background image

25

 

 

of

 

the

 

other

 

groups

 

should

 

not

 

be

 

used

 

unless

 

there

 

is

 

a

 

specific

 

reason.

 

These

 

usually

 

include

 

“EEPC52

 

OPTION:”

 

or

 

similar

 

at

 

the

 

start

 

of

 

the

 

name

 

(example

 

from

 

EEPC

 

v5.2.2).

  

Some

 

of

 

the

 

optional

 

compatibility

 

file

 

groups

 

that

 

should

 

not

 

be

 

assigned

 

to

 

machines

 

unless

 

a

 

specific

 

issue

 

is

 

being

 

addressed:

  

 

 

“EEPC52

 

OPTION:

 

Exclude

 

Sector

 

59

 

for

 

NEC

 

Compatibility”

 

 

“EEPC52

 

OPTION:

 

Tests

 

for

 

Computrace

 

presence”

 

 

“EEPC52

 

OPTION:

 

Update

 

MBR

 

for

 

Endpoint

 

Encryption

 

for

 

PC

 

compatibility”

 

 

“EEPC52

 

OPTION:

 

Update

 

number

 

of

 

sides

 

reported

 

in

 

the

 

OS

 

boot

 

sector”

 

 

“EEPC52

 

OPTION:

 

WACOM

 

Active

 

Tablet

 

Pen

 

Driver”

 

 

Things

 

to

 

avoid

 

 

Alternative

 

supported

 

method

 

follows

 

each

 

item.

  

 

 

Do

 

not

 

assign

 

multiple

 

Theme

 

file

 

groups

  

 

Assign

 

the

 

Theme

 

you

 

require.

 

 

Avoid

 

using

 

SafeTech

 

via

 

bootable

 

USB

 

stick.

  

Although

 

the

 

function

 

it

 

is

 

available,

 

the

 

BIOS

 

on

 

many

 

laptops

 

causes

 

the

 

USB

 

stick

 

(at

 

boot

up)

 

to

 

appear

 

as

 

a

 

fixed

 

drive

 

and

 

therefore

 

swaps

 

with

 

the

 

fixed

 

disk

 

after

 

booting

 

from

 

it.

  

It

 

can

 

cause

 

recovery

 

problems

 

with

 

Remove

 

or

 

Emergency

 

Boot,

 

for

 

example.

  

 

Alternatively,

 

use

 

with

 

a

 

floppy

 

disk

 

drive

 

or

 

bootable

 

CD

 

(make

 

an

 

ISO

 

from

 

the

 

floppy

 

disk

 

to

 

make

 

a

 

bootable

 

CD).

   

 

Avoid

 

making

 

multiple

 

fundamental

 

changes

 

to

 

clients

 

at

 

once

.

  

For

 

example,

 

changing

 

the

 

encryption

 

state

 

and

 

upgrading

 

EEPC

 

clients

 

at

 

the

 

same

 

time

 

will

 

cause

 

problems.

 

 

Do

 

one

 

major

 

thing

 

at

 

a

 

time,

 

allow

 

clients

 

to

 

sync

 

and

 

perform

 

the

 

change,

 

then

 

make

 

the

 

second

 

change.

 

 

Do

 

not

 

assign

 

multiple

 

unnecessary

 

file

 

groups

 

as

 

a

 

“catch

 

all

 

for

 

all

 

possible

 

hardware/software

 

combinations.

 

 

 

Instead,

 

try

 

to

 

group

 

machines

 

carefully

 

and

 

assign

 

only

 

the

 

necessary

 

file

 

groups

 

for

 

their

 

specific

 

requirements.

 

 

Do

 

not

 

use

 

the

 

file

 

group

 

“EEPC52

 

OPTION:

 

Update

 

MBR

 

for

 

Endpoint

 

Encryption

 

for

 

PC

 

compatibility”

 

together

 

with

 

“EEPC52

 

OPTION:

 

Update

 

number

 

of

 

sides

 

reported

 

in

 

the

 

OS

 

boot

 

sector”

  

 

they

 

are

 

not

 

compatible

;

   

Instead,

 

use

 

one

 

or

 

the

 

other,

 

but

 

only

 

if

 

specifically

 

needed

 

or

 

recommended

 

by

 

McAfee

 

Support.

  

Summary of Contents for ENDPOINT ENCRYPTION ENTERPRISE - BEST PRACTICES GUIDE

Page 1: ...1 McAfee Endpoint Encryption Enterprise Best Practices Guide November 2009...

Page 2: ...d No part of this publication may be reproduced transmitted transcribed stored in a retrieval system or translated into any language in any form or by any means without the written permission of McAfe...

Page 3: ...OF 5000 USER MACHINE OBJECT DIRECTORY 10 VIRTUAL SERVERS 10 GLOBAL DEPLOYMENTS 11 OPTIMISATION ACTIONS 11 OPTIMISATION ACTIONS OVERVIEW 12 NAME INDEXING DBCFG INI 13 WARNINGS 13 DBCFG INI 13 GROUP SI...

Page 4: ...19 CLEARING THE AUDIT 19 DELETED ITEMS CLEANUP 20 CHECKING FOR DATABASE CORRUPTION 20 WHY DOES THE DATABASE GET CORRUPTED 20 ORPHANED OBJECTS 21 RESTORE COMMANDS 21 CLEANUP COMMANDS 21 DUMP MACHINE D...

Page 5: ...e product and the environment in which it is being used before arriving at any decision on implementation strategy Calculations and figures in this guide are based on field evidence and not theoretica...

Page 6: ...a distributed way For example the Web Helpdesk component can be installed on a dedicated web server while the rest of the components are on a separate Endpoint Encryption Server However the majority o...

Page 7: ...hared Server can be used for low numbers Please see Virtual Server section in this guide Virtual hardware has to be of higher specification if resources are shared See Page 11 2000 5000 users systems...

Page 8: ...nvironment has not been fully tested at this time in engineering Load Balancing Given the best configuration is usually a single high performance server with DAS then the least optimal way to perform...

Page 9: ...s The default settings of the Communication Server limit the queue to 200 entries a balance between taking connections and processing connections After that point the connections are refused This is a...

Page 10: ...use of Virtual Servers is a result of Lack of resources dedicated to the virtual server Dynamically assigned resources to the virtual server which starves it of the necessary performance during peak p...

Page 11: ...y is necessary it is better to include endpoints from all regions in the pilot phase Optimisation Actions NOTE These are generic recommendations based on experience but not always be suitable for your...

Page 12: ...me to five minutes Disable NTFS Last Access Update with a registry change Increase the size of the NTFS Master File Table MFT with a registry change Optimize backups Exclude the Object Directory and t...

Page 13: ...smaller than 5000 systems otherwise you find the number by multiplying the number of users or systems in the database by 0 6 Example If the number of users in the database is 10 000 the Locktimeout s...

Page 14: ...lable from your McAfee representative Attribs SingleFile No If this is set to Yes the attributes for objects will be placed into a single file instead of each one having their own file Not generally u...

Page 15: ...ours NOTE A similar setting KeepAliveInterval has a default 1000 1 second this setting is correct so do not change this Last Access Time Stamp NtfsDisableLastAccessUpdate With large databases it is po...

Page 16: ...3 or 4 instead of the default value of 1 Object Directory Backup Tool Setup If you set up your Object Directory backup tool make sure it is not running too many times a day because the in between tim...

Page 17: ...ed you schedule EEPC command line tool SBADMCL to cleanup machine audit and the user audit See Endpoint Encryption Object Directory Maintenance section below File Cache on Raid Hard Drive Controller L...

Page 18: ...containing old deleted users systems and other objects and are found through the System tab in the Endpoint Encryption Manager These objects can slow searches down If these objects are needed for aud...

Page 19: ...ds please see the Endpoint Encryption Scripting Tool User Guide which is found in most normal installations of the Endpoint Encryption Manager Extracting and Clearing Audit from the Database The audit...

Page 20: ...within the Object Directory is renamed The extension of the folder is renamed from RMV to WPE With a very large database these empty removed folders can sometimes slow down searches In a test lab try...

Page 21: ...have a full backup of SBDATA before doing this Restore Commands To restore orphaned user objects back into a group use this command SBADMCL Command RestoreUsers Adminuser Admin Adminpwd mypassword Gr...

Page 22: ...ects in the DumpMaDesc log can be deleted from the database If the normal deletion doesn t work use Windows Explorer to browse to the actual location in the database and delete the physical folder In...

Page 23: ...utes servicing each client EEPC has excellent password synchronization across all the endpoint clients a user is assigned to It is therefore logical that adding thousands of users to each machine will...

Page 24: ...nate Requests This option stops the machine from entering hibernation mode Note this option is not supported in Vista With later versions of EEPC v5 x this should normally be left disabled to allow no...

Page 25: ...ppear as a fixed drive and therefore swaps with the fixed disk after booting from it It can cause recovery problems with Remove or Emergency Boot for example Alternatively use with a floppy disk drive...

Page 26: ...tion to encrypted data Using one autoboot user for too many machines Instead use more autoboot users to reduce the multiple connections and load on the autoboot user object in the database Autoboot us...

Reviews: