User manual KASPERSKY LAB KASPERSKY ANTI-VIRUS - ADMINISTRATION KIT 4.5

KASPERSKY LABS Kaspersky® Administration Kit 4.5 USER GUIDE KASPERSKY® ADMINISTRATION KIT 4.5 User Guide Kaspersky Labs Ltd. Visit our web site: http://www.kaspersky.com Edition date: September 2003 Contents CHAPTER 1. KASPERSKY® ADMINISTRATION KIT .................................................. 7 1.1. What's new in version 4.5? ................................................................................... 8 1.2. Software and hardware requirements .................................................................. 9 1.3. Distribution kit ...................................................................................................... 10 1.4. Help desk for registered users ............................................................................ 10 1.5. Conventions......................................................................................................... 12 CHAPTER 2. BUILDING UP ANTI-VIRUS PROTECTION ......................................... 13 2.1. The Kaspersky Anti-Virus® logical network ........................................................ 13 2.2. Logical network addresses.................................................................................. 14 2.3. Creating a logical network................................................................................... 15 2.4. Logical network administrators. Access rights ................................................... 16 2.5. Maintaining a logical network .............................................................................. 17 2.6. Safety requirements. Joint operation of administrators...................................... 18 CHAPTER 3. INSTALLING THE SOFTWARE PACKAGE......................................... 20 3.1. Installing Kaspersky® Network Control Centre................................................... 20 3.2. Adding, reinstalling and/or uninstaling separate components ........................... 27 CHAPTER 4. GETTING STARTED.............................................................................. 28 CHAPTER 5. USER INTERFACE ................................................................................ 34 5.1. Main window........................................................................................................ 34 5.2. Menu .................................................................................................................... 35 5.3. Toolbars ............................................................................................................... 35 5.4. Network pane ...................................................................................................... 35 5.5. Shortcut menu ..................................................................................................... 36 5.6. Object property pane........................................................................................... 37 5.6.1. Tabs for groups............................................................................................. 38 5.6.2. Tabs for servers............................................................................................ 38 5.6.3. Tabs for workstations.................................................................................... 40 5.7. Info bar................................................................................................................. 42 5.8. Status bar............................................................................................................. 43 4 Kaspersky Administration Kit 5.9. Help...................................................................................................................... 43 CHAPTER 6. CREATING AND EDITING A LOGICAL NETWORK ........................... 45 6.1. Creating groups ................................................................................................... 45 6.2. Adding servers..................................................................................................... 46 6.3. Adding workstations ............................................................................................ 47 6.4. Deployment of Kaspersky Anti-Virus® on workstations ..................................... 50 6.4.1. Uploading the software to the program storage. Customizing the programs to be installed ............................................................................... 51 6.4.2. Deployment settings. Starting login script based deployment .................... 53 6.4.3. Computer based deployment....................................................................... 57 6.5. Adding objects to a logical network..................................................................... 61 6.6. Moving and removing logical network objects.................................................... 62 6.7. Searching for and renaming logical network objects ......................................... 63 CHAPTER 7. CONFIGURING A LOGICAL NETWORK ............................................. 65 7.1. General features of workstation settings ............................................................ 65 7.1.1. Copying Kaspersky Anti-Virus® settings to another workstation................. 65 7.1.2. Off­line mode. Pending application of new settings.................................... 66 7.2. Alerts and e-mail notifications from workstations and servers........................... 67 7.2.1. Alerts from workstations and their severity levels........................................ 67 7.2.2. Enabling workstations to send alerts via the supervising server................. 68 7.2.3. Forwarding alerts according to their severity level....................................... 69 7.2.4. Virus outbreak alerts..................................................................................... 71 7.2.4.1. Defining symptoms indicating a virus outbreak .................................... 72 7.2.4.2. Setting the virus outbreak alert.............................................................. 72 7.2.5. Customizing e-mail service settings............................................................. 72 7.2.5.1. Sending messages using MAPI............................................................ 73 7.2.5.2. Sending messages via SMTP............................................................... 74 7.3. Defining remote management of servers and workstations .............................. 74 7.3.1. Remote management settings..................................................................... 74 7.3.2. Security settings for remote management................................................... 75 7.3.3. Network browsing settings ........................................................................... 76 7.3.4. Specifics of setting remote management of workstations........................... 77 7.4. Setting automatic updating of anti-virus databases on workstations................. 78 7.4.1. Updating anti-virus databases from a Kaspersky AV server ...................... 78 Contents 5 7.4.2. Updating the anti-virus database storage on a server from another server on the logical network........................................................................ 81 7.5. Configuring and using the quarantine function................................................... 83 7.5.1. Quarantine types .......................................................................................... 83 7.5.2. Selecting a quarantine type.......................................................................... 84 7.5.3. Working with quarantined files ..................................................................... 85 7.5.3.1. Working with server quarantine............................................................. 85 7.5.3.2. Local quarantine .................................................................................... 88 7.6. Scheduling Kaspersky Anti-Virus® components to be automatically started on workstations .................................................................................................. 89 7.7. Exporting, importing, and printing settings.......................................................... 94 7.7.1. Exporting and printing the logical network hierarchy................................... 94 7.7.2. Exporting and importing server and workstation settings............................ 94 CHAPTER 8. ASSIGNING ACCESS RIGHTS TO OTHER USERS.......................... 96 8.1. Securing Kaspersky Anti-Virus® settings on workstations ................................. 96 8.1.1. Preventing users from changing Kaspersky Anti-Virus® settings from workstations .................................................................................................. 96 8.1.2. Synchronizing changes made by administrators and users to ® Kaspersky Anti-Virus settings..................................................................... 98 8.2. Assigning an administrator to a group ................................................................ 99 CHAPTER 9. MAINTAINING A LOGICAL NETWORK ............................................. 102 9.1. Viewing network reports.................................................................................... 102 9.2. Selecting objects of a logical network............................................................... 103 9.3. Viewing task performance results..................................................................... 106 9.4. If a workstation or a server are unavailable...................................................... 107 9.5. Receiving alerts from workstations. The Attention flag .................................... 108 9.6. Receiving e-mail from workstations .................................................................. 109 9.7. Starting tasks on workstations .......................................................................... 110 9.8. Monitoring updating progress ........................................................................... 110 9.9. Key file installation on a workstation ................................................................. 111 CHAPTER 10. ORGANIZING ADMINISTRATORS GROUP WORK....................... 113 10.1. Changing administrator names and passwords............................................. 113 10.2. Changing network access passwords to workstations and servers.............. 113 APPENDIX A. PROGRAM MENU.............................................................................. 116 A.1. The Network menu ........................................................................................... 116 6 Kaspersky Administration Kit A.2. The Edit menu................................................................................................... 117 A.3. The View menu ................................................................................................. 118 A.4. The Object menu .............................................................................................. 119 A.5. The Tools menu ................................................................................................ 120 A.6. The Help menu.................................................................................................. 120 APPENDIX B. THE PROGRAM TOOLBAR DIRECTORY ....................................... 121 B.1. The Standard toolbar ........................................................................................ 121 B.2. The Action bar................................................................................................... 122 APPENDIX C. GLOSSARY......................................................................................... 