Configuring ePolicy Orchestrator;
The ePO server is the center of your managed environment, providing a single location from
which to administer system security throughout your network.
If your organization is very large or divided into multiple large sites, ePolicy Orchestrator 4.5
is scalable to allow you to customize how you set up your managed environment. You can:
• Install a separate ePO server at each site.
• Install remote Agent Handlers at each site, provided an ePO server is installed that you want
to communicate with.
The option you choose depends on the needs of your environment. Using remote agent handlers
allows you to reduce network traffic when managing agents and sending updates. Agent handlers
can also serve as distributed repositories. Remote agent handlers help to load balance your
network and increase fallback security, while passing all agent-server communication back to
your ePO server and its database.
Using multiple ePO servers differs from using remote agent handlers because each ePO server
maintains a separate database from which you can roll up information to your main ePO server
and database. Both choices can help to limit the amount of network traffic created within a
local LAN. Network traffic has a larger impact on your resources when this communication takes
place across WAN, VPN, or other slower network connections typically found between remote
sites.
Are you configuring the ePO server for the first time?When configuring the ePO server for the first time:
1 Decide how to implement the flexibility of permission sets.
2 Create user accounts and permission sets, and assign the permission sets to the user
accounts as needed.
3 Set up your contacts list and email server settings.
ePO user accounts;User accounts provide a means for users to access and use the software. They are associated
with permission sets, which define what users are allowed to do with the software.
You must create user accounts and permission sets to accommodate the needs of each user
that logs on to the ePO server. You can create accounts for individual users, or you can create
a permission set that maps to users or groups in your Active Directory/NT server.
There are two types of users, global administrators and users with limited permissions.
Global administrators;Global administrators have read and write permissions and rights to all operations. When you
install the server, a global administrator account is created with the user name admin.
You can create additional global administrator accounts for people who require global
administrator rights.
Permissions exclusive to global administrators include:
• Create, edit, and delete source and fallback sites.
• Change server settings.
• Add and delete user accounts.
• Add, delete, and assign permission sets.
• Import events into ePolicy Orchestrator databases and limit events that are stored there.
Creating user accounts;Use this task to create a user account. You must be a global administrator to add, edit, or delete
user accounts.
Task
For option definitions, click ? in the interface.
1 Click Menu | User Management | Users, then click New User. The New User page
appears.
2 Type a user name.
3 Select whether to enable or disable the logon status of this account. If this account is for
someone who is not yet a part of the organization, you might want to disable it.
4 Select whether the new account uses ePO authentication or Windows authentication,
and provide the required credentials.
5 Optionally, provide the user’s full name, email address, phone number, and a description
in the Notes text box.
6 Choose to make the user a global administrator, or select the appropriate permission sets
for the user.
7 Click Save to save the current entries and return to the Users tab. The new user should
appear in the Users list.
How permission sets work;A permission set is a group of permissions that can be granted to users or Active Directory (AD)
groups by assigning it to those users’ accounts. One or more permission sets can be assigned
to users who are not global administrators (global administrators have all permissions to all
products and features).
Permission sets only grant rights and access — no permission ever removes rights or access.
When multiple permission sets are applied to a user account, they aggregate. For example, if
one permission set does not provide any permissions to server tasks, but another permission
set applied to the same account grants all permissions to server tasks, that account has all
permissions to server tasks. Consider this as you plan your strategy for granting permissions
to the users in your environment.
When are permission sets assigned?Global administrators can assign existing permission sets when they create or edit user accounts
and when they create or edit permission sets.
What happens when I install new products?
When a new product extension is installed, it can add one or more groups of permissions to
the permission sets. For example, when you install a VirusScan Enterprise extension, a VirusScan
Enterprise section is added to each permission set. Initially, the newly added section is listed
in each permission set with no permissions yet granted. The global administrators can then
grant permissions to users through existing or new permission sets.
Default permission sets;
ePolicy Orchestrator 4.5 ships with four default permission sets that provide permissions to
ePolicy Orchestrator functionality. These are:
• Executive Reviewer — Provides view permissions to dashboards, events, contacts, and
can view information that relates to the entire System Tree.
• Global Reviewer — Provides view access globally across functionality, products, and the
System Tree, except for extensions, multi-server roll-up data, registered servers, and software.
• Group Admin — Provides view and change permissions across ePolicy Orchestrator features.
Users that are assigned this permission set each need at least one more permission set that
grants access to needed products and groups of the System Tree.
• Group Reviewer — Provides view permissions across ePolicy Orchestrator features. Users
that are assigned this permission set each need at least one more permission set that grants
access to needed products and groups of the System Tree.
Server settings and the behaviors they control;Various settings control how the ePO server behaves. You can change most settings at any
time. But, only global administrators can access the server settings.
Types of ePO server settings are:
• Dashboards — Specifies the default active dashboard that is assigned to new users’ accounts
at the time of account creation, if one has been defined.
• Detected System Compliance — Specifies the settings that affect how rogue systems in
your network are identified and treated.
• Detected System Exception Categories — Specifies the categories that can be used to
mark systems in your environment as exceptions.
• Detected System Matching — Specifies the settings used to match detected systems and
system interfaces.
• Detected System OUIs — Specifies how your OUI (Organizationally Unique Identifier) list
is updated, and when the last update occurred.
• Email Server — Specifies the email server that is used when ePolicy Orchestrator sends
email messages.
• Event Filtering — Specifies which events are forwarded by the agent.
• Event Notification — Specifies the interval at which you want ePO Notification Events to
be sent to Automatic Responses.
• Global Updating — Specifies whether and how global updating is enabled.
• License Key — Specifies the 25 digit license key you provide while installing ePolicy
Orchestrator, via the hyperlink from the Log On to ePO page to an Enter License Key page,
or via this Server Settings page. McAfee introduced license keys to help customers with
license usage tracking needs and to be compliant with McAfee licensing terms.
• MyAvert Security Threats — Specifies the update frequency for the MyAvert Security
Threats service. If proxy settings are entered in Proxy Settings, they are used while collecting
MyAvert security threats.
• Policy Maintenance — Specifies whether policies for unsupported products are visible or
hidden. This is needed only after ePolicy Orchestrator is upgraded to 4.5 from a previous version.
• Ports — Specifies the ports used by the server when it communicates with agents and the
database.
• Printing and exporting — Specifies how information is exported to other formats, and
the template for PDF exports. It also specifies the default location where the exported files
are stored.
• Proxy Settings — Specifies the type of proxy settings configured for your ePO server.
• Repository Packages — Specifies whether any package can be checked in to any branch.
Only agents later then version 3.6 can retrieve packages other than updates from branches
other than Current.
• Rogue System Sensor — Specifies the settings that define behavior for Rogue System
Sensors in your network.
• Security Keys — Specifies and manages the agent-server secure communication keys, and
repository keys.
• Server Certificate — Specifies the server certificate that your ePO server uses for HTTPS
communication with browsers.
• System Tree Sorting — Specifies whether and how System Tree sorting is enabled in your
environment.
• User Auto Creation — Specifies whether ePO users are automatically created upon logon,
based on AD (Active Directory) user profiles.
• Windows Authentication — Specifies the domain name and Active Directory servers
configured. This is also used for user authentication. For example, Windows Authentication
is used to determine if the password entered should allow the user to log on to ePolicy
Orchestrator.
• Windows Authorization — Specifies the domain name and Active Directory servers
configured for use with this ePO server. This is used while dynamically assigning permissions
to the users who have logged on to ePolicy Orchestrator.
Enabling user autocreation;Use this task to enable user autocreation, which creates ePO user account records for Active
Directory users when they first log on.
Before you begin;Configure the following prerequisites before enabling User Auto Creation,
1 Register the LDAP server containing the user accounts with your ePO server.
NOTE: ePO 4.5 supports only Windows LDAP servers.
2 Edit Windows Authorization settings to map the corresponding domain and the registered
LDAP server.
NOTE: If the LDAP server is on a different domain, then specify the corresponding domain
controller on the Windows Authentication settings. For more information on editing windows
authentication settings, see Configuring Windows authentication section.
3 Create a new permission set and map the Active Directory groups.
NOTE: Permission sets are assigned to users based on the Active Directory groups mapped
to it. For example, User1 is a member of Group1 and Group2. P1 and P2 are permission
sets mapped to Group1 and Group2 respectively. In this case, User1 will have a combined
permissions of P1 and P2 to the ePO server.
4 Add users to be created to the Active Directory group.
Total Members: 14197
