McAfee Total Protection Service Installation Guide

(1)

McAfee Total Protection Service

Installation Guide

(2)

COPYRIGHT

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

License Attributions

Refer to the product Release Notes.

(3)

Introduction to Total Protection Service

This guide contains the information required to prepare for and install the McAfee^®Total Protection Service software on client computers.

NOTE:Some types of protection managed by Total Protection Service do not reside as software on client computers. Therefore, they are not included in this guide. If your purchase included email protection, the email server security application, or vulnerability scanning, refer to emails and materials from McAfee for instructions on installing them.

Contents

After you place your order Installation environment

Advanced network environments

After you place your order

When you place an order for Total Protection Service, you supply an email address, and your account is associated with that email address. After you submit your order:

1 McAfee processes your order.

2 You receive three emails.

Contains...

This email...

The download URL and instructions for installing the client software, activating and setting up the protection you purchased, accessing documentation, and contacting customer support.

Welcome

Instructions for logging on to the McAfee SecurityCenter administrative website and changing your password. You must use Microsoft Internet Explorer Logon credentials

(version 6.0 or later) or Mozilla Firefox (version 2.0 or later) to access the SecurityCenter.

The grant number for the order, which is required for customer support.

Grant letter

NOTE:If you purchase Total Protection Service from a McAfee partner who manages security for you, the partner usually receives these emails. If you have questions about which emails you should receive, contact the partner.

Merging multiple orders or accounts

If you placed more than one order using different email addresses, you have more than one Total Protection Service account.

Use this task to merge separate accounts so that all your security information and emails are

(6)

Task

For option definitions, click ? in the interface.

1 From your web browser, log on to the SecurityCenter. Login credentials were sent to you in a Welcome email when you purchased Total Protection Service.

NOTE:You must use Internet Explorer (version 6.0 or later) or Firefox (version 2.0 or later) to log on to the SecurityCenter.

2 On the My Account page, click the Accounts & Keys tab.

3 In the Manage Accounts section, select Merge another account.

4 Enter the email address and password for the account you want to merge into your main account, then click Next. The main account is the one that uses the email address where you want to receive status emails and messages regarding all your subscriptions.

5 Verify that the licenses and computers listed for the account are the ones you want to merge.

6 Click Merge Account.

Installation environment

Total Protection Service is designed for Microsoft Windows operating systems running on a PC platform. The client software installs and runs on computers equipped with:

• An Intel Pentium processor or compatible architecture.

• Microsoft Internet Explorer 6.0 or later.

Check these topics for additional requirements and support guidelines:

• Supported operating systems

• RAM requirements

• Requirements for email protection

• Requirements for the email server security application

Supported operating systems

Use this table to verify that client computers are running supported operating systems. This table includes only the types of protection that require installation of a client component.

Protection Operating system

Content filtering Browser

Virus and spyware, firewall

Client computers

X Windows 2000 Professional

with Service Pack 3 or later

X X

X Windows XP Home

Windows XP Professional with Service Pack 2 or later (32-bit and 64-bit)

Introduction to Total Protection Service Installation environment

(7)

Protection Operating system

Content filtering Browser

Virus and spyware, firewall

X X

X Windows Vista

(32-bit and 64-bit)

X X

X Windows 7

(32-bit and 64-bit)

Servers

X Windows 2000 Server

Advanced Server Small Business Server with Service Pack 3 or later

X X

X Windows 2003 Standard Server

Enterprise Server Small Business Server (32-bit and 64-bit)

X X

X Windows Server 2008

Standard Server Enterprise Server Small Business Server Essential Business Server (32-bit and 64-bit)

When upgrading the operating system

If you upgrade the operating system on a client computer (for example, from Windows 2000 to Windows XP) and you want to leave your existing files and programs intact during the upgrade, you must first uninstall Total Protection Service. You can reinstall it after the upgrade is complete.

Support for Windows Home Server

A different version of the Total Protection Service client software is being developed for computers running Microsoft Windows Home Server. Administrators running Windows Home Server software will have access to the SecurityCenter to download this version, which will allow the Total Protection Service client software to interact with the Windows Home Server console.

Please note these differences between the two versions of Total Protection Service:

• Installing on computers running Windows Home Server requires a different installation program than the one described in this guide in order to interact with the Windows Home Server console.

• Download the installation program from the Utilities page of the SecurityCenter (when the program becomes available).

• The client software for Windows Home Server supports only virus and spyware protection.

• A separate product guide that describes the installation process and features unique to the Windows Home Server product will be available from the Help page of the SecurityCenter.

(8)

• Installation methods described in this guide are not supported installation methods of the client software on a computer running Windows Home Server.

Operating system support ending

Support for the Windows 2000 operating system is scheduled to end.

Computers running Total Protection Service will still be protected from existing threats, but they will no longer receive product updates and DAT files updated with protection for the latest threats.

For more information about support for Windows 2000, visit:

http://www.mcafee.com/us/small/support/customer_service/end_life.html

Notifying users when support ends

By default, Total Protection Service displays notifications on client computers to remind users that support is ending for their operating system. Notifications appear:

• When upgrades to product components, such as the scanning engine, are scheduled to end on a specific date or will end within 30 days.

• When updates to detection definition (DAT) files have ended or will end within 30 days.

A policy option determines whether support notifications are displayed. However, notifications are not displayed for computers running versions of Windows for which support has already ended.

