background image

14

 

 

LifeTime=86400

 

The

 

time

 

(in

 

seconds)

 

for

 

which

 

the

 

index

 

will

 

be

 

used

 

before

 

it

 

is

 

automatically

 

re

created

 

if

 

somebody

 

logs

 

on

 

to

 

the

 

database.

 

The

 

default

 

is

 

30

 

minutes

 

but

 

is

 

never

 

recommended.

 

A

 

value

 

of

 

zero

 

means

 

that

 

it

 

never

 

expires

 

automatically,

 

and

 

the

 

value

 

of

 

86400

 

means

 

one

 

day.

  

 

A

 

value

 

of

 

zero

 

gives

 

you

 

full

 

control

 

but

 

this

 

setting

 

needs

 

a

 

separate

 

process

 

to

 

recreate

 

the

 

index.

  

This

 

could

 

be

 

a

 

simple

 

batch

 

file

 

that

 

runs

 

overnight

 ‐ 

removes

 

the

 

index

 

files

 

and

 

forces

 

a

 

recreate.

 

This

 

can

 

sometimes

 

produce

 

the

 

best

 

result

 

and

 

performance.

   

 

Recreation

 

of

 

the

 

index

 

files

 

will

 

take

 

performance.

 

It

 

will

 

cause

 

the

 

logon

 

to

 

be

 

delayed

 

for

 

quite

 

some

 

time

 

dependant

 

on

 

database

 

size

 

and

 

performance,

 

and

 

can

 

cause

 

issues

 

if

 

the

 

creation

 

of

 

systems

 

occurs

 

during

 

this

 

rebuild

 

time.

 

Therefore,

 

depending

 

on

 

the

 

size

 

of

 

the

 

database,

 

it

 

is

 

recommended

 

this

 

process

 

is

 

set

 

to

 

run

 

very

 

early

 

in

 

the

 

morning.

  

For

 

example,

 

remove

 

name*

 

files

 

in

 

SBDATA

 

00000001

 

and

 

00000002

 

folders

 

especially

 

through

 

a

 

script

 

early

 

morning

 

2

 

A.M.

 

Following

 

that,

 

run

 

an

 

admin

 

logon

 

using

 

the

 

command

 

line

 

tool

 

(SBADMCL)

 

and

 

perform

 

a

 

command

 

such

 

as

 

getcounts

 

through

 

script

 

to

 

rebuild

 

the

 

cache

 

early,

 

before

 

the

 

systems

 

synchronize.

 

 

You

 

can

 

use

 

a

 

batch

 

files

 

for

 

this,

 

one

 

example

 

is

 

called

 

RecreateCache.bat.

 

Examples

 

of

 

scripts

 

are

 

in

 

the

 

optional

 

EEPC

 

Tools

 

download,

 

or,

 

available

 

from

 

your

 

McAfee

 

representative.

 

 

[Attribs]

 

SingleFile=No

 

If

 

this

 

is

 

set

 

to

 

Yes,

 

the

 

attributes

 

for

 

objects

 

will

 

be

 

placed

 

into

 

a

 

single

 

file

 

instead

 

of

 

each

 

one

 

having

 

their

 

own

 

file.

 

Not

 

generally

 

used

 

although

 

it

 

simplifies

 

and

 

speeds

 

up

 

backup,

 

this

 

will

 

make

 

the

 

database

 

twice

 

as

 

slow!

   

 

AutoConvert=No

 

If

 

this

 

is

 

set

 

to

 

Yes

 

and

 

SingleFile

 

is

 

also

 

set

 

to

 

Yes,

 

then

 

attributes

 

are

 

automatically

 

converted

 

to

 

a

 

single

 

file

 

when

 

the

 

object

 

is

 

opened

 

for

 

writing.

 

Otherwise,

 

only

 

new

 

objects

 

will

 

have

 

their

 

attributes

 

in

 

a

 

single

 

file.

 

NOTE

:

 

Attributes

 

are

 

not

 

converted

 

until

 

they

 

are

 

opened

 

for

 

writing.

  

Again,

 

this

 

can

 

produce

 

fewer

 

files

 

per

 

object

 

to

 

aid

 

backups

 

but

 

is

 

slightly

 

less

 

resilient

 

to

 

failure.

  

 

[Tracking]

 

ObjectChanges=No

 

Object

 

change

 

tracking

 

for

 

the

 

backup

 

tool

 

might

 

decrease

 

the

 

performance

 

of

 

the

 

database

 

by

 

about

 

100%

 

thus

 

it

 

is

 

not

 

recommended

 

to

 

use

 

this

 

in

 

big

 

environments.

 

 

Group

 

sizes

 

The

 

size

 

of

 

a

 

user

 

group

 

or

 

systems

 

group

 

should

 

not

 

be

 

too

 

big.

 

A

 

user

 

group

 

of

 

5000

 

can

 

take

 

20

 

seconds

 

or

 

more

 

to

 

open

 

even

 

on

 

a

 

fast

 

server.

  

We

 

recommend

 

keeping

 

the

 

size

 

under

 

2000.

  

Optimally

 

1000

 

or

 

less

 

will

 

work

 

well

 

in

 

many

 

cases

 

for

 

faster

 

access

 

to

 

groups

 

on

 

any

 

server.

   

 

Also

 

assigning

 

large

 

group

 

of

 

users

 

directly

 

to

 

a

 

client

 

can

 

have

 

performance

 

implications

 

(network/server

 

performance,

 

slow

 

client

 

boot

 

up

 

and

 

sync

 

times

 

and

 

installation

 

processes)

 

so

 

smaller

 

groups

 

are

 

better.

 

Users

 

can

 

be

 

assigned

 

individually

 

too.

  

The

 

fewer

 

users

 

assigned

 

the

 

better

 

from

 

a

 

security

 

perspective.

  

See

 

User

 

Objects

 

 

General

 

Performance

 

Tips

 

section

 

later.

 

 

 

Summary of Contents for ENDPOINT ENCRYPTION ENTERPRISE - BEST PRACTICES GUIDE

Page 1: ...1 McAfee Endpoint Encryption Enterprise Best Practices Guide November 2009...

Page 2: ...d No part of this publication may be reproduced transmitted transcribed stored in a retrieval system or translated into any language in any form or by any means without the written permission of McAfe...

Page 3: ...OF 5000 USER MACHINE OBJECT DIRECTORY 10 VIRTUAL SERVERS 10 GLOBAL DEPLOYMENTS 11 OPTIMISATION ACTIONS 11 OPTIMISATION ACTIONS OVERVIEW 12 NAME INDEXING DBCFG INI 13 WARNINGS 13 DBCFG INI 13 GROUP SI...

Page 4: ...19 CLEARING THE AUDIT 19 DELETED ITEMS CLEANUP 20 CHECKING FOR DATABASE CORRUPTION 20 WHY DOES THE DATABASE GET CORRUPTED 20 ORPHANED OBJECTS 21 RESTORE COMMANDS 21 CLEANUP COMMANDS 21 DUMP MACHINE D...

Page 5: ...e product and the environment in which it is being used before arriving at any decision on implementation strategy Calculations and figures in this guide are based on field evidence and not theoretica...

Page 6: ...a distributed way For example the Web Helpdesk component can be installed on a dedicated web server while the rest of the components are on a separate Endpoint Encryption Server However the majority o...

Page 7: ...hared Server can be used for low numbers Please see Virtual Server section in this guide Virtual hardware has to be of higher specification if resources are shared See Page 11 2000 5000 users systems...

Page 8: ...nvironment has not been fully tested at this time in engineering Load Balancing Given the best configuration is usually a single high performance server with DAS then the least optimal way to perform...

Page 9: ...s The default settings of the Communication Server limit the queue to 200 entries a balance between taking connections and processing connections After that point the connections are refused This is a...

Page 10: ...use of Virtual Servers is a result of Lack of resources dedicated to the virtual server Dynamically assigned resources to the virtual server which starves it of the necessary performance during peak p...

Page 11: ...y is necessary it is better to include endpoints from all regions in the pilot phase Optimisation Actions NOTE These are generic recommendations based on experience but not always be suitable for your...

Page 12: ...me to five minutes Disable NTFS Last Access Update with a registry change Increase the size of the NTFS Master File Table MFT with a registry change Optimize backups Exclude the Object Directory and t...

Page 13: ...smaller than 5000 systems otherwise you find the number by multiplying the number of users or systems in the database by 0 6 Example If the number of users in the database is 10 000 the Locktimeout s...

Page 14: ...lable from your McAfee representative Attribs SingleFile No If this is set to Yes the attributes for objects will be placed into a single file instead of each one having their own file Not generally u...

Page 15: ...ours NOTE A similar setting KeepAliveInterval has a default 1000 1 second this setting is correct so do not change this Last Access Time Stamp NtfsDisableLastAccessUpdate With large databases it is po...

Page 16: ...3 or 4 instead of the default value of 1 Object Directory Backup Tool Setup If you set up your Object Directory backup tool make sure it is not running too many times a day because the in between tim...

Page 17: ...ed you schedule EEPC command line tool SBADMCL to cleanup machine audit and the user audit See Endpoint Encryption Object Directory Maintenance section below File Cache on Raid Hard Drive Controller L...

Page 18: ...containing old deleted users systems and other objects and are found through the System tab in the Endpoint Encryption Manager These objects can slow searches down If these objects are needed for aud...

Page 19: ...ds please see the Endpoint Encryption Scripting Tool User Guide which is found in most normal installations of the Endpoint Encryption Manager Extracting and Clearing Audit from the Database The audit...

Page 20: ...within the Object Directory is renamed The extension of the folder is renamed from RMV to WPE With a very large database these empty removed folders can sometimes slow down searches In a test lab try...

Page 21: ...have a full backup of SBDATA before doing this Restore Commands To restore orphaned user objects back into a group use this command SBADMCL Command RestoreUsers Adminuser Admin Adminpwd mypassword Gr...

Page 22: ...ects in the DumpMaDesc log can be deleted from the database If the normal deletion doesn t work use Windows Explorer to browse to the actual location in the database and delete the physical folder In...

Page 23: ...utes servicing each client EEPC has excellent password synchronization across all the endpoint clients a user is assigned to It is therefore logical that adding thousands of users to each machine will...

Page 24: ...nate Requests This option stops the machine from entering hibernation mode Note this option is not supported in Vista With later versions of EEPC v5 x this should normally be left disabled to allow no...

Page 25: ...ppear as a fixed drive and therefore swaps with the fixed disk after booting from it It can cause recovery problems with Remove or Emergency Boot for example Alternatively use with a floppy disk drive...

Page 26: ...tion to encrypted data Using one autoboot user for too many machines Instead use more autoboot users to reduce the multiple connections and load on the autoboot user object in the database Autoboot us...

Reviews: