SQL Server Magazine

A feature large organizations will appreciate is ePO's ability to automatically place new systems into the correct location in the directory tree. When this occurs, automatic actions, such as deploying an agent and products and applying specific policies, can occur without administrative effort. IP address- based rules and AD integration are two methods ePO supports to accomplish this functionality.

Installation
I installed ePolicy Orchestrator on a Windows Server 2003 system. For testing, I allowed the program to install MSDE 2000 rather than use another SQL Server system, and the installation completed uneventfully. This was one of the easiest products to install in the group. In the Console

After logging on to the console with credentials created during installation, I explored the console tree. As Figure 3 shows, below the top level McAfee folder (which you can rename), I found two levels: ePolicy Orchestrator, and Reporting. My ePO server was the only object under the ePolicy Orchestrator level, and its folder contains the Directory, Policy Catalog, and Repository, along with Notifications and Rogue System Detection. For the purposes of this review, I spent little time in the Reporting section.

Within the directory structure, I found Policies, Properties, and Tasks tabs in the details pane. I created a site and groups within the directory structure. The process was intuitive using the right-click menu. I found my ePO server in the Lost&Found folder. Clicking the server name displayed the default policies inherited from above on the Policies tab. On the Properties tab I found 27 items of system information and a summary of installed McAfee products—at this point, the agent and ePO. The only task on the Tasks tab was the ePO Agent Deployment task, inherited from the directory level above.

Clicking Policy Catalog, I found a display of McAfee products, each containing default policies. Intrigued by a “Show Me” link, I clicked it and was rewarded with a brief flash demonstration of the tasks I could perform within the Policy Catalog section. The interface is easy to work with. I duplicated one of the Virus Scan Enterprise policies, named it, and was presented with a tabbed screen offering access to all the related policy options. Each tab has an Inherit check box: Selecting it disables all the settings on that tab and allows the settings inherited from above to take effect. Each tab also has a drop-down list offering server and workstation options, which creates the ability to implement distinct settings for the two kinds of targets.

I found working with named policies easy to understand. Starting in a low-level group, I made a copy of the default ePO agent policy, modified some settings, and applied the change. Looking at the top level, the new policy wasn’t available for assignment there, so I did a copy-and-paste operation to make it available throughout the directory tree. At each level, applying a policy is a matter of clicking Edit on the applications policy configuration line, selecting the desired policy, then clicking Apply.

Software Deployment
Because each managed system needs to know the location of its ePO server, the ePO installation process creates a customized agent deployment package for systems that will report to it. McAfee supports most software deployment methods for agent deployment. With one option, ePO will automatically deploy agents as systems are added to sites or groups within the directory tree.

To deploy McAfee software such as Virus Scan Enterprise, you simply “check-in” its installation package to ePO. This is a wizard-driven process in two parts: First check in a product catalog (.z) file, which describes the installation package, then check in the product policy (.nap) files, which describe policy options associated with the product.

The ePO console is well organized and easy to find your way around. Using the familiar tree-on-left, details-on-right organization was a structure I found logically consistent; I had no trouble locating what I needed to complete a task. The documentation is also very helpful. The ePO Walkthrough Guide is an excellent place to start and clearly describes the structure and concepts fundamental to effective implementation and use of ePO and presents instructions for an initial test deployment.

I tested policy-based automatic deployment by deploying a Rogue System Detector, then set up a conditional task that would deploy the ePO agent to rogue systems within a particular IP address range. The Rogue System Detector detected all the systems on my network and initiated a push install for the ePO agent.

Final Analysis
For a system as configurable as it is, ePO is surprisingly easy to use. Not as easy, perhaps, as simpler systems, but well done. The architecture allows administrators to design an implementation that will eliminate many day-to-day tasks, such as insuring that new systems run protection software according to policy.

Prev. page     1 2 3 [4] 5 6 7     next page