Use this task to enable or disable automatic notifications.

Task

1 From your web browser, log on to the SecurityCenter. Login credentials were sent to you in a Welcome email when you purchased Total Protection Service.

2 On the Policies page, click Add Policy to create a new policy, or click Edit to modify an existing policy.

3 On the Client Settings tab, select or deselect Display support notifications on client computers.

4 Click Save.

RAM requirements

Before installing Total Protection Service, use this table to verify that sufficient RAM is installed on client computers.

Recommended Minimum for multiple

types of protection Minimum for single

type of protection Operating system

1 GB 1 GB

512 MB Windows 2000

1 GB 1 GB

512 MB Windows XP

2 GB 1 GB

512 MB Windows 2003

2 GB 1 GB

1 GB Windows Vista

2 GB 1 GB

1 GB Windows 7

(9)

Recommended Minimum for multiple

types of protection Minimum for single

type of protection Operating system

2 GB 1 GB

512 MB Windows Server 2008

2 GB 1 GB

512 MB Other Servers

NOTE:When calculating the total RAM required, consider the memory requirements of other software applications running on client computers.

Requirements for email protection

If your subscription includes email protection, be sure your network meets these requirements to set up and run email protection:

• A dedicated email server, either in-house or hosted by an ISP.

• A company email domain, such as yourdomain.com, with a static IP address.

Instructions for setting up email protection are provided in an email from McAfee and in the product guide, available on the Help page of the SecurityCenter.

Requirements for the email server security application

If your subscription includes the email server security application, check these lists to verify that your email server meets or exceeds minimum requirements. Instructions for installing the email server security application are provided in emails and materials from McAfee.

McAfee GroupShield for Microsoft Exchange Server Minimum requirements for Microsoft Exchange Server 2007:

• x64 architecture-based processor with EM64T or AMD64 support.

• 2 GB of RAM.

• 740 MB free disk space.

• Microsoft Exchange 2007.

• Internet Explorer 6.0 or later.

• One of these operating systems:

• Microsoft Windows 2003 Server with Service Pack 1 (64-bit).

• Microsoft Windows 2003 R2, Standard or Enterprise Edition (64-bit).

Minimum requirements for Microsoft Exchange Server 2003:

• Intel Pentium or compatible 133MHz processor.

• 256 MB of RAM (512 MB recommended).

• 740 MB free disk space.

• Microsoft Exchange 2003 with Service Pack 1 or later.

• Microsoft Windows 2000 Server with Service Pack 4.

• Microsoft Windows 2000 Advanced Server with Service Pack 4.

• Microsoft Windows Server 2003 Standard Edition (32-bit).

(10)

• Microsoft Windows Server 2003 Enterprise Edition (32-bit).

Minimum requirements for Microsoft Exchange Server 2000 with Service Pack 3:

• 128 MB of RAM (256 MB recommended).

• 740 MB of free disk space.

• Microsoft Exchange 2000 with Service Pack 3.

• Microsoft Windows 2000 Server with Service Pack 4.

McAfee GroupShield for Lotus Domino, Windows edition Minimum requirement:

• 512 MB of RAM (1 GB recommended).

• Internet Explorer 6.0 or later set as the default browser.

• Microsoft Windows 2000 or 2003 Server.

• Microsoft Windows 2000 Advanced Server with Service Pack 4 or later.

• Microsoft Windows Server 2003 Enterprise Server with Service Pack 2 or later.

Advanced network environments

A few features might be appropriate to consider before installing Total Protection Service on networks with certain characteristics.

Check this topic If your network includes...

Decide whether to set up relay servers One or more computers without an Internet connection

How firewall protection interacts with the Windows firewall Computers running the Windows firewall

Support for corporate firewalls or proxy servers A corporate firewall or proxy server

Terminal server support Terminal servers or shared computers where the fast user

switching feature is used

Decide whether to set up relay servers

Before installing Total Protection Service, decide whether you want to set up relay servers and which computers should be relay servers. This affects which installation methods you can use for these computers.

When to set up relay servers

It is not necessary to set up relay servers. However, you might want to consider designating one or more computers as relay servers if any computers on your network do not have a direct connection to the Internet.

Introduction to Total Protection Service Advanced network environments

(11)

What is a relay server?

The Internet Independent Updating (IIU) feature allows computers without an Internet connection to receive software updates through another local computer that has been designated as a relay server. Any computer with an Internet connection can be set up as a relay server at the time the client software is installed or at a later time. A relay server acts as a proxy for other computers by allowing them to use its connection to check for updates.

How to set up relay servers

Specify relay servers using these methods:

• Silent installation — Designate a relay server during installation, or run VSSETUP at any time to reconfigure a client computer as a relay server.

• Push installation — Perform a separate push operation to push files to computers that will serve as relay servers and computers that will not serve as relay servers.

How firewall protection interacts with the Windows firewall

If client computers on your network have been running the Windows firewall, and you plan to install firewall protection with Total Protection Service, you should be aware of the way in which the two firewalls interact.

To ensure complete protection on computers running Windows XP, Windows Vista, or Windows 7, firewall protection automatically disables the Windows firewall and configures itself as the default firewall. This enables it to monitor communications for Internet applications and track events for reporting purposes.

We recommend that you do not re-enable the Windows firewall while the Total Protection Service firewall is enabled.

CAUTION:If both firewalls are enabled, the Total Protection Service firewall lists only a subset of the blocked IP addresses in its report, Inbound Events Blocked by the Firewall. The Windows firewall blocks some of these addresses; however, it does not report them because event logging is disabled in the Windows firewall by default. If both firewalls are enabled, you must enable Windows firewall logging to view a list of all blocked IP addresses. The default Windows firewall log is C:\Windows\pfirewall.log. Enabling both firewalls also results in duplicate status and alert messaging.

Support for corporate firewalls or proxy servers

Total Protection Service downloads components directly from McAfee servers to client computers.

If you are behind a corporate firewall, or are connected to the Internet by a proxy server, you might need to provide additional information for your service to work properly.

• Authentication support is limited to anonymous authentication or Windows domain challenge/response authentication. Basic authentication is not supported.

• Silent installation, push installation, and automatic updating do not support a CHAP or NTLM proxy.

Contact product support if you have proxy questions while installing or updating Total Protection Service.

(12)

Terminal server support

Total Protection Service supports terminal servers and the Windows fast user switching feature in most scenarios, with these limitations:

• Total Protection Service must be installed on the server by someone with local administrator rights.

• When an installation or update occurs on a terminal server, one session is designated as the primary update session for restrictions that apply to automatic updates.

• For all user sessions, the Total Protection Service icon is removed from the system tray during the installation or update. The icon is restarted only for the user logged on to the primary update session. All user sessions are protected, and other users can manually redisplay their icons. (See the product guide or the client online help for instructions on displaying the icon.)

• Detection notifications are not displayed on the desktop of all computer users if the fast user switching feature is enabled.

(13)

Preparing to Install the Client Software

The chapter explains how to prepare computers on your network before installing the client software.

Contents

Uninstalling active virus protection software Uninstalling active firewall software

Configuring your browser

Installing the standalone installation agent

Uninstalling active virus protection software

Other virus protection software might conflict with the advanced features of McAfee virus protection. When multiple virus scanning engines try to access the same files on your computer, they interfere with each other. Use this task to uninstall existing virus protection software before installing the Total Protection Service virus and spyware protection. (There is no need to uninstall an existing installation of Total Protection Service.)

Total Protection Service automatically detects some virus protection software during installation.

It can uninstall some of these products during installation, and it prompts you to uninstall other products manually. If you are notified of existing virus protection software on a computer during installation, you must uninstall it before installing Total Protection Service.

For a list of software that is detected and/or uninstalled during installation, visit http://www.mcafeeasap.com/downloads/uninstallinfo/detected_software_list.html.

Task

1 In the Windows Control Panel, open Add/Remove Programs.

2 From the list of programs, locate any virus protection software.

3 Click Remove.

Uninstalling active firewall software

Before installing firewall protection, we recommend that you uninstall any other firewall programs on your computer. (There is no need to uninstall an existing installation of Total Protection Service.) Follow your firewall program’s instructions for uninstalling or use the Windows Control Panel.

Use this task to uninstall existing firewall software from the Windows Control Panel.

(14)

Task

1 In the Windows Control Panel, open Add/Remove Programs.

2 From the list of programs, locate any firewall software.

3 Click Remove.

NOTE:On computers running the Windows firewall, it is disabled automatically during installation of Total Protection Service.

Configuring your browser

The computer used to install Total Protection Service must have Microsoft Internet Explorer 6.0 or later installed. Total Protection Service works with the default security settings in Internet Explorer. Use this task to verify and configure your settings if you are unsure of them.

NOTE:If on your administrative or client computers you typically use a non-Microsoft browser, such as Mozilla Firefox or Opera, you must install Internet Explorer before installing Total Protection Service. After the software is installed, you can continue to use your default Internet browser. You can access the SecurityCenter with Internet Explorer (version 6.0 or later) or Firefox (version 2.0 or later).

Task

1 From the Windows Control Panel, open Internet Options.

2 On the Security tab, verify and change your security setting as needed, depending on your version of Internet Explorer:

• Internet Explorer 7.x — Select Medium-high.

• Internet Explorer 6.x — Select Custom Level, then from the Reset to menu, select Medium and click Reset.

3 Click OK.

Installing the standalone installation agent

To allow users without administrator rights to install Total Protection Service on client computers by using the URL method, you must first load a standalone installation agent on their client computers.

NOTE:This task is not required unless you want users without administrator rights to install the client software.

Use this task to install the installation agent with a deployment tool, such as Microsoft Systems Management Server (SMS) installer, Windows NT login scripts, or Tivoli IT Director, or by downloading it directly onto client computers. You must have administrator rights on the client computer to install this file. After the standalone installation agent is installed on a client computer, any user can install Total Protection Service client software on that computer.

Task

1 From the SecurityCenter website, click the Help tab, select Utilities, then click installation agent to download the executable installation file for the agent.

Preparing to Install the Client Software Configuring your browser

(15)

2 Copy the installation file to a portable medium, such as a thumb drive, or email it to client computer users (optional).

3 Install the agent with one of these methods, depending on your location:

• From the administrative computer — Deploy and execute the file on client computers using your customary deployment tools.

• From the client computer — Double-click the file to begin the installation process.

Preparing to Install the Client Software Installing the standalone installation agent

(16)

Installing Total Protection Service

This chapter explains how to install the client software on computers.

