Topic: McAfee ePolicy Orchestrator (ePO)

[metalmunna]

hi guys,

do you know about McAfee ePolicy Orchestrator? how it works and how to distribute to the whole enterprise network and manage and control? enough we talked like a kid for a simple antivirus, now we will work about the whole Enterprise security and how to controlling from a central point. so lets jump in advanced level ...

To know detail of McAfee ePolicy Orchestrator, walk here;
http://www.mcafee.com/us/products/security-management/index.aspx
http://www.mcafee.com/us/products/epolicy-orchestrator.aspx

(McAfee ePolicy Orchestrator (ePO) is widely acknowledged as the most advanced and scalable security management software in the industry. With ePO software, organizations of all sizes can efficiently manage any number of devices — all from a personalized web console. As a key component of the McAfee Security Management Platform, ePO software manages security across endpoints, networks, and data; integrates third-party solutions; and automates workflows to create efficiencies, streamline compliance, and provide visibility into security and compliance postures.

Only McAfee ePO delivers:

End-to-end visibility — Get a unified view of your security posture. A single point of reference for security data across endpoints, data, and networks provides immediate insight and shortens response times.

An open, extensible architecture — Easily leverage your existing IT infrastructure. McAfee ePO software connects management of both McAfee and third-party security solutions to your LDAP, IT operations, and configuration management tools.

Proven efficiencies — Respond quickly and spend less. Independent studies show ePO software helps organizations of every size streamline administrative tasks, ease audit fatigue, and reduce security management-related hardware costs.
)

we the guys who know better and have experience on McAfee ePolicy Orchestrator will try to help others who will be new and wanted to learn and deploy on small business to enterprise network ...

[Samker]

Nice Topic Munna. 

[metalmunna]

Nice Topic Munna. 

thanks man, it's a nice enterprise security management software and fully automated ... most of entry level and mid level administrator don't know how to automated(included automated installation, update, patch update, scanning, reporting ..etc.) the security system for the whole network, they feel it but don't know how to solve .. on the 1st stage it's little complicated but not too much complicated ... OK we should learn more.

lets wait for the question .... i know it will take little more time to run ... i meant the topic. hoping will grow up soon and we all should learn something new by exchanging the experience and knowledge ..

[Samker]

Nice Topic Munna.   

lets wait for the question .... i know it will take little more time to run ... i meant the topic. hoping will grow up soon and we all should learn something new by exchanging the experience and knowledge ..

I'm sure this will be very popular Topic since We have a lot of McAfee users at SCF.

[metalmunna]

thanks man, till the question comes we can start learning(included me) .. from the very beginning by small part of every essential steps on each session;

(It is recommended that we should have a working knowledge of Microsoft Windows administration and system administration concepts, a basic understanding of computer security concepts, and a general understanding of viruses and anti-virus technologies.)

lets start from the installation and pre request installation;
(used by Official McAfee ePolicy Orchestrator 4.5 Installation Guide)

System requirements

Verify that your environment meets the minimum requirements listed here:
• Server and Agent Handler
• Database
• Distributed repositories

Server and Agent Handler requirements

Free disk space — 1 GB minimum (first-time installation); 1.5 GB minimum (upgrade);
2 GB recommended.
Memory — 1 GB available RAM; 2–4 GB recommended.
Processor — Intel Pentium III-class or higher; 1 GHz or higher.
Monitor — 1024x768, 256-color, VGA monitor.
NIC — Network interface card; 100 MB or higher.

NOTE: If using a server with more than one IP address, ePolicy Orchestrator uses the first
identified IP address. If you want to use additional IP addresses for agent-server communication,
see Installing an Agent Handler.
Dedicated server — If managing more than 250 computers, McAfee recommends using a
dedicated server.
File system — NTFS (NT file system) partition recommended.
IP address — McAfee recommends using static IP addresses for ePO servers.
Server-class operating system — 32bit or 64bit
• Windows Server 2003 Enterprise with Service Pack 2 or later
• Windows Server 2003 Standard with Service Pack 2 or later
• Windows Server 2003 Web with Service Pack 2 or later
• Windows Server 2003 R2 Enterprise with Service Pack 2 or later
• Windows Server 2003 R2 Standard with Service Pack 2 or later
• Windows Server 2008

NOTE: Installation is blocked if you attempt to install on a version of Windows earlier than
Server 2003. In addition, ePolicy Orchestrator stops functioning if, after having been installed
on Windows Server 2003, the server is upgraded to Windows Server 2008.

Browser
• Firefox 3.0
• Microsoft Internet Explorer 7.0 or 8.0
If using Internet Explorer and a proxy, follow these steps to bypass the proxy server.
1 From the Tools menu in Internet Explorer, select Internet Options.
2 Select the Connections tab and click LAN Settings.
3 Select Use a proxy server for your LAN, then select Bypass proxy server for local
addresses.
4 Click OK as needed to close Internet Options.
Domain controllers — The server must have a trust relationship with the Primary Domain
Controller (PDC) on the network. For instructions, see the Microsoft product documentation.
Security software
• Install and/or update the anti-virus software on the ePolicy Orchestrator server and scan
for viruses.

CAUTION: If running VirusScan Enterprise 8.5i or 8.7i on the system where you are installing
ePolicy Orchestrator, you must ensure that the VSE Access Protection rules are disabled
during the installation process, or the installation fails.
• Install and/or update firewall software on the ePolicy Orchestrator server.
Ports
• McAfee recommends avoiding the use of Port 8443 for HTTPS communication. Although this
is the default port, it is also the primary port used by many web-based activities, is a popular
target for malicious exploitation, and it is likely to be disabled by the system administrator
in response to a security violation or outbreak.

NOTE: Ensure that the ports you choose are not already in use on the ePolicy Orchestrator
server computer.
• Notify the network staff of the ports you intend to use for HTTP and HTTPS communication
via ePolicy Orchestrator.
NOTE: Installing the software on a Primary Domain Controller (PDC) is supported, but not
recommended.
Supported virtual infrastructure software
• VMware ESX 3.5.x
• Microsoft Virtual Server 2005 R2 with Service Pack 1
• Windows Server 2008 Hyper-V

[metalmunna]

Database requirements

Microsoft updates and patches Update both the ePO server and the database server with the latest Microsoft security updates.
If you are upgrading from MSDE 2000 or SQL 2000, be sure to follow Microsoft's required upgrade scenarios.

Databases supported for use with ePolicy Orchestrator

• SQL Server 2005 Express. This database is included with ePolicy Orchestrator for use in
environments where there is no supported database available.
• SQL Server 2005.
• SQL Server 2008 Express.
• SQL Server 2008.

NOTE: Use of ePolicy Orchestrator with MSDE 2000 or SQL 2000 (or earlier) is not supported.
Database installation documented in this Guide


The only database installation scenario described in detail is a first-time installation of SQL
Server 2005 Express. In this scenario, the ePOSetup installs both the ePolicy Orchestrator
software and the database on the same server. If the database is to be installed on a different
server from the ePolicy Orchestrator software, manual installation is required on the remote
servers.

Other relevant database installations and upgrades

See the documentation provided by the database manufacturer for information about the
following installation scenarios:
• Installing SQL Server 2005.
• Installing SQL Server 2008.
• Upgrading from MSDE 2000.
• Upgrading from SQL 2000.
• Upgrading from SQL 2005.
• Upgrading from SQL 2005 Express.

• Maintenance settings — McAfee recommends making specific maintenance settings to
ePO databases.

• Dedicated server and network connection — Use a dedicated server and network
connection if managing more than 5,000 client computers.
• Local database server — If using SQL Server on the same system as the ePOserver,
McAfee recommends using a fixed memory size in Enterprise Manager that is approximately
two-thirds of the total memory for SQL Server. For example, if the computer has 1GB of
RAM set 660MB as the fixed memory size for SQL Server.
Pre-Installation

System requirements
• SQL Server licenses — If using SQL Server, a SQL Server license is required for each
processor on the computer where SQL Server is installed.
CAUTION: If the minimum number of SQL Server licenses is not available after you install
the SQL Server software, you may have issues installing or starting the ePolicy Orchestrator
software.

[metalmunna]

Database considerations

Using ePolicy Orchestrator with a database

A database must be installed before ePolicy Orchestrator can be installed. Any of the following
databases, if previously installed, meets this requirement.
• SQL Server 2005
• SQL 2005 Express
• SQL 2008
• SQL 2008 Express
NOTE: SQL 2000 is not supported.

If none of those databases was previously installed, the ePO installation wizard detects that no
database is present and offers you the opportunity to install SQL Server 2005 Express.

Database Requirements Note
Dedicated server and network Needed if managing more than 5,000 computers.
connection
SQL Server 2005
or SQL Server
2008
If the database and ePO server are on the same system,
McAfee recommends using a fixed memory size in Enterprise
Local database server
Manager or SQL Server Management Studio that is
approximately two-thirds of the total memory for SQL Server.
For example, if the computer has 1 GB of RAM, set 660 MB
as the fixed memory size for SQL Server.
A license is required for each processor on the computer
where SQL Server is installed. If the minimum number of SQL
Licenses
Server licenses is not available, you might have difficulty
installing or starting the ePolicy Orchestrator software.
SQL Server 2005 .NET Framework You must acquire and install.
Express

Software Note
MSXML 6.0 You must acquire and install.
1 From the Internet Explorer Tools menu, select Windows
Update.
2 Click Custom, then select Software.
3 Select MSXML6.
4 Select Review and install updates, then click Install Updates.

Pre-Installation
System requirements
Software Note
Internet Explorer 7 or 8, or You must acquire and install.
Firefox 3.0
.NET Framework 2.0 You must acquire and install if using SQL Server 2005 Express.
Microsoft Visual C++ If not previously installed, the installation wizard installs automatically.
Redistributable
Microsoft Visual C++ If not previously installed, the installation wizard installs automatically.
Redistributable - x86 9.0.21022
MDAC 2.8 If not previously installed, the installation wizard installs automatically.
SQL Server 2005 Backward If not previously installed, the installation wizard installs automatically.
Compatibility
If no other database has been previously installed, this database can be installed
automatically at user’s selection.
SQL Server 2005 Express
Update the ePolicy Orchestrator server and the database server with the most
current updates and patches.
Microsoft updates
MSI 3.1 The installation fails if using a version of MSI previous to MSI 3.1.
Database installation documented in this guide

The only database installation scenario described in detail is a first-time installation of SQL
Server 2005 Express. In this scenario, the ePolicy Orchestrator Setup installs both the ePolicy
Orchestrator software and the database on the same server. If the database is to be installed
on a different server from the ePolicy Orchestrator software, manual installation of SQL is
required on the remote server.
Other relevant database installations and upgrades
See the documentation provided by the database manufacturer for information about the
following installation scenarios:
• Installing SQL Server 2005 or 2008.
• Upgrading from MSDE 2000 to SQL Server 2005 or 2008.
• Upgrading from MSDE 2000 to SQL Server 2005 Express.
Nested triggers — The SQL Server Nested Triggers option must be enabled.
Database collation — The only database collation supported by ePolicy Orchestrator is the
U.S. English default: SQL_Latin1_General_Cp1_CI_AS.
Maintenance settings — McAfee recommends making specific maintenance settings to ePolicy
Orchestrator databases. For instructions, see Maintaining ePolicy Orchestrator databases in the
ePolicy Orchestrator 4.5 Help.

SQL Server
Dedicated server and network connection — Use a dedicated server and network connection
if managing more than 5,000 client computers.
Local database server — If using SQL Server on the same system as the ePolicy Orchestrator
server, McAfee recommends using a fixed memory size in Enterprise Manager that is
approximately two-thirds of the total memory for SQL Server. For example, if the computer has
1 GB of RAM, set 660 MB as the fixed memory size for SQL Server.

Pre-Installation
System requirements

SQL Server licenses — If using SQL Server, a SQL Server license is required for each processor
on the computer where SQL Server is installed.

CAUTION: If the minimum number of SQL Server licenses is not available after you install the
SQL Server software, you might have issues installing or starting the ePolicy Orchestrator
software.

Distributed repositories
Free disk space — 400 MB on the drive where the repository is stored.
NOTE: The disk space requirement for the distributed repositories on agents that are designated
as SuperAgents is equal to the disk space available for the master repository.
Memory — 256 MB minimum.

Possible hosts:
• HTTP-compliant servers on Microsoft Windows, Linux, or Novell NetWare operating systems
• Windows, Linux, or NetWare FTP servers
• Windows, Linux, or UNIX Samba UNC shares
• Computer with a SuperAgent installed on it


[NOTE; no more today, we will jump next stage tomorrow, now forget about it and go back as we were doing]

[metalmunna]

hi guys,

tomorrow we will start installing and i will do itl on a virtual server and will keep telling every error i will get on installation time and how to solve, there must have some error on 1st time installation. i think no one can complete the installation 1st time(if have no previous experience and fixing error before installation) without fixing some default error which comes for the default system settings on the server ......

Supported products and components by ePO 4.5

• McAfee Agent 4.0 for Email and Web Security
• McAfee Agent 4.0 for HP-UX
• McAfee Agent 4.0 for Linux
• McAfee Agent 4.0 for Macintosh
• McAfee Agent 4.0 for Solaris
• McAfee Agent 4.5
• McAfee Agent for Windows Patch 1 and Patch 2
• McAfee Common Management Agent 3.7 Patch 1
• McAfee Common Management Agent MA 3.6 Patch 4
• McAfee Data Loss Prevention 2.1 Patch 2
• McAfee Data Loss Prevention 2.2
• McAfee Data Loss Prevention 3.0
• McAfee Email and Web Security 5.1 Appliance
• McAfee Endpoint Encryption 5.2.1
• McAfee Endpoint Encryption 5.3
• McAfee Endpoint Encryption Files/Folders 3.1 (EEFF)
• McAfee Endpoint Encryption Files/Folders 4.x (EEFF)
• McAfee EndPoint Encryption for Mobile 3.0 (EEMO)
• McAfee Foundstone 6.5.3
• McAfee GroupShield for Domino 7.0
• McAfee GroupShield for Exchange 6.0.2 with SKE
Pre-Installation
Supported products and components
10 McAfee ePolicy Orchestrator 4.5 Installation Guide
• McAfee GroupShield for Exchange 7.0
• McAfee GroupShield for Exchange 7.0 SP 1
• McAfee Host Intrusion Prevention 6.1 Patch 3
• McAfee Host Intrusion Prevention 7.0 Patch 3
• McAfee Host Intrusion Prevention 7.1
• McAfee IntruShield 4.1
• McAfee IntruShield 5.1
• McAfee LinuxShield 1.5.1
• McAfee Network Access Control 3.1
• McAfee Policy Auditor 5.1 (Feyman)
• McAfee PortalShield 2.0 Patch 1
• McAfee Quarantine Manager 6.0
• McAfee Rogue System Detection 2.0 Patch 2
• McAfee Security for Lotus Domino Linux 7.5
• McAfee Security for Macintosh v1.0
• McAfee SiteAdvisor Enterprise 1.6
• McAfee SiteAdvisor Enterprise 2.0+
• McAfee SiteAdvisor Enterprise 3.0
• McAfee VirusScan 8.5i with McAfee AntiSpyware Enterprise
• McAfee VirusScan 8.7 with McAfee AntiSpyware Enterprise
• McAfee VirusScan 8.8 with McAfee AntiSpyware Enterprise (it's not added on the main list but as i test that on real world scenario so i know it's compatible with ePo 4.5 too.)
• McAfee VirusScan Advanced Server (NetApp)
• McAfee VirusScan Advanced Server (SAP)
• McAfee VirusScan Advanced Server (Virtualization)
• McAfee VirusScan for Macintosh 8.6.1
• Symantec SAV 10.x
• Symantec SAV 9.x
• USB Device 1.0 (EEV)
• Vdisk 4.1 (EEV)
• vDisk for Macintosh 1.0

[metalmunna]

lets work ...

just finished installation Windows Server 2008 R2(DataCenter) on Hyper-V. kept the IP 10.0.0.5 with default mask and join it on the domain controller.

as needed to install SQL server for the ePO 4.5, so lets install the SQL server first .. i choose the SQL server 2012 CP version for this time and lets see what will happen!!

damn god, SQL server check list failed and need to install dotnet 4 ... ok, doing ........ done. lets try again the SQL 2011, working now ... choosing Express with Advanced Service as the edition .... Please Note; the SQL Browser must be enabled nor you cannot complete the installation wizard when you will try to install ePO 4.5. so startup type of SQL Browser is Automatic.

now wait till the SQL Server installed ...

[metalmunna]

done, SQL installation, lets jump to install the ePO 4.5 ... just run the setup ...
 
1st installation error; "The 8.3 naming convention is required for installation. Click "OK" to cancel this installation and enable the 8.3 naming convention before proceeding."

lets fix it ...

Click Start, Run, type regedit and click OK.
Navigate to and select the following registry key:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]

In the right pane, right-click NtfsDisable8dot3NameCreation and select Properties.
Modify the Value data from 1 to 0.

NOTE: On Windows 2008 server the default value is 2 and will need to be changed to 0.[/size]

and restart the server ....