Summary of Contents for ESET REMOTE ADMINISTRATOR 4
Page 1
ESET Remote Administrator 4 Installation Manual and User Guide...
Page 2
ESET, spol. s r.o. reserves the right to change any of the described application software without prior notice. Customer Care Worldwide: www.eset.eu/support Customer Care North America: www.eset.com/support...
ESET Remote Administrator itself does not provide any other form of protection against malicious code. ERA depends on the presence of an ESET security solution on workstations or servers, such as ESET NOD32 Antivirus or ESET Smart Security.
- support for ESET Security products 4.x ESET Remote Administrator Version 2.0 - support of new ESET Security Products version 3 (ESET Smart Security, ESET NOD32 Antivirus) - new logs (new columns, ESET Personal Firewall logs) - new client state information for version 3 clients (Protection Status, Protection Features, System Information)
Page 7
ERAC is the client component of ERA and is usually installed on a workstation. This workstation is used by the administrator to remotely control ESET solutions on individual clients. Using ERAC, the administrator can connect to the server component of ERA – on TCP port 2223. The communication is controlled by the process console.exe, which is...
2. Client connection interval The client connection interval is set to 10 minutes by default in ESET Smart Security / ESET NOD32 Antivirus versions 4.2 and later. If you need the client status to update more or less frequently than the default interval, you can change the setting.Keep in mind that a shoerter client connection interval will affect server performance.
Most of the storage space is taken up by client events, that are stored in the database and to a repository on the disk (default directory is C:\Documents and Settings\All Users\Application Data\Eset\ESET Remote Administrator\Server). ERA requires that at least 5% of the disk be free. If this minimum is exceeded the server will stop receiving some of the client events.
A company network usually consists of one local area network (LAN), therefore we suggest installing one ERAS and one Mirror server. The Mirror server can either be created in ERAS or in ESET NOD32 Antivirus Business Edition /ESET Smart Security Business Edition.
2.2.2 Before installation Before installing, the following installation packages should be downloaded from ESET’s website: ESET Remote Administrator components: ESET Remote Administrator – Server ESET Remote Administrator – Console ESET client solutions: ESET Smart Security 4.x ESET Smart Security 3.x ESET NOD32 Antivirus 4.x...
Parameters and configuration of the command line installation can be further supplemented by the administrator's .xml configuration file the "cfg.xml", which must be in the same folder as the ERA .msi installation file. The configuration file can be created in the ESET Configuration Editor and allows you to configure various ERA settings. See chapter ESET Configuration Editor for more details.
2.2.3.4 Database types supported by ERA Server By default, the program uses the Microsoft Access (Jet Database) engine. ERAS 4.0 also supports the following databases: Microsoft SQL Server 2005 MySQL 5.0 Oracle 9i The database type can be selected during the Advanced installation mode of ERAS. After the installation it is not possible to change the database type directly from ERA, however, you can do so using the ERA Maintenance Tool NOTE:...
This is an example of a complete connection string for Oracle Server: Driver ={Oracle in instantclient10_1}; dbq =hostname: 1521/ESETRADB This is an example of a complete connection string for MySQL Server: Driver ={MySQL ODBC 3.51 Driver}; Server =hostname; Database =ESETRADB Then set the Username and password for the connection (the...
2.3 Scenario - Installation in an Enterprise environment 2.3.1 Environment overview (network structure) Below is a copy of the previous network structure with one additional branch office, several clients and one server named LITTLE. Let’s suppose there is a slow VPN channel between the headquarters and the branch office. In this scenario, the Mirror server should be installed on the server LITTLE.
As in Figure 2- 3, updates for the branch office are not downloaded from ESET’s update servers, but from the server at the headquarters (GHOST). The update source is defined by the following URL address:...
2.3.3 Other requirements for Enterprise environments In larger networks, multiple ERA Servers can be installed to perform remote installs of client computers from servers which are more accessible. For this purpose, ERAS offers replication (see chapter Installation at headquarters Branch office: Installation of ERA Server ), which allows stored information to be forwarded to a parent ERAS (upper server).
ERAS needs to be installed under the Windows/Domain account with sufficient rights. You must also enable this feature in Tools > Server Options… > Advanced > Edit Advanced Settings… > ESET Remote Administrator > ERA Server > Setup > Security:...
3.2 ERAC - main window The current communication status between ERAC and ERAS is displayed in the status bar (1). All necessary data from ERAS is refreshed regularly (Default is every minute. See Tools > Console Options…). The refresh progress can also be seen in the status bar.
Server Name Displays name of server. Clients Total number of clients connecting to or in the database of the selected ERAS. Virus Signature DB Range Version of virus signature databases among the clients of the selected ERAS. Least Recent Connection Time elapsed since the least recent connection to the server.
Output only includes clients with names identical to the string entered. Only clients beginning like (?,*) Output will only list clients with names beginning with the specified string. Only clients like (?,*) Output will list only clients with names containing the specified string. Exclude clients (using whole words), Exclude clients beginning like (?,*), Exclude clients like (?,*) These options will yield results opposite to the previous three.
Detailed current client configurations in the.xml format (the Clients tab, the Configuration column, Protection Status, Protection Features, System Information) Information from the ESET SysInspector program may also be missing. ESET SysInspector is integrated with generation 4. x ESET products and later.
On the upper server you can set the level of logs that will be received by the server (Tools > Server Options > Advanced > Edit Advanced Settings... > ESET Remote Administrator > ERA Server > Setup > Server Maintenance > ..logs to accept).
Page 24
Client submits system information to ERAS (including time that the system information was System Information submitted) Clients with versions containing the ESET SysInspector tool can submit logs from this SysInspector complementary application. Custom Information to be displayed specified by the administrator (this option can be configured in...
Page 25
Protection Status This is a general status statement regarding all ESET programs. Some of the statements are interactive and allow immediate intervention. This functionality is useful in that it prevents the need to manually define a new task to solve a given protection problem.
3.4.4 Threat Log tab This tab contains detailed information about individual virus or threat incidents. Attribute Description Client Name Name of client reporting the threat alert Computer Name Workstation/server name (hostname) MAC Address MAC address (network adapter) Primary Server Name of ERAS with which a client is communicating Date Received Time at which the event was logged by ERAS Date Occurred...
3.4.7 Scan Log tab This tab lists results of On-demand computer scans that were started remotely, locally on client computers, or as scheduled tasks. Attribute Description Scan Id ID of the corresponding entry in the database (ID is in the form: Scan Number) Client Name Name of client where the scan was performed Computer Name...
For more information, see chapter Reports 3.4.12 Remote install tab This tab provides options for several remote installation methods of ESET Smart Security or ESET NOD32 Antivirus on clients. For detailed information, see chapter Remote Installation 3.5 ERA Console setup...
The read-only mode is suitable for viewing the status of ESET client solutions connecting to ERAS; creation of tasks for client workstations, creation of install packages and remote installation are not allowed. The