SEP User Guide

Symantec EndpointProtection IntegrationComponent 7.5 User Guide

Symantec Endpoint Protection IntegrationComponent 7.5 User Guide

The software described in this book is furnished under a license agreement and may be usedonly in accordance with the terms of the agreement.

Legal NoticeCopyright 2013 Symantec Corporation. All rights reserved.

Symantec, the Symantec Logo, the Checkmark Logo, Altiris, and any Altiris or Symantectrademarks used in the product are trademarks or registered trademarks of SymantecCorporation or its affiliates in the U.S. and other countries. Other names may be trademarksof their respective owners.

This Symantec product may contain third party software for which Symantec is required toprovide attribution to the third party (Third Party Programs). Some of the Third Party Programsare available under open source or free software licenses. The License Agreementaccompanying the Licensed Software does not alter any rights or obligations you may haveunder those open source or free software licenses. For more information on the Third PartyPrograms, please see the Third Party Notice document for this Symantec product that maybe available at http://www.symantec.com/about/profile/policies/eulas/, the Third Party LegalNotice Appendix that may be included with this Documentation and/or Third Party Legal NoticeReadMe File that may accompany this Symantec product.

The product described in this document is distributed under licenses restricting its use, copying,distribution, and decompilation/reverse engineering. No part of this document may bereproduced in any form by any means without prior written authorization of SymantecCorporation and its licensors, if any.

THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIEDCONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIEDWARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE ORNON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCHDISCLAIMERSAREHELD TOBE LEGALLY INVALID. SYMANTECCORPORATIONSHALLNOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTIONWITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THEINFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGEWITHOUT NOTICE.

The Licensed Software and Documentation are deemed to be commercial computer softwareas defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19"Commercial Computer Software - Restricted Rights" and DFARS 227.7202, "Rights inCommercial Computer Software or Commercial Computer Software Documentation", asapplicable, and any successor regulations. Any use, modification, reproduction release,performance, display or disclosure of the Licensed Software and Documentation by the U.S.Government shall be solely in accordance with the terms of this Agreement.

Symantec Corporation350 Ellis StreetMountain View, CA 94043

http://www.symantec.com

Technical SupportSymantec Technical Support maintains support centers globally. Technical Supportsprimary role is to respond to specific queries about product features and functionality.The Technical Support group also creates content for our online Knowledge Base.The Technical Support group works collaboratively with the other functional areaswithin Symantec to answer your questions in a timely fashion. For example, theTechnical Support group works with Product Engineering and Symantec SecurityResponse to provide alerting services and virus definition updates.

Symantecs support offerings include the following:

A range of support options that give you the flexibility to select the right amountof service for any size organization

Telephone and/or Web-based support that provides rapid response andup-to-the-minute information

Upgrade assurance that delivers software upgrades

Global support purchased on a regional business hours or 24 hours a day, 7days a week basis

Premium service offerings that include Account Management Services

For information about Symantecs support offerings, you can visit our website atthe following URL:

www.symantec.com/business/support/

All support services will be delivered in accordance with your support agreementand the then-current enterprise technical support policy.

Contacting Technical SupportCustomers with a current support agreement may access Technical Supportinformation at the following URL:


Before contacting Technical Support, make sure you have satisfied the systemrequirements that are listed in your product documentation. Also, you should be atthe computer on which the problem occurred, in case it is necessary to replicatethe problem.

When you contact Technical Support, please have the following informationavailable:

Product release level

Hardware information

Available memory, disk space, and NIC information

Operating system

Version and patch level

Network topology

Router, gateway, and IP address information

Problem description:

Error messages and log files

Troubleshooting that was performed before contacting Symantec

Recent software configuration changes and network changes

Licensing and registrationIf your Symantec product requires registration or a license key, access our technicalsupport Web page at the following URL:


Customer serviceCustomer service information is available at the following URL:


Customer Service is available to assist with non-technical questions, such as thefollowing types of issues:

Questions regarding product licensing or serialization

Product registration updates, such as address or name changes

General product information (features, language availability, local dealers)

Latest information about product updates and upgrades

Information about upgrade assurance and support contracts

Information about the Symantec Buying Programs

Advice about Symantec's technical support options

Nontechnical presales questions

Issues that are related to CD-ROMs, DVDs, or manuals

Support agreement resourcesIf you want to contact Symantec regarding an existing support agreement, pleasecontact the support agreement administration team for your region as follows:

[email protected] and Japan

[email protected], Middle-East, and Africa

[email protected] America and Latin America

Technical Support ............................................................................................... 4

Chapter 1 Introducing Symantec Endpoint ProtectionIntegration Component ................................................. 9

About Endpoint Protection Integration Component ................................ 9System requirements ................................................................... 10What you can do with Symantec Endpoint Protection Integration

Component ........................................................................... 10Components of Symantec Endpoint Protection Integration

Component ........................................................................... 12About Endpoint Protection Integration Component resource

filters ................................................................................... 13Where to get more information ........................................................ 13

Chapter 2 Getting Startedwith Symantec Endpoint ProtectionIntegration Component ................................................ 16

Getting started with Symantec Endpoint Protection Management ........... 16About Antivirus Inventory ............................................................... 19Running an antivirus inventory ........................................................ 21Creating Symantec Endpoint Protection client installation

packages .............................................................................. 21Migrating computers to the latest Symantec Endpoint Protection

client .................................................................................... 22Viewing computers on which the Symantec Endpoint Protection client

rollout task has failed .............................................................. 24Running a full scan for viruses and security risks ................................ 24

Chapter 3 Completing jobs and taskswith Symantec EndpointProtection Integration Component ........................... 26

About tasks for Endpoint Protection Integration Component .................. 27Types of tasks for Symantec Endpoint Protection Integration

Component ........................................................................... 27Installing Symantec Endpoint Protection clients remotely ...................... 29Uninstalling antivirus software remotely ............................................. 30

