background image

24

• 

Top Threats

  List of the most frequently detected threats

• 

Top Clients with most Threats

  Lists the most “active” client workstations (in number of detected threats)

• 

Threats Progress

  Progress of malware events (number)

• 

Threats Comparative Progress

  Progress of malware events by selected threats (using filter) compared with the total number of malware

• 

Threats By Scanner 

  Number of threat alerts from the individual program modules

• 

Threats By Object 

  Number of threat alerts according to the way they attempted to infiltrate (emails, files, boot sectors)

• 

Combined Top Clients / Top Threats

  Combination of the above mentioned types

• 

Combined Top Threats / Threats Progress

  Combination of the above mentioned types

• 

Combined Top Threats / Threats Comparative Progress

  Combination of the above mentioned types

• 

Clients Report

,

 Threats Report

,

 Events Report

,

 Scans Report

,

 Tasks Report

  Typical reports that can be viewed in the Clients, Threat Log, Event Log, Scan Log or Tasks tab

• 

Comprehensive Report

  Summary of:

  –

 

Combined Top Clients / Top Threats

 

 

Combined Top Threats / Threats Comparative Progress

 

 

Threats Progress

In the 

Filter

 section you can use the 

Target clients

 or 

Threat

 drop-down menus to select which clients or viruses will 

be included in the report.

Other details can be configured by clicking the 

Additional Settings...

 button. These settings apply mostly to data in 

the heading and in the types of graphical diagrams used. However, you can also filter data according to the status of 

chosen attributes (show only clients with a “Protection State“ problem), as well as choose which report format will 

be used (HTML, CSV).

Interval

 

tab - This tab allows you to define an interval for which the report will be generated:

• 

Current

  Only events which occurred in a chosen time period will be included in the report – e.g., if a report is created 

on Wednesday and the interval is set to 

Current Week

, then the events from Sunday, Monday, Tuesday, and 

Wednesday will be included.

• 

Completed

  Only events which occurred in a chosen, closed period will be included in the report (for example, the entire 

month of August, or a whole week – from Sunday to next Saturday). If the option 

Add also the current period

 is 

selected, the report will include events from the last completed period up till the moment of creation. 

 

Example:

 

We want to create a report including events from the last calendar week, i.e. from Sunday to next Saturday. We 

want this report to be generated on the next Wednesday (after Saturday).

     In the 

Interval

 tab, select 

Completed

 and

 1 Weeks

. In the 

Scheduler

 tab set 

Frequency

 to 

Weekly

 and select 

Wednesday

. The other settings can be configured according to the administrator‘s discretion. 

• 

From/To

  Use this setting to define a period for which the report will be generated.

Scheduler

 tab - This tab allows you to define and configure an automatic report in chosen time or intervals (Using 

the 

Frequency

 section).

Using the 

Run at

 spin box and the 

Start

 drop-down menu, enter the time and date when the report is to be generated. 

Click the 

Select Target...

 button to specify where the report is to be saved. Reports can be saved to the ERA Server 

(default), sent via email to a chosen address, or exported to a folder. The latter option is useful if the report is sent to 

a shared folder on your organization‘s intranet where it can be can be viewed by other employees.

To send generated reports via email, you need to enter SMTP server and sender address information as described in 

the Chapter 4.6 , “Configuring ERA Server using the Console.”

To define a fixed date range for the report-generation process, use the options in the 

Range

 section. You can define 

Содержание REMOTE ADMINISTRATOR

Страница 1: ...ESET Remote Administrator we protect your digital worlds Installation Manual and User Guide ...

Страница 2: ...4 Threat Log tab 22 4 4 5 Firewall Log tab 22 4 4 6 Event Log tab 22 4 4 7 The Scan Log tab 23 4 4 8 Tasks tab 23 4 4 9 Reports tab 23 4 4 10 Remote Install tab 25 4 5 ERA Console setup 25 4 5 1 Connection tab 25 4 5 2 Columns Show Hide tab 25 4 5 3 Colors tab 25 4 5 4 Paths tab 25 4 5 5 Date Time tab 25 4 5 6 Other Settings tab 25 4 6 Configuring ERA Server using the Console 26 4 6 1 General tab ...

Страница 3: ...narios for ESET Remote Administrator Mirror server and ESET client solutions 42 7 1 Small network 1x ERAS 1x Mirror server 42 7 1 1 Installation of HTTP Mirror server 42 7 1 2 Installation of ERA Server 43 7 1 3 Installation of ERA Console 43 7 1 4 Remote install on workstations present in the network 43 7 1 5 Remote install on notebooks currently not present in the network 44 7 2 Company with a r...

Страница 4: ...epends on the presence of an ESET solution on workstations or servers such as ESET NOD32 Antivirus or ESET Smart Security To perform a complete deployment of ESET security solutions portfolio the following steps must be taken Installation of ERA Server ERAS Installation of ERA Console ERAC Installation of Mirror server Installation of client computers ESET NOD32 Antivirus ESET Smart Security ESET ...

Страница 5: ...e Other instances of ERAS if replicated The chart below lists the possible network communications used when ERAS is installed The process era exe listens on TCP ports 2222 2223 2224 and 2846 Other communications occur using native operating system processes for example NetBIOS over TCP IP Protocol Port Description TCP 2222 ERAS listening Communication between clients and ERAS TCP 2223 ERAS listeni...

Страница 6: ...gure below He will not need to use the VPN tunnel to access individual departments the communications B C D and E allowing him to bypass a slower communication channel through the use of ERA Server replication The replication setup allows an administrator to define which information will be transferred to upper servers automatically at a preset interval and which will be sent upon request from the...

Страница 7: ...orrupt database error or license key error The log file allows you to quickly determine the exact cause of ERAS failing to launch correctly NOTE In the ERAS setup accessible through ERAC you can define several levels of logging including log rotation to significantly reduce log file size and growth rate Logging to the operating system application log can also be configured 2 1 5 Configuration To a...

Страница 8: ...an six months Decrease this value only in the event that the system is overwhelmed by entries from a large amount of clients The database is stored in the following directory ALLUSERSPROFILE Application Data Eset Eset Remote Administrator Server database Files related to records in the database are stored in ALLUSERSPROFILE Application Data Eset Eset Remote Administrator Server storage Information...

Страница 9: ... Configuration Editor The ESET Configuration Editor is an important component of ERAC and is used for several purposes One of the most important is the creation of the following Predefined configurations for installation packages Configurations sent as tasks to clients A general xml configuration file The Configuration Editor allows the administrator to remotely configure many of the parameters av...

Страница 10: ...user name EAV 12345678 and password but will also allow the use of a proxy server and defines its address and port 3 2 2 Key configuration entries In this section we will explain several of the key configuration entries for ESET Smart Security available through the ESET Configuration Editor Tools ESET Configuration Editor To change specific settings select the option in the tree structure on the l...

Страница 11: ...Choose Automatically all updates will be downloaded from ESET s update servers In this case please specify the User name and Password parameters which were provided at the time of purchase For information on setting client workstations to receive updates from a local server Mirror please see section 3 3 LAN Update Server Mirror NOTE On mobile devices two profiles can be configured one to provide u...

Страница 12: ...older method we recommend that you create a unique user name e g NODUSER This account would be used on all client machines for the sole purpose of downloading updates The NODUSER account should have read rights to the shared network folder which contains the update packages NOTE For authentication to a network drive please enter the authentication data in the full form WORKGROUP User or DOMAIN Use...

Страница 13: ... that server Select the Create update mirror option and enter a path to the folder which will store the update files By default this is a relative path to the Mirror folder as long as the option Provide update files via internal HTTP server is selected and is available on the HTTP port defined in HTTP server port by default 2221 Set Authentication to NONE Select the components to be downloaded Com...

Страница 14: ...t is not required to populate these fields as the authentication data will be entered at the client level Click the Advanced setup button and set Authentication to NONE1 select components to be downloaded components for all language versions which will be used in the network should be selected To maintain optimal functionality we recommend that you enable downloading and mirroring of program compo...

Страница 15: ...AC and ERAS an alert is displayed Connections can be password protected By default there is no password to connect to an ERA Server but we strongly recommend that one be established To create a password to connect to an ERA Server Click File Change Password and then click the Change button to the right of Password for Console When entering a password there is the option to Remember password Please...

Страница 16: ...he attribute Last Event Warning in section 5 of Figure 4 If you are not currently connected you can right click in the Server section 4 and select Connect to This Server to connect to the chosen ERAS If replication is enabled lower servers will automatically be displayed in the Server section 4 The most important features of ERAC are accessible from the menu or from the ERAC toolbar 3 The last sec...

Страница 17: ...y select highlight all other workstations or servers with the same attribute Inverse selection Perform inverted selection of entries Hide selected Hides selected entries Hide unselected Hides all unselected entries in the list The last two options are effective if further organization is needed after using previous filtering methods To disable all filters set by the context menu click View Cropped...

Страница 18: ...e one shown in the example below and the attribute New User will change to No NOTE The Comment attribute is optional in all three tabs The administrator may insert any description here e g Office No 129 NOTE Time values in ERAS can be displayed either in the relative mode 2 days ago or in the absolute mode 20 5 2007 In most cases data in tabs can be sorted in ascending or descending order by click...

Страница 19: ... client is communicating Domain Domain group name to which a client belongs these are not groups created in ERAS IP IP address Product Name Name of product from ESET Product Version Version of the above mentioned product Last Connected Last connection of a client to its ERAS All other data from a client have this timestamp except for some data obtained by replication Protection Status Text Current...

Страница 20: ...s current configuration The attribute includes time of configuration if there is no replication activated it equals to the time when it had been modified for the last time Protection Status General status statement Similar in nature to the attribute Configuration Protection Features General status statement for program components Similar to Configuration System Information Information about progra...

Страница 21: ...ation tab This tab allows you to view or export the current client configuration to an xml file Later in this manual we will explain how xml files can be used to create a configuration template for new modified xml configuration files For more information see Tasks in Chapter 5 the Protection Status tab General status statement regarding all ESET programs Some of the statements are interactive and...

Страница 22: ...vity Attribute Description Firewall Id ID of the corresponding entry in the database tab Client Name Name of client reporting the event Computer Name Computer name of the client reporting the event MAC Address MAC address of the client reporting the event Primary Server Name of the ERA Server with which the client is communicating Date Received Time at which the event was logged by ERAS Date Occur...

Страница 23: ... files Cleaned Number of cleaned files Status Status of the scan User Name of the logged in user when the scan took place Type Who started the task Scanner Type of scan performed Details Any detailed information 4 4 8 Tasks tab The meaning of this tab is described in Chapter 5 Tasks The following attributes are available Attribute Description Task Id ID of the corresponding entry in the database t...

Страница 24: ... Current Only events which occurred in a chosen time period will be included in the report e g if a report is created on Wednesday and the interval is set to Current Week then the events from Sunday Monday Tuesday and Wednesday will be included Completed Only events which occurred in a chosen closed period will be included in the report for example the entire month of August or a whole week from S...

Страница 25: ... setup The ERA Console can be configured in the Tools Console Options menu 4 5 1 Connection tab This tab is related to communication between the ERA Console and ERA Server For more details see the beginning of Chapter 4 ESET Remote Administrator Console in detail 4 5 2 Columns Show Hide tab This tab allows you to specify which attributes columns are displayed in individual tabs Changes will be ref...

Страница 26: ...ts found in order to specify which events will trigger a color change of the ERAC icon Show all groups in filter panes Changes the group filtration Tutorial messages Disables Disable All or enables Enable All all informative messages Warn if the server license is about to expire in X days If enabled the program will display a notification X days before the license date Warn if there is only X free...

Страница 27: ...client Delete clients not connected for the last X months days Deletes all clients that have not connected to ERAS form more than the specified number of months or days Delete threat logs older than X months days Deletes all virus incidents older than the specified number of months or days Delete firewall logs older than X months days Deletes all firewall logs older than the specified number of mo...

Страница 28: ...nt individual ERA Servers Each ERA Server is represented by its name which should be the same as Computer Name to avoid confusion and the corresponding settings in the replication dialog window Other options which influence the replication behavior of servers Replicate threat log Replicate firewall log Replicate event log Replicate scan log If these options are selected all information displayed o...

Страница 29: ...It verifies the user account which is specified at the client s side in the form of user name and password granting access to the update server In order for the Mirror feature to function properly it is necessary to specify in the Advanced Setup window which components will be downloaded from the update servers including language versions Press F5 from the main program window of ESET Smart Securit...

Страница 30: ...onfiguration files are performed in the ESET Configuration Editor described previously Please take note of the icons associated with each setting they will turn blue if changed To view a selected configuration click View To modify a selected configuration click Edit Click Create from Template to open an existing xml configuration file and use it as a starting point for a completely new configurati...

Страница 31: ... detected scan creates a log Scan without cleaning disabled action taken corresponds to configuration defined for cleanable and uncleanable threats If there are generation 3 x solutions present on client computers ESET Smart Security or ESET NOD32 Antivirus then select On demand Scan task for Windows ESET Security Product and follow these steps Select the profile to be applied for the scan on the ...

Страница 32: ... client solutions The parameter is not required for remote installation Installation packages contain their own xml configuration which is applied automatically Parameters for ESET NOD32 Antivirus version 2 x should be typed after the file setup exe which can be extracted along with other files from the installation package e g setup exe silentmode SILENTMODE Quiet installation mode no dialog wind...

Страница 33: ...bution of MSI LANDesk etc In the end the most important aspect is to deliver the installation file or the agent to clients and to ensure that it is launched under an Administrator account For this purpose the direct installation described in the previous section can also be used Remote installation by means of ESET Remote Administrator consists of these steps Creation of installation packages Dist...

Страница 34: ...mputers should be online The following is a list of requirements for additional requirements see the Chapter 2 ERAS Microsoft network client enabled feature of network adapter File sharing service enabled feature of network adapter File sharing service enabled in firewall Services Remote Registry Service Remote Service Manager Server Administrator user name and password for client workstations pre...

Страница 35: ...nfo to view information on selected clients 6 In most cases you will be prompted to insert the user name and password of the account under which the installation will take place it must be an account with administrator rights 7 The following operations are indicated by a progress bar and a text message The operations are described below 8 ERAS sends the einstaller exe agent to the workstation with...

Страница 36: ...ions Get Info This feature detects the current status of the ESET client solution on selected workstations requires Administrator user name and password This feature uses the admin share Uninstall Program removal the agent tries to remotely uninstall the program The Uninstall mode does not take into consideration which package is selected from the Package menu Diagnostics Checks the availability o...

Страница 37: ...on see section 6 4 Avoiding repeated installations NOTE The line calling the einstaller exe agent from the logon script can be inserted using a text editor or other proprietary tool Similarly einstaller exe can be sent as an email attachment by any email client Regardless of the method used make sure you are using the correct einstaller exe file NOTE For einstaller exe to launch the currently logg...

Страница 38: ...ddresses from the address book3 or insert individual addresses Insert a Subject in the corresponding field Type a message into Body Click Send to send the message Figure 11 Send Eset Installer Via E mail dialog window During the process of remote installation backward connection to ERAS takes place and the agent einstaller exe The ERA Console opens the Microsoft Outlook address book provided it is...

Страница 39: ...tallation without displaying a user interface During the process of remote installation backward connection to ERAS takes place and the agent einstaller exe adopts settings from the Set Default Logon for E mail and Logon Script settings in the Remote Install tab Click Logon to specify the user name and password of the account under which the installation of the package is to be performed It must b...

Страница 40: ...he flag is written to the following registry key HKEY_LOCAL_MACHINE Software Eset Eset Remote Installer If the Type and Name of the package defined in the einstaller exe agent matches the data in the registry no installation is performed This process prevents repeated installations to target workstations if the einstaller exe agent is launched repeatedly The ERA Server provides an additional level...

Страница 41: ...ivered to a target workstation in TEMP einstaller log the most important messages are sent back to the ERA Server TCP 2224 Of course this happens only if there is no communication problems between the workstation and ERAS At this point in the installation the following messages may be encountered Eset Installer was told to quit by the server X 2224 Eset Installer could not connect to server X The ...

Страница 42: ...ed GHOST During the installation the license key file nod32 lic must be supplied in order to provide operation of ERAS for a defined period After installation the ERAS service is launched automatically The activity of the ERAS service is recorded in the following file ALLUSERSPROFILE Application Data Eset Eset Remote Administrator Server logs era log 7 1 2 Installation of ERA Console Install the E...

Страница 43: ... Advance Settings In the tree like structure navigate to ERA Server Setup Mirror Create mirror for the selected program components Click Edit on the right hand side and select program components to be downloaded Components for all language versions to be used in the network should be selected In the tab Updates click Update now to create Mirror 7 1 4 Remote install on workstations present in the n...

Страница 44: ...e Installation Packages Editor window Click Close in the Installation Packages Editor dialog window You will be prompted to define the name of the package i e workstation The installation package is now created Last the actual push installation process can be performed Click the Install button Remote Install tab and follow the instructions from previous chapters It is important to select the works...

Страница 45: ...vers is granted by the User name and Password supplied by ESET after purchase Click Console on the right side of the ESET Configuration Editor to return to the Installation Packages Editor window Click Yes and then Save as in the Installation Packages Editor window and save the modified installation package as notebooks Click Close to return to the ERA Console Next the einstaller exe agent needs t...

Страница 46: ...r Let s use a copy of the previous network structure and add one subsidiary with several clients and one server named LITTLE Let s suppose there is a VPN channel between the headquarters and the subsidiary In this scenario the Mirror server should be installed on the server LITTLE We will also install a second ERA Server on LITTLE in order to create a more user friendly environment and minimize th...

Страница 47: ...e 14 updates for the subsidiary are not downloaded from ESET s update servers but from the server at the headquarters GHOST The update source is defined by the URL address http ghost 2221 or http IP_address_of_ghost 2221 By default there is no need to specify a user name or password because the integrated HTTP server requires no authentication 7 2 4 Subsidiary Remote installation to clients Once m...

Страница 48: ...es in your local network i e notebooks we recommend that you configure a combined update from two sources ESET s update servers and the local Update Server Mirror First notebooks contact the local Mirror server and if the connection fails they are outside of the office they download updates directly from ESET s servers To allow for this functionality Create two update profiles one directed to the ...

Страница 49: ...d xml file Thus any duplications between the Scheduler and non working profiles is avoided 8 3 Removing existing profiles If unused or duplicate profiles have been created on client workstations by mistake these can be removed remotely To remove an unwanted profile follow the steps below From the ERA Console click the Clients tab and then double click on a problematic client From the Client Proper...

Страница 50: ... or remove existing tasks it is necessary to Use an xml configuration exported from the given client Or use the same IDs of the tasks you intend to Edit or Remove This is the resulting Scheduled tasks window from an exported xml configuration Every new task is assigned an attribute ID Default tasks have decimal IDs 1 2 3 and Custom tasks are assigned hexadecimal keys e g 4AE13D6C which are automat...

Страница 51: ...orkstations modifies it and applies it as a configuration task to all 50 workstations This creates a problem because the same type of task now has two different IDs 4A2B8CA5 8D5A6D1B The modification will be performed correctly on the first 40 workstations but the 10 new workstations will have a new duplicate task created These complications can be avoided by clicking Change ID and setting a commo...

Отзывы: