User manual KASPERSKY LAB KASPERSKY ANTI-VIRUS - ADMINISTRATION KIT 5.0 - GETTING STARTED

KASPERSKY LAB Kaspersky® Administration Kit version 5.0 Getting started KASPERSKY® ADMINISTRATION KIT VERSION 5.0 Getting started © Kaspersky Lab http://www.kaspersky.com/ Revision date: December 2005 Contents CHAPTER 1. INTRODUCTION ...................................................................................... 4 CHAPTER 2. GETTING STARTED................................................................................ 6 2.1. Installing MSDE 2000............................................................................................ 7 2.2. Installing the Administration Server and Administration Console ........................ 8 2.3. Quick Start Wizard................................................................................................. 9 2.4. Creating an administration group........................................................................ 10 2.5. Remote installation of the Network Agent .......................................................... 11 2.6. Kaspersky Anti-Virus application deployment .................................................... 12 2.7. Checking the operation of the update task......................................................... 13 2.8. Configuring notifications ...................................................................................... 14 2.9. Testing the notification system and on-demand scan task................................ 15 2.10. Generating reports............................................................................................. 15 CHAPTER 3. UPGRADING FROM 4. TO VERSION 5.......................................... 17 CHAPTER 4. CONCLUSION........................................................................................ 18 APPENDIX A. KASPERSKY LAB................................................................................. 19 A.1. Other Kaspersky Lab Products .......................................................................... 20 A.2. Contact Us........................................................................................................... 25 APPENDIX B. LICENSE AGREEMENT....................................................................... 27 CHAPTER 1. INTRODUCTION This document outlines the main steps a network security administrator must take to quickly and efficiently install an anti-virus protection system, based on Kaspersky Lab's applications, across a corporate network using Kaspersky Administration Kit. This document examines a simple scenario in which anti-virus protection is installed on several computers. For successful installation, the computers must run Windows NT/2000/2003/XP. This document also describes the process of upgrading Kaspersky Lab's applications from version 4.x to version 5.x. Refer to the Kaspersky Administration Kit Administrator's Guide for detailed information on the application's functionality. Kaspersky Administration Kit 5 is designed for managing the anti-virus protection system within a corporate network. The application enables the administrator to do the following: · · · · Deploy Kaspersky Lab's applications across the network. Remotely manage the anti-virus protection system from a single location. Receive notifications across the network about virus protection-related events. Accumulate statistics and reports from all installations. Kaspersky Administration Kit 5 consists of the following components: · The Administration Server lets administrators manage Kaspersky Lab's applications installed across a network from a central location. The applications which can be managed currently are Kaspersky Anti-Virus for Workstations 5.0 and Kaspersky Anti-Virus for File Servers 5.0. The Administration Server stores all the data about the corporate anti-virus protection system in a Microsoft Development Environment (MSDE) 2000 or MS SQL Server 2000 database. MSDE 2000 Service Patch (SP) 3 or MS SQL Server 2000 SP 3 must be installed and configured before Administration Server is installed. You can install MSDE 2000 SP 3 from the package included with Kaspersky Administration Kit 5. Introduction 5 · The Network Agent is installed on workstations which are protected by either Kaspersky Anti-Virus for Workstations 5.0 or Kaspersky Anti-Virus for File Servers 5.0, and managed via the Administration Server. This component coordinates the interaction between Kaspersky Lab applications, running on client computers, and the Administration Server. The Network Agent receives commands from the Administration Server and dispatches information about the anti-virus protection status of client computers. The Administration Console provides a user interface for Server and Agent administration services. This component snaps into the Microsoft Management Console (MMC). · CHAPTER 2. GETTING STARTED To build an effective protection system around your corporate network, follow these steps: 1. Install MSDE 2000 SP 3 or SQL Server 2000 SP 3 (see section 2.1 on page 7). Skip this step if your network already has either of these database servers installed. Install the Administration Server and Administration Console (see section 2.2 on page 8). Configure the initial settings of the anti-virus protection system using the Quick Start Wizard (see section 2.3 on page 9). Create administration groups to manage groups of client computers by applying group policies and tasks (see section 0 on page 10). Remotely install the Network Agent on client computers to allow their anti-virus application to interact with the Administration Server (see section 2.5 on page 11). Remotely install Kaspersky Anti-Virus for Workstations 5.0 or Kaspersky Anti-Virus for File Servers 5.0 on selected client computers (see section 2.6 on page 12). Configure the downloading of anti-virus database updates from the Internet by the Administration Server, and verify that the operation is successful. Verify that the databases are being updated on client computers (see section 2.7 on page 13). Configure options for notifying the administrator of virus-related events on client computers (see section 2.8 on page 14). Run an on-demand scan on client computers and check the notification task performed on client computers (see section 2.9 on page 14). 2. 3. 4. 5. 6. 7. 8. 9. 10. View a report on the anti-virus protection of client computers and the number of viruses detected by Kaspersky Lab's applications (see section 2.10 on page 15). Getting started 7 If the steps above have been successfully completed, you have built a reliable anti-virus protection system for your corporate network. The following sections describe these steps in more detail. 2.1. Installing MSDE 2000 Skip this step if your network already has Microsoft Development Environment (MSDE) 2000 SP 3 or SQL Server 2000 SP 3 installed. To install MSDE 2000 from the package included in Kaspersky Administration Kit, 1. Select a computer on which to install the Administration Server database. This is typically the same computer on which Administration Server will be installed. Run the setup.exe file in the MSDE2KSP3 directory on the Kaspersky Administration Kit 5.0 installation CD. Follow the setup wizard's instructions. 2. 3. After you have performed all the installation steps, the MSDE 2000 SP 3 application will be installed on the selected computer. MSDE 2000 SP 3 requires no administration. The version of MSDE contained in the Kaspersky Administration Kit package can be used only with Kaspersky Administration Kit. The Administration Server uses MSDE 2000 SP 3 or SQL Server 2000 SP 3 to store anti-virus protection data in a central database. The klbackup application included in the Kaspersky Administration Kit distribution package creates backup copies of the Administration Server data. For details of this utility, please refer to the Administrator's Guide. 8 Kaspersky Administration Kit 5.0 2.2. Installing the Administration Server and Administration Console During installation, you can select to install either the Administration Server and the Administration Console, or only the Administration Console. The Administration Server cannot be installed without the Console. The default option is to install both components. If necessary, the Administration Console can be installed on another computer, and manage the Administration Server via the network. To install the Administration Server and / or the Administration Console, 1. Select a computer on which to install the components. If there is a Windows domain structure on your network, it is recommended that you install the Administration Server on a member of the domain. You can install Administration Server 5.x on the same computer that Administration Server 4.x is on. The Administration Servers of versions 5.x and 4. are independent of one another and can run concurrently on the same computer without any compatibility issues. You are advised to posess domain administrator rights when installing the product. This will allow to automatically create KLAdmins and KLOperators groups and to provide necessary credentials to account, under which Administration server will operate. 2. Run the setup.exe file from the Kaspersky Administration Kit 5 installation CD. Follow the wizard's instructions. Select the domain administrator account as the service account under which the Administration Server will start on this computer. 3. Getting started 9 2.3. Quick Start Wizard To perform initial configuration of anti-virus protection settings, 1. Run the Administration Console by clicking Start Programs Kaspersky Administration Kit Kaspersky Administration Kit. Connect to the Administration Server by clicking the Administration Server node in the console tree. Accept the server certificate. Open the shortcut menu and select Quick Start Wizard. Wait until the Administration Server finishes searching your network and detects all computers on the network. Create administration groups by one of the following methods: · If you are only dealing with several test computers, select the Manual option to manually add test client computers to the group. If you are deploying the anti-virus protection system throughout a corporate network, select one of the following methods of automatically creating logical networks: o 2. 3. 4. 5. · Add computers to a group using Windows networking. In this case, the logical network will be based on the structure of Windows domains and user groups (administration groups will coincide with Windows domains and user groups). Add computers to a group using the structure of the previous version of Kaspersky Administration Kit. In this case, the logical network will be based upon the network of Kaspersky Administration Kit 4.x. o 6. Specify options for sending email notifications generated by Kaspersky Lab's applications. These settings can be edited as part of the Administration Server properties. For more information, refer to the Administrator's Guide. 10 Kaspersky Administration Kit 5.0 7. Create a policy for Kaspersky Anti-Virus for Workstations 5, and define tasks to activate the anti-virus protection system. Kaspersky Administration Kit 5 uses group policies to apply settings uniformly to all computers in a group. Tasks are actions performed by the anti-virus software on all computers in a group. The wizard will create the following policies and tasks: · An upper-level policy for all anti-virus applications, with default settings. Later you will be able to view and modify the policy settings. In order to apply changes that you have made in the policy to the client computers and to prevent the user from altering these settings, use the · symbol. A global task for updating the Administration Server from the Internet. The application will download updates, to both the anti-virus database and to program modules, from Kaspersky Lab's update servers, and save them to the shared folder specified during the installation of Administration Server. Client computers will retrieve the updates from this shared folder. Click the Updater Settings button to configure updating options for the Administration Server. · An upper-level group task to update anti-viruses databases on client computers will be created, with default settings. The client computers will be configured to retrieve updates from the shared folder. An on-demand scan task for client computers will be created, with default settings. · 2.4. Creating an administration group To add a new group to the logical network, 1. In the console tree or the Groups folder in the details pane, select a group to which you want to add a new group. Open the shortcut menu Getting started 11 and click New Group to start a New Group wizard. Follow the wizard's instructions. 2. Move the selected client computers from the Network group to the new group using cut-and-paste or drag-and-drop. Kaspersky Lab's Anti-Virus 4.x may already be installed on the selected client computers, in which case it will be automatically overwritten during remote installation of version 5.x. 2.5. Remote installation of the Network Agent To install the Network Agent from a remote location, 1. Run the Application Deployment Wizard from the Administration Console shortcut menu. Select the Network Agent installation package created by the Quick Start Wizard. This package is created during the installation of the Administration Server and contains settings that are used by the Network Agent to connect to the Administration Server. Select the administration group containing the target computers on which Network Agent is to be installed. If the Administration Server service account does not have administrator rights for the selected client computers, enter the administrator login and password for the client computers. 4. The remote installation task will start. When the task is complete, the Network Agent will have been installed on the specified client computers. In the wizard's next dialog box, you can see the progress of the remote installation task and task history for each of the client computers. When the task has completed, view the task's results and exit the Application Deployment Wizard. If you wish to control the anti-virus protection of the client computer in real-time in order to ensure that the Administration Server can establish 2. 3. 5. 6. 12 Kaspersky Administration Kit 5.0 connection to the Network Agent at any given moment, UDP port number 15000 must be opened on the client computer. If the UPD port cannot be opened, check the Do not sever connection with the Administration Server box on the General tab in the Properties: dialog box used to configure the client computer's settings. To check that the installation was successful, click the Properties option in the shortcut menu of one of the computers on which you have just installed the Network Agent. Check that the Kaspersky Network Agent application is displaying Running status on the Applications tab. If the deployment was successful, but the Network Agent was unable to connect to the Administration Server, use the kinagchik.exe utility. This utility is included into the Network Agent distribution kit and is located in the Network Agent installation root folder after the installation of this component. When run from the command line, this utility provides detailed diagnostics of the Administration Server connection settings. 2.6. Kaspersky Anti-Virus application deployment This section focuses on the installation of Kaspersky Anti-Virus for Windows Workstations from a remote location. Deployment of other Kaspersky Lab applications is similar to that described below. To remotely deploy Kaspersky Anti-Virus for Windows Workstations on networked computers, 1. Create an installation package for Kaspersky Anti-Virus for Workstations 5 using a wizard. The wizard is started using the Remote Install node in the shortcut menu. The .kpd file required to create the installation package is located in the root of the Kaspersky Anti-Virus for Workstations distribution file. The license key file for Kaspersky Anti-Virus for Workstations is also located in this root directory. If needed, configure the installation package settings. It is recommended, for example, that you enable automatic restart for client computers. Getting started 13 2. Run the Application Deployment Wizard from the Administration Server shortcut menu. Install Kaspersky Anti-Virus for Workstations from the installation package, in the same manner as for the Network Agent (see section 2.5 on page 11). You can also install the Network Agent a the time of the installation of Kaspersky Anti-Virus for Windows Workstation. You can install Kaspersky Anti-Virus 5.x on computers with 4. applications installed. In this case, the 4. applications will be automatically overwritten by the later 5. version. 3. To verify that the installation was correct, select a client computer on which you have just installed the application, and open its Properties window. Open the Applications tab and check that the Kaspersky Anti-Virus for Workstations 5 application has the Running status. The Tasks tab must display the real-time protection task executed by Kaspersky Anti-Virus for Workstations 5. 2.7. Checking the operation of the update task To verify that client computers retrieve correctly the updates, 1. Run the update task on the Administration Server from the Task node in the upper level of the console tree. This task is automatically created by the Quick Start Wizard. The application will download updates from Kaspersky Lab's update servers and save them to the shared folder specified during Administration Server installation. Wait until the task is complete. Click the History button to view the task's outcome. For a list of the updates downloaded, click on the Updates node in the console tree. Details on the updating procedure are available on Kaspersky Lab's website (http://www.kaspersky.ru/avupdates). 14 Kaspersky Administration Kit 5.0 2. Run the group update task on client computers. This task is created by the Quick Start Wizard and is stored in the Tasks folder of the Group node. Wait until the task is complete. Click the History button to view the task's outcome. Task, created by the Quick Start Wizard, updates client computers using the connection between Network Agent and Administration Server. The following methods of client computers updating are also supported: · · · From the shared folder on Administration Server; Using HTTP-server; Using FTP-server. To copy the latest updates from the shared folder, the client computers must have read permission for this folder. If for some reason this is impossible, a FTP or HTTP server can be used to deploy updates to client computers. Create a FTP or HTTP directory linked to the Updates subfolder, in the shared folder in which the Administration Server will save downloaded updates (for example, ftp://admserver/updates). Specify this folder (ftp://admserver/updates) as the update source for the update task running on client computers. 2.8. Configuring notifications To configure notifications about virus protection-related events, 1. Open the Event Processing tab from the properties of the upper-level policy for an anti-virus application (for example, Kaspersky Anti-Virus for Workstations). On this tab, specify the events you want to be notified about and select how the notifications will be sent. To test the notification system (see section 2.9 on page 15), it is sufficient to setup a notification for the Virus found event. 3. Use the symbol for all settings that you configure in order to extend these settings to all client computers. To apply changes press the Apply button. 2. Getting started 15 4. You can verify the settings you have configured by sending a message manually. In order to do this, press the Test button. As the result messages created based on a specified template will be sent to addresses specified in the settings. 2.9. Testing the notification system and on-demand scan task To test the notification system and on-demand scan task, 1. Try to copy the Eicar test virus to the protected computer. Copying it will fail if the real-time protection task is running. You should receive a notification that the virus has been detected and this event should also be recorded in the Events node in the console tree. The Eicar "test virus" is not actually a virus, as it contains no code that can cause damage to your computer. However, most anti-virus products flag this file as a virus. You can download the "test virus" from the official website of the EICAR organization at http://www.eicar.org/anti_virus_test_file.htm. 2. Stop the real-time protection task on the client computer. Copy the Eicar test virus on the client computer and enable the real-time protection task again. Run the on-demand scan group task for a group of client computers. As a result, the application should detect the eicar.com file and send a corresponding notification. A record of this event should also appear in the Events node of the console tree. 3. 2.10. Generating reports From the Kaspersky Administration Kit event log data stored on the Administration Server, the application can generate reports on the current state of the anti-virus protection system state. The preset report templates can be accessed from the Reports node of the console tree. There are seven standard templates that correspond to the following types of reports: 16 Kaspersky Administration Kit 5.0 · · · · · · · Anti-virus databases version report Error report Licensing report Most infected desktops report Protection report Software version report Virus activity report For example, if you create a virus activity report using the corresponding template, it will contain information about all virus occurrences recorded by Kaspersky Administration Kit. If you add a computer that has no Network Agent to an administration group, the protection report will contain information that one computer in the group is not protected. CHAPTER 3. UPGRADING FROM 4. TO VERSION 5. This section describes upgrading from 4. Kaspersky Lab applications to Kaspersky Anti-Virus for Workstations version 5. or Kaspersky Anti-Virus for File Servers version 5.. Some of the steps have been described above. Here you will find step-by-step instructions for a seamless transition. Kaspersky Administration Kit 5. works independently of Kaspersky Administration Kit 4.. The administration system for version 5. manages only applications of version 5. and vice versa. Therefore, during the transition, two administration systems can work side by side on networked computers. Below is a typical transition scenario: 1. Install the 5. version of Administration Server. You can install it on the same computer as the 4. version. Create a logical network structure of administration groups for 5. applications. This structure can be imported from the 4. administration system. Create policies and group tasks for 5. applications on the logical network. Configure required anti-virus protection settings and set rules for processing virus protection-related events. Specify which computers will switch from version 4. to version 5.. Create an installation package for version 5. applications, and install the 5. applications on the selected computers. During installation, the 4. applications are automatically overwritten by the 5. applications. Computers on which you installed the 5. version anti-virus software are added to the logical network of the 5.x Administration Server. The remaining computers will still be managed by the 4. Administration System. 2. 3. 4. 5. 6. In this way, your company's anti-virus protection system, based on the previous version, will gradually transfer to the version 5. applications and administration system. CHAPTER 4. CONCLUSION Kaspersky Administration Kit 5 offers a variety of administrative features, extending beyond those mentioned in this document. This document introduces Kaspersky Administration Kit 5 to show you how to begin using the application, and to deploy the anti-virus protection system to networked computers. This simple scenario deals with the basic issues related to building a reliable protection system, allowing the administrator to: · · · · · · · · Deploy and configure the anti-virus protection administration system Deploy anti-virus applications on client computers from a single location Define the anti-virus protection policy Create and test the operability of the update task on client computers Test the operation of the real-time protection task Create and test the on-demand scan task for client computers Set rules for sending notifications after critical events Generate and view reports created by the anti-virus protection system APPENDIX A. KASPERSKY LAB Founded in 1997, Kaspersky Lab has become a recognized leader in information security technologies. It produces a wide range of data security software and delivers high-performance, comprehensive solutions to protect computers and networks against all types of malicious programs, unsolicited and unwanted email messages, and hacker attacks. Kaspersky Lab is an international company. Headquartered in the Russian Federation, the company has representative offices in the United Kingdom, France, Germany, Japan, USA (CA), the Benelux countries, China and Poland. A new company department, the European Anti-Virus Research Centre, has recently been established in France. Kaspersky Lab's partner network incorporates more than 500 companies worldwide. Today, Kaspersky Lab employs more than 250 specialists, each of whom is proficient in anti-virus technologies, with 9 of them holding M.B.A. degrees, 15 holding Ph.Ds, and two experts holding membership in the Computer Anti-Virus Researchers Organization (CARO). Kaspersky Lab offers best-of-breed security solutions, based on its unique experience and knowledge, gained in over 14 years of fighting computer viruses. A thorough analysis of computer virus activities enables the company to deliver comprehensive protection from current and future threats. Resistance to future attacks is the basic policy implemented in all Kaspersky Lab's products. At all times, the company's products remain at least one step ahead of many other vendors in delivering extensive anti-virus coverage for home users and corporate customers alike. Years of hard work have made the company one of the top security software manufacturers. Kaspersky Lab was one of the first businesses of its kind to develop the highest standards for anti-virus defense. The company's flagship product, Kaspersky Anti-Virus, provides full-scale protection for all tiers of a network, including workstations, file servers, mail systems, firewalls and Internetgateways, hand-held computers. Its convenient and easy-to-use management tools ensure advanced automation for rapid virus protection across an enterprise. Many well-known manufacturers use the Kaspersky Anti-Virus kernel, including Nokia ICG (USA), F-Secure (Finland), Aladdin (Israel), Sybari (USA), G Data (Germany), Deerfield (USA), Alt-N (USA), Microworld (India) and BorderWare (Canada). Kaspersky Lab's customers benefit from a wide range of additional services that ensure both stable operation of the company's products, and compliance with 20 Kaspersky Administration Kit 5.0 specific business requirements. Kaspersky Lab's anti-virus database is updated every 3 hours. The company provides its customers with a 24-hour technical support service, which is available in several languages to accommodate its international clientele. A.1. Other Kaspersky Lab Products Kaspersky Anti-Virus® Personal Kaspersky Anti-Virus® Personal has been designed to provide anti-virus protection to personal computers running Windows 98/ME or Windows 2000/NT/XP against all known viruses, including potentially dangerous software. Kaspersky Anti-Virus Personal provides real-time monitoring of all sources of virus intrusion - e-mail, internet, CD, etc. The unique system of heuristic data analysis allows efficient processing of yet unknown viruses. This application can work in the following modes (that can be used separately or jointly): · · Real-time computer protection - anti-virus scanning of all objects run, opened on or saved to the user's computer. On-demand computer scan - scan and disinfection of the entire user's computer or of individual disks, files or folders. You can start such scan manually or configure an automatic scheduled scan. ® Kaspersky Anti-Virus Personal does not re-scan objects that had been already scan during a previous scan and have not changed since then not only when performing real-time protection, but also during an on-demand scan. This considerably increases the speed of the program's operation. The application creates a reliable barrier to viruses when they attempt to intrude ® your computer via e-mail. Kaspersky Anti-Virus Personal performs automatic scan and disinfection of all incoming and outgoing mail sent or received using POP3 and STMP protocol and provides highly efficient detection of viruses in mail databases. The application support over 700 formats of archived and compressed files and provides automatic scan of their content as well as removal of malicious code from ZIP, CAB, RAR and ARJ archives. Configuring the application is made simple and intuitive due to the possibility to select of the preset protection levels: Maximum Protection, Recommended and High Speed.