HEAT Endpoint Management and Security Suite 8.4. Server Install Guide

Transcription

1 8.4 Server Install Guide

2 - 2 -

3 Notices Version Information Server Install Guide; - HEAT Endpoint Management and Security Suite Version Published: May 2016 Document Number: 02_202_8.4_ Copyright Information Lumension Security Inc., 8660 East Hartford Drive, Suite 300 Scottsdale, AZ Phone: Fax: info@lumension.com Copyright ; Lumension Security, Inc.; all rights reserved. Covered by one or more of U.S. Patent Nos. 6,990,660, 7,278,158, 7,487,495, 7,823,147, 7,870,606, and/or 7,894,514; other patents pending. This manual, as well as the software described in it, is furnished under license. No part of this manual may be reproduced, stored in a retrieval system, or transmitted in any form electronic, mechanical, recording, or otherwise except as permitted by such license. LIMITATION OF LIABILITY/DISCLAIMER OF WARRANTY: LUMENSION SECURITY, INC. (LUMENSION) MAKES NO REPRESENTATIONS OR WARRANTIES WITH REGARD TO THE ACCURACY OR COMPLETENESS OF THE INFORMATION PROVIDED IN THIS MANUAL. LUMENSION RESERVES THE RIGHT TO MAKE CHANGES TO THE INFORMATION DESCRIBED IN THIS MANUAL AT ANY TIME WITHOUT NOTICE AND WITHOUT OBLIGATION TO NOTIFY ANY PERSON OF SUCH CHANGES. THE INFORMATION PROVIDED IN THIS MANUAL IS PROVIDED AS IS AND WITHOUT WARRANTY OF ANY KIND, INCLUDING WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE INFORMATION PROVIDED IN THIS MANUAL IS NOT GUARANTEED OR WARRANTED TO PRODUCE ANY PARTICULAR RESULT, AND THE ADVICE AND STRATEGIES CONTAINED MAY NOT BE SUITABLE FOR EVERY ORGANIZATION. NO WARRANTY MAY BE CREATED OR EXTENDED WITH RESPECT TO THIS MANUAL BY SALES REPRESENTATIVES OR WRITTEN SALES MATERIALS. LUMENSION SHALL NOT BE LIABLE TO ANY PERSON WHATSOEVER FOR ANY LOSS OF PROFIT OR DATA OR ANY OTHER DAMAGES ARISING FROM THE USE OF THIS MANUAL, INCLUDING BUT NOT LIMITED TO DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGES

4 Trademark Information Lumension, Lumension Endpoint Management and Security Suite, Lumension Endpoint Management Platform, Lumension Patch and Remediation, Lumension Enterprise Reporting, Lumension Security Configuration Management, Lumension Content Wizard, Lumension AntiVirus, Lumension Wake on LAN, Lumension Power Management, Lumension Application Control, Lumension Device Control, Lumension Endpoint Security, Lumension Intelligent Whitelisting, PatchLink, PatchLink Update, their associated logos, and all other Lumension trademarks and trade names used here are the property of Lumension Security, Inc. or its affiliates in the U.S. and other countries. RSA Secured is a registered trademark of RSA Security Inc. Apache is a trademark of the Apache Software Foundation. In addition, any other companies' names, trade names, trademarks, and products mentioned in this document may be either registered trademarks or trademarks of their respective owners. Feedback Your feedback lets us know if we are meeting your documentation needs. the HEAT Software Technical Publications department at techpubs@heatsoftware.com to tell us what you like best, what you like least, and to report any inaccuracies

5 Table of Contents Table of Contents Preface: About This Document... 7 Typographical Conventions... 7 Contacting HEAT Software... 8 System Requirements... 9 Supported Operating Systems...9 Supported Languages and Locales...10 Software Requirements...11 Web Browser Requirements...12 SQL Server Requirements IIS Requirements NET Framework Requirements...15 Hardware Requirements...15 Network Requirements Recommended Configurations...17 Combined EMSS Application and Database Server...18 Separated EMSS Application and Database Servers Chapter 2: Installing Downloading EMSS...23 About SQL Server Instance Location Defining the Web Client Account and Service Account Selecting an Installation Method...25 Installing Using a New SQL Server Instance...26 Installing Using an Existing SQL Server Instance (Either Locally or Remotely) Installing Using a Remote SQL Server Instance (with no Local Instance) Installing (Separate EMSS and SQL Server Admins) Beginning Installation (Part I)...64 Creating Components on SQL Server (Part II) Completing Installation (Part III) Logging In to...78 Setting Up...79 Appendix A: Configuring Remote SQL Server Instances...83 Creating Remote Accounts Configuring SQL Server to Accept Remote Connections Configuring Windows Firewall for SQL Server Instance Access...88 Appendix B: Configuring Your Server to use SSL Configuring SSL Appendix C: Upgrading from Previous Installations Appendix D: Installation Checklist Server Installation Checklist

6 - 6 -

7 Preface About This Document This Server Install Guide is a resource written for all users of HEAT Endpoint Management and Security Suite 8.4. This document defines the concepts and procedures for installing, configuring, implementing, and using 8.4. Tip: HEAT documentation is updated on a regular basis. To acquire the latest version of this or any other published document, please refer to the HEAT Customer Portal ( Typographical Conventions The following conventions are used throughout this documentation to help you identify various information types. Table 1: Typographical Conventions Convention Usage bold Buttons, menu items, window and screen objects. bold italics Wizard names, window names, and page names. italics New terms, options, and variables. MONOSPACE UPPERCASE Keyboard keys. BOLD UPPERCASE SQL Commands. monospace File names, path names, programs, executables, command syntax, and property names

8 Contacting HEAT Software Arizona Ireland California 8660 East Hartford Drive Suite 300 Scottsdale, AZ United States of America HEAT Software Ireland Ltd. Citypoint Prospect Hill Galway City H91 P9KP Ireland 490 N. McCarthy Blvd. Suite 100 Milpitas, CA United States of America 490 N. McCarthy Blvd. Phone: Phone: Fax: Phone: Fax: Phone: Phone: HEAT Support phone: (USA) (USA - legacy Sanctuary products) (EMEA) (UK) +61 (02) (Australia) (Hong Kong) (Singapore) submit a ticket: Registered users can open a support ticket via the customer portal ( HEAT customers without a support account should contact our support team (support@lumension.com) to have an account created. Note: For additional contact information, please visit the Contact HEAT page at

9 System Requirements Before installing, verify that the targets meets hardware, software, and network requirements. On servers that do not meet recommended system requirements If your target server does not meet the system requirements, EMSS will not perform optimally, or may not install. Review all hardware, software, and network requirements before proceeding with installation. Supported Operating Systems The server is supported on a number of Microsoft Windows operating systems. Table 2: Supported Operating Systems Operating System Edition 1 Data Width 2 Microsoft Windows Server 2012 R2 Standard Datacenter2 Foundation 64-bit Microsoft Windows Server Standard2 Datacenter2 Foundation 64-bit Web 64-bit Microsoft Windows Web Server 2008 R2 3 Microsoft Windows Server 2008 R2 SP1 2 Standard Enterprise2 64-bit Microsoft Windows Server 2008 SP23 Web Standard Enterprise 64-bit4-9 -

10 Operating System Edition Data Width 1. Initial installation of EMSS on this family of operating systems when Core mode is enabled is not supported; a GUI is required. However, following installation, general operation of EMSS while Core mode is enabled is supported. For more information on enabling and disabling Core mode on Windows 2012 and 2012 R2 servers, see HEAT KnowledgeBase Article 1642 ( The Hyper-V edition of this operating system edition is supported, however, the Microsoft Hyper-V Server 2012 stand-alone edition is not. 3. The Datacenter and Core editions of this operating system family are not supported. 4. New installations of EMSS are only supported on the 64-bit version of this operating system. However, if upgrading 8.4 from a prior supported version of EMSS, the 32-bit version of this operating system is still supported. Supported Languages and Locales can only be installed on servers for certain languages and locales. Ensure the target server you are installing on uses one of the listed languages and locales. EMSS is installable on the following locales. The installer is available only in English. Table 3: Server Supported Locales Language Locale Identifier English: United States English: Australia English: Belize English: Canada English: India English: Ireland English: Jamaica English: New Zealand English: Philippines English: Singapore English: South Africa English: United Kingdom German: Germany Spanish: Spain (Modern Sort) en-us en-au en-bz en-ca en-in en-ie en-jm en-nz en-ph en-sg en-az en-gb de-de es-es

11 System Requirements After installing EMSS, you can use a translated UI by selecting one of the following languages in your Web browser. Table 4: Server Supported Languages Language Language Identifier English: United States French: France German: Germany Spanish: Spain (Modern Sort) en-us fr-fr de-de es-es Software Requirements Your server requires other software to operate. Review the listed software requirements to confirm your server has the required software. Before you begin installation of EMSS you must install the following software on your server or another supported location: Software Documentation Supported Web Browsers Web Browser Requirements on page 12 EMSS requires additional, supplemental software, but the EMSS will install it for you during installation: Software Documentation Microsoft SQL Server Microsoft.NET Framework Microsoft Windows Installer Microsoft Silverlight 5.0 Microsoft Visual C SP1 Redistributable Package (x86 and x64) Microsoft Visual C Update 4 Redistributable Package (x86 and x64) SQL Server Requirements on page 13.NET Framework Requirements on page 15 IIS Requirements on page 14.NET Framework Requirements on page 15 Note: Although EMSS installs an instance of SQL Server 2014, (x64), installing an instance yourself is best practice when supporting an enterprise environment

12 Web Browser Requirements You need one of several specific Web browsers to use the HEAT Endpoint Management and Security Suite Web console after installation. Table 5: Supported Web Browsers Supported Browser Supported Versions Microsoft Internet Explorer Mozilla Firefox 38 Extended Support Release 31 Extended Support Release Important: Microsoft Silverlight 5.0 is also required to use HEAT Installation Manager. Due to the accelerated release cycle of the Mozilla Firefox Rapid Release, support cannot be guaranteed

13 System Requirements SQL Server Requirements requires an instance of Microsoft SQL Server to store its data. Multiple version of SQL Server are supported. You can use an instance of any of the following versions. Table 6: Supported Database Servers Database Data Width Edition SQL Server 2014 SP1 x86/x64 Express Standard Enterprise Business Intelligence SQL Server 2014 x86/x64 Express Standard Enterprise Business Intelligence SQL Server 2012 and later x86/x64 Express Standard Enterprise SQL Server 2008 R2 SP1 and later x86/x64 Express Standard Enterprise SQL Server 2008 SP2 and later x86/x64 Express Standard Enterprise Note: HEAT recommends using the latest service pack available for your instance of SQL Server. If installing to a 64-bit server, HEAT recommends installing using a supported preexisting instance of SQL Server that supports 64-bit architecture. For evaluation installs, EMSS installs an instance of SQL Server 2014 Express SP1, which you can later upgrade to Standard or Enterprise before adding EMSS to a production environment. If you are evaluating EMSS, and you have no intent of using SQL Server 2014 Express SP1, your evaluation installation of EMSS should use your preferred version of SQL Server

14 You can install one of the supported database servers instances listed above in the following locations relative to the EMSS server. Table 7: Supported Database Instance Install Locations Location On the target EMSS server itself, as installed by the HEAT server installer, which installs an instance of SQL Server 2014 Express SP1 (x64). On the target HEAT server itself, using a preexisting instance of SQL Server. On a remote server that the HEAT server remotely connects to, using a preexisting instance of SQL Server. Important: When installing EMSS using an existing SQL Server instance, the instance collation must be set to one of the following values: SQL_Latin1_General_CP1_CI_AS Latin1_General_CI_AS IIS Requirements Before you can install EMSS, Microsoft Internet Information Services 7.0 or later must be installed. Table 8: Internet Information Services (IIS) Requirements Required IIS Operating System Family Version Microsoft Documentation Microsoft Internet Information Services 7.0+ Microsoft Windows Server 2012 R2 installing-iis-85-on-windows-server-2012-r2 Microsoft Windows Server Microsoft Windows Server 2008 R2 cc aspx Microsoft Windows Server cc771209(ws.10).aspx

15 System Requirements.NET Framework Requirements EMSS requires installation of.net Framework Microsoft Windows Server 2012 and 2012 R2 use.net 4.5, which comes installed by default. Table 9:.NET Framework Requirements Required.NET Framework Version Operating System Family Microsoft.NET Framework Microsoft.NET Framework with KB Note: EMSS provides the.net Framework installer during installation or upgrade (reboot required). Microsoft Windows Web Server 2008 R2 Microsoft Windows Server 2008 R2 SP1 Microsoft Windows Server 2008 SP2 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Hardware Requirements The server must meet or exceed the specified hardware requirements. Note: Installing the EMSS server on a dedicated server is recommended. The minimum hardware recommendation is designed for trial environments of 50 endpoints. For a EMSS configuration ideal for your environment, see Recommended Configurations on page GHz dual-core processor 4 GB RAM 50 GB or more hard drive space RAID 1 disk array 7200 RPM drive speed 1 Gbps Network Card

16 Network Requirements Your EMSS server needs access to specific websites and network services. Network Requirement Server Role: Your EMSS should not be a domain controller. Firewall Access URLs for replication and agent communication: (For Microsoft content) (For Microsoft content) (For Adobe content) (For Adobe content) (For Adobe content) (For Adobe content) Important: Network Discovery Windows Services: Refer to HEAT KnowledgeBase Article 539 ( and HEAT KnowledgeBase Article 334 ( for additional URLs and IP Addresses which may be required depending upon your configuration and content subscriptions. The firewalls on your server may require modification to access these URLs. If your corporate policies do not allow you to make the necessary firewall modifications, please contact HEAT Support (support@lumension.com) for a recommended configuration. EMSS uses the server Network Discovery Windows Services to discover other computers and devices on your network and installation. At time of install, the EMSS installer prompts you to enable these services: DNS Client Function Discovery Resource Publication SSDP Discovery UPnP Device Host

17 System Requirements Network Requirement Encryption Protocols: EMSS uses Transport Layer Security for communication between the HEAT EMSS Server and the HEAT EMSS Agent: TLS 1.0, 1.1, and 1.2. EMSS prompts you to enable these protocols during installation. Note: If you do not plan on supporting Windows XP, Vista, Server 2003, or Server 2008 endpoints, you can disable TLS 1.0 and 1.1 to improve security. See for more information. Recommended Configurations HEAT recommends different hardware and software requirements customized for your HEAT Endpoint Management and Security Suite network setup. Server Configuration Considerations EMSS requires two main components to function: EMSS Application Server: This server is responsible for Web site, replication services, and endpoint distribution services. EMSS Database Server: This server is responsible for SQL database and stored procedures. These servers can be installed on a single server, or on two, separate servers. Combined Application and Database Server: In configurations where the EMSS application and database are installed on the same server, the server requires both high processing power and disk speed, as it is performs both application and database functions. Combined EMSS Application and Database Server on page 18 Separate Application and Database Servers: In configurations where the EMSS application and database are installed on separate servers, the server requirements are different. Although processing and software requirements on both servers remain the same, the database requires increased HDD specifications, as it executes disk-intensive functions. Separated EMSS Application and Database Servers on page 19 Endpoint Scaling Considerations Regardless of your EMSS application and database configuration, your server (or servers) require increasingly high-end hardware and software to offset increased load from endpoints. Use better hardware in environments with a high endpoint count

18 Additional Considerations For additional information about the physical memory limits for Windows releases, refer to Memory Limits for Windows Releases ( aa366778(v=vs.85).aspx). For additional information about moving SQL Server databases, refer to Move System Databases ( For additional information about Microsoft's top ten best practices for storage, refer to Storage Top Ten Best Practices ( Combined EMSS Application and Database Server For optimal performance, the hardware and software supporting HEAT Endpoint Management and Security Suite should be scaled to your endpoint count. The following table lists the recommended hardware and software for you EMSS network. Note: Installation on a physical server is assumed. If installing to virtual environment, refer to HEAT KnowledgeBase Article 258 ( Combined Server Recommended Configuration < 50 < 500 < 1,000 < 5,000 < 10,0001 Operating System Windows 2012 R2 Windows 2012 R2 Windows 2012 R2 Windows 2012 R2 Windows 2012 R2 Operating System Edition Standard Standard Standard Standard Standard x64 x64 x64 x64 x64 Database Server SQL 2014 SQL 2014 SQL 2014 SQL 2014 SQL 2014 Database Server Edition Standard2 Standard Standard Standard Enterprise x64 x64 x64 x64 x64 Core Architecture Core Speed (GHz) Gb/s 1 Gb/s 1 Gb/s 1 Gb/s 1 Gb/s RAID 1 RAID 1 Multiple RAID Multiple RAID Multiple RAID k/SSD 10k/SSD 15k/SSD Endpoint Count Software Operating System Architecture Database Server Architecture Hardware RAM (GB)4 Network (LAN) Disk Array 5 # Hard Drives Drive Speed (RPM)

19 System Requirements Endpoint Count < 50 < 500 < 1,000 < 5,000 < 10,0001 Hard Drive Volume Breakdown OS/Data 250GB 500GB N/A N/A N/A OS N/A N/A RAID 1-250GB RAID 1-250GB RAID 1-250GB Data N/A N/A RAID 1-500GB RAID 1/ SSD - 1TB RAID 10/ SSD - 1TB Temp DB N/A N/A N/A RAID 0-250GB SSD 240GB 1. If you are managing endpoints, contact HEAT Support ( for a recommended configuration. 2. Evaluation customers should use Express edition with Advanced Services. 3. A Sandy Bridge Xeon+ or AMD equivalent is recommended. On virtualized servers, 2x the assigned cores is recommended. 4. On virtualized servers, 2x RAM is recommended for networks supporting endpoints. 5. Due to performance issues, do not use RAID 5 configurations. Replace the disk array with a shared SAN, an enterprise-class SSD, or another enterprise storage solution IOPS minimum sustained performance is recommended. A dedicated array or LUN is recommended. Separated EMSS Application and Database Servers When the Application Server and Database Server are installed on two physical servers, then each servers recommended hardware requirements will increase according to the number of managed endpoints in your network. Review the following information when the components are installed on separate servers. Note: Installation on a physical server is assumed. If installing to virtual environment, refer to HEAT KnowledgeBase Article 258 ( Recommended Application Server Configuration The following table lists the recommended configuration for the Application Server. < 50 < 500 < 1,000 < 5,000 < 10,0001 Operating System Windows 2012 R2 Windows 2012 R2 Windows 2012 R2 Windows 2012 R2 Windows 2012 R2 Operating System Edition Standard Standard Standard Standard Standard Endpoint Count Software

20 < 50 < 500 < 1,000 < 5,000 < 10,0001 Operating System Architecture x64 x64 x64 x64 x64 Core Architecture Core Speed (GHz) Gb/s 1 Gb/s 1 Gb/s 1 Gb/s 1 Gb/s RAID 1 RAID 1 RAID 1/SSD RAID 1/SSD RAID 1/SSD k/SSD 10k/SSD 10k/SSD Endpoint Count Application Server Hardware RAM (GB)3 Network (LAN) 4 Disk Array # Hard Drives Drive Speed (RPM) Hard Drive Volume Breakdown OS/Data (GB) If you are managing endpoints, contact HEAT Support ( for a recommended configuration. 2. A Sandy Bridge Xeon+ or AMD equivalent is recommended. On virtualized servers, 2x the assigned cores is recommended. 3. On virtualized servers, 2x RAM is recommended for networks supporting endpoints. 4. Due to performance issues, do not use RAID 5 configurations. Replace the disk array with a shared SAN, an enterprise-class SSD, or another enterprise storage solution IOPS minimum sustained performance is recommended. A dedicated array or LUN is recommended. Recommended SQL Server Configuration The following table lists the recommended configuration for the Database Server. < 50 < 500 < 1,000 < 5,000 < 10,0001 Operating System Windows 2012 R2 Windows 2012 R2 Windows 2012 R2 Windows 2012 R2 Windows 2012 R2 Operating System Edition Standard Standard Standard Standard Standard x64 x64 x64 x64 x64 SQL 2014 SQL 2014 SQL 2014 SQL 2014 SQL 2014 Endpoint Count Software Operating System Architecture Database Server

21 System Requirements < 50 < 500 < 1,000 < 5,000 < 10,0001 x64 x64 x64 x64 x64 Standard2 Standard Standard Standard Enterprise Core Architecture Core Speed (GHz) Gb/s 1 Gb/s 1 Gb/s 1 Gb/s 1 Gb/s RAID 1 RAID 1 Multiple RAID Multiple RAID Multiple RAID k/SSD 10k/SSD 15k/SSD Endpoint Count Database Server Architecture Database Server Edition SQL Server Hardware 3 RAM (GB)4 Network (LAN) Disk Array 5 # Hard Drives Drive Speed (RPM) Hard Drive Volume Breakdown OS/Data (GB) N/A N/A N/A OS (GB) N/A N/A RAID RAID RAID Data N/A N/A RAID 1-500GB RAID 1/ SSD - 1TB RAID 10/ SSD - 1TB Temp DB (GB) N/A N/A N/A RAID SSD If you are managing endpoints, contact HEAT Support ( for a recommended configuration. 2. Evaluation customers should use Express edition with Advanced Services. 3. A Sandy Bridge Xeon+ or AMD equivalent is recommended. On virtualized servers, 2x the assigned cores is recommended. 4. On virtualized servers, 2x RAM is recommended for networks supporting endpoints. 5. Due to performance issues, do not use RAID 5 configurations. Replace the disk array with a shared SAN, an enterprise-class SSD, or another enterprise storage solution IOPS minimum sustained performance is recommended. A dedicated array or LUN is recommended

22 - 22 -

23 Chapter 2 Installing HEAT Endpoint Management and Security Suite In this chapter: Downloading EMSS About SQL Server Instance Location Defining the Web Client Account and Service Account Selecting an Installation Method Installing Using a New SQL Server Instance Complete the installation method that is best for your network environment. Before installation, download the latest HEAT Endpoint Management and Security Suite (EMSS) installer. There is an installation procedure for all EMSS installation scenarios. After installation, complete any additional procedures associated with the installation method. Installing Using an Existing SQL Server Instance (Either Locally or Remotely) Installing Using a Remote SQL Server Instance (with no Local Instance) Installing HEAT Endpoint Management and Security Suite (Separate EMSS and SQL Server Admins) Logging In to HEAT Endpoint Management and Security Suite Setting Up HEAT Endpoint Management and Security Suite Downloading EMSS When you purchase, you receive no physical media. Rather, you download it from the company Web site. Download EMSS from the HEAT Customer Portal (

24 1. Open your Web browser. 2. Browse to the HEAT Customer Portal ( 3. Browse to and download the most recent version of the EMSS installer to your desired location. After Completing This Task: Complete the installation procedure applicable to your network environment. For additional information, refer to Selecting an Installation Method on page 25. About SQL Server Instance Location requires an instance of Microsoft SQL Server to store system data values. You can install this SQL Server instance on your target EMSS server or a remote server. Local SQL Server Instance A SQL Server instance can be installed on the same server as HEAT Endpoint Management and Security Suite. When using a local SQL Server instance, you can use either a named or default instance of SQL Server that is preexisting, or you can use a new instance of SQL Server (which is set up by the Log Collector installer). Remote SQL Server Instance A SQL Server instance can be installed on a different server than EMSS, and EMSS can then access that remote instance. If you elect to use a remote SQL Server instance, you must direct EMSS toward the remote instance during EMSS installation. However, before directing EMSS to the remote instance, you must configure that instance to accept remote connections. For additional information, refer to Configuring SQL Server to Accept Remote Connections on page 86. Tip: Install EMSS using a remote SQL Server instance to increase performance. Defining the Web Client Account and Service Account requires two user accounts to operate critical components: a Web client account and a service account. HEAT recommends creating new local user accounts to use as Web client and service accounts (as defined in the installation procedures). However, you can also use preexisting local or domain accounts. When using preexisting local or domain accounts, certain requirements must be fulfilled. Remember

25 Installing the following rules if you use preexisting user accounts when installing EMSS using a remote instance of SQL Server: In cross-domain network configurations, accounts from either domain may be used as the Web client and service accounts, but the domains must have a trust relationship. Any install in which either the EMSS server or the SQL server is in a workgroup must use local accounts as the Web client and service accounts. When using local accounts as the Web client and service accounts, there must be a duplicate of each account on each server. For example, if the EMSS server hosts an account named serviceadmin with a password of Password.0, then the SQL server must host an account called serviceadmin with a password of Password.0. When using a domain account for the service accounts it must also belong to the local Administrator group in order to run critical services including Internet Information Services (IIS). Note: You can use existing user accounts as the Web client account and service account. However, HEAT recommends creating new accounts specifically for EMSS using the installer (if using a remote SQL Server instance, manual creation of identical accounts is required). Creating accounts specifically for the product increases security and automates creation of trust relationships. Selecting an Installation Method There are multiple methods of installing the product. When installing, identify the scenario that best suits your network environment, and complete the scenario according to the provided procedures. For small network environments that do not require complex instances of SQL Server, complete the basic (EMSS) installation. This installation includes an installation of Microsoft SQL Server 2014, Express Edition (x64). This installation method is the simplest EMSS method. Installing Using a New SQL Server Instance on page 26 For larger network environments, the EMSS installation requires a more sophisticated SQL Server instance that must be installed independently from EMSS. This instance of SQL Server, which must be installed before EMSS, can be installed on either the target EMSS server or a remote server. Installing Using an Existing SQL Server Instance (Either Locally or Remotely) on page 36 Installing Using a Remote SQL Server Instance (with no Local Instance) on page 50 In especially large environments, the SQL Server administrator and the EMSS administrator may be separate individuals. In this scenario, a special installation procedure is required due to administrator access right limitations. Installing (Separate EMSS and SQL Server Admins) on page 63 Attention: Complete Downloading EMSS on page 23 before beginning an installation procedure

26 Installing Using a New SQL Server Instance If SQL Server is not installed on your target server, or if you want to use a new instance instead of an existing one, you can create a new SQL Server 2014, Express Edition (x64) instance during the HEAT Endpoint Management and Security Suite installation. Prerequisites: You have completed Downloading EMSS on page 23. As applicable to your network environment, you have gathered the information and completed the tasks itemized in the Server Installation Checklist on page 97. Note: For additional information about using preexisting user accounts to operate critical EMSS components, refer to Defining the Web Client Account and Service Account on page 24. If you are installing using a Secure Sockets Layer (SSL), complete the first portion of Configuring SSL on page Log on to the server on which you want to install EMSS using either a local or domain user account with system administrator privileges. 2. Stop or disable any AntiVirus products (such as McAfee, Trend-micro, Symantec, and so on) running on your server. Note: An AntiVirus product can prevent processes from running correctly during the installation. Therefore, to ensure a successful installation, all AntiVirus services must be stopped or disabled prior to running the EMSS installer. 3. Double-click the EMSS installer at the location defined during the download. Step Result: The EMSS InstallShield Wizard opens and begins extracting files. This process may take several minutes. 4. If prompted, install prerequisites and reboot your server. The installer reopens by itself after the reboot. 5. Click Next. Step Result: The License Agreement page opens. Tip: Click Print for a hard copy of the license agreement. 6. Review the License Agreement and select the I accept the terms of the license agreement option

27 Installing 7. Click Next. Step Result: The Customer Information page opens. Figure 1: Customer Information Page 8. Type the applicable information in the following fields: Field Description Company Name Your company name. Serial Number Your EMSS serial number. Note: Your serial number is two groups of eight alphanumeric characters. Letters are not case sensitive. If you cannot locate your serial number, obtain it by contacting the HEAT Sales Support Tip: Retain your serial number following installation, as it is necessary if a reinstall of the EMSS server is needed

28 9. Click Next. A new page or dialog opens. Page/Dialog Step If the Question dialog opens: Click Yes to start network discovery services. The following services are necessary to use discovery features within EMSS: If the Required IIS Features page opens: DNS Client Function Discovery Resource Location SSDP Discover UPnP Device Host Your server does not have the required IIS features installed. Click Install Features to install the features and proceed. Note: On Windows Server 2008, the default installation of IIS lacks components necessary for EMSS. The EMSS installer installs the following IIS components if not present: Static Content Default Document HTTP Errors ASP.NET.NET Extensibility ASP ISAPI Extensions ISAPI Filters Basic Authentication Windows Authentication Static Content Compression Dynamic Content Compression

29 Installing Page/Dialog Step If the System Requirements page opens: Your server does not meet the minimum installation requirements. If you receive only system requirement warnings, you may proceed with installation by clicking Next. HEAT recommends resolving warnings before proceeding with installation. Note: When installing on a virtual platform you will likely receive a warning about the CPU requirements since the installer is unable to identify the processor in a virtual environment. If you receive any system requirement failures, you must cancel the installation, resolve these failures, and then restart installation. Tip: Click View all Failures/Warnings for detailed information about prerequisite status deficiencies. If the Service Accounts page opens: Proceed to the next step. 10.Create or define the Web client account and service account that EMSS will use. These accounts are used to operate components critical to EMSS. Select from the following options. Option To create new accounts: Steps 1. Edit the Web Client Account Username field. 2. In the Web Client Account Password field, type the desired password. 3. In the Web Client Account Confirm password field, retype the password. 4. Edit the Service Account Username field. 5. In the Service Account Password field, type the desired password. 6. In the Service Account Confirm password field, retype the password. Note: If you create new Web client account and service account, HEAT recommends using the default account user names the installation creates; clientadmin for the Web client account, and serviceadmin for the service account

30 Option To use preexisting accounts: Steps 1. Type the user name associated with the desired account in the Web Client Account Username field. 2. Type the password associated with the user name in the Web Client Account Password field. 3. Retype the password in the Web Client Account Confirm password field. 4. Type the user name associated with the desired account in the Service Account Username field. 5. Type the password associated with the service account user name in the Service Account Password field. 6. Retype the password in the Service Account Confirm password field Note: HEAT recommends creating new accounts. If using domain accounts, include the domain name as part of the user name (DOMAIN\Username). You may only use preexisting accounts if they meet the requirements defined in Defining the Web Client Account and Service Account on page

31 Installing 11.Click Next. If required, acknowledge the creation of new accounts by clicking OK. Step Result: The SQL Server Instance page opens. Figure 2: SQL Server Instance Page 12.Select the Install a new SQL Server instance option. 13.[Optional] Type a new instance name in the Instance Name field

32 14.Click Next. Step Result: The Destination Location page opens. Figure 3: Destination Location Page 15.[Optional] Change the EMSS installation location. a) Click Browse. b) Define the desired file path using either the Look in lists or the Folder name field. c) Click OK. Step Result: The Installation Folder field reflects your changes. 16.[Optional] Change the EMSS content storage location. The content storage location is the location where patches and other content items are downloaded. HEAT recommends allocating at least 32 GB of storage space to content (plus an additional 10 GB if managing non-windows endpoints). a) Click Browse. b) Define the desired file path using either the Look in lists or the Folder name field. c) Click OK. Step Result: The Content Storage Location field reflects your changes

33 Installing 17.Click Next. Step Result: The Proxy Settings page opens. Note: Refer to the : Requirements Guide ( for a complete list of proxy types that EMSS supports. Figure 4: Proxy Settings Page Note: If one or both of the storage directories defined on the Destination Location page does not contain the recommended available disk space, the Proxy Settings page does not immediately open. Rather, a dialog that lets you redefine the storage directories will open. Then after redefining the storage directories, the Proxy Settings page will open. 18.If your network uses a proxy server to access the Internet, select the A proxy server is required check box and type the applicable information in the following fields. Field Type Server Address The IP address of the applicable proxy server

34 Field Type Port The port number used for communication. Note: You can also configure EMSS to use a proxy following installation. Refer to The Service Tab in the User Guide ( for additional information on proxy communication. 19.If your network uses a proxy server to access the Internet, and that proxy requires authentication, select the Authentication required check box and type the applicable information in the following fields. Field Type Username A user name that authenticates with the proxy. Password The password associated with the user name. Confirm Password The password retyped. 20.Click Next. Step Result: The Agent to Server Communication page opens. Figure 5: Agent to Server Communication Page

35 Installing 21.If you are using SSL for server and agent communication, select the Use SSL security for Patch agent communication with the server check box. Note: You must possess an SSL certificate to implement SSL communication. Implementation of SSL communication during installation is optional. This feature can be implemented following installation. 22.In the Default server identity field, type the name of your server in one of the following formats: DNS name (computername.domainname.com) Computer name (computername) IP address ( ) During agent registration, the EMSS agents use this name to identify the server. Note: If you are using SSL, the server name that you type in the field must match the server named on your certificate. 23.Click Next. Step Result: The Installation Ready page opens. Figure 6: Installation Ready Page

36 24.[Optional] If you only want to install core components, clear the Automatically include all licensed modules and updates during installation check box. Note: You may use the HEAT Installation Manager after the initial installation of EMSS to install additional components. For additional information, refer to Using HEAT Installation Manager in the User Guide ( 25.Review the installation information and click Install to begin the installation of EMSS. This process may take several minutes. Important: During installation, do not attempt to access the EMSS Web site. Accessing the Web site during installation can cause installation errors. 26.After installation completes, click Finish. 27.Acknowledge the notification that appears by clicking OK. The credentials you use to log in to the EMSS Web site for the first time are the credentials that you used when you logged into the server initially. Result: EMSS is installed and can now be accessed. After Completing This Task: Proceed to one of the following procedures based on selections made during installation. If your server will use SSL, finish Configuring SSL on page 89. If your server will not use SSL, proceed to Logging In to HEAT Endpoint Management and Security Suite on page 78. Installing Using an Existing SQL Server Instance (Either Locally or Remotely) You can configure your installation to use a SQL Server instance that exists either locally or remotely. Prerequisites: Complete Downloading EMSS on page 23. As applicable to your network environment, you have gathered the information and completed the tasks itemized in the Server Installation Checklist on page 97. If you are installing using SSL, complete the first portion of Configuring SSL on page 89 If you are installing using a remote instance of SQL Server, complete Configuring SQL Server to Accept Remote Connections on page 86 Additionally, if you are installing using a remote instance of SQL Server, and no instances of SQL Server exist locally, complete Installing Using a Remote SQL Server Instance (with no Local Instance) on page 50 rather than this procedure

37 Installing 1. If installing using a remote instance of SQL Server, complete Creating Remote Accounts on page 83. Note: If using preexisting accounts, you may skip completion of this step. 2. Using either a local or domain account with system administrator privileges, log in to the server on which you will install EMSS. 3. Stop or disable any AntiVirus products (such as McAfee, Trend-micro, Symantec, and so on) running on your server. Note: An AntiVirus product can prevent processes from running correctly during the installation. Therefore, to ensure a successful installation, all AntiVirus services must be stopped or disabled prior to running the EMSS installer. 4. Double-click the EMSS installer at the location defined during the download. Step Result: The EMSS InstallShield Wizard opens and begins extracting files. This process may take several minutes. 5. If prompted, install prerequisites and reboot your server. The installer reopens by itself after the reboot. 6. Click Next. Step Result: The License Agreement page opens. Tip: Click Print for a hard copy of the license agreement. 7. Review the License Agreement and select the I accept the terms of the license agreement option

38 8. Click Next. Step Result: The Customer Information page opens. Figure 7: Customer Information Page 9. Type the applicable information in the following fields: Field Description Company Name Your company name. Serial Number Your EMSS serial number. Note: Your serial number is two groups of eight alphanumeric characters. Letters are not case sensitive. If you cannot locate your serial number, obtain it by contacting the HEAT Sales Support Tip: Retain your serial number following installation, as it is necessary if a reinstall of the EMSS server is needed

39 Installing 10.Click Next. A new page or dialog opens. Page/Dialog Step If the Question dialog opens: Click Yes to start network discovery services. The following services are necessary to use discovery features within EMSS: If the Required IIS Features page opens: DNS Client Function Discovery Resource Location SSDP Discover UPnP Device Host Your server does not have the required IIS features installed. Click Install Features to install the features and proceed. Note: On Windows Server 2008, the default installation of IIS lacks components necessary for EMSS. The EMSS installer installs the following IIS components if not present: Static Content Default Document HTTP Errors ASP.NET.NET Extensibility ASP ISAPI Extensions ISAPI Filters Basic Authentication Windows Authentication Static Content Compression Dynamic Content Compression

40 Page/Dialog Step If the System Requirements page opens: Your server does not meet the minimum installation requirements. If you receive only system requirement warnings, you may proceed with installation by clicking Next. HEAT recommends resolving warnings before proceeding with installation. Note: When installing on a virtual platform you will likely receive a warning about the CPU requirements since the installer is unable to identify the processor in a virtual environment. If you receive any system requirement failures, you must cancel the installation, resolve these failures, and then restart installation. Tip: Click View all Failures/Warnings for detailed information about prerequisite status deficiencies. If the Service Accounts page opens: Proceed to the next step. 11.Define the Web client account and service account that EMSS will use. Define these accounts based on how you are configuring your EMSS server. Option Steps If your install will use a local SQL Server instance: Define the credentials for two new user accounts (which are created by the installer). 1. In the Web Client Account Username field, edit the user name. 2. In the Web Client Account Password field, type a password. 3. In the Web Client Account Confirm password field, retype the password. 4. In the Service Account Username field, edit the user name. 5. In the Service Account Password field, type a password. 6. In the Service Account Confirm password field, retype the password

41 Installing Option Steps If your install will use a remote SQL Server instance: Define the credentials for the two user accounts created while completing Creating Remote Accounts on page In the Web Client Account Username field, type the user name of the Web client account on your SQL Server. 2. In the Web Client Account Password field, type the password of the Web client account on your SQL Server. 3. In the Web Client Confirm password field, retype the password. 4. In the Service Account Username field, type the user name of the service account on your SQL Server. 5. In the Service Account Password field, type the password of the service account on your SQL Server. 6. In the Service Account Confirm password field, retype the password. Important: The Web client account and the service account credentials must be identical on both the SQL Server and the EMSS server. If they are not, you cannot access the EMSS Web site. If your install will use a local or remote SQL Server instance that uses preexisting accounts as the Web Client and Service Accounts: Define the credentials for the preexisting accounts. 1. Type the user name associated with the desired account in the Web Client Account Username field. 2. Type the password associated with the user name in the Web Client Account Password field. 3. Retype the password in the Web Client Account Confirm password field. 4. Type the user name associated with the desired account in the Service Account Username field. 5. Type the password associated with the service account user name in the Service Account Password field. 6. Retype the password in the Service Account Confirm password field. Important: You can use either local or domain accounts. If using domain accounts, include the domain name as part of the user name (DOMAIN\username). Additionally, preexisting accounts may only be used if they meet the requirements listed in Defining the Web Client Account and Service Account on page

42 12.Click Next. If required, acknowledge the creation of new accounts by clicking OK. Step Result: The SQL Server Instance page opens. Figure 8: SQL Server Instance Page 13.Ensure the Connect to an existing SQL Server instance option is selected

43 Installing 14.Click Next. Step Result: The SQL Server and Instance page opens. Use this page to define the SQL Server instance you will use with EMSS. Figure 9: SQL Server and Instance Page 15.Select a Server Location. Select one of the following options. Option Steps To use a locally installed existing SQL Server instance: Select the On this machine (local) option. To use a remotely installed existing SQL Server instance: 1. Select the On another machine (remote) option. 2. Type the server name (not the IP address) in the Server name field. Note: If you must define an IP address, either map the IP address to the server name in the hosts file or create an alias using SQL Server Configuration Manager

44 16.Select a SQL Server Instance. Select one of the following options: Option Steps To use a default instance of SQL Server: Select the Default instance option. To use a named instance of SQL Server: 1. Select the Named instance option. 2. If the SQL Server instance is local, select it from the list. If the SQL Server instance is remote, type its name in the field. 17.Click Next. Step Result: The SQL Server Authentication page opens. Figure 10: SQL Server Authentication Page 18.Define the credentials that will be used to access the SQL Server instance (based upon its authentication mode). Select from the following options: Option Steps To use Windows authentication: Select the Windows Authentication option