Agent Install Guide. Lumension Endpoint Management and Security Suite 8.0

Transcription

1 Agent Install Guide Lumension Endpoint Management and Security Suite 8.0

2 Lumension Endpoint Management and Security Suite - 2 -

3 Notices Version Information Lumension Endpoint Management and Security Suite Agent Install Guide - Lumension Endpoint Management and Security Suite Version Published: April 2014 Document Number: 02_017_8.0_ Copyright Information Lumension Security, Inc East Hartford Drive, Suite 300 Scottsdale, AZ Phone: Fax: info@lumension.com Copyright ; Lumension Security, Inc.; all rights reserved. Covered by one or more of U.S. Patent Nos. 6,990,660, 7,278,158, 7,487,495, 7,823,147, 7,870,606, and/or 7,894,514; other patents pending. This manual, as well as the software described in it, is furnished under license. No part of this manual may be reproduced, stored in a retrieval system, or transmitted in any form electronic, mechanical, recording, or otherwise except as permitted by such license. LIMITATION OF LIABILITY/DISCLAIMER OF WARRANTY: LUMENSION SECURITY, INC. (LUMENSION) MAKES NO REPRESENTATIONS OR WARRANTIES WITH REGARD TO THE ACCURACY OR COMPLETENESS OF THE INFORMATION PROVIDED IN THIS MANUAL. LUMENSION RESERVES THE RIGHT TO MAKE CHANGES TO THE INFORMATION DESCRIBED IN THIS MANUAL AT ANY TIME WITHOUT NOTICE AND WITHOUT OBLIGATION TO NOTIFY ANY PERSON OF SUCH CHANGES. THE INFORMATION PROVIDED IN THIS MANUAL IS PROVIDED AS IS AND WITHOUT WARRANTY OF ANY KIND, INCLUDING WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE INFORMATION PROVIDED IN THIS MANUAL IS NOT GUARANTEED OR WARRANTED TO PRODUCE ANY PARTICULAR RESULT, AND THE ADVICE AND STRATEGIES CONTAINED MAY NOT BE SUITABLE FOR EVERY ORGANIZATION. NO WARRANTY MAY BE CREATED OR EXTENDED WITH RESPECT TO THIS MANUAL BY SALES REPRESENTATIVES OR WRITTEN SALES MATERIALS. LUMENSION SHALL NOT BE LIABLE TO ANY PERSON WHATSOEVER FOR ANY LOSS OF PROFIT OR DATA OR ANY OTHER DAMAGES ARISING FROM THE USE OF THIS MANUAL, INCLUDING BUT NOT LIMITED TO DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGES

4 Lumension Endpoint Management and Security Suite Trademark Information Lumension, Lumension Endpoint Management and Security Suite, Lumension Endpoint Management Platform, Lumension Patch and Remediation, Lumension Enterprise Reporting, Lumension Security Configuration Management, Lumension Content Wizard, Lumension Risk Manager, Lumension AntiVirus, Lumension Wake on LAN, Lumension Power Management, Lumension Remote Management, Lumension Scan, Lumension Security Configuration Management, Lumension Application Control, Lumension Device Control, Lumension Endpoint Security, Lumension Intelligent Whitelisting, PatchLink, PatchLink Update, their associated logos, and all other Lumension trademarks and trade names used here are the property of Lumension Security, Inc. or its affiliates in the U.S. and other countries. RSA Secured is a registered trademark of RSA Security Inc. Apache is a trademark of the Apache Software Foundation. In addition, any other companies' names, trade names, trademarks, and products mentioned in this document may be either registered trademarks or trademarks of their respective owners. Feedback Your feedback lets us know if we are meeting your documentation needs. the Lumension Technical Publications department at techpubs@lumension.com to tell us what you like best, what you like least, and to report any inaccuracies

5 Table of Contents Table of Contents Preface: About This Document... 7 Typographical Conventions...7 Contacting Lumension...8 Chapter 1: Agent Requirements... 9 Supported Endpoint Operating Systems... 9 Windows Endpoint Operating Systems Mac Endpoint Operating Systems Linux Endpoint Operating System UNIX Endpoint Operating System...13 Supported Endpoint Browsers...14 Windows Endpoint Requirements...14 Mac, Linux, or UNIX Endpoint Requirements Agent Locales and Internationalization Supported Endpoint Module Operating Systems Windows Endpoint Operating Systems Mac Endpoint Operating Systems Linux Endpoint Operating Systems...21 UNIX Endpoint Operating Systems Mobile Endpoint Operating Systems...23 Chapter 2: Understanding Agent Installation The Lumension EMSS Agent Workflow...25 Understanding Agent Installation Methods Chapter 3: Installing the Agent on Windows...29 Windows Installation Methods...29 Agent Management Job for Windows Agent Management Job Checklist...30 Port and ICMP Requirements for an Agent Management Job Configuring Windows XP or Windows Server 2003 Endpoints...32 Configuring Vista or Later Endpoints Configuring the Lumension EMSS Server for Discovery Scanning Installing Agents by Agent Management Job Command Line for Windows...69 Command Line Workflow for Windows...70 Downloading the Installer...70 Silently Installing the Agent by Command Line for Windows Install of the Agent for Windows Manually Manual Install Workflow for Windows...76 Downloading the Installer...76 Manually Installing the Agent for Windows

6 Lumension Endpoint Management and Security Suite Chapter 4: Installing the Agent on Mac Mac Installation Methods...83 Installing Java Runtime Environment...84 Command Line Workflow for Mac Downloading the Installer...86 Installing the Agent by Command Line for Mac...88 Silent Install by Command Line for Mac Agent Installer Workflow for Mac Downloading the Installer...97 Manually Installing the Agent for Mac...99 Chapter 5: Installing the Agent on Linux or UNIX Linux and UNIX Installation Method Installing Java Runtime Environment Command Line Workflow for Linux or UNIX Downloading the Installer Installing the Agent by Command Line for Linux or UNIX Silent Install by Command Line for Linux or UNIX Appendix A: Upgrading Agents Agent Upgrade on Windows Upgrading Agents From the Web Console Agent Upgrade on Mac, Linux, or UNIX Upgrading Agents by Command Line for Mac, Linux, or UNIX Appendix B: Uninstalling Agents Agent Uninstall on Windows Uninstalling the Agent by Agent Management Job Uninstalling the Agent on Windows Agent Uninstall on Mac, Linux, or UNIX Uninstalling the Agent for Mac, Linux, or UNIX

7 Preface About This Document This Agent Install Guide is a resource written for all users of Lumension Endpoint Management and Security Suite 8.0. This document defines the concepts and procedures for installing, configuring, implementing, and using Lumension Endpoint Management and Security Suite 8.0. Tip: Lumension documentation is updated on a regular basis. To acquire the latest version of this or any other published document, please refer to the Lumension Customer Portal ( Typographical Conventions The following conventions are used throughout this documentation to help you identify various information types. Table 1: Typographical Conventions Convention bold bold italics italics MONOSPACE UPPERCASE BOLD UPPERCASE monospace Usage Buttons, menu items, window and screen objects. Wizard names, window names, and page names. New terms, options, and variables. Keyboard keys. SQL Commands. File names, path names, programs, executables, command syntax, and property names

8 Lumension Endpoint Management and Security Suite Contacting Lumension Arizona 8660 East Hartford Drive Suite 300 Scottsdale, AZ United States of America Phone: Phone: Fax: Lumension Support Ireland Lumension Security Ireland Ltd. Lyrr Building, Second Floor Mervue Business & Technology Park Mervue, Galway Ireland Phone: Fax: Luxembourg Lumension Security SA Atrium Business Park Z.A Bourmicht 23, rue du Puits Romain L-8070 Bertrange Luxembourg Phone: Fax: phone: (USA) (USA - legacy Sanctuary products) (EMEA) (UK) +61 (02) (Australia) (Hong Kong) (Singapore) submit a ticket: Registered users can open a support ticket via the customer portal ( Lumension customers without a support account should contact our support team (support@lumension.com) to have an account created. Note: For additional contact information, please visit the Contact Lumension page at

9 Chapter 1 Agent Requirements In this chapter: Supported Endpoint Operating Systems Supported Endpoint Browsers Windows Endpoint Requirements Mac, Linux, or UNIX Endpoint Requirements Agent Locales and Internationalization Supported Endpoint Module Operating Systems The Lumension Endpoint Management and Security Suite Agent is supported on a variety of operating systems and platforms. Before installing the agent on an endpoint, ensure that system meets the agent requirements. Your endpoints must meet the hardware and software requirements for the Lumension Endpoint Management and Security Suite Agent. The following sections include system requirements that you should verify prior to installing the Lumension EMSS Agent. The complete list of requirements are listed in the following topics: Supported Endpoint Operating Systems on page 9 Supported Endpoint Browsers on page 14 Windows Endpoint Requirements on page 14 Mac, Linux, or UNIX Endpoint Requirements on page 16 Agent Locales and Internationalization on page 18 Supported Endpoint Module Operating Systems on page 19 Supported Endpoint Operating Systems Lumension Endpoint Management and Security Suite Agent functionality is supported on a variety of operating systems. The agent is supported on endpoints that contain one of the supported endpoint operating system types: Windows Endpoint Operating Systems on page 10 Mac Endpoint Operating Systems on page 11 Linux Endpoint Operating System on page 12 UNIX Endpoint Operating System on page

10 Lumension Endpoint Management and Security Suite Windows Endpoint Operating Systems The following table lists supported Windows platforms on which the Lumension Endpoint Management and Security Suite Agent is supported. Table 2: Supported Windows Endpoint Operating Systems Supported OS Versions Supported Editions Supported Processors Windows Server 2012 R2 Standard 1 Datacenter 1 Foundation Essentials Data Width Supported Agent Intel 64 bit Lumension EMSS 8.0 Windows 8.1 Enterprise Enterprise N Professional 2 Professional N Intel 32/64 bit Lumension EMSS 8.0 Windows Storage Server 2012 Standard Workgroup Intel 64 bit Lumension EMSS 8.0 Windows Server 2012 Standard 1 Datacenter 1 Foundation Essentials Windows 8 Enterprise Enterprise N Professional 2 Professional N Windows Server 2008 R2 Enterprise Standard Web Windows Server 2008 Enterprise Standard Web Intel 64 bit Lumension EMSS 8.0 Intel 32/64 bit Lumension EMSS 8.0 Intel 64 bit Lumension EMSS 8.0 Intel 32/64 bit Lumension EMSS

11 Agent Requirements Supported OS Versions Supported Editions Supported Processors Windows 7 Enterprise Standard Web Data Width Supported Agent Intel 32/64 bit Lumension EMSS 8.0 Windows Vista 3 Business Enterprise Ultimate Intel 32/64 bit Lumension EMSS 8.0 Windows Server 2003 SP1+ Enterprise 4 Standard 4 Web Intel 32/64 bit Lumension EMSS 8.0 Windows Server 2003 R2 Enterprise 4 Standard 4 Web Intel 32/64 bit Lumension EMSS 8.0 Windows XP SP2+ 5 Professional Intel 32/64 bit Lumension EMSS Core mode for this edition is supported. 2 This edition is also supported when Windows Media Center is installed. 3 When installing the Device Control endpoint module on these editions, SP1+ is required. 4 When installing the Device Control endpoint module on these editions, SP2+ is required. 5 On Windows XP SP2 endpoints, the Microsoft Windows Installer 3.1 or higher must be present on the endpoint prior to installing or upgrading to the Lumension EMSS 8.0 Agent. Refer to Lumension KnowledgeBase Article 1644 ( for additional information. Mac Endpoint Operating Systems The following table lists supported Mac platforms on which the Lumension Endpoint Management and Security Suite Agent is supported. Table 3: Supported Mac Endpoint Operating Systems Supported OS Versions Supported Editions Supported Processor(s) Supported Agent Mac OS X 10.8 All Intel Patch Agent for Linux, UNIX, and Mac Mac OS X 10.7 All Intel Patch Agent for Linux, UNIX, and Mac

12 Lumension Endpoint Management and Security Suite Supported OS Versions Supported Editions Supported Processor(s) Supported Agent Mac OS X 10.6 All Intel Patch Agent for Linux, UNIX, and Mac Linux Endpoint Operating System The following table lists supported Linux platforms on which the Lumension Endpoint Management and Security Suite Agent is supported. Table 4: Supported Linux Endpoint Operating Systems Supported OS Versions Supported Editions Supported Processor(s) Supported Agent CentOS Linux 6 Server Intel Patch Agent for Linux, UNIX, and Mac CentOS Linux 5 Server Intel Patch Agent for Linux, UNIX, and Mac Oracle Linux 6 Server Intel Patch Agent for Linux, UNIX, and Mac Oracle Linux 5 Server Intel Patch Agent for Linux, UNIX, and Mac Novell SUSE Linux 11 Desktop Server Novell SUSE Linux 10 Desktop Server Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Desktop Server Desktop Server Intel Intel Intel Intel Patch Agent for Linux, UNIX, and Mac Patch Agent for Linux, UNIX, and Mac Patch Agent for Linux, UNIX, and Mac Patch Agent for Linux, UNIX, and Mac

13 Agent Requirements UNIX Endpoint Operating System The following table lists supported UNIX platforms on which the Lumension Endpoint Management and Security Suite Agent is supported. Table 5: Supported UNIX Endpoint Operating Systems Supported OS Versions Supported Editions Supported Processor(s) Oracle Solaris 11 All Intel SPARC Oracle Solaris 10 All Intel SPARC Supported Agent Patch Agent for Linux, UNIX, and Mac Patch Agent for Linux, UNIX, and Mac Hewlett Packard HP-UX Hewlett Packard HP-UX Hewlett Packard HP-UX All PA-RISC Itanium Patch Agent for Linux, UNIX, and Mac All PA-RISC Patch Agent for Linux, UNIX, and Mac All PA-RISC Patch Agent for Linux, UNIX, and Mac IBM AIX 7.1 All Power Patch Agent for Linux, UNIX, and Mac IBM AIX 6.1 All Power Patch Agent for Linux, UNIX, and Mac

14 Lumension Endpoint Management and Security Suite Supported Endpoint Browsers Lumension Endpoint Management and Security Suite (Lumension EMSS) is an Internet application that conforms to standard Web conventions. Lumension recommends you download the most recent version of the Lumension EMSS Agent installer using a supported Web browser. Table 6: Supported Web Browsers Supported Browser Supported Versions Microsoft Internet Explorer 10 with Compatibility View 9 with Compatibility View 8 with Compatibility View How to enable Compatibility View in IE 10 How to enable Compatibility View in IE 9 How to enable Compatibility View in IE 8 Mozilla Firefox 24.x Extended Support Release Windows Endpoint Requirements Before installing the Lumension Endpoint Management and Security Suite (Lumension EMSS) Agent on a supported Windows endpoint, ensure that it meets the necessary hardware and software requirements. Processor Physical RAM 500 MHz or higher for Windows XP SP2+ and Windows Server 2003 SP MHz or higher for Windows Vista and later 256 MB for Windows XP SP2+ and Windows Server 2003 SP1+ (minimum) 1 GB for Windows Vista and later (minimum) Note: Your Lumension EMSS endpoint may require additional RAM depending on the RAM requirements of other applications installed. Free Disk Space Network Connection 1 GB of free space A 10 Mbps network connection with access to the Lumension Endpoint Management and Security Suite server

15 Agent Requirements Antivirus Ensure any third-party antivirus software on the endpoint computer is disabled prior to Lumension EMSS Agent installation. Port Requirements Port 80 This must be open for Lumension EMSS module downloads. Port 443 This must be open for Lumension EMSS policy download and general communication. Ephemeral ports This is used to listen for Notification Manager connection requests (Patch and Remediation) only. For Windows XP and Windows Server 2003, open ports For Windows Vista and later, open ports Microsoft.NET Framework Microsoft.NET Framework (is required for Patch and Remediation only). The required version of the.net Framework changes according to operating system. Table 7:.NET Framework Version Operating System.Net Framework Version Microsoft Windows Microsoft Windows Storage Server Microsoft Windows Server Microsoft Windows Server 2012 R Microsoft Windows Microsoft Windows Server 2008 R Microsoft Windows Vista 3.0+ Microsoft Windows Server Microsoft Windows 2003 SP Microsoft Windows XP SP Other Software Requirements Windows Installer 3.1 or later Microsoft Visual C Redistributable Package or later Note: If not installed at time of agent installation, the Microsoft Visual C Redistributable Package is installed during agent installation

16 Lumension Endpoint Management and Security Suite Mac, Linux, or UNIX Endpoint Requirements Before installing the Lumension EMSS Agent on a supported Mac, Linux, or UNIX endpoint, ensure that it meets the necessary hardware and software requirements. Processor Physical RAM 500 MHz processor or higher 256 MBs or greater Note: Your Lumension EMSS endpoint may require additional RAM depending on the RAM requirements of other applications installed. Disk Requirements Presence of a /tmp directory (/var/tmp on Oracle Solaris) with 100 MB of free space. 50 MB of free space for the agent installation directory. Lumension EMSS also recommends 100 Mb of unused disk space to download and install content. Java Runtime Environment (JRE) Ensure Java Runtime Environment (JRE) or later is installed. Refer to Java Frequently Asked Questions ( download/faq/whatis_java.xml/) for additional information. Note: IcedTea/Open JDK can be substituted for Oracle Java JRE on the following operating systems: Mac OS X (versions 10.8 and 10.7 only) Cent OS Linux Novell SUSE Linux Oracle Linux Red Hat Enterprise Linux (version 6 only) Refer to IcedTea Project ( for additional information. Perl Perl is needed for Linux content. Perl is automatically installed for all opensource Linux operating systems unless uninstalled. Tip: To determine if you have perl installed, type perl -v on a command line. Refer to Perl Download ( to download. Network Connection A 10 Mbps network connection with access to the Lumension Endpoint Management and Security Suite server. Refer to Supported Endpoint Browsers on page 14 for a list of supported browsers

17 Agent Requirements Antivirus Ensure any antivirus software installed on the applicable endpoint computer is disabled. Port Requirements Port 80. This must be open for Lumension EMSS module downloads. Port 443. This must be open for Lumension EMSS policy download and general communication. Ports These ports are used as listener ports for check now commands, which are server-sent requests that agents use to check for tasks. Closing these ports delays agent tasks until they check in themselves

18 Lumension Endpoint Management and Security Suite Agent Locales and Internationalization The Lumension Endpoint Management and Security Suite Agent is localized and internationalized for a variety of languages. The agent has been fully localized and translated for the following locales. en-au: English (Australia) en-bz: English (Belize) en-ca: English (Canada) en-in: English (India) en-ie: English (Ireland) en-jm: English (Jamaica) en-nz: English (New Zealand) en-ph: English (Philippines) en-sg: English (Singapore) en-za: English (South Africa) en-gb: English (United Kingdom) en-us: English (United States) fr-fr: French (France) de-de: German (Germany) it-it: Italian (Italy) ja-jp: Japanese (Japan) nl-nl: Dutch (Netherlands) pt-be: Portuguese (Brazil) ru-ru: Russian (Russia) es-es: Spanish (Spain) sv-se: Swedish (Sweden) zh-cn / zh-chs: Chinese (China [Simplified]) zh-tw / zh-cht: Chinese (Taiwan [Traditional]) Note: The agent has been internationalized to operate in the following locales. However, the agent UI text has not been translated. English text is displayed. da-da: Danish (Denmark) fi-fi: Finnish (Finland) ko-kr: Korean (Korea) no-no: Norwegian - Nynorsk (Norway)

19 Agent Requirements Supported Endpoint Module Operating Systems The modules that you can install vary by operating system and your licensing. Windows Endpoint Operating Systems on page 19 Mac Endpoint Operating Systems on page 20 Linux Endpoint Operating Systems on page 21 UNIX Endpoint Operating Systems on page 22 Mobile Endpoint Operating Systems on page 23 A list of module abbreviations within the tables: LPR: Lumension Patch and Remediation LAC: Lumension Application Control LDC: Lumension Device Control LAV: Lumension AntiVirus LPM: Lumension Power Management WOL: Lumension Wake on LAN SCM: Lumension Security Configuration Management RSM: Lumension Remote Systems Management LMDM: Lumension Mobile Device Management Windows Endpoint Operating Systems The following table lists the modules you can install on endpoints that contain a Windows operating system. Table 8: Supported Endpoint Windows Operating Systems by Module Operating Modules (2) System (1) LPR LAC LDC LAV LPM WOL SCM RSM LMDM Microsoft Windows 8.1 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2-19 -

20 Lumension Endpoint Management and Security Suite Operating Modules (2) System (1) LPR LAC LDC LAV LPM WOL SCM RSM LMDM Microsoft Windows Storage Server 2012 Microsoft Windows 7 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows Server 2003 R2 Microsoft Windows Server 2003 SP1+ Microsoft Windows XP SP2+ (1) Refer to Supported Endpoint Operating Systems on page 9 for a complete list of operating system versions. (2) Refer to Supported Endpoint Module Operating Systems on page 19 for a list of module abbreviation definitions. Mac Endpoint Operating Systems The following table lists the modules you can install on endpoints that contain a Mac operating system. Table 9: Supported Endpoint Mac Operating Systems by Module Operating Modules (2) System (1) LPR LAC LDC LAV LPM WOL SCM RSM LMDM Mac OS X 10.8 Mac OS X

21 Agent Requirements Operating Modules (2) System (1) LPR LAC LDC LAV LPM WOL SCM RSM LMDM Mac OS X 10.6 Mac OS X 10.5 Mac OS X 10.4 Mac OS X 10.3 (1) Refer to Supported Endpoint Operating Systems on page 9 for a complete list of operating system versions. (2) Refer to Supported Endpoint Module Operating Systems on page 19 for a list of module abbreviation definitions. Linux Endpoint Operating Systems The following table lists the modules you can install on endpoints that contain a Linux operating system. Table 10: Supported Endpoint Linux Operating Systems by Module Operating Modules (2) System (1) LPR LAC LDC LAV LPM WOL SCM RSM LMDM Cent OS Linux 6 Cent OS Linux 5 Oracle Linux 11 Oracle Linux 10 Novell SUSE Linux 11 Novell SUSE Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux

22 Lumension Endpoint Management and Security Suite Operating Modules (2) System (1) LPR LAC LDC LAV LPM WOL SCM RSM LMDM (1) Refer to Supported Endpoint Operating Systems on page 9 for a complete list of operating system versions. (2) Refer to Supported Endpoint Module Operating Systems on page 19 for a list of module abbreviation definitions. UNIX Endpoint Operating Systems The following table lists the modules you can install on endpoints that contain a UNIX operating system. Table 11: Supported Endpoint UNIX Operating Systems by Module Operating Modules (2) System (1) LPR LAC LDC LAV LPM WOL SCM RSM LMDM Oracle Solaris 11 Oracle Solaris 10 HP-UX HP-UX HP-UX IBM AIX 7.1 IBM AIX 6.1 (1) Refer to Supported Endpoint Operating Systems on page 9 for a complete list of operating system versions. (2) Refer to Supported Endpoint Module Operating Systems on page 19 for a list of module abbreviation definitions

23 Agent Requirements Mobile Endpoint Operating Systems The following table lists the modules you can install on endpoints that contain a Mobile operating system. Table 12: Supported Endpoint Mobile Operating Systems by Module Operating Modules (2) System (1) LPR LAC LDC LAV LPM WOL SCM RSM LMDM Apple Mobile Operating Systems ios 6 ios 5 ios 4 Google Mobile Operating Systems Android Jelly Bean Android Ice Cream Sandwich Android Honeycomb Android Gingerbread (1) Refer to Supported Endpoint Operating Systems on page 9 for a complete list of operating system versions. (2) Refer to Supported Endpoint Module Operating Systems on page 19 for a list of module abbreviation definitions

24 Lumension Endpoint Management and Security Suite

25 Chapter 2 Understanding Agent Installation In this chapter: The Lumension EMSS Agent Workflow Understanding Agent Installation Methods The Lumension EMSS agent is installed on network endpoints to manage their behavior. The Lumension EMSS Agent Workflow Lumension Endpoint Management and Security Suite uses a server/client relationship to manage network endpoints. Review this chart to understand the Lumension EMSS Agent workflow. Install the Lumension Endpoint Management and Security Suite (Lumension EMSS) server and complete an initial replication with the Global Subscription Server. You must have completed a server install prior to installing a Lumension EMSS Agent. Note: For server installation information, refer to the Lumension Endpoint Management and Security Suite: Server Installation Guide ( Prior to installing the agent on an endpoint, determine agent requirements. Refer to Agent Requirements on page 9 for all requirements. For requirements on the endpoint by operating system, refer to: Windows Endpoint Requirements on page 14 Mac, Linux, or UNIX Endpoint Requirements on page 16 Prior to installing the agent on an endpoint, ensure you understand the methods used to install the agent. Refer to Understanding Agent Installation Methods on page

26 Lumension Endpoint Management and Security Suite Install the agent. You may install agents on any endpoints that you want to manage. Agent installation is based on administrator need and operating system type. Refer to the following: Installing the Agent on Windows on page 29 Installing the Agent on Mac on page 83 Installing the Agent on Linux or UNIX on page 105 Following initial installation, the agent and server components begin communicating. The agent downloads the following data from the Lumension EMSS server: Agent policies, which contain information about how the agent should behave. Agent packages, which contain files to modify the agent. The agent uploads the following data to the Lumension EMSS server: Host endpoint operating system information. Heartbeats, which are notification messages the agent sends to the server. This message is used continually to notify the server that the agent is available within the network. The state of the endpoint and applicable module logs. After you install the agent on an endpoint, you may access its available controls using the Agent Control Panel. Refer to Using the Lumension EMSS Agent in the Lumension Endpoint Management and Security Suite User Guide ( for additional information. Additionally, if you are licensed for additional Lumension EMSS modules, you can install these modules on the Lumension EMSS endpoint that has an agent. Installing modules expands agent functionality. Note: For more information on modules and module installation, refer to Lumension Endpoint Management and Security Suite User Guide (

27 Understanding Agent Installation Understanding Agent Installation Methods You can install the Lumension EMSS Agent on your network using a variety of methods. Network administrators should carefully consider which method to use when installing the agent as each method has its own unique steps. The following table describes each installation method. Table 13: Installation Methods Installation Method Agent Management Job Description Benefits in using this method: Using this method you search for endpoints in your network and then install the agent on network endpoints based on criteria you define. You complete the Agent Management Job within the Lumension Endpoint Management and Security Suite Web console using an easy-to-use wizard. Using this method eases administrative workload, since you do not have to install agents locally on endpoints. Using this method you may uninstall the agent on network endpoints based on criteria you define. Important: This method only supports endpoints that contain a Windows operating system. Refer to the Command Line or Install Wizard method to install an agent on an endpoint that has a supported Mac, Linux or UNIX operating system. Command Line Benefits in using this method: You may use command line to install the agent. You may complete silent installs when using a command line parameters. When using silent installs using a command line, the installation of the agent can be run unattended (without user interaction). This install method supports an endpoint that has one of the following operating systems: Windows Mac Linux or UNIX Important: On Linux and UNIX endpoints, the command line is the only method that can be used to install the agent

28 Lumension Endpoint Management and Security Suite Installation Method Install Wizard Description Benefits in using this method: This method utilizes an easy-to-use installation wizard to install a single agent on a network endpoint. This installation method is useful if you are unfamiliar with using the command line prompt to install a single agent on a network endpoint. The agent is installed using an installation wizard and accessed using a graphical user interface via the Control Panel (Windows) or System Preferences (Mac). The installer for Windows uses the familiar EXE file format, and the installer for Mac uses the DMG file format. This method supports an endpoint that has one of the following operating systems: Windows Mac Other Methods Third-Party Software Golden Image In some environments, customers may prefer to use third-party software, such as PsExec, to install the agent. In networks making substantial use of golden images, which are compressed operating system archives that are entirely installed and configured according to an organization's specifications, network administrators may benefit from adding the Lumension EMSS Agent to their image. Attention: These installation methods are not documented in this guide. For additional information on these installation methods, contact Lumension Support (support@lumension.com). Note: Supported operating systems listed in this topic are generalized for each operating system. Before installing the agent on an endpoint, ensure its operating system is supported by referring to Supported Endpoint Operating Systems on page

29 Chapter 3 Installing the Agent on Windows In this chapter: Windows Installation Methods Agent Management Job for Windows Command Line for Windows Install of the Agent for Windows Manually There are various methods when installing the Lumension Endpoint Management and Security Suite Agent on a Windows endpoint. Windows Installation Methods To install the Lumension Endpoint Management and Security Suite Agent on a Windows platform you can utilize various methods. An Agent Management Job. This method supports installing an agent on endpoints that have a Windows operating system using the Lumension EMSS Web console. For additional information, refer to Installing Agents by Agent Management Job on page 50. You may use a command line to install an agent on Windows endpoints. For additional information, refer to Silently Installing the Agent by Command Line for Windows on page 72. You may use the Lumension EMSS installer. This method uses an easy-to-use installation wizard that allows you to install a single agent on an endpoint. For additional information, refer to Manually Installing the Agent for Windows on page 78. For a description of the benefits of each install method, refer to Understanding Agent Installation Methods on page 27. Agent Management Job for Windows The Lumension Endpoint Management and Security Suite Web console utilizes the Agent Management Job method to install agents on Windows endpoints. This method uses an easy-to-use wizard to discover endpoints within your network and then install the agent. This method only supports endpoints that use the Windows operating system

30 Lumension Endpoint Management and Security Suite Each Agent Management Job consists of two parts; endpoint detection and agent management itself. Detection Management The initial portion of an Agent Management Job detects endpoints and their operating systems in a network. This is done by scanning the network. Access to the endpoints is based on credentials used during job configuration. During agent management, the agent is installed (or uninstalled) based on information found during scanning. The Agent Management Job determines which type of agent to install on applicable endpoints. Agent installation occurs silently on the endpoint; endpoint users are unaware of the installation. After installing Lumension Endpoint Management and Security Suite (Lumension EMSS) on a server, you must perform additional configuration on the endpoint and server prior to an Lumension EMSS Agent Management Job. Refer to Agent Management Job Checklist on page 30 for a description of the configuration needs on the endpoint and server prior to an Agent Management Job. Agent Management Job Checklist This checklist itemizes the information and tasks an administrator needs to perform prior to an Agent Management Job. Prior to configuring your network to successfully use Agent Management Jobs, confirm the following information: Tasks Performed on the Endpoint Verify your target endpoints meets or exceeds the requirements defined in the Windows Endpoint Requirements on page 14. Verify that your target endpoints are all supported Windows endpoints. You cannot complete an Agent Management Job on Linux, UNIX, or Mac endpoints. Refer to the list of Windows operating systems in the Supported Endpoint Operating Systems on page 9. Ensure any antivirus software installed on target endpoints is disabled. Verify that your target endpoints have applicable ports open. Refer to Port and ICMP Requirements for an Agent Management Job on page 31. Configure your target endpoints to accept an Agent Management Job. Target endpoints must be configured to allow the Agent Management Job access to the endpoint. This includes verifying that the C$ and ADMIN$ network shares are enabled, Refer to the following: To configure Windows XP or Windows 2003 endpoints for Agent Management Jobs, complete Configuring Windows XP or Windows Server 2003 Endpoints on page 32. To configure Windows Vista and later endpoints for Agent Management Jobs, complete Configuring Vista or Later Endpoints on page

31 Installing the Agent on Windows Tasks Performed on the Server Verify that your Lumension EMSS server can utilize the Discovery Scanning process needed in by the Agent Management Job. Refer to Configuring the Lumension EMSS Server for Discovery Scanning on page 49. Gather credentials for the endpoints. A user name and password that authenticates with Windows-based endpoints is required during configuration of the Agent Management Job. Type the user name in a local format (UserName) or a domain format (DOMAIN\UserName). Gather proxy information if your agents will be required to use a proxy to access your Lumension Endpoint Management and Security Suite server. The proxy information is required during configuration of the Agent Management Job that is using a proxy server. Note: A Squid proxy server will only properly resolve using a fully qualified domain name. Refer to Lumension KnowledgeBase Article 1625 ( for additional information on a Squid proxy server configuration. Once you have completed the tasks in the list you may begin installing or uninstalling the Lumension EMSS Agent using an Agent Management Job. For information on this install method, refer to Installing Agents by Agent Management Job on page 50. Port and ICMP Requirements for an Agent Management Job Certain ports are required on the endpoint during the installation process of the Agent Management Job. Firewall configuration changes may be required to access applicable ports. Note: If your firewall policies cannot allow needed port access, contact Lumension Support ( support.lumension.com) for a recommended configuration. On the endpoint, open the ports listed in the following table. Table 14: Required Ports Required Ports Direction Description 445/TCP 139/UDP 135/UDP 137/UDP 443/TCP 80/TCP Inbound Outbound Lumension EMSS uses these ports to access the endpoint during the installation of the Agent Management Job. After the Agent Management Job completes, you can close these ports. Tip: In addition, the Discovery Scan Job also use these ports to discover information about the endpoint. Following agent installation, the Lumension EMSS Agent uses these ports to register and communicate with the Lumension EMSS server. After the Agent Management Job completes, you need to leave these ports open. Both the Discovery Scan Job and the Agent Management Job requires the endpoint to accept ping requests from the Lumension EMSS server. Ping operates by sending Internet Control Message Protocol (ICMP) echo request

32 Lumension Endpoint Management and Security Suite packets to the target host and waiting for an ICMP response. Therefore, you need an exception within your endpoint firewall for inbound Internet Control Message Protocol (ICMP) echo request. Refer to Enable or disable Internet Control Message Protocol requests for ICF ( library/cc738771(v=ws.10).aspx) for additional information. Configuring Windows XP or Windows Server 2003 Endpoints Prior to using an Agent Management Job to install agents on your Windows XP or Windows Server 2003 endpoints, you must first configure the endpoints. Prerequisites: Prior to configuring, review the following requirements: You can perform these steps on endpoints with the following operating systems: Windows XP SP2+ Note: On a endpoint containing a Windows XP SP2+ platform, the Microsoft Windows Installer 3.1 or higher must be present on the endpoint prior to installing or upgrading to the 8.0 agent. Refer to Lumension KnowledgeBase Article 1644 ( Windows 2003 SP1+ Windows 2003 R2 You have gathered and confirmed the information and tasks in the Agent Management Job checklist. Refer to Agent Management Job Checklist on page 30 for a description. Verify your Windows endpoint meets the defined hardware and software requirements. Refer to Agent Requirements on page 9 for a complete list of agent requirements. Note: If your organization uses a third-party firewall: Do not complete the steps for creating Windows Firewall exceptions. Your third-party firewall makes them unnecessary. However, you must create exceptions for Lumension EMSS within you third-party firewall. For additional information, refer to Port and ICMP Requirements for an Agent Management Job on page Start applicable Windows services. Tip: There are specific Windows services that are necessary for successful Agent Management Job completion. a) Open Windows Control Panel. Control Panel opens. b) Open Administrative Tools. The Administrative Tools dialog opens

33 Installing the Agent on Windows c) Open Services. The Services dialog opens. d) Ensure the necessary services are started for an Agent Management Job. The following list itemizes the services that must be started for Agent Management Job completion. DCOM Server Process Launcher Remote Procedure Call (RPC) Server Windows Firewall Windows Management Instrumentation Note: In environments that use a third-party firewall, ensure the Windows Firewall service is instead disabled. e) If all of the listed services required for your configuration purposes have a Server status of Started, continue to the next step. If any of the listed services for your configuration purposes are not started, complete the following: 1. Right-click the applicable service and select Properties. 2. Ensure the Startup type list is set to Automatic. If edits are necessary, click Apply after selecting Automatic from the list. 3. Click Start. 4. Click OK. 5. If necessary, repeat the above steps for each unstarted service. f) Close the Services dialog and the Administrative Tools dialog. The applicable Windows services for a successful Agent Management Job are started. 2. Ensure Simple File Sharing is disabled on the endpoint. Tip: You must have Simple File Sharing disabled so that the Lumension EMSS can access the necessary files during agent installation a) Select Start > My Computer. The My Computer dialog opens. b) From the dialog toobar, select Tools > Folder Options. c) Select the View tab. The Folder Options dialog opens. The View tab opens. d) Ensure the Use simple file sharing (Recommended) check box is clear. You may have to scroll to find this setting. e) Click OK. f) Close the My Computer dialog

34 Lumension Endpoint Management and Security Suite 3. Ensure File and Printer sharing is enabled. Tip: Lumension EMSS needs access to certain endpoint folders. Enabling File and Printer sharing grants this access. a) Select Start > Control Panel. The Control Panel dialog opens. b) Double-click Network Connections. The Network Connections dialog opens. c) Right-click your local area connection and select Properties. The Local Area Connection Properties dialog opens. Note: In Windows Server 2003, the Local Area Connection Status dialog opens. d) Ensure the File and Printer Sharing for Microsoft Networks check box is selected. e) Click OK. f) Click Close. The Local Area Connection Properties dialog closes. The Network Connections dialog closes. 4. Ensure the Windows Firewall is configured to allow exceptions. Tip: A Windows Firewall that does not allow exceptions will block pings and other agent management processes necessary for a successful Agent Management Job. a) Select Start > Run. The Run prompt opens. b) Type gpedit.msc in the Open field and press ENTER. The Local Group Policy Editor opens. Note: In Windows Vista, this dialog is called the Group Policy Object Editor. c) Expand the local computer policy tree to Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profiles. Ensure the Domain Profiles folder is selected. The Domain Profile windows opens

35 Installing the Agent on Windows d) Ensure the following settings (and their subsettings) are configured for the Domain Profile: Name Windows Firewall: Do not allow exceptions Windows Firewall: Allow inbound file and printer sharing exception Step 1. Right-click and select Edit to open the setting dialog. 2. Ensure the Disabled option is selected. 3. Click OK. 1. Right-click and select Edit to open the setting dialog. 2. Ensure the Enabled option is selected. 3. Define an IP range in the Allow unsolicited incoming messages from field. Note: Lumension recommends defining this field using your Lumension EMSS Server IP address. This input is not validated. To define a range, you may use the following syntax: * (any IP address) /24 (specific Class C subnet) localsubnet (for local subnetwork access only) 4. Click OK. Windows Firewall: Allow ICMP exceptions 1. Right-click and select Edit to open the setting dialog. 2. Ensure the Enabled option is selected. 3. Click OK

36 Lumension Endpoint Management and Security Suite Name Windows Firewall: Allow inbound remote administration exception Step 1. Right-click and select Edit to open the setting dialog. 2. Ensure the Enabled option is selected. 3. Define an IP range in the Allow unsolicited incoming messages from field. Note: Lumension recommends defining this field using your Lumension EMSS Server IP address. This input is not validated. To define a range, you may use the following syntax: * (any IP address) /24 (specific Class C subnet) localsubnet (for local subnetwork access only) 4. Click OK. e) Expand the local computer policy tree to Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall > Standard Profiles. Ensure the Standard Profiles folder is selected. The Standard Profile windows opens. f) Ensure the following settings (and their subsettings) are configured for the Standard Profile: Tip: These settings will mimic the Domain Profile. Name Windows Firewall: Do not allow exceptions Step 1. Right-click and select Edit to open the setting dialog. 2. Ensure the Disabled option is selected. 3. Click OK

37 Installing the Agent on Windows Name Windows Firewall: Allow inbound file and printer sharing exception Step 1. Right-click and select Edit to open the setting dialog. 2. Ensure the Enabled option is selected. 3. Define an IP range in the Allow unsolicited incoming messages from field. Note: Lumension recommends defining this field using your Lumension EMSS Server IP address. This input is not validated. To define a range, you may use the following syntax: * (any IP address) /24 (specific Class C subnet) localsubnet (for local subnetwork access only) 4. Click OK. Windows Firewall: Allow ICMP exceptions 1. Right-click and select Edit to open the setting dialog. 2. Ensure the Enabled option is selected. 3. Click OK. Windows Firewall: Allow inbound remote administration exception 1. Right-click and select Edit to open the setting dialog. 2. Ensure the Enabled option is selected. 3. Define an IP range in the Allow unsolicited incoming messages from field. Note: Lumension recommends defining this field using your Lumension EMSS Server IP address. This input is not validated. To define a range, you may use the following syntax: * (any IP address) /24 (specific Class C subnet) localsubnet (for local subnetwork access only) 4. Click OK

38 Lumension Endpoint Management and Security Suite g) Close the Group Policy dialog. Note: The creation of Windows Firewall exceptions opens the following ports, which are required for job completion: 445/TCP 139/UDP 135/UDP 137/UDP 5. Ensure your endpoint has an NT LAN Manager (NTLM) setting that is compatible with the Lumension EMSS server. You can define this setting for your endpoint using the Registry Editor. a) Select Start > Run. The Run prompt opens. b) In the Open field, type regedit and press ENTER. The Registry Editor opens. Figure 1: Registry Editor c) In the tree panel, expand the registry to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Control\Lsa. Ensure the Lsa folder is selected. The Lsa folder keys open in the main panel. d) In the main panel, double-click lmcompatibilitylevel. The Edit DWORD Value dialog for the lmcompatibilitylevel key opens. e) In the main panel, double-click lmcompatibilitylevel. The Edit DWORD Value dialog for the lmcompatibilitylevel key opens. f) Ensure that the Value data field is set to 3 or 5. If the field is not set correctly, complete the following: 1. Type 3 or 5 in the Value data field

39 Installing the Agent on Windows 2. Click OK. Note: Under most network conditions, a setting of 3 or 5 is sufficient. However, in some networks, this key may require a different value. To determine which value to use, refer to How to enable NTLM 2 authentication ( g) Close the Registry Editor. 6. Ensure that the C$ and ADMIN$ network shares are enabled. The C$ and ADMIN$ network shares are necessary for remote management. This is necessary for a successful Agent Management Job completion. a) From the Command Prompt, type net share and press ENTER. The endpoint network shares are listed. b) Ensure that the following shares are listed in the Share name column. C$ ADMIN$ Note: If these shares are not listed, complete the following steps to enable them. If one of the necessary shares is enabled but not the other, only enable the share that needs to be enabled c) From the Command Prompt, type the necessary commands to enable the required network shares. Example: Complete the following: To enable the C$ share, type NET SHARE C$=C and press ENTER. To enable the ADMIN$ share, type NET SHARE ADMIN$ and press ENTER. You have enabled the required share(s). Note: All enabled shares remain active until the system reboots. d) Close the Command Prompt window. The Command Prompt closes. You have verified that the C$ and ADMIN$ network shares are enabled. 7. [Optional] For Windows Server 2003 and Windows XP 64-bit endpoints, ensure WMI Windows Installer Provider is installed. Tip: This Management and Monitoring Tool is used to complete the Lumension EMSS Agent uninstall by Agent Management Job. This tool is not installed by default on these operating systems. These steps apply only to Windows Server 2003 and Windows XP 64-bit endpoints. You do not have to complete these steps for Windows XP 32-bit endpoints. a) Select Start > Control Panel. Control Panel opens