Contents

Running a Quick Scan for viruses and security risks ............................ 31Repairing Symantec Endpoint Protection clients ................................. 32Updating the content of Symantec Endpoint Protection clients ............... 32Using power sensitive malware scanning .......................................... 33Using the remote SERT boot and repair task ...................................... 34Configuring a connection profile for Endpoint Protection Integration

Component tasks ................................................................... 36

Chapter 4 Viewing Symantec Endpoint Protection IntegrationComponent Reports ..................................................... 38

About reports for Endpoint Protection Integration Component ................ 38Symantec Endpoint Protection Integration Component reports ............... 39Viewing the status of Symantec Management Agent installations ........... 40Viewing summaries of the antivirus versions that are installed in your

environment .......................................................................... 40Viewing computers on which the Symantec Endpoint Protection client

rollout is successful ................................................................. 41Viewing computers on which Tamper Protection is detected and

enabled ................................................................................ 41Viewing your unmanaged computers that are discovered ...................... 42

Index .................................................................................................................... 43

8Contents

Introducing SymantecEndpoint ProtectionIntegration Component

This chapter includes the following topics:

About Endpoint Protection Integration Component

System requirements

What you can do with Symantec Endpoint Protection Integration Component

Components of Symantec Endpoint Protection Integration Component

About Endpoint Protection Integration Component resource filters

Where to get more information

About Endpoint Protection Integration ComponentThe Symantec Endpoint Protection Integration Component combines SymantecEndpoint Protection with your other Symantec Management Platform solutions.You can inventory computers, update patches, deliver software, and deploy newcomputers. You can also back up and restore your systems and data, manage DLPagents, manage Symantec Endpoint Protection clients. You can do this work froma single, Web-based Symantec Management Console.

You can perform common Symantec Endpoint Protection client managementoperations from the Symantec Management Console.

See What you can do with Symantec Endpoint Protection Integration Componenton page 10.

1Chapter

System requirementsEndpoint Protection Integration Component requires the following software to beinstalled:

Symantec Management Platform 7.1SP2.When you install Endpoint Protection Integration Component using SymantecInstallation Manager, the Symantec Management Platform is installedautomatically.

Symantec-Real Time Console Infrastructure 7.1 SP2.

The operating systems that are supported by the Symantec Management Platformare also supported by Endpoint Protection Integration Component.

For more information, see the product support matrix at the following URL:http://www.symantec.com/docs/HOWTO9965

What you can do with Symantec Endpoint ProtectionIntegration Component

Symantec Endpoint Protection Integration Component lets you perform commonSymantec Endpoint Protection client management operations from the SymantecManagement Console.

Specifically, Symantec Endpoint Protection Integration Component lets you performthe following tasks:

Run an Antivirus Inventory.See Running an antivirus inventory on page 21.

View summaries of the antivirus software that is installed in your environment.See Viewing summaries of the antivirus versions that are installed in yourenvironment on page 40.

Uninstall antivirus software remotely.See Uninstalling antivirus software remotely on page 30.

Create Symantec Endpoint Protection client installation packages.See Creating Symantec Endpoint Protection client installation packageson page 21.

Install Symantec Endpoint Protection clients remotely.See Installing Symantec Endpoint Protection clients remotely on page 29.

View computers on which Symantec Endpoint Protection client rollouts aresuccessful.

10Introducing Symantec Endpoint Protection Integration ComponentSystem requirements

See Viewing computers on which the Symantec Endpoint Protection clientrollout is successful on page 41.

View computers on which Symantec Endpoint Protection client rollout has failed.See Viewing computers on which the Symantec Endpoint Protection clientrollout is successful on page 41.

Repair Symantec Endpoint Protection clients.See Repairing Symantec Endpoint Protection clients on page 32.

Repair and reboot remote client computers using SERTSee Using the remote SERT boot and repair task on page 34.

Perform power-sensitive malware scanningSee Using power sensitive malware scanning on page 33.

Migrate computers to the latest Symantec Endpoint Protection client.See Migrating computers to the latest Symantec Endpoint Protection clienton page 22.

Update the content of Symantec Endpoint Protection clients.See Updating the content of Symantec Endpoint Protection clients on page 32.

View computers on which Tamper Protection is detected and enabled.See Viewing computers on which Tamper Protection is detected and enabledon page 41.

Run Quick Scans for viruses and security risks.See Running a Quick Scan for viruses and security risks on page 31.

Run Full Scans for viruses and security risks.See Running a full scan for viruses and security risks on page 24.

View your unmanaged computers that are discovered.See Viewing your unmanaged computers that are discovered on page 42.

View the status of Symantec Management Agent installations.See Viewing the status of Symantec Management Agent installationson page 40.

See About Endpoint Protection Integration Component on page 9.

See Getting started with Symantec Endpoint Protection Management on page 16.

11Introducing Symantec Endpoint Protection Integration ComponentWhat you can do with Symantec Endpoint Protection Integration Component

Components of Symantec Endpoint ProtectionIntegration Component

This section describes the components that Symantec Endpoint ProtectionIntegration Component works with.

Table 1-1 Components of Symantec Endpoint Protection IntegrationComponent

DescriptionComponent

Symantec Management Platform installs andmanages the Symantec Management Agenton client computers, and it manages yourConfiguration Management Database.

Symantec Management Platform with SQLServer database

The Symantec Management Console is theinterface for the Symantec ManagementPlatform and is automatically installed withthe platform.

Symantec Management Console

Symantec Endpoint Protection IntegrationComponent lets you perform commonSymantec Endpoint Protection clientmanagement tasks from the SymantecManagement Console.

Symantec Endpoint Protection IntegrationComponent

Symantec Endpoint Protection IntegrationComponent uses Task Server for tasksequencing and automation of its tasks. TaskServer is automatically installed with theSymantec Management Platform.

Task Server

To use the Symantec Management Platformwith Windows client computers, you mustinstall the Symantec Management Agent onthem. To run Symantec Endpoint Protectiontasks from the Symantec ManagementConsole, the client computers must have theSymantec Management Agent installed.Following the installation of the SymantecManagement Platform, you can install theagent on your client computers.

Symantec Management Agent (installed onclient computers)

12Introducing Symantec Endpoint Protection Integration ComponentComponents of Symantec Endpoint Protection Integration Component

Table 1-1 Components of Symantec Endpoint Protection IntegrationComponent (continued)

DescriptionComponent

The Symantec Endpoint Protection clientsoftware is installed on client computers. Itlets Symantec Endpoint Protection Managersecure your environment. You can managethe Symantec Endpoint Protection client fromthe Symantec Management Console byinstalling Symantec Endpoint ProtectionIntegration Component.

Symantec Endpoint Protection client (installedon client computers)

The Symantec Management Platformincludes Task Server to run managementtasks in sequence. Symantec EndpointProtection Integration Component requiresthat two Task Server agents are installed onyour client computers. Following theinstallation of Symantec Endpoint ProtectionIntegration Component, you must install theClient Task Agent and the Script Task Agenton your client computers.

Client Task Agent and Script Task Agent(installed on client computers)


About Endpoint Protection Integration Componentresource filters

The Symantec Management Platform lets you organize your computer resourcesinto groups. These groups are called resource filters.

Computer resources are automatically organized into filters. Symantec EndpointProtection Integration Component automatically adds each client computer to itsapplicable filter.

For more information, see topics about resource filters in theSymantecManagementPlatform User Guide.

Where to get more informationUse the following documentation resources to learn about and use this product.

13Introducing Symantec Endpoint Protection Integration ComponentAbout Endpoint Protection Integration Component resource filters

Table 1-2 Documentation resources

LocationDescriptionDocument

The Supported Products A-Z page, which is available at the followingURL:

http://www.symantec.com/business/support/index?page=products

Open your product's support page, and then under Common Topics,click Release Notes.

Information about newfeatures and importantissues.

Release Notes

The Documentation Library, which is available in the SymantecManagement Console on the Help menu.

The Supported Products A-Z page, which is available at thefollowing URL:http://www.symantec.com/business/support/index?page=productsOpen your product's support page, and then underCommon Topics,click Documentation.

Information about how touse this product,including detailedtechnical information andinstructions forperforming commontasks.

User Guide

The Documentation Library, which is available in the SymantecManagement Console on the Help menu.

Context-sensitive help is available for most screens in the SymantecManagement Console.

You can open context-sensitive help in the following ways:

Click the page and then press the F1 key.

Use the Context command, which is available in the SymantecManagement Console on the Help menu.

Information about how touse this product,including detailedtechnical information andinstructions forperforming commontasks.

Help is available at thesolution level and at thesuite level.

This information isavailable in HTML helpformat.

Help

In addition to the product documentation, you can use the following resources tolearn about Symantec products.

Table 1-3 Symantec product information resources

LocationDescriptionResource

http://www.symantec.com/business/theme.jsp?themeid=support-knowledgebaseArticles, incidents, andissues about Symantecproducts.

SymWISESupportKnowledgebase

14Introducing Symantec Endpoint Protection Integration ComponentWhere to get more information

Table 1-3 Symantec product information resources (continued)

LocationDescriptionResource

http://www.symantec.com/connect/endpoint-management/forums/endpoint-management-documentation

Here is the list of links to various groups on Connect:

Deployment and Imaginghttp://www.symantec.com/connect/groups/deployment-and-imaging

Discovery and Inventoryhttp://www.symantec.com/connect/groups/discovery-and-inventory

ITMS Administratorhttp://www.symantec.com/connect/groups/itms-administrator

Mac Managementhttp://www.symantec.com/connect/groups/mac-management

Monitor Solution and Server Healthhttp://www.symantec.com/connect/groups/monitor-solution-and-server-health

Patch Managementhttp://www.symantec.com/connect/groups/patch-management

Reportinghttp://www.symantec.com/connect/groups/reporting

ServiceDesk and Workflowhttp://www.symantec.com/connect/workflow-servicedesk

Software Managementhttp://www.symantec.com/connect/groups/software-management

Server Managementhttp://www.symantec.com/connect/groups/server-management

Workspace Virtualization and Streaminghttp://www.symantec.com/connect/groups/workspace-virtualization-and-streaming

An online resource thatcontains forums, articles,blogs, downloads,events, videos, groups,and ideas for users ofSymantec products.

SymantecConnect

15Introducing Symantec Endpoint Protection Integration ComponentWhere to get more information

Getting Started withSymantec EndpointProtection IntegrationComponent


Getting started with Symantec Endpoint Protection Management

About Antivirus Inventory

Running an antivirus inventory

Creating Symantec Endpoint Protection client installation packages

Migrating computers to the latest Symantec Endpoint Protection client

Viewing computers on which the Symantec Endpoint Protection client rollouttask has failed

Running a full scan for viruses and security risks

Getting started with Symantec Endpoint ProtectionManagement

Symantec Endpoint Protection Management includes a Quick Start tool to help youget started. The quick start tool is located on the Symantec Endpoint ProtectionManagement portal page.

2Chapter


To get started with Symantec Endpoint Protection Management

1 In the Symantec Management Console, on the Home menu, click SymantecEndpoint Protection Management.

2 Using the Quick Start page, complete the following steps:

Table 2-1 Process for getting started with Symantec Endpoint ProtectionManagement

DescriptionActionStep

Before you canmanage computers, youmust complete the following tasks:

Discover the computers on yournetwork.

Create resources for them in theCMDB.

This process is called discovery and letsyou discover the computers on whichyou can install the SymantecManagement Agent and various solutionagent/plug-ins.

You can import all computers that areregistered in your Microsoft ActiveDirectory. You can choose to import onlya subset of your computers that matchthe criteria you specify.

You can also discover Windowscomputers with resource discovery .

For more information, see topics aboutdiscovering Windows computers in theSymantec Management Platform UserGuide.

Import Microsoft Active Directory.Step 1

17Getting Started with Symantec Endpoint Protection Integration ComponentGetting started with Symantec Endpoint Protection Management

Table 2-1 Process for getting started with Symantec Endpoint ProtectionManagement (continued)


The Symantec Management Agent isthe software that is installed on acomputer to enable the NotificationServer computer to monitor andmanageit.

To manage your computers with theSymantec Management Platform, youmust first install the SymantecManagement Agent on them.

For more information, see topics aboutinstalling the Symantec ManagementAgent in the Symantec ManagementPlatform User Guide.

Install the Symantec ManagementAgent.

Step 2

The antivirus inventory task checks yourmanaged computers for the known typesof antivirus software. Antivirus inventoryalso retrieves information aboutcomputers with tamper protectionenabled. Antivirus inventory can alsoretrieve details about the version ofSymantec Endpoint Protection virusdefinitions.

See Running an antivirus inventoryon page 21.

Run antivirus inventory.Step 3

Before you can remotely migrate andinstall the Symantec Endpoint Protectionclient on your managed computers, youmust first configure the installationpackage. You must configure theinstallation package locally on theNotification Server computer.

See Creating Symantec EndpointProtection client installation packageson page 21.

Configure Endpoint Protectionpackages.

Step 4

18Getting Started with Symantec Endpoint Protection Integration ComponentGetting started with Symantec Endpoint Protection Management

Table 2-1 Process for getting started with Symantec Endpoint ProtectionManagement (continued)


The migration job uninstalls any existingantivirus software, and then it installs anew Symantec Endpoint Protectionclient on the computers that you specify.

See Migrating computers to the latestSymantec Endpoint Protection clienton page 22.

Run migration job.Step 5

You can view a list of the computers thatthe Symantec Endpoint Protection clientrollout task has failed to run on.

See Viewing computers on which theSymantec Endpoint Protection clientrollout task has failed on page 24.

View computers on which theSymantec Endpoint Protectionclient rollout task has failed.

Step 6

You can run a full scan for viruses andsecurity risks on the computers that youspecify.

See Running a full scan for viruses andsecurity risks on page 24.

Run Full Scan Task.Step 7


See Components of Symantec Endpoint Protection Integration Componenton page 12.

About Antivirus InventorySymantec Endpoint Protection Integration Component lets you deploy andmanageyour Symantec Endpoint Protection clients from the SymantecManagement Console.Symantec Endpoint Protection Integration Component includes a feature calledAntivirus Inventory. When Antivirus Inventory is run, it searches for common typesof antivirus software. If a recognized type of antivirus is located on a managedcomputer, this data is stored for reporting purposes. This data is also reflected inthe Antivirus Version Summary pie-chart and the Antivirus Summary report on theSymantec Endpoint Protection Home page.

Antivirus Inventory can also identify computers with tamper protection enabled. Ifthe feature tamper protection is enabled on a computer, the computer is displayed

19Getting Started with Symantec Endpoint Protection Integration ComponentAbout Antivirus Inventory

in the following report: Computers on which tamper protection is detected andenabled.

See Viewing computers on which Tamper Protection is detected and enabledon page 41.

If computers have a recognized type of antivirus, the antivirus software is firstremoved before your Symantec Endpoint Protection client package is installed.This functionality occurs if you apply the following tasks:

Migrate computers to latest Symantec Endpoint Protection client.

Install Symantec Endpoint Protection client.

Uninstall antivirus.

See Migrating computers to the latest Symantec Endpoint Protection clienton page 22.

See Installing Symantec Endpoint Protection clients remotely on page 29.

See Uninstalling antivirus software remotely on page 30.

Symantec Endpoint Protection Integration Component can remove the followingsoftware from your managed computers:

CA Anti-Virus for Enterprise

CA eTrust Threat Management Agent

ESET

F-Secure Anti-Virus for Windows Servers

Kaspersky Antivirus

Trend MICRO OfficeScan

McAfee Virus Scan Enterprise

McAfee Virus Scan Enterprise

Sophos Anti-Virus

Sophos Endpoint Security and Control

Symantec Anti Virus

Symantec Endpoint Protection

Symantec Endpoint Protection Small Business Enterprise Edition

See Running an antivirus inventory on page 21.

20Getting Started with Symantec Endpoint Protection Integration ComponentAbout Antivirus Inventory

Running an antivirus inventoryYou can run an inventory of the antivirus software that is installed on your managedcomputers. Running an antivirus inventory can help you to determine which groupsof computers may be vulnerable. You can then migrate these computers to havethe latest version of Symantec Endpoint Protection client installed.

See About Antivirus Inventory on page 19.

You can create an inventory by scheduling the antivirus inventory task to run onthe groups of computers that you specify. The inventory information is displayed inthe Antivirus Version summaryWeb part after you run the antivirus inventorytask.

Running the antivirus inventory on a regular basis is a good practice to continuetracking the installed version of Symantec Endpoint Protection. This practice helpyou identify computers in your environment that need to be migrated.

To run an antivirus inventory

1 In the Symantec Management Console, on theManagemenu, click Jobs andTasks.

2 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint Protection Management > Antivirus inventory.

3 On the Antivirus inventory page, Click New Schedule to schedule the taskand to define the computers that you want to run the antivirus inventory taskon.

For more information, see topics about using tasks in the SymantecManagement Platform User Guide.

4 On the New Schedule page, click Schedule.

The status of your task is displayed under Task Status.


See Types of tasks for Symantec Endpoint Protection Integration Componenton page 27.

Creating Symantec Endpoint Protection clientinstallation packages

You must create a Symantec Endpoint Protection client package before you caninstall and migrate Symantec Endpoint Protection clients from the SymantecManagement Console. You must upload the Symantec Endpoint Protection clientSETUP.EXE file into the Symantec Management Platform. The Symantec

21Getting Started with Symantec Endpoint Protection Integration ComponentRunning an antivirus inventory

Management Platform creates a software package that you can roll out usingSoftware Management Framework packaging features.

For more information, see topics about configuring packages in the SymantecManagement Platform User Guide.


Note: This task must be performed locally on your Notification Server computer.

To create a Symantec Endpoint Protection client package

1 In the Symantec Management Console, on the Settings menu, click AllSettings.

2 In the left pane, click Settings > Software > Symantec Endpoint Protection> Client Package Configuration.

3 On the Client Package Configuration page, under Symantec EndpointProtection Packages, click New.

4 On the Create Symantec Endpoint Protection Client Package page,complete the following options:

The type of computers that you intend thepackage to run on; either 32-bit or 64-bit.

Symantec Endpoint Protection PackageType

The name of the installation package. Thepackage name must be a valid Windowsfolder name because a folder is createdon the Notification Server computer usingthis name.

Package Name

The location of the Symantec EndpointProtection client SETUP.EXE file. TheSETUP.EXE file must be stored locally onthe Notification Server computer.

Symantec Endpoint Protection SetupFile

5 Click OK.

Migrating computers to the latest Symantec EndpointProtection client

You can migrate your managed computers to the latest version of SymantecEndpoint Protection client. To accomplish this goal you run an antivirus softwaremigration job. The migration job stages the new installer on the client computers,

22Getting Started with Symantec Endpoint Protection Integration ComponentMigrating computers to the latest Symantec Endpoint Protection client

it then uninstalls existing antivirus software. The job then installs a new SymantecEndpoint Protection client on the computers that you specify.


Note: You must create at least one Symantec Endpoint Protection client softwarepackage before you can use this job.

See Creating Symantec Endpoint Protection client installation packageson page 21.

To migrate computers to the latest Symantec Endpoint Protection client


2 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint Protection Management, right-click, and then click New > Task.

3 In the Create New Task page, in the left pane, click Symantec EndpointProtectionManagement >Migrate computers to latest Symantec EndpointProtection Client.

4 In theCreate New Task page, in the right pane, complete the following options:

Name of the job.Name

Description of the job.Description

The software package that contains theSymantec Endpoint Protection clientSETUP.EXE file.

Package

Forces the target computers to restart afterthe previous antivirus version is removed.

See Creating Symantec EndpointProtection client installation packageson page 21.

Restart After Old Antivirus Uninstall

Forces the target computers to restart afterthe Symantec Endpoint Protection client isinstalled.

Restart After Endpoint Protection Install

5 Click Ok.


23Getting Started with Symantec Endpoint Protection Integration ComponentMigrating computers to the latest Symantec Endpoint Protection client

7 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint Protection Managment, and then click your job.

8 In the right pane, click New Schedule to schedule the task and to define thecomputers that you want to run the antivirus inventory task on.

For more information, see topics about using tasks in the IT Management Suite7.5 powered by Altiris technology Administration Guide.


The status of your job is displayed under Task Status.


Viewing computers on which the Symantec EndpointProtection client rollout task has failed

You can view reports on the computers that the Symantec Endpoint Protectionclient rollout task has failed to run on.

To view computers on which the Symantec Endpoint Protection client rollout taskhas failed

1 In the Symantec Management Console, on the Reports menu, click AllReports.

2 In the left pane, clickReports > Symantec Endpoint ProtectionManagement> Computers on which Symantec Endpoint Protection Client rollout taskhas failed.

3 On the Computers on which Symantec Endpoint Protection Client rollouttask has failed page, in the right pane, view the report.

For more information, see topics about using reports in the SymantecManagement Platform User Guide.

See Symantec Endpoint Protection Integration Component reports on page 39.


Running a full scan for viruses and security risksYou can use the Symantec Management Platform to remotely run full scans forviruses and security risks on the computers that you specify.


24Getting Started with Symantec Endpoint Protection Integration ComponentViewing computers on which the Symantec Endpoint Protection client rollout task has failed

To run a full scan for viruses and security risks


2 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint Protection Management > Full scan for viruses and securityrisks.

3 In the right pane, click New Schedule to schedule the task and to define thecomputers on which you want to run the antivirus inventory task.

For more information, see topics about Using Tasks in the SymantecManagement Platform User Guide.




25Getting Started with Symantec Endpoint Protection Integration ComponentRunning a full scan for viruses and security risks

Completing jobs and taskswith Symantec EndpointProtection IntegrationComponent


About tasks for Endpoint Protection Integration Component

Types of tasks for Symantec Endpoint Protection Integration Component

Installing Symantec Endpoint Protection clients remotely

Uninstalling antivirus software remotely

Running a Quick Scan for viruses and security risks

Repairing Symantec Endpoint Protection clients

Updating the content of Symantec Endpoint Protection clients

Using power sensitive malware scanning

Using the remote SERT boot and repair task

Configuring a connection profile for Endpoint Protection Integration Componenttasks

3Chapter

About tasks for Endpoint Protection IntegrationComponent

Symantec Endpoint Protection Integration Component provides several predefinedtasks that you can use to manage your Symantec Endpoint Protection clients. Youcan execute these tasks on the groups of computers that you organize with filters.

For more information, see topics about task management in the SymantecManagement Platform User Guide.

Symantec Endpoint Protection Integration Component includes the following tasks:

Antivirus inventory.

Full Scan of viruses and security risks.

Install Symantec Endpoint Protection client.

Migrate computers to latest Symantec Endpoint Protection client.

Quick Scan of viruses and security risks.

Power sensitive malware scanning.

Using the remote SERT boot and repair task

Repair Symantec Endpoint Protection client.

Uninstall antivirus.

Update content of Symantec Endpoint Protection client.


Types of tasks for Symantec Endpoint ProtectionIntegration Component

Symantec Endpoint Protection Integration Component includes several tasks. Youcan use tasks to manage your Symantec Endpoint Protection clients and to protectyour environment against viruses and security risks.

For more information see topics about task management in the SymantecManagement Platform User Guide.

27Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentAbout tasks for Endpoint Protection Integration Component

Table 3-1 Tasks of Symantec Endpoint Protection Integration Component

DescriptionTask

Creates an inventory of the antivirus software that isinstalled on the computers that you specify.

See Running an antivirus inventory on page 21.

Antivirus inventory

Runs a full scan for viruses and security risks on thecomputers that you specify.

See Running a full scan for viruses and security riskson page 24.

Full Scan of viruses and securityrisks

Installs a new Symantec Endpoint Protection client onthe computers that you specify

See Installing Symantec Endpoint Protection clientsremotely on page 29.

Install Symantec EndpointProtection client

Stages a new Symantec Endpoint Protection client ,then uninstalls the previous antivirus software. The taskthen installs a new Symantec Endpoint Protection clienton the computers that you specify.

See Migrating computers to the latest SymantecEndpoint Protection client on page 22.

Migrate computers to latestSymantec Endpoint Protectionclient

This power sensitive malware scanning job lets you turnon one or multiple systems withWake-on-LAN and IntelvPro technologies. You can then update the content ofSymantec Endpoint Protection clients and run a scanfor viruses and security risks. The computers are thenturned off after these tasks are completed.

See Using power sensitive malware scanningon page 33.

Power sensitive malwarescanning

Runs a Quick Scan for viruses and security risks on thecomputers that you specify.

See Running a Quick Scan for viruses and securityrisks on page 31.

Quick scan of viruses andsecurity risks

This task lets you boot a remote Intel AMT enabled clientcomputer. The bootable image contains the SymantecEndpoint Recovery Tool (SERT) to repair the clientcomputer.

See Using the remote SERT boot and repair taskon page 34.

Remote SERT boot and repair

28Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentTypes of tasks for Symantec Endpoint Protection Integration Component

Table 3-1 Tasks of Symantec Endpoint Protection Integration Component(continued)

DescriptionTask

Repairs the Symantec Endpoint Protection client on thecomputers that you specify.

See Repairing Symantec Endpoint Protection clientson page 32.

Repair Symantec EndpointProtection client

Uninstalls any existing antivirus software on thecomputers that you specify.

See Uninstalling antivirus software remotelyon page 30.

Uninstall antivirus

Updates the Symantec Endpoint Protection clientcontent on the computers that you specify.

See Updating the content of Symantec EndpointProtection clients on page 32.

Update content of SymantecEndpoint Protection client

See About tasks for Endpoint Protection Integration Component on page 27.

Installing Symantec Endpoint Protection clientsremotely

You can use the SymantecManagement Platform to remotely install new SymantecEndpoint Protection clients on the computers that you specify.

You can also use this task to roll out Symantec Endpoint Protection updated files.

Note: You must create at least one Symantec Endpoint Protection client softwarepackage before you can use this task.

See Creating Symantec Endpoint Protection client installation packageson page 21.

To install the Symantec Endpoint Protection client remotely


2 In the left pane, expand Jobs and Tasks > System Jobs and Tasks right-clickSymantec Endpoint Protection Management, and then click New > Job orTask.

29Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentInstalling Symantec Endpoint Protection clients remotely

3 In the Create New Task dialog box, in the left pane, click Symantec EndpointProtection Management > Install Symantec Endpoint Protection Client.

4 In the Create New Task dialog box, in the right pane, complete the followingoptions:

DescriptionOption

The name of the package.Name

The software package that contains the SymantecEndpoint Protection client SETUP.EXE file.

See Creating Symantec Endpoint Protection clientinstallation packages on page 21.

Package

5 Click OK.


In the left pane, expand Jobs and Tasks > System Jobs and Tasks >Symantec Endpoint Protection Managment, and then click your task.


For more information, see topics about Using Tasks in the IT ManagementSuite 7.5 powered by Altiris technology Administration Guide.

8 In the New Schedule page, click Schedule.



Uninstalling antivirus software remotelyYou can use the Symantec Management Platform to uninstall existing antivirussoftware on the computers that you specify.

To uninstall antivirus software remotely


2 In the left pane, click Jobs and Tasks > System Jobs and Tasks right-clickSymantec Endpoint Protection Management, and then click New > Job orTask.

30Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentUninstalling antivirus software remotely

3 In the Create New Task page, in the left pane, click Symantec EndpointProtection Management > Uninstall Antivirus.

4 In the Create New Task page, enter a name for the task.

5 Click OK.

6 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint Protection Managment, and then click your task.


For more information, see topics about using tasks in the IT Management Suite7.5 powered by Altiris technology Administration Guide.

8 In the New Schedule page, click Schedule.



Running a Quick Scan for viruses and security risksYou can use the Symantec Management Platform to remotely run quick scans forviruses and security risks on the computers that you specify.


To run a Quick Scan for viruses security risks


2 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint Protection Management > Quick scan for viruses and securityrisks.





31Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentRunning a Quick Scan for viruses and security risks

Repairing Symantec Endpoint Protection clientsYou can use the Symantec Management Platform to remotely repair the SymantecEndpoint Protection client on the computers that you specify.

To repair Symantec Endpoint Protection clients


2 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint ProtectionManagement > Repair Symantec Endpoint ProtectionClient.






Updating the content of Symantec EndpointProtection clients

You can use the Symantec Management Platform to remotely update the SymantecEndpoint Protection client content on the computers that you specify. When thecontent is updated, the Symantec Endpoint Protection client is forced to updatefrom the source for which it is configured: either Symantec Endpoint ProtectionManager or the Internet.

To update the content of Symantec Endpoint Protection clients


2 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint ProtectionManagement > Update Content of Symantec EndpointProtection Management Client.

32Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentRepairing Symantec Endpoint Protection clients






Using power sensitive malware scanningThis power sensitive malware scanning job lets you turn on one or multiple systemswith Wake-on-LAN and Intel vPro technologies. You can then update the contentof Symantec Endpoint Protection clients and run a scan for viruses and securityrisks. The computers are then turned off after these tasks are completed.


To use power sensitive malware scanning


2 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint Protection Management.

3 Right-click Symantec Endpoint Protection Management, then click New >Task.

4 On the Create New Task page, in the left pane, click Symantec EndpointProtection Management > Power Sensitive Malware Scanning.

33Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentUsing power sensitive malware scanning

5 On the Create New Task page, in the right pane, complete the followingoptions:

Enter a name for the task.Name

Enable this option if you need to update content, forexample virus definition files.

Update content ofSymantec EndpointProtection clients

Choose the malware scan type that you need the taskto run.

Select scan type

Select Intel vPro if your client computers are Intel vProcomputers with AMT enabled. SelectWake-on-LAN ifyour client computers are Wake-on-LAN enabled. Youcan select Both if your targeted computers contain acombination of both technologies.

Select power managementtechnology

6 Click OK.

7 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint Protection Management, and then click your task.

8 In the right pane, click New Schedule to schedule the task. On this page,configure the connection profile.

See Configuring a connection profile for Endpoint Protection IntegrationComponent tasks on page 36.

9 On New Schedule page, select the targeted computers that you want to rollout the job.

10 Click on schedule to run a task.

11 In the Task Management page, you can view the status of the scheduled task.

Using the remote SERT boot and repair taskThis task lets you boot a remote Intel AMT enabled client computer. The bootableimage contains the Symantec Endpoint Recovery Tool (SERT) to repair the clientcomputer. Use a remote control tool like Symantec pcAnywhere installed on theserver computer. You can use pcAnywheres Thost.exe running in the SERT ISO.This task first redirects to the boot-capable win-PE image with SERT and boots theclient computer using this image. The task works irrespective of the power state ofthe Intel vPro computer. You can then repair the client computer using SERT toolby using remote control software.

34Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentUsing the remote SERT boot and repair task

For this task to work, youmust have an Intel vPro managed computer with SymantecManagement Agent installed on it. The AMT (Active Management Technology)protocol and the IDE Redirection feature must be enabled. These steps can bedone when you provision the Intel computer.

For information about setting up AMT see:http://www.fic.com.tw/product/AMT_Procedure.pdf


To use the remote SERT boot and repair task


2 In the left pane, click Jobs and Tasks > System Jobs and Tasks > right-clickSymantec Endpoint Protection Management and then click New > Task.

3 In the Create New Task dialog box, in the left pane, click Symantec EndpointProtection Management > Remote SERT Boot Task.

4 In the Create New Task dialog box, in the right pane, complete the followingoptions:

Boot option : select CD Image if you boot from an ISOimage. Use CD with ISO image only. DVD boot is notsupported.

Performe Boot From

If you select the boot option, CD Image, then browseto the location where your ISO image is stored. If youselectCD/DVD drive option then this option is disabled.The task automatically receives the boot location.

Browse

5 Click OK.


7 In the left pane, click Jobs and Tasks > System Jobs and Tasks > SymantecEndpoint Protection Management, and then click your newly created task.

8 In the right pane, click New Schedule to schedule the task. Select thecomputers that you want to run the Remote SERT Boot task on.

9 On the New Schedule page, configure a connection profile .

See Configuring a connection profile for Endpoint Protection IntegrationComponent tasks on page 36.

35Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentUsing the remote SERT boot and repair task

10 Click Schedule to run the task.

11 The status of your task is displayed under Task Status.

See What you can do with Symantec Endpoint Protection Integration Componenton page 10.

Configuring a connection profile for EndpointProtection Integration Component tasks

When you set up the power sensitive malware scanning task and the remote SERTboot task you must specify or create a connection profile. Use this topic to createand configure a connection profile.

To configure a connection profile for the power sensitive malware scanning task

1 When you schedule a task on the New Schedule page, you must click SelectConnection Profile.

See Using power sensitive malware scanning on page 33.

See Using the remote SERT boot and repair task on page 34.

2 Select Default Connection Profile.

3 In the Select connection profile dialog box, do either of the following:

If you have already created and configured a connection profile, select itand click OK.

If you want to modify an existing connection profile, select the profile andclick Edit.

Click Add Settings to add a new connection profile. You must specify aname for the connection profile.

4 In the Connection Profile window, enable the AMT protocol.

5 In the Add Credentials dialog box, click on the plus sign to add new AMTcredential.

6 From the Credential type drop-down list, select the credential type as AMTCredentials.

7 Enter your AMT user name and password. This password must match thepassword that was configured for AMT provisioning.

8 Click OK.

9 Select the name of your credential.

10 Select your new connection profile.

36Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentConfiguring a connection profile for Endpoint Protection Integration Component tasks


37Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentConfiguring a connection profile for Endpoint Protection Integration Component tasks

ViewingSymantecEndpointProtection IntegrationComponent Reports


About reports for Endpoint Protection Integration Component

Symantec Endpoint Protection Integration Component reports

Viewing the status of Symantec Management Agent installations

Viewing summaries of the antivirus versions that are installed in your environment

Viewing computers on which the Symantec Endpoint Protection client rollout issuccessful

Viewing computers on which Tamper Protection is detected and enabled

Viewing your unmanaged computers that are discovered

About reports for Endpoint Protection IntegrationComponent

The Symantec Management Platform collects up-to-date environmental informationabout your client computers. You can view this information in reports. SymantecEndpoint Protection Integration Component provides several reports that give youinformation on infected and at risk computers. You can also view reports about yourSymantec Endpoint Protection clients.

4Chapter

For more information, see topics about using reports in the Symantec ManagementPlatform User Guide.


SymantecEndpointProtection IntegrationComponentreports

You can view and manage your Symantec Endpoint Protection IntegrationComponent data by using reports.

For more information, see topics about using reports in the Symantec ManagementPlatform User Guide.

Table 4-1 Reports of Symantec Endpoint Protection Integration Component

DescriptionReport

Lists the Agent installation status for the last week (bydefault). This list does not include agent pull installinformation.

See Viewing the status of Symantec ManagementAgent installations on page 40.

Symantec Management AgentInstallation Status

Lists the details about the versions of antivirus softwarethat is installed in your environment.

See Viewing summaries of the antivirus versions thatare installed in your environment on page 40.

Antivirus Version Summary

Lists the computers that the Symantec EndpointProtection client rollout policy has been successfully runon.

See Viewing computers on which the SymantecEndpoint Protection client rollout is successfulon page 41.

Computers on which SymantecEndpoint Protection Clientrollout is successful

Lists the computers that the Symantec EndpointProtection client rollout task has failed to run on.

See Viewing computers on which the SymantecEndpoint Protection client rollout task has failedon page 24.

Computers on which SymantecEndpoint Protection Clientrollout task has failed

39Viewing Symantec Endpoint Protection Integration Component ReportsSymantec Endpoint Protection Integration Component reports

Table 4-1 Reports of Symantec Endpoint Protection Integration Component(continued)

DescriptionReport

Lists the details about the antivirus software that isinstalled on your computers with tamper protection.

See Viewing computers on which Tamper Protectionis detected and enabled on page 41.

Computers on which TamperProtection is detected andenabled

Lists the computers that Symantec ManagementPlatform has discovered, but that do not have theSymantec Management Agent installed on them.

See Viewing your unmanaged computers that arediscovered on page 42.

Discovered computers that areunmanaged

See About reports for Endpoint Protection Integration Component on page 38.

Viewing the status of Symantec Management Agentinstallations

You can view reports about the Agent installation status for the last week (by default).This list does not include agent pull install information.

To viewing the status of Symantec Management Agent installations


2 In the left pane, click Reports > Notification Server Management > Agent> Agent Installation Status.

3 On the Agent Installation Status page, in the right pane, view the report.



Viewing summaries of the antivirus versions that areinstalled in your environment

You can view reports on the versions of antivirus software that are installed in yourenvironment.

40Viewing Symantec Endpoint Protection Integration Component ReportsViewing the status of Symantec Management Agent installations

To view summaries of the antivirus versions that are installed in your environment


2 In the left pane, clickReports > Symantec Endpoint ProtectionManagement> Antivirus Version Summary.

3 On the Antivirus Version Summary page, in the right pane, view the report.



Viewing computers on which the Symantec EndpointProtection client rollout is successful

You can view reports about the computers on which the Symantec EndpointProtection client rollout policy has succeeded.

To view the status of your Symantec Endpoint Protection client installation jobs


2 In the left pane, clickReports > Symantec Endpoint ProtectionManagement> Computers on which Symantec Endpoint Protection Client rollout issuccessful.

3 On the Computers on which Symantec Endpoint Protection Client rolloutis successful page, in the right pane, view the report.



Viewing computers on which Tamper Protection isdetected and enabled

You can view reports about the antivirus software that is installed on your computerswith tamper protection.

41Viewing Symantec Endpoint Protection Integration Component ReportsViewing computers on which the Symantec Endpoint Protection client rollout is successful

To view computers on which tamper protection is detected and enabled


2 In the left pane, clickReports > Symantec Endpoint ProtectionManagement> Computers on which tamper protection is detected and enabled.

3 On the Computers on which tamper protection is detected and enabledpage, in the right pane, view the report.



Viewing your unmanaged computers that arediscovered

You can view reports about the computers that Symantec Management Platformhas discovered but that do not have the Symantec Management Agent installed onthem.

To view your unmanaged computers that are discovered


2 In the left pane, clickReports > Symantec Endpoint ProtectionManagement> Discovered computers that are unmanged.

3 On the Discovered computers that are unmanged page, in the right pane,view the report.



42Viewing Symantec Endpoint Protection Integration Component ReportsViewing your unmanaged computers that are discovered

Aantivirus

inventory of 21

Ccontext-sensitive help 13

Ddocumentation 13

Eendpoint protection management

about 9

Ggetting started

endpoint protection management 16

Hhelp

context-sensitive 13

Iinventory

antivirus integration component 21

Qquick start


RRelease Notes 13report


Ttask


Index

Symantec Endpoint Protection Integration Component 7.5 User GuideTechnical SupportContents1. Introducing Symantec Endpoint Protection Integration ComponentAbout Endpoint Protection Integration ComponentSystem requirementsWhat you can do with Symantec Endpoint Protection Integration ComponentComponents of Symantec Endpoint Protection Integration ComponentAbout Endpoint Protection Integration Component resource filtersWhere to get more information

2. Getting Started with Symantec Endpoint Protection Integration ComponentGetting started with Symantec Endpoint Protection ManagementAbout Antivirus InventoryRunning an antivirus inventoryCreating Symantec Endpoint Protection client installation packagesMigrating computers to the latest Symantec Endpoint Protection clientViewing computers on which the Symantec Endpoint Protection client rollout task has failedRunning a full scan for viruses and security risks

3. Completing jobs and tasks with Symantec Endpoint Protection Integration ComponentAbout tasks for Endpoint Protection Integration ComponentTypes of tasks for Symantec Endpoint Protection Integration ComponentInstalling Symantec Endpoint Protection clients remotelyUninstalling antivirus software remotelyRunning a Quick Scan for viruses and security risksRepairing Symantec Endpoint Protection clientsUpdating the content of Symantec Endpoint Protection clientsUsing power sensitive malware scanningUsing the remote SERT boot and repair taskConfiguring a connection profile for Endpoint Protection Integration Component tasks

4. Viewing Symantec Endpoint Protection Integration Component ReportsAbout reports for Endpoint Protection Integration ComponentSymantec Endpoint Protection Integration Component reportsViewing the status of Symantec Management Agent installationsViewing summaries of the antivirus versions that are installed in your environmentViewing computers on which the Symantec Endpoint Protection client rollout is successfulViewing computers on which Tamper Protection is detected and enabledViewing your unmanaged computers that are discovered

Index

Date post:	26-Nov-2015
Category:	Documents
Upload:	shahid-wahab-nawab
View:	7 times
Download:	0 times

SEP User Guide

Documents