Client Manager For Endpoint Protection (CMEP) : User's Guide
Client Manager For Endpoint Protection (CMEP) : User's Guide
Protection (CMEP)
User’s Guide
July, 2010
BigFix® Client Manager for Endpoint Protection 1.0
BigFix®, Fixlet®, Relevance Engine®, Powered by BigFix™ and related BigFix logos are
trademarks of BigFix, Inc. All other product names, trade names, trademarks, and logos used in
this documentation are the property of their respective owners. BigFix’s use of any other
company’s trademarks, trade names, product names and logos or images of the same does not
necessarily constitute: (1) an endorsement by such company of BigFix and its products, or (2) an
endorsement of the company or its products by BigFix, Inc.
(1) No part of this documentation may be reproduced, transmitted, or otherwise distributed in any
form or by any means (electronic or otherwise) without the prior written consent of BigFix, Inc.,
and (2) you may not use this documentation for any purpose except in connection with your
properly licensed use or evaluation of BigFix software and any other use, including for reverse
engineering such software or creating derivative works thereof, is prohibited. If your license to
access and use the software that this documentation accompanies is terminated, you must
immediately return this documentation to BigFix, Inc. and destroy all copies you may have.
BigFix, Inc.
1480 64th Street, Suite 200
Emeryville, California 94608
User’s Guide 2 © 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
Contents
CONTENTS
Part One _________________________________________________________________ 4
Introduction _______________________________________________________________ 4
System Requirements_____________________________________________________________ 4
Part Two _________________________________________________________________ 6
Navigating CMEP ___________________________________________________________ 6
Components ____________________________________________________________________ 6
Working with Content __________________________________________________________ 8
Dashboards___________________________________________________________________11
Part Four_________________________________________________________________17
Using CMEP _______________________________________________________________ 17
Reports _______________________________________________________________________ 17
How to Update _________________________________________________________________ 21
Wizards _______________________________________________________________________ 22
Create Update Task Wizard _____________________________________________________ 23
Windows Defender Update Wizard ______________________________________________ 25
McAfee On‐Demand Scan Wizard ________________________________________________ 26
Configuration Tasks _____________________________________________________________ 28
Disable and Enable System Restore ______________________________________________ 29
Part One
Introduction
BigFix Client Manager for Endpoint Protection (CMEP) is an application that encompasses Anti-
Virus, spyware tools, and device control capabilities. This application enables the management of
third-party endpoint security clients from vendors such as McAfee, Symantec, IBM and Trend
Micro through the BigFix Unified Management Platform. More than just a way to put anti-malware
defense under a BigFix umbrella, BigFix Client Manger for Endpoint Protection brings
unprecedented scalability, speed and thoroughness to keep organizations steps ahead of
external threats.
Real-time visibility into the current health and status of third-party endpoint security
clients
Management and remediation of unhealthy, third-party endpoint security clients where
possible
Uninstall tools to enable easy switch-out of incumbent endpoint protection tools
Web-based reporting to monitor migration progress in real time, with drill-down details
Closed-loop verification of updates, signature definition files, and more—even if
endpoints are disconnected from the network
Unparalleled scalability and speed—a single management server can support up to
250,000 endpoints with updates made in minutes
CMEP is intended to supersede the BigFix Client Manager for Anti-Virus (CMAV) content site.
CMEP contains all of the functionality of CMAV, including some additional features:
System Requirements
BigFix CMEP offers support for a variety of operating systems and products. The table below
highlights each supported product, version, and operating environment. This table includes the
most current system requirements for this product. However, as system requirements are likely to
change, check the BigFix support website for the most current CMEP system requirements.
User’s Guide 4 © 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
Symantec Anti-Virus Corporate Edition 7.6, 8, 9, 10, 10.1, Windows 95, Windows 98,
10.2 Windows Me, Windows NT 4 SP6,
Windows 2000, Windows XP
Professional, Windows Server 2003
Symantec Anti-Virus Corporate Edition x64 All versions Windows XP 64-Bit Version 2003,
Windows Server 2003 64-Bit,
Windows Vista, Windows Server
2008
Symantec AntiVirus 10.2 Mac OS X 10.3.9+
Symantec Endpoint Protection 11 Windows 2000, Windows 2008,
Windows Vista, Windows 2000
SP3+, Windows Server 2003,
Windows Server 2008, Windows 7
Sophos Anti-Virus 3.x, 4.1x, 4.6x, 6.x, Windows 95 OSR2, Windows 98
7.x SE, Windows NT 4 SP6+, Windows
XP SP1+, Windows Vista, Windows
Server 2003, Windows Server 2003
R2, Windows Server 2008,
Windows Server 2008 R2
Trend Micro OfficeScan 7, 8, 10 Windows 2000, Windows XP Pro
SP2+, Windows XP Home SP3+,
Windows Server 2003 SP2+
Windows Server 2003 R2 SP2+,
Windows Vista SP1+, Windows
Server 2008 SP1+, Windows 7
Trend Micro ServerProtect 5.5 Windows 2000 SP4+, Windows
Server 2003 SP1+, Windows
Server 2008
* Audit only means that CMEP only checks that the definitions are more than 7 days old.
User’s Guide 5 © 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
Part Two
Navigating CMEP
The navigation tree in the BigFix Console, which is available for all BigFix products, will serve as
your central command for all CMEP functionality. The navigation tree gives you easy access to all
reports, wizards, Fixlet messages, analyses and tasks related to the anti-malware tools in your
deployment.
Components
In the context of the BigFix Console, products or sites are grouped by categories or domains. For
example, CMEP is one of the sites contained within the Endpoint Protection domain, along with
Device Control and Core Protection Module.
The domain panel is the area on the left side of the Console that includes a navigation tree and a
list of all domains. The navigation tree includes a list of nodes and sub-nodes containing site
content.
In the image below, you will see a navigation “tree” at the top with expandable and collapsible
nodes, and a list of domains at the bottom. By clicking the Endpoint Protection domain at the
bottom of the domain panel, a list of sites associated with that particular domain will display in the
navigation tree at the top.
User’s Guide 6 © 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
The red-outlined area represents the entire Domain Panel (including the navigation tree and list of
domains), and the blue box contains just the Navigation Tree for the Endpoint Protection domain.
CMEP tasks are sorted through upper and lower task windows, which are located on the right
side of the Console.
The upper panel, called the List Panel (blue), contains columns that sort data according to type,
such as ID, Name, Site, Applicable Computer Count, etc.
The lower panel or Work Area (red) presents the Fixlet, task screen or Wizard from which you will
be directed to take specific actions to customize the content in your deployment.
User’s Guide 7 © 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
Working with Content
The navigation tree organizes CMEP content into expandable and collapsible folders that enable
you to easily navigate and manage relevant components in your deployment. Click the plus sign
(+) to expand the navigation tree nodes and the minus sign (-) to collapse them.
User’s Guide 8 © 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
When you click on the Endpoint Protection domain at the bottom of your screen, you will see
content related to the CMEP and Device Control “sites” organized into expandable nodes.
The All Endpoint Protection node includes content (analyses, dashboards, wizards, etc.) related
to the entire Endpoint Protection domain as a whole, including all of its related “sites”.
User’s Guide 9 © 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
Note: Depending on your operating system, your system may display the “+” and “-“ buttons in
the navigation tree as triangles. Specifically, the “+” and “-“ icons will display on Windows
XP/2003/2008/2008R2 machines, and triangles will display on Windows Vista/7. This
feature was designed so that the Console matches the standards and conventions of your
specific operating system. Regardless of the particular icon, the functionality of these
buttons works the same way to either expand or collapse content.
You will use this same expand/collapse method to move through the entire navigation tree.
The CMEP site is organized into 6 primary nodes: Reports, Product Updates, Manage Definitive
Updates, Manage Scanning, Deploy AV Applications, and Troubleshooting.
Some of these nodes expand into sub-nodes that contain additional content:
The Device Control node includes tasks for monitoring connected devices and disabling /
restoring devices.
Dashboards
The Dashboards in CMEP include overview pie chart reports that summarize the anti-malware
products within your deployment. You can view an overview of all anti-malware products, or view
each pie chart individually.
The CMEP Overview dashboard is located at the top of the CMEP navigation tree. The remaining
dashboards are located under the Reports node.
The CMEP Overview dashboard contains an Anti-Virus Health Status pie chart, and a graph
displaying the vendor products installed in your deployment. Each chart contains a corresponding
summary table below it.
Part Three
Installation
Prior to beginning installation, you should be logged into the BigFix Console and be familiar with
its basic operation. If you have questions about how to use the BigFix Console, we recommend
that you review the BigFix Console Operator’s Guide prior to using this document.
Site Subscription
Activating tasks and analyses
Subscribing to the CMEP Site
The CMEP Masthead contains information about BigFix content that performs certain tasks and
analyses within your deployment. You must be subscribed to the CMEP site in order to collect
data from the BigFix Clients. This data will be utilized for reporting and analysis.
The process for site subscription depends on the version of the BigFix Console that you have.
Click here to get specific site subscription directions from the BigFix Knowledge Base.
Activating Analyses and Tasks
Once the Masthead file has been downloaded and applicable tasks and analyses have been
gathered from the content server, you will then need to deploy those tasks and activate those
analyses to make them visible in the BigFix Console.
Start by viewing the All Endpoint Protection node in the navigation tree. Click on Analyses, then
click By Site and select Client Manager for Endpoint Protection. The corresponding number in
parentheses indicates how many analyses are available and applicable to the CMEP site.
Click Client Manager for Endpoint Protection. This will display the list of related Analyses in the
window on the right.
To activate a number of analyses at once, highlight the list of analyses and select Activate from
the right-click menu. Enter your Private Key Password.
Once all analyses have been activated, they will display with an Activated status in the window:
For more detailed information on deploying tasks and activating analyses, review the BigFix
Console Operator’s Guide available on the BigFix support website.
Part Four
Using CMEP
Reports
Overview
The Anti-Virus Overview Report provides a summary of Anti-Virus health and Anti-Malware
products in your deployment. The left side of the Overview screen contains an Anti-Virus Health
Status pie chart and Anti-Virus Deployment Information statistics. The right side contains an Anti-
Malware Vendor Products bar graph with dates of the latest available Anti-Malware definitions.
The table below illustrates the color-coding used for the Anti-Virus Health Status pie chart, as well
as a brief description of each category:
Category Definition
Healthy This machine is adequately protected from Malware
Old Definitions Virus definitions need to be updated on this machine
* Special Note: For detailed information on how CMEP defines the “healthy”
category in the Health Status pie chart, see the related
Knowledge Base article on the BigFix support website.
The Anti-Malware Vendor Products bar graph is color-coded according to vendor, as shown in the
image on page 12 above.
McAfee
Symantec
Trend Micro
Sophos
eTrust
Proventia Desktop
Windows Defender
You may also select individual vendors to display a customized pie chart and summary. For
example, by selecting to view the Trend Micro report, the dashboard will display the Trend Micro
health status pie chart, the date of the latest definition release, and a list of related Analyses with
either Activated or Not Activated status.
The Agent Status section displays pie charts representing the health and status of your Anti-
Virus according to each vendor. Status is measured by the following criteria:
Analyses
For each of the vendors represented in the Anti-Malware reports, there are corresponding
analyses listed in the Latest Available Definition section on the right of each pie chart.
When clicked, each item will display a Fixlet that allows you to either activate or de-activate that
particular analysis.
User’s Guide 20
© 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
How to Update
If one of your Anti-Malware vendors displays a yellow “Need Update” status in the Agent Status
pie chart, you need to update your virus definitions to ensure that all applicable computers are
adequately protected.
Start by clicking directly on the pie chart. This will open a new window where you can update the
related Fixlets. When the window opens, click on the applicable computer listed under the
Computers column on the right side of the screen.
Next, click the Fixlets tab on the left, which will display a list of all applicable Fixlets associated
with this computer. Scan the list to find the relevant update Fixlet.
Double-click on the Fixlet name in the displayed list to get to the Fixlet window. Review the
description, and click where indicated in the Actions box to initiate the deployment process.
This will open the Take Action dialog, where you can set specific parameters for this action. As an
alternative, you may also click the Take Action pull-down in the top left of the panel. For detailed
information about the Take Action dialog, review the BigFix Console Operator’s Guide.
Wizards
CMEP Anti-Malware wizards offer an easy, step-by-step guided process for updating virus
definitions and setting up on-demand virus scans on your endpoints.
Create Update Task Wizard
The Create Update Task wizard allows you to create anti-virus definition updates for a number of
McAfee and Symantec applications. Access the wizard by expanding the Manage Definition
Updates sub-node in the navigation tree. Click Create Update Task, as shown below. This will
open the wizard in the lower panel.
Selecting any anti-virus product from the list will display more information at the bottom of the
panel. You may either retrieve the package from a URL or browse to locate the package from
your computer.
The box in the lower left corner allows you to either create a reusable Fixlet or a one-time action.
Click Finish.
Note: In order to enter the correct URL, go to the virus definitions page on the McAfee
or Symantec website copy/paste the link into the dialog field. You can also
download the virus definition to your computer and browse to its location by
selecting the second button.
You will see the following screen as the virus definitions are downloaded to your system:
Next, you will see the Create Task window. Review the content in the Description, Actions,
Relevance, and Properties tabs, click Okay, and enter your Private Key Password.
At the next task window, click where indicated in the Actions box to initiate deployment. This will
open the Take Action dialog, where you can set specific parameters of the action.
Windows Defender Update Wizard
To access the Windows Defender Update Wizard, click on the Wizard from the Manage Definition
Updates sub-node in the navigation tree.
Click Download and you will see a progress window appear as the Wizards retrieves spyware
updates.
Once spyware signatures have been downloaded, you will see a window displaying the version
number of the latest update. Click Next to take additional actions.
User’s Guide 25 © 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
From this screen, you may choose to edit or create a Fixlet, or create a one-time action.
McAfee On‐Demand Scan Wizard
Access the McAfee On-Demand Scan Wizard from the Manage Scanning node in the navigation
tree.
User’s Guide 26
© 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
The Wizard allows you to configure McAfee On-Demand scan on Windows computers that have
McAfee VirusScan Enterprise 8.0i and the BES Client installed.
Once you click to open the Wizard, you will select to either generate a Task to change the default
behavior, or generate a Fixlet message that will run the scan. Make a selection and click Next.
If you click Generate a Task to change default behavior, you will see the following screen. Select
a scan location, then make a drive selection from the pull-down list. You may select multiple
drives by using the Add and Remove buttons.
Use the Next, Back and Quit navigation buttons at the bottom of each window to proceed through
the Wizard. The remaining windows will enable you to select scan inclusions and exclusions,
specify advanced scan options, specify virus detection options, specify destination options for
unwanted programs, and specify log file options.
Configuration Tasks
Anti-Malware configuration tasks enable you to manage aspects of McAfee AVERT Stinger,
Symantec UPX Parsing Engine and Windows Defender. Click on any title in the list of Anti-
Malware tasks to display the related Fixlet window.
User’s Guide 28
© 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
Disable and Enable System Restore
The Disable/Enable System Restore task can be accessed through the Configuration node of the
navigation tree.
Click on the task to display the task screen in the lower panel. If System Restore is currently
enabled, using this task will allow you to disable it, and vice versa. Review the text in the
Description, and then click the applicable link in the Actions box to disable System Restore. You
may also select an Action from the Take Action pull-down at the top of the panel.
You may also click the bottom two links in the Actions box to read about how Microsoft System
Restore affects other anti-virus products.
User’s Guide 29
© 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
Part Five
Device Control
The Device Control functionality within CMEP allows you to control and manage various devices
in your deployment, including USB storage devices, CD-ROMS drives, etc.
To view applicable tasks related to Device Control, click the Device Control site located below the
Client Manager for Endpoint Protection site within the Endpoint Protection domain.
Click the “+” next to Device Control to display a list of tasks, analyses, or Fixlets related to Device
Control
You may click on each category to display the related tasks, or use the top right panel in the
Console to deploy these actions from a single list. Any tasks beginning with “Removable
Media:” are related to Device Control component of CMEP.
User’s Guide 30
© 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
The tasks listed in the Device Control node allow you to control removable media devices by
either disabling or restoring future use of the devices. These devices include:
USB Storage
CD-ROMs
Floppy Disk drives
High Capacity Floppy Disk Drives
Parallel Port Devices
PCMCIA Devices
Click on each name in the list to display the related Fixlet in the window below.
After reviewing the information displayed in the Description box, click the link in the Actions box to
deploy the task, then enter your Private Key Password.
This link displays the Take Action dialog, where you can set specific parameters of the task. For
more information about using the Take Action dialog, see the BigFix Console Operator’s Guide
on the BigFix support website.
Use this same method to work with all existing content in Device Control, including analyses,
Fixlets, and tasks.
USB Storage
Removable media, such as CDs, USB drives and memory sticks can be considered a security
risk, as they can potentially introduce malware or transport sensitive information out of your
network. The Device Control Configuration Tasks control future use of USB storage devices by
disabling the usbstor.sys driver on targeted computers.
To disable the future use of a USB Storage device, click the applicable task displayed under the
Device Control node in the navigation tree.
A Fixlet will open in the window below. Click where indicated in the Actions box to either initiate
this task or to view the related article on the Microsoft website.
Note: Affected computers may report back as “Pending Restart” once the action has
run successfully. The setting may not take effect until the computer is rebooted.
Use this same method for restoring or disabling CD-ROMS, Floppy Disk drives, High Capacity
Floppy Disk drives, Parallel Port Devices, or PCMCIA Devices.
Part Six
Support
Frequently Asked Questions
Why are my Windows 7 and Windows 2008 machines, which have a supported Anti‐
Virus installed, showing up as Other/None in the Health Status overview pie chart?
If you have BES 7.2.4 (or an earlier version) installed, Windows 7 and Windows 2008 are not
supported. If you upgrade to BES 7.2.5 or later, those operating systems will display as expected
in the pie chart.
If I already have Client Manager for Anti‐Virus, how do I get the new dashboard for
Client Manager for Endpoint Protection?
In the bottom of the Domain Panel, click the Endpoint Protection domain. This will display
the Client Manager for Endpoint Protection site at the top of the navigation bar.
The Client Manager for Anti-Virus dashboard contains a note with a link to the current
CMEP dashboard:
Note: If your Console is open and displaying the old dashboard, you will need to close
and then re-open the old dashboard in order for the “This dashboard has been
superseded" message to display.
How do I get back to the CMEP navigation tree from within the wizards?
The domain panel, which contains the navigation tree for all BigFix products, is always visible on
the left side of your screen. When Fixlets or tasks display, they will open in a window on the lower
right part of your screen. See the Navigation chapter of this document for more information.
User’s Guide 34
© 2010 BigFix, Inc.
BigFix® Client Manager for Endpoint Protection 1.0
Tips
Click the Refresh Console button located at the top of the Console to ensure that the data
displayed in your reports is always current.
Data gathering occurs during start-ups and when you refresh the dashboard. Several
factors can affect how long this process takes, including deployment size, the
performance of the BES server, and the machine the Console is running. If the gathering
process seems unreasonably long, restart the dashboard.
Global Support
BigFix offers a suite of support options to help optimize your user-experience and success with
this product. Here’s how it works:
If you still can’t find the answer you need, contact BigFix’s support team for technical assistance: