green banner confirms that the installation was successful and the license, policy, and signature database are up to date. Restart your client system to complete the update. 11

12 Command Line Installation To install SonicWALL Enforced Client Anti-Virus on a client system using the CLI in a DOS command window, perform the following steps: 1. Log in to the client system as an administrator. 2. Launch Internet Explorer and download four files from the following URLs: MSetup.msi DK.msi Copy the four files to a Windows\temp folder. Then change directory to the Windows\temp folder. 4. In a DOS command window, type the following command on a single line and press Enter: msiexec.exe /l*v ECMSetup.log /qb /i SWECMSetup.msi ECMID=<Appliance Serial Number> LM_URL=<Client Manager URL> The items within angle brackets are defined as follows and must be replaced by these values when typing the command: <Appliance Serial Number>: The Company Key for your SonicWALL firewall with Activated AV service. <Client Manager URL>: The options in the command are used for the following purposes: /l*v verbose logging /qb silent install with error feedback. /i install 5. Double-click the SonicWALL Enforced Client icon when it appears in your system tray. The application opens to the Summary page. The green banner confirms that the installation was successful and the application is ready to use. Restart your client system to complete the update. 12

13 Domain Group Policy Installation To install SonicWALL Enforced Client Anti-Virus on all clients in a domain, you can create your own MST transform files for a Microsoft Windows Installer MSI package and deploy SonicWALL Enforced Client through domain group policy. An MST file is essentially an answer file for MSI packages. You can use Microsoft s Orca editor to create the MST transform file to use with SWECMSetup.msi for deployment of SonicWALL Enforced Client through domain policy. The SWECMSetup.msi installer and your MST transform file can be deployed on multiple client machines by using group policy. When the client computers start, the assigned MSI package will be installed automatically. For detailed instructions regarding deployment of SonicWALL Enforced Client through domain policy, see the following sections. This information is also available in the Deploying Enforced Client Through Group Policy technote, available on Introduction Prerequisites How to Get the Orca Editor Creating an MST Transform File with Orca Creating a Group Policy for SonicWALL Enforced Client Deployment Methods of Deployment Creating a Distribution Point Creating a Group Policy Object Refreshing Group Policy to Apply New Settings Uninstalling SonicWALL Enforced Client Introduction This document provides instructions for creating your own MST transform file for use with a Microsoft Windows Installer MSI package to deploy SonicWALL Enforced Client through domain group policy. An MST file is essentially an answer file for MSI packages. In this document, you will learn how to use Microsoft s Orca editor to create the MST transform file to use with SWECMSetup.msi for deployment of SonicWALL Enforced Client through domain policy. The SWECMSetup.msi installer with the help of your MST transform file can be deployed on multiple client machines by using group policy. When the client computers start, the assigned MSI package will be installed automatically. Prerequisites Workstation or member server (Windows 2000 workstation, Windows 2000 member server, or Windows XP Pro) for creating an MST file Windows 2003 Server with Domain controller installed Microsoft s Orca Editor Windows Installer 2.0 How to Get the Orca Editor The Orca Editor is Microsoft s MSI file editor. Other editors are also available on the Internet. The Orca Editor allows you to edit the MSI file directly, create new files, or change existing MST files. Follow these steps to download and install the editor. For our purposes, we installed the Orca Editor on a Windows workstation. You can download the Orca Editor from either of the following links:

14 Creating an MST Transform File with Orca To create an MST Transform file, perform the following steps: 1. Launch Orca, click File > Open, navigate to the SWECMSetup.MSI file and click Open. 2. Click on New Transform under the Transform menu. 14

15 3. In the Tables pane, click Property to select the Property table. 4. Click Tables > Add Row (Ctrl+R). The Add Row dialog box opens. 15

16 5. In the Add Row dialog box, add the following row and click OK: Property Name = LM_URL, Value = 6. Click Tables > Add Row (Ctrl+R). In the Add Row dialog box, add the following row and click OK: Property Name = SECID, Value = <Appliance_serial_number> (excluding the angle brackets, where Appliance_serial_number is in the form of 0017C510C724) 16

17 7. Click Generate Transform under the Transform menu. 8. Type in a name for the file, and click Save to save the Transform. 9. Now you can use the saved MST transform file with SWECMSetup.msi for SonicWALL Enforced Client deployment through domain policy. 17

18 Creating a Group Policy for SonicWALL Enforced Client Deployment This section describes how to deploy the SWECMSetup.msi installer on multiple machines by using Group Policy. See the following sections: Methods of Deployment Creating a Distribution Point Creating a Group Policy Object Refreshing Group Policy to Apply New Settings Methods of Deployment Group Policy supports two methods of deploying an MSI package: Assign software A program can be assigned per-user or per-machine. If it is assigned per-user, it will be installed when the user logs on. If it is assigned per-machine, then the program will be installed for all users when the machine starts. Publish software A program can be published for one or more users. This program will be added to the Add or Remove Programs list and the user will be able to install it from there. See the following Microsoft knowledge base article for more information about these deployment methods: For both types of deployment, you need a distribution point on a server where you can place the SWECMSetup.msi and Transform files. The distribution point must be accessible for all domain users. When a domain computer starts or connects, it will attempt to access the two files on the distribution point due to domain policy enforcement. This document discusses the Assign software method. Creating a Distribution Point The first step in deploying an MSI through a Group Policy Object is to create a distribution point on the publishing server. This can be done by following these steps: 1. Log on to the server as an Administrator. 2. Create a shared network folder (this folder will contain the MSI package). 3. Set permissions on this folder to allow access to the distribution package. 4. Copy the SWECMSetup.msi file and your SEC_MSI_Transform.mst Transform file into the shared folder. Creating a Group Policy Object An MSI package is deployed (distributed) as a Group Policy Object. In order to create an object for your package, follow these steps: 1. Click on the Start button, go to Programs, select Administrative Tools and then select Active Directory Users and Computers. This brings up an Active Directory MMC snap-in. 18

19 2. In the console tree, right-click the domain name on which you want to deploy the Sonicwall Enforced Client and select Properties. 3. In the Properties window, select the Group Policy tab and click New. 19

20 4. Type in a name for the policy (for example, Sonicwall SEC Policy) and click OK. 5. In the Properties window again, select your policy and click the Edit button to open the Group Policy Object Editor MMC snap-in. 6. In the Group Policy Object Editor, select Computer Configuration. Note: There is also a User Configuration option which causes the policy to be enforced when a user logs in. This option causes a check for enforced policy every time the user logs in, and is therefore rarely used. 20

21 7. Expand Software Settings under Computer Configuration. Right-click Software Installations, select New and then click on Package. 8. In the File name field of the Open dialog box, type the full UNC path (in the form: \\ComputerName\SharedFolder\PackageName) of the shared package to assign and then click Open. 9. In the Deploy Software dialog box that pops up, select Advanced and then click OK (the package will be added to the right pane of the "Group Policy" window). 21

22 10. In the SonicWALL Enforced Client Properties window, select the Modifications tab and then click Add. 11. Navigate to the Transform file that you created (using the UNC path). Select it and then click Open. 22

23 12. In the SonicWALL Enforced Client Properties window, select the Security tab. 13. Click Add to open the Select Users, Computers, or Groups window. Add the Domain Computers group and click OK. 23

24 14. Verify that the Domain Computers group is added. Click Apply and then click OK. 15. Close the Group Policy Object Editor and other MMC snap-ins that are open. This completes the setup process. Continue to the next section to refresh group policy and apply these settings. 24

25 Refreshing Group Policy to Apply New Settings To refresh group policy for the domain and apply the new Group Policy Object, perform the following steps: 1. Click Start and select Run, then type cmd to open a command prompt window. 2. Type the command gpupdate at the prompt. When domain computers start, the assigned package will be installed automatically. The message Installing managed software SonicWALL Enforced Client is displayed. Uninstalling SonicWALL Enforced Client To uninstall the Sonicwall Enforced Client Anti-Virus from a client computer, perform the following steps: 1. Log in to the client computer as an Administrator. 2. Click Start and select Run, then type cmd to open a command prompt window. 3. Type the following command at the prompt, without the angle brackets and using the UNC path for Path : msiexec /x <Path\swecmsetup.msi> /qb Last updated: 2/21/2012 PN Rev A 25