124 APPENDIX D. FREQUENTLY ASKED QUESTIONS ............................................... 129 APPENDIX E. KASPERSKY LABS LTD. ................................................................... 131 E.1. Other Anti-Virus products.................................................................................. 132 E.2. Contact Information........................................................................................... 134 APPENDIX F. LICENSE AGREEMENT..................................................................... 135 CHAPTER 1. KASPERSKY® ADMINISTRATION KIT Kaspersky® Administration Kit was developed specially for administrators of corporate networks or anti-virus security officers. Using this toolkit, a network administrator can manage anti-virus protection (i.e. install, configure, and update the Kaspersky Anti-Virus® software, and also quickly and efficiently deal with virus outbreaks) SIMULTANEOUSLY on all workstations of a corporate network DIRECTLY FROM THE ADMINISTRATING STATION. Kaspersky® Administration Kit enables an administrator to: · Remotely manage anti-virus settings across a corporate network. The administrator can remotely manage anti-virus tools installed on other network computers from one location. Remote management is especially important for administrators of large networks that cover more then one building or office. Remotely install (deploy) anti-virus software on workstations. This feature facilitates creating of a unified anti-virus protection system across a network. The administrator downloads the Kaspersky Anti-Virus® package on his computer (or a dedicated server) only once and then deploys it to the workstations that are connected to the network. Remotely launch scheduled or on-demand scans. This feature allows the administrator to remotely launch scans on workstations and schedule the scanning procedure to be automatically started at a specified time. Automatically update anti-virus databases on workstations. Updating of anti-virus databases can be performed centrally: you do not need every workstation to connect to the Kaspersky Labs web server. The updating procedure can also be scheduled to run automatically on a regular basis. Receive the cumulative network report. The network report logs all events detected by the anti-virus software on all protected workstations. The administrator can also request reports from individual workstations. Customize the notification system. This feature allows the administrator to define a list of events to be notified about by e-mail. For example, these can be a detection of a virus on the protected network or an unsuccessful attempt to update anti-virus databases on a workstation. Quarantine suspicious files. The administrator can centrally store suspicious files, encode them, and move them to the server quarantine. This enables the administrator to maintain the highest level of anti-virus protec- · · · · · · 8 Kaspersky Administration Kit tion because even if an infected file has been deleted, it can be easily restored from the quarantine. · Control user access to anti-virus protection settings. The administrator can prevent users from accessing anti-virus protection settings. This feature substantially enhances anti-virus protection security. Group computers into logical groups and delegate administrative control over specific groups to particular group administrators. This feature simplifies administration of the anti-virus protection of a large number of workstations. · 1.1. What's new in version 4.5? Kaspersky® Administration Kit 4.5 has the following features not found in previous versions: · ® One installer for Kaspersky Network Control Centre, Kaspersky Anti® ® Virus Server, Kaspersky Anti-Virus Control Centre, and Kaspersky Anti® Virus Updater. · Application of new settings can be delayed. Now the administrator can define new settings for a workstation even if this workstation is not currently available on the network. The workstation can be merely switched off at the moment. The changes are recorded in backup settings on the primary server and are applied immediately after the workstation appears on the network. Simultaneous customization of logical network objects. The administrator can simultaneously customize the anti-virus protection settings for several workstations, servers, or groups. Network quarantine. Now quarantined files can be stored on servers. This minimizes the possibility of virus infection of the network. Extended search capabilities and a more easy-to-use interface. Now there are more criteria that can be used to find a computer on a logical network. When adding a computer to the network, the administrator is ® able to see the Microsoft network (not only the Kaspersky Anti-Virus logical network). Detection of a virus attack which is a simultaneous infection of several computers on the network. The administrator can customize the anti-virus programs how to response to the outbreak. Network report. All events detected by the anti-virus software on logical network objects and changes in the integrity of the logical network are logged to a cumulative report. · · · · · Kaspersky® Administration Kit 9 1.2. Software and hardware requirements To run the Kaspersky® Administration Kit software package, you need: · · · A TCP/IP network A configured MS Windows network The MS Windows 95/98/Me/NT/2000/XP operating system. If installing on a computer running MS Windows NT 4.0, the service pack 6 must be preinstalled. ® The administrating station must have (for the Kaspersky Centre program): · · · · · 16 Mb of available RAM 10 Mb of available hard disk space Network Control (for the Kaspersky AV Server program): MS Windows 2000/NT/XP. 5 Mb of available RAM. 1 Mb of available hard disk space and also the disk space required to store the updates for your anti-virus database, the Kaspersky Anti-Virus® package components, and downloaded software products. The possibility to send e-mail messages using the MAPI client or via the SMTP protocol. This is necessary to enable the server to forward alerts from the tasks running on the supervised workstations. After the installation of the MAPI client, you must configure the appropriate profile for the server mail system. To do this, select the Mail icon in MS Windows Control Panel and define the mail system settings. For information on hardware and software requirements for worksta® tions please refer to User Guide "Kaspersky Anti-Virus for Workstations." Kaspersky® Administration Kit 4.5 is designed for local area networks with domain structure. · 10 Kaspersky Administration Kit 1.3. Distribution kit You can purchase Kaspersky Anti-Virus® Personal either from our distributors (retail box) or online at one of our Internet shops (for example, www.kaspersky.com, the Buy online link). The retail box includes: · A sealed envelope with an installation CD containing files for the software product; · User Guide; · A license key written on the installation CD; · License agreement. Before you unseal the envelope containing the CD, be sure to thoroughly review the license agreement. ® If you buy Kaspersky Anti-Virus Personal online, you download the installation file of the product from the Kaspersky Labs website. This installation file includes this User Guide and the license key. The license key can be also sent to you by e-mail after receiving your payment. The License Agreement (LA) is a legal agreement between you and the manufacturer (Kaspersky Labs Ltd.) describing the terms on which you may employ the anti-virus product which you have purchased. Make sure you read the License Agreement! If you do not agree to the terms of this LA, you can return the unused product to ® your Kaspersky Anti-Virus dealer for a full refund, making sure the envelope with the CD is sealed. If you unsealed the envelope, you have agreed to all the terms of the LA. 1.4. Help desk for registered users Kaspersky Labs offers a large service package enabling its legal customers to ® enjoy all available features of Kaspersky Anti-Virus . If you register and purchase a subscription you will be provided with the following services for the period of your subscription: Kaspersky® Administration Kit 11 · · · new versions of this anti-virus software product provided free of charge; phone or e-mail advising on matters related to the installation, configuration, and operation of this anti-virus product; information about new Kaspersky Labs products and about new computer viruses (for those who subscribe to the Kaspersky Labs newsletter). Kaspersky Labs does not provide information related to operation and use of your operating system or various other technologies. 12 Kaspersky Administration Kit 1.5. Conventions In this book we use various conventions to emphasize different meaningful parts of the documentation. The Table below lists the conventions used in this User Guide. Convention Bold font Meaning Menu titles, commands, window titles, dialog elements, etc. Note. Additional information, notes Attention! Critical information To do this, 1. 2. Step 1. ... Task or example Actions that must be taken Formulation of the problem or an example of how to use the product. A solution of the problem formulated Solution [key]-- Function of the key. Text of information messages and the command line Command line keys Text of configuration files, information messages, and the command line. CHAPTER 2. BUILDING UP ANTIVIRUS PROTECTION 2.1. The Kaspersky Anti-Virus® logical network The Kaspersky Anti-Virus® logical network (logical network) is a number of computers interconnected into a local network and running the Kaspersky AntiVirus® package components managed by Kaspersky® Administration Kit. Computers within a logical network can perform the following functions: Kaspersky Anti-Virus® workstation (workstation1) is a computer that is protected from viruses. The Kaspersky Anti-Virus® package with the Kaspersky AV Control Centre component must be preinstalled on the workstation. ® Kaspersky Anti-Virus Server (server2) is a computer running Kaspersky AV Server. This computer is used to store program installation files, update anti-virus databases and package components, monitor for virus outbreaks (infection of ® several workstations), and forward alerts from tasks (the Kaspersky Anti-Virus components with pre-defined settings) performed on the supervised workstations. These alerts, for example, may notify the administrator about a virus detected on a workstation. Every server can control several workstations. Logical group (group) is a defined number of servers and workstations controlled by these servers. Several groups at a certain hierarchical level may constitute a group of a higher level, etc. Each group must have at least one server. Administrating stations are computers on which the Kaspersky® Network Control Centre administration component is installed. From these administrating stations the administrators can manage all the Kaspersky Anti-Virus® software components installed on local network computers. Logical network objects are workstations, servers, or groups of any hierarchical level. 1 Below the word "workstation" means a Kaspersky Anti-Virus workstation. Below the word "server" means a Kaspersky Anti-Virus server. 2 14 Kaspersky Administration Kit The structure of a logical network or the network configuration, i.e. information about the hierarchical interconnections between groups, servers, and workstations, is stored on one of the servers. This server is called the primary server of the logical network. The same computer can function as a workstation, a server, and an administrating station. The number of workstations, servers, and administrating stations is unlimited but there must be only one primary server. A workstation and a server can be added to the logical network only once. If your computer network has several logical networks, you cannot add elements of one logical network to another logical network. Figure 1 shows an example of the structure of a logical network. Figure 1. An example of the structure of a logical network 2.2. Logical network addresses Logical network objects (servers and workstations) are identified by network addresses of computers on which the appropriate programs are installed. A logical network object may have the following addresses (depending on network settings): · · · a static numerical IP address; a fully qualified domain name (FQDN); a computer name on the Microsoft network (NetBIOS name). The first type of identification is available when the computer is assigned a static IP address and is not available if the addresses are dynamically assigned by a DHCP server. The second type of identification is available if there is a DNS service and the domain names are fixed and assigned to certain computers. The third type is available if there is a WINS service. building up anti-virus protection 15 Below all the above mentioned types of addresses are referred to as the object address. 2.3. Creating a logical network The process may be divided into the following stages: 1. Project your logical network: the logical network administrator (the administrator) chooses the computers on which to organize administrating stations, the primary server, servers, and workstations. Logical networks can have various configurations. Below you can see general recommendations on how to create a logical network: · · All computers with installed Kaspersky Anti-Virus® must be workstations. Each segment of the network must have at least one server (usually one server is enough). All workstations of this segment are connected to this server. It is advisable to set the primary server in the same network segment as the administrating station (they may be configured on the same computer). If the projected logical network is too complicated to be controlled by a single person, it is recommended that you divide it into groups containing at least one server and the attached workstations. If required, you can assign particular group administrators and install the software for administrating stations on their computers. ® Install Kaspersky Network Control Centre on the administrating station (see subchapter 3.1 on page 20). · · · 2. Install anti-virus software on your network computers: · · · Install Kaspersky AV Server on the computers reserved for the primary server and other logical servers (see subchapter 3.1 on page 20). Install the workstation software on the selected computers (see subchapter 6.3 on page 47). 3. Configure the logical network: · · · Add servers to the logical network (see subchapter 6.2 on page 46). Attach workstations to the servers (see subchapter 6.3 on page 47). Set the server parameters (see subchapter 7.3 on page 74). 16 Kaspersky Administration Kit · · · 4. Define alert-forwarding settings on the servers (alerts are generated by tasks running on workstations) (see Chapter 7 on page 65). Customize anti-virus settings for workstations. Divide (if required) the logical network into groups (see subchapter 6.1 on page 45). Assign access rights to other users: · · Allow or prohibit users to access the Kaspersky AV Control Centre settings on workstations (see subchapter 8.1 on page 96). Assign group administrators (see subchapter 8.2 on page 99). A company owns several offices in different buildings that are located far from each other. All computers of this company are connected to a computer network. The task of an administrator is to protect the company network from viruses. The administrator installs the Kaspersky® ® Administration Kit and Kaspersky Anti-Virus packages on the network computers and creates and configures the logical network. After this, the administrator is able to monitor the network for virus-like activities from his administrating station. 2.4. Logical network administrators. Access rights The logical network administrator is a user who installed the Kaspersky® Administration Kit software package on the network computers. The administrator has full control over all servers and workstations of the logical network. The group administrator is a user who is authorized to access the settings on servers and workstations included in a certain group. Below, the logical network administrator and group administrators are referred to as administrators. When starting Kaspersky® Network Control Centre the first time the administrator defines the address of the primary server and specifies his or her user name and password to access the program settings. Kaspersky® Network Control Centre allows the administrator to: · · build the logical network by adding groups, servers, and workstations (see Chapter 6 on p. 45); manage the Kaspersky Anti-Virus workstations; ® package components running on building up anti-virus protection 17 · · contol access to the settings of Kaspersky Anti-Virus® applications on workstations (see subchapter 8.1 on page 96); assign administrators to the logical groups (see subchapter 8.2 on page 99). To configure a logical network, the administrator must know not only his or her user name and password but also the network access passwords to the workstations and servers to be added to the logical network. Network access passwords for workstations are defined when you install Kaspersky AV Control Centre (see subchapter 6.3 on page 47). Network access passwords for servers are defined