Contents

Summary of installation methods The standard installation process The silent installation process The push installation process

Processes for pre-installed and CD versions Completing the installation

Summary of installation methods

There are three methods for installing Total Protection Service client software, one standard and two advanced methods.

Standard installation

Use a URL to install Total Protection Service on each client computer.

• Use the URL you received in your Welcome email message to install the client software on your computer and access the SecurityCenter website. This URL is specific to your account and will install all the protection you have subscribed to in the default language for your account.

• Optionally, create a custom URL on the SecurityCenter with the Install Protection wizard.

Use the custom URL to specify specific types of protection to install, a language for the client software, and a group to place the client computer in.

Send either the URL you received in your Welcome email or the custom URL to users with instructions for installation, or visit each client computer and use the URL to install the software.

Advanced installation options

From an administrative computer, visit the SecurityCenter website and select an advanced installation method to install the software without user interaction.

• Silent installation — Download a program called VSSETUP.EXE, deploy it to client computers, then open a DOS window on each client computer and run VSSETUP.EXE from the command line. This method requires a third-party deployment tool, a login script, or a link to an executable file in an email message.

• Push installation — Obtain the Push Install utility, then deploy the software directly from your service provider’s website to one or more client computers remotely.

This table summarizes the differences in the advanced installation methods.

(17)

Advanced installation method The administrator...

Push Silent

Administrative computer Client computer

Performs the installation from

Push Install utility VSSETUP.EXE

Obtains this file from the SecurityCenter

One or more computers One computer

Installs the client software on

Yes No

Installs remotely

Yes (requires a separate installation for client computers and relay servers) Yes

Can designate relay servers (optional)

The standard installation process

URL installation is the most common installation method. Client software is installed on each computer individually. Users install the client software by downloading it to their computers from a company-specific URL.

How standard installation works

1 Obtain your download URL from your Welcome email message, or create a customized URL from the SecurityCenter.

2 Send the URL to users in an email message with instructions (optional).

3 From the client computer, enter the URL into a browser window.

Requirements for standard installation

To install Total Protection Service on a client computer by using a download URL:

• The client computer must have an Internet connection.

• The client computer's user must have local administrator rights.

NOTE:Administrator rights are not the default setting. Change the default Windows configuration or deploy a standalone installation agent on the client computer (seeInstalling the standalone installation agent).

Sending an installation URL to users

As the administrator, you can obtain the company-specific installation URL in two ways:

• After signing up for Total Protection Service, you receive an email message containing the installation URL that has been set up for your company. This URL installs all the protection software you have subscribed to, and places it in your account’s default group in the default language of your account. You can copy this URL into an email message and send it to users.

• At any time, you can log on to your SecurityCenter and create a customized URL for users.

This enables them to install selected protection software in a designated group and language.

Use this task to create a customized installation URL and send it to users.

Task

Installing Total Protection Service The standard installation process

(18)

1 In your web browser, log on to your SecurityCenter website.

2 From the Computers page, click Add Computer.

3 Select the group where you want to place the client computers, and select the types of protection to install, and a language for the software, then click Next. A customized URL is displayed, along with simple instructions for users.

4 Click Select Text and Copy to Clipboard.

5 In your local email application, open a new message and paste the text you have copied.

6 Revise the instructions as needed, then send the email to the users who need to install the software.

Installing with a URL

Use this task to install Total Protection Service on a client computer with a download URL.

Task

1 Email the URL you received in your Welcome email to users, or log on to the SecurityCenter, click Install Protection on the Dashboard page, and follow the steps in the wizard to create a custom URL and email it to users.

2 Open the email message on the client computer and click the installation URL.

3 If prompted, select the types of protection to install, type your email address in the Email or identifier field, and click Continue.

NOTE:The information entered here identifies the computer where the installation is taking place. The SecurityCenter uses it to identify that computer in reports. If reports indicate a problem with a computer, you can use the email address to notify the user. If the user does not enter an email address, it is important to know how to contact the user when security issues arise.

4 When prompted, click Install.

5 In the File Download dialog box, click Run.

For installation, Total Protection Service uses a cookie that is created at this time and expires after 24 hours. If you save the installation file and try to install it after 24 hours have passed, or delete the cookie, you are prompted to begin the installation process again.

6 If the User Account Control dialog box appears, click Continue.

7 If you are installing firewall support, select Restart when prompted.

The silent installation process

The silent installation method uses the executable file VSSETUP to install Total Protection Service on a client computer, with no user interaction. This installation method is not network-specific and installs the software on any Windows operating system.

How silent installation works

1 Download VSSETUP from the SecurityCenter.

2 Deploy to each computer where you want to install the client software.

Installing Total Protection Service The silent installation process

(19)

3 On the computer, open a DOS window and run the VSSETUP command using the appropriate parameters.

Requirements for silent installation

To install Total Protection Service on a client computer using the silent installation method:

• You should run this program using an account with sufficient rights to install the product.

Typically local administrator rights are required, and some methods require remote execution rights.

• You must know your company key. To find it, check these locations:

• In the installation URL, the series of characters following

CK=

• On the SecurityCenter, the Accounts & Keys tab of the My Account page.

• To deploy VSSETUP.EXE, you must have a method for installing executable files on your network computers. For example:

• A third-party deployment tool, such as Novell NAL, ZenWorks, Microsoft Systems Management Server (SMS) installer, or Tivoli IT Director.

• A login script.

• A link to an executable file in an email message.

• A portable medium, such as a CD or thumb drive.

Installing with silent installation

Use this task to install Total Protection Service with the silent installation method.

Task

1 From your web browser, log on to your SecurityCenter.

2 On the Dashboard page, click Install Protection.

3 Select the group where you want to place the client computers, the types of protection to

(20)

4 Under Additional Installation Options, select Display advanced installation methods.

5 Under method 1, click VSSETUP to save the VSSETUP.EXE file to your hard drive.

6 Deploy the program to each client computer using your customary deployment tool, such as those listed underRequirements for silent installation.

7 On each client computer, open a DOS window and run the following command.

VSSETUP.EXE /CK=<your company key> /<parameters>

As shown in this example, you must include your company key (CK) as a parameter. See VSSETUP parameters for a list of optional parameters you can add to your command line.

NOTE:Your company key is included in the URL that you received when you subscribed to Total Protection Service. It is the hexadecimal value that follows the characters

CK=

at the end of the URL. Your company key is also listed on the SecurityCenter, on the Accounts & Keys tab of the My Account page.

8 If you are installing firewall protection, reboot the client computer.

Designating a relay server with VSSETUP

Use this task to specify whether a computer should function as a relay server.

Task

• Use a VSSETUP parameter to specify a computer as a relay server or change a relay server specification.

Use this parameter To do this...

VSSETUP /RelayServer=1

NOTE:If you do not specify this parameter, the default is 0 and the computer is not a relay server.

During installation, specify a computer is a relay server.

VSSETUP /SetRelayServerEnable=1 Modify an existing installation to specify a computer is

a relay server.

VSSETUP /SetRelayServerEnable=0 Modify an existing installation to specify a computer is

not a relay server.

VSSETUP parameters

For a silent installation, use this command line and any of the following parameters (which are not case-sensitive):

VSSETUP.EXE /CK=<your company key> /<parameters>

Description Parameter

Required. Launches Setup using the company key.

Your company key is listed on the SecurityCenter, on the Accounts &

Keys tab of the My Account page.

/CK=XYZ

(21)

Description Parameter

Identifies the user’s email address in administrative reports.

NOTE:Despite its name, the email variable does not need to be an email address. Do not use a string containing non-standard characters, because they might be displayed incorrectly in reports.

/Email=x@y.com

Uninstalls Total Protection Service.

/Uninstall

Sets a computer with a connection to the Internet as a relay server. If the computer is not used as a relay server, set to 0.

/SetRelayServerEnable=1

Reinstalls Total Protection Service, leaving the previous values for company key, email address, and machine ID intact.

/Reinstall

Places the computer into any group you have created. You can find the number associated with a group by checking the Computer Profiles report /Groupid=[group number]

or by generating a customized URL. The group ID is at the end of the URL in the formatG=xx.

NOTE:If you designate a group that does not exist, users are placed in the Default Group.

Selects the types of protection to install:

/P=b

/P=c ^• b— browser protection

• c— content filtering /P=f

• f— firewall protection /P=v

• v— virus and spyware protection

NOTE:If you omit the/Pparameter, only virus and spyware protection is installed.

Examples

VSSETUP.EXE /vfbc /CK=abcd /Email=joe@example.com /Groupid=3

Virus and spyware protection, firewall protection, browser protection, and content filtering are installed. The company key isabcd, the user’s email address isjoe@example.comfor reporting purposes, and this user is placed in an existing group represented by the number3. Check the Computer Profiles report to find the correct numeric groupid.

VSSETUP.EXE /CK=abcd /Email=joe@example.com

Only virus and spyware protection is installed. The company key is abcd and the user’s email address isjoe@example.comfor reporting purposes.

The push installation process

Push means deploying remotely to one or more computers in a network. This method uses the Push Install utility to deploy the client software directly from your service provider’s website to client computers on your network. Push installation does not require third-party deployment software or interaction with users.

To perform a push installation:

1 Designate anadministrative computer, where you will install the Push Install utility and initiate the push.

Installing Total Protection Service The push installation process

(22)

2 Select thetarget computers, which are client computers on your network that will receive the software.

The Push Install utility is an ActiveX control that runs on an administrative computer. It installs client software on all target computers that are online when the push takes place. Use push installation to install client software on new network computers, or to install additional types of protection on computers with existing client software.

The Push Install utility allows you to specify one or more network computers that have an Internet connection as relay servers. You must do so in a separate push operation, because you cannot push to relay servers and non-relay servers at the same time. SeeDecide whether to set up relay servers for more information.

How push installation works

1 From the SecurityCenter, obtain the Push Install utility from one of these locations:

• As part of the Install Protection wizard.

• From the Utilities page.

2 Initiate a push to one or more client computers.

(23)

3 Initiate a push to one or more relay servers(optional).

Considerations for scheduling push installations

When scheduling push installations:

• Consider other network tasks. Pushing to a large number of computers simultaneously can produce a high volume of network traffic, so schedule push installations for times when they will not affect other network tasks.

• Make sure the target computers are turned on. The Push Install utility installs client software on target computers that are online and turned on when the push takes place.

• Make sure users are not using the target computers. Restarting a client computer while a push installation is in progress can cause the computer to become unstable, so schedule push installations for times when users will not be using their computers.

We recommend scheduling a push installation for the middle of the night, and sending users an email during the day asking them to leave their computers turned on overnight.

(24)

Requirements for push installation

You must meet these system requirements to deploy Total Protection Service on client computers using the push installation method.

Requirements for target computers

• All target computers must be logged on to the same Microsoft Windows domain as the administrator.

Requirements for administrative computers

• The administrative computer must be running the Windows 2000, Windows XP Professional, Windows Vista, or Windows 7 operating system.

NOTE:Push installation is not supported on Microsoft Windows XP Home Edition because Windows XP Home Edition cannot log on to an Active Directory domain.

• The administrative computer must be running Internet Explorer 6.0 or later, with ActiveX enabled.

• At the administrative computer, you must be logged on with domain administrator privileges for the domain being installed.

• You must have your credentials for logging on to the SecurityCenter administrative website.

You received them in a Welcome email after you placed your order.

• Administrative computers running the Windows firewall and Windows XP Professional, Windows Vista, or Windows 7 must add File and Print Sharing to the firewall’s Exceptions list.

Preparing the administrative computer

Administrative computers running the Windows firewall on Windows XP Professional, Windows Vista, or Windows 7 must add File and Print Sharing to the firewall’s Exceptions list.

Use this task to prepare an administrative computer before running the Push Install utility.

Task

1 Open Windows Control Panel.

2 Double-click Windows Firewall or Windows Security Center.

3 On the Exceptions tab, under Programs and Services select File and Print Sharing.

4 Click OK.

Installing with push installation

Use this task to deploy the Total Protection Service client software using the Push Install utility.

CAUTION:Back up any vital data on your critical servers before pushing software to them.

Task

1 On the administrative computer, open Internet Explorer, log on to the SecurityCenter, then click Install Protection.

(25)

2 Select the type of computers to install software on, then click Next.

3 If you are installing to new computers (where Total Protection Service is not currently installed), select the group where you want to assign the computers.

4 Select the types of protection to install, select the language, then click Next.

5 Under Additional Installation Options, select Display advanced installation methods.

6 Under method 2, click Run Push Install utility. A window lists the visible computers in your domain.

7 Select the target computer(s) from the left pane, then click Add.

8 Optionally, select Set as Relay Server(s) to configure all the selected computers as relay servers, which can distribute updates to other computers on the network.

9 Select the type(s) of protection to install, then click Install Components. After installation is complete, a status for each target computer is displayed.

10 Click View Log to open a log file in Microsoft Notepad, which shows the status of the current session. The contents of the log file are deleted when you close the Push Install utility or perform another push installation.

NOTE:The dialog box and log file indicate only whether the files were pushed to the target computers. It is important to review reports on the SecurityCenter or check the client computers to verify that the files were installed and the computers are updating successfully.

11 Save the log file or, optionally, click Back to return to the previous screen and push to more computers.

12 If you have installed firewall protection, restart the client computers.

Removing the Push Install utility

Use this task to remove the utility from the administrative computer after deploying Total Protection Service.

Task

1 In your Windows Control Panel, open Add/Remove Programs.

2 Select McAfee PushInstall.

(26)

3 Click Remove.

Processes for pre-installed and CD versions

When you install a copy of Total Protection Service by using a download URL, silent installation, or push installation, the copy is activated and current licensing information is applied

automatically. However, when Total Protection Service is pre-installed on a computer by the manufacturer or installed from a CD, additional steps are required to set up the account.

Follow this process If your copy is...

To install the first copy:

Installed from a CD

1 Install using a CD.

2 Activate the software.

3 During the activation process, enter a license key to install the first copy and create an account.

4 After activation is complete, save the account enrollment key created by the Activation wizard. (You can also find it on the SecurityCenter, on the Accounts

& Keys tab of the My Account page.) To install on additional computers:

1 Install using a CD.

2 Activate the software.

3 During the activation process, enter the account enrollment key.

See the instructions that came with the CD for more information.

Pre-installed 1 Activate your copy of Total Protection Service.

2 During the activation process, if a license key is required, enter the license key located on the McAfee license card shipped with your system. (Some PC makers do not require a license key. If no key is requested, skip this step.) 3 During the activation process, enter the account enrollment key if prompted.

4 If it is a trial subscription, purchase a full subscription by the end of the trial period.

About pre-installed trial and full subscriptions

If a copy of Total Protection Service is pre-installed when you receive the computer, one of these options occurs when you turn on the computer:

• A trial period begins. Activate the trial copy, evaluate the protection features, then purchase a full subscription to extend protection beyond the trial period.

• A full subscription begins. Activate the subscription, then use the protection features until it is time to renew the subscription.

When you first turn on the computer

The first time a network is detected, the pre-installed copy of Total Protection Service updates the detection definition (DAT) files used to detect threats. The on-access scanning feature then begins checking all files automatically as they are accessed, and users can perform on-demand

Installing Total Protection Service

Processes for pre-installed and CD versions

(27)

scans to check all the files on the computer for threats. To continue receiving updates that protect against new threats, the copy of Total Protection Service must be activated.

In most cases, a dialog box reminds users to activate. If they do not activate, their copy of Total Protection Service stops functioning at the end of the activation period. When they attempt to access a feature, a dialog box notifies them that the activation period has ended and offers them the opportunity to purchase a full subscription.

Activating the copy of Total Protection Service

Activate each copy of Total Protection Service to continue receiving updates to the detection definition (DAT) file, which protects against the latest threats. An activated copy checks for updates automatically at regular intervals. After activating a trial version, users also have an option to purchase a full subscription that extends protection beyond the trial period.

Use this task to activate the software.

Task

1 On the client computer, click the Total Protection Service icon in the system tray, then select Activate, or select the Activate link in a notification dialog box.

2 In the Activation wizard, select the type of account to activate.

If you want to...

Select this option...

If this is the first copy of Total Protection Service that you are activating or purchasing, create a new account.

If you purchased multiple licenses for Total Protection Service, you can then add other computers to this account and manage security for all of them.

Create a new account

Join an account that has already been set up.

An account enrollment key is required. This was provided when the account was set up. View the Join an existing account

account enrollment key or create a new one from the Accounts & Keys tab on the My Account page of the SecurityCenter.

3 Enter information to identify the account by following the instructions in the Activation wizard.

4 When creating a new account, save the account enrollment key to use while installing Total Protection Service on other computers. You will also receive an email with an installation URL for use when installing Total Protection Service on other computers.

NOTE:If you are asked to enter a license key and you do not have one, you can set up a trial account, then activate the license key and convert to a full account after you obtain one.

Purchasing or renewing a full subscription

Once a trial subscription is activated, you can extend protection for your computer by purchasing a full subscription during the trial period. A full subscription ensures that you continue to receive updates and retain access to features such as on-demand scans, automatic scanning of incoming

(28)

email and attachments, monitoring of incoming communications for suspicious activity, and up-to-the-minute safety reports while browsing and searching the Internet.

When a full subscription nears expiration, you can renew it to ensure uninterrupted protection.

Use this task to purchase or renew a subscription.

Task

1 On the client computer, click the Total Protection Service icon in the system tray, then select Buy or Renew this subscription. (You can also select these options from the notification dialog box.)

2 When prompted, enter your contact and payment information.

NOTE:If a trial or full subscription has expired, Total Protection Service is no longer protecting the computer. When users attempt to access a feature, a dialog box notifies them that their copy has expired and offers them the opportunity to purchase or renew a full subscription.

Viewing or creating an account enrollment key

The account enrollment key is a unique identifier that enables you to add new installations of Total Protection Service to your account. It remains valid for seven days.

An account enrollment key is originally created when you activate a new account for a pre-installed copy or a CD version of Total Protection Service. This key is required to:

• Activate new pre-installed copies of Total Protection Service under your account.

• Add new CD installations to your account.

If your key expires or is compromised, create a new one, which becomes effective immediately.

Use this task to view or create an account enrollment key.

Task

1 On the My Account page of the SecurityCenter, click the Accounts & Keys tab.

2 Check for an existing key in the Account Enrollment Key section.

3 If no current key is listed, click Create a new key. A new key appears on the page.

Activating your license key after installation

If you do not have a valid license key when you install Total Protection Service, you can set up a trial subscription to protect your computers while you obtain a license key.

Use this task to set up the trial, then obtain and activate a license key.

Task

1 During the activation process, select Continue as a trial user.

2 On the My Account page of the SecurityCenter, click the Accounts & Keys tab.

3 Select Activate License Key.

(29)

4 Contact your reseller or McAfee product support to obtain a valid license key.

5 Enter the information requested in the form, then click Next.

Once you activate your license key, your account becomes a licensed full subscription.

Licensing information is also updated automatically for other computers installed under your account.

Completing the installation

After installing Total Protection Service, use these tasks on each client computer to ensure that the software is working correctly and the computer is protected.

Tasks

Testing virus protection Scanning the client computer Scanning the email Inbox

Testing virus protection

Use this task to test the virus-detection feature of virus and spyware protection by downloading the EICAR Standard AntiVirus Test File at the client computer. Although it is designed to be detected as a virus, the EICAR test file is not a virus.

Task

1 Download the EICAR file from the following location:

http://www.eicar.org/download/eicar.com

If installed properly, virus and spyware protection interrupts the download and displays a threat detection dialog box.

2 Click OK, then select Cancel.

NOTE:If installed incorrectly, virus and spyware protection does not detect the virus or interrupt the download process. In this case, use Windows Explorer to delete the EICAR test file from the client computer, then reinstall Total Protection Service and test the new installation.

Scanning the client computer

After installing virus and spyware protection for the first time, we recommend running an on-demand scan of all client computer drives before proceeding. This scan checks for and cleans or deletes existing threats in files. In the future, files are scanned when they are accessed, downloaded, or saved.

Use this task to scan the drives on a client computer.

Task

1 On the client computer, click the Total Protection Service icon in the system tray, then select Console.

Installing Total Protection Service Completing the installation

(30)

2 From the Action Menu, select Scan Tasks, then select Scan My Computer.

3 In the Scan Completed dialog box, click Report to view scan statistics and check whether any threats were detected during the scan.

Scanning the email Inbox

After installing virus and spyware protection for the first time, we recommend running an on-demand email scan before proceeding. This scan checks for threats in email already in the client’s Microsoft Outlook Inbox. Future emails are scanned before they are placed in the Inbox.

Use this task to scan the contents of the Inbox.

Task

• From the Tools menu in Outlook, select Scan for Threats. The On-Demand Email Scan dialog box appears when the scan starts. From the dialog box, you can stop, pause, and restart the scan. You can also check the results of the scan.

Installing Total Protection Service Completing the installation

(31)

Troubleshooting and support

This chapter provides information to help resolve issues related to installing and activating Total Protection Service.

Contents

Frequently asked questions Error messages

Contacting product support

Frequently asked questions

This section includes questions asked by administrators and client computer users that are related to installing and activating the Total Protection Service client software.

Questions about installation

Can I use a non-Microsoft browser, such as Mozilla Firefox or Opera?

No. The client computer must use Microsoft Internet Explorer 6.0 or later to install the client software. However, once the client software is installed, the default Internet browser can be used for other purposes. You can view the SecurityCenter using Internet Explorer or Firefox.

How do users without administrator rights install the client software with an Internet URL?

To allow users without administrator rights to install the client software, you must first install a standalone installation agent on their client computers. SeeInstalling the standalone installation agent.

Does it matter which email address or identifier I enter when installing the client software?

No. Any description can be entered in the field, or it can be left blank. However, an email address provides a link for notifying the principal user about security issues for the computer.

The information entered identifies the client computers in administrative reports.

While installing the client software, the installation process appears to stop responding.

The installation might take a few minutes to complete. However, if the status bar stops moving and nothing in the installation window has changed in more than five minutes, close the window and start the installation process again (for example, by clicking the installation URL).

(32)

Do access protection or behavior blocking rules in other applications affect installation of the client software?

Yes. If users are unable to install the client software and you have defined access protection or behavior blocking rules, such as those that would prevent binaries from executing from the Temp folder, disable them and try installing again.

I want to update the Windows operating system on my client computer. Do I need to reinstall the Total Protection Service client software?

Yes. If you upgrade a client computer’s operating system (for example, from Windows 2000 to Windows XP) and you want to leave your existing files and programs intact during the upgrade, you must first uninstall the client software, then reinstall it after the upgrade is complete.

Questions about pre-installed or CD versions

Why should I activate each copy of the Total Protection Service client software?

The first time a user turns on a computer with a pre-installed copy of Total Protection Service or installs Total Protection Service from a CD, the computer is updated with the latest detection definition (DAT) files and product components. No more updates occur until the copy of Total Protection Service is activated. To ensure that the computer is always protected against the latest threats, activate the copy as soon as possible.

How do I get another account enrollment key if mine is lost or expired?

On the My Account page of the SecurityCenter, click the Accounts & Keys tab, then check the Account Enrollment Key section to view the existing key. If no key exists, select Create a new key. Account enrollment keys remain valid for seven days.

How can I protect a computer while I purchase additional licenses?

Install Total Protection Service as a trial. Then purchase additional licenses and merge the trial account into your main account.

What if I can’t find my license key or the key is not valid?

If you do not have a valid license key when you install Total Protection Service, you can obtain one and register it later. Install Total Protection Service as a trial to ensure that the computer is protected while you obtain a license key, then activate the license key.

How do I know when new installations of Total Protection Service have joined my account? Do I need to perform any setup tasks for them?

An alert appears on the Dashboard page of the SecurityCenter to notify you when new computers have been added. By default, new computers are placed in the Default Group and assigned the McAfee Default policy. If you want to change these settings, click the resolution button for the alert to display instructions. If you do not want to change these settings, select Dismiss Alert.

Troubleshooting and support Frequently asked questions

(33)

Error messages

This section includes error messages that are related to installing and activating the Total Protection Service client software. Locate an error message to see details about causes and solutions.

Error messages for installation

A file needed to install the software is not available. Please click the installation URL to begin the installation process again.

When a user clicks the installation URL to download the installation file, a cookie is created.

The cookie expires after 24 hours. If the user saves the installation file and then tries to install it after 24 hours have passed, or deletes the cookie, that user must download the file and begin the installation process again.

Cannot find remote shared directory.

This error appears during a failed push installation. The target computers did not meet one or more of the following requirements:

• File and Print Sharing must be enabled.

• User-level access control must be configured.

• They must not be running Microsoft Windows XP Home Edition, which does not support Windows NT Domain logins.

• The person initiating the push must have domain administrator rights.

Check if the client computer you are pushing to has the appropriate shares enabled, and if you have appropriate administrator rights to perform a push installation to that computer. To check:

1 On the client computer, select Start | Run.

2 In the Open text box, type\\CPUNAME\ADMIN$(where CPUNAME is the name of the computer to which you are pushing); then click OK.

The \Windows directory of the computer to which you are trying to push should be displayed.

If you do not have sufficient administrator rights to that computer, or if that computer does not have appropriate user-level access and sharing enabled, a Network path not found error dialog box appears.

3 See your Windows networking documentation for information on fixing your network administrative settings.

Installation cannot proceed because you have selected not to accept a vital agent component....

The full text of the error message is Installation cannot proceed because you have selected not to accept a vital agent component, you don’t have administrative rights to your machine, or other issues occurred. This error message can be caused by several different problems:

• The security level of the browser is too high. Set the browser’s security level to Medium or Medium-high.

• The user doesn’t have administrator rights. Users must have administrator rights to install protection on client computers. If they do not, you need to install the standalone installation agent.

Troubleshooting and support Error messages