when you install Kaspersky AV Server (see subchapter 3.1 on page 20). When a logical network is constructed, the administrator may allow/prohibit other users from accessing the Kaspersky Anti-Virus® settings on workstations (see subchapter 8.1.1 on page 96). The administrator may assign administrators of the groups included in his or her logical network at any hierarchical level. In addition, the administrator may change rights of the subordinate administrators, regardless of who originally defined these rights. The logical network structure may be configured by any authorized administrator but several administrators cannot do it at the same time. ® Only one administrator with full access rights can log on to Kaspersky Network Control Centre at a time. 2.5. Maintaining a logical network After you have created and configured your logical network, you must regularly do the following: · Review the network reports and performance reports of the anti-virus software on workstations on a daily basis (see subchapter 9.1 on page 102). The reports contain details of the last start of the corresponding task. For example, the Kaspersky AV Scanner report contains information about the number of scanned sectors, files, directories, archives, and packed executable modules, about viruses and virus bodies detected, about disinfected, deleted, suspicious, and corrupted objects, and also about the time spent by the program to scan for viruses in all predefined objects. 18 Kaspersky Administration Kit If the administrator fails to connect to a workstation (i.e. the connectionfailed message appears on the screen), and at the same time the computer is available on the local network, it is advisable to check whether ® the Kaspersky Anti-Virus software is still running on this workstation or it has been deleted or reinstalled by the user. For details see subchapter 9.4 on page 107. · Check your mailbox and read alerts delivered from workstations (see subchapter 9.6 on page 109). For a complete list of alerts generated by the Kaspersky Anti-Virus® package components refer to their documentation. By configuring the logical network using Kaspersky® Network Control Centre, you may enable and disable various alerts (see the User Guide "Kaspersky AntiVirus® for Workstations"/ "Kaspersky Anti-Virus® for MS NT Server"). · Remotely perform the required tasks on workstations from the administrating station. For example, the administrator may disinfect files on a workstation (see subchapter 9.7 on page 110). Update anti-virus databases of Kaspersky Anti-Virus® on supervised workstations. To update the anti-virus database, use the updating task that is included in the list of tasks regularly performed on workstations. Set the updates to be retrieved from the server (see subchapter 7.4 on page 78). In this case, the updates will be copied from the updates storage on the supervising server. We recommend you to set your updates storages on servers to be automatically updated from one server that will retrieve the latest updates from the Internet. · 2.6. Safety requirements. Joint operation of administrators To support the safety, integrity, and controllability of a logical network, the administrators must follow these rules. Administrators must not disclose to anyone their passwords to the network configuration. If a group administrator forgets his password, he or she can obtain a new one from the supervising administrator. If the logical network administrator forgets the password, he or she will be denied access to the network configuration. In this case, the entire logical network must be redeveloped. building up anti-virus protection 19 To avoid confusion, logical network administrators are not recommended to ® change Kaspersky Anti-Virus settings on the workstations supervised by subordinate group administrators. If it is necessary to change the settings, the supervising administrator must inform the subordinate administrator about this. CHAPTER 3. INSTALLING THE SOFTWARE PACKAGE 3.1. Installing Kaspersky® Network Control Centre In this subchapter we describe the step-by-step installation of Kaspersky® Administration Kit on a computer that does not have preinstalled components from this package. For instructions on how to reinstall, add or uninstall separate components, see subchapter 3.2 on page 27. The setup wizard will suggest you to install Kaspersky® Network Control Centre and Kaspersky AV Server on the same computer. This is recommended if you have just started creating your logical network. By doing this, you are creating both the administrating station and the primary server. If you need to install only Kaspersky AV Server or only Kaspersky® Network Control Centre, you must skip some of the steps described below. For details see the description of the steps below. Before you begin the installation, we recommend that you exit all run® ning Kaspersky Anti-Virus programs. To install Kaspersky® Network Control Centre and/or Kaspersky AV Server on your computer, follow these steps: 1. Start Setup.exe on the installation CD. The Kaspersky® Administration Kit setup wizard info box will appear on your screen. Click the Next button to proceed or the Cancel button to cancel the installation. Every dialog box of the setup wizard contains these buttons and the Back button that allows you to return to the previous wizard box. The license agreement box will appear on your screen. Review all the agreement terms. If you agree to all the terms of the agreement, click Yes to proceed. Otherwise, click No to abort the installation. After this, the user detail wizard box will appear on your screen. Enter the required information in the User Name and the Company Name fields (make sure to fill in both fields; otherwise you will not be able to proceed with the installation). 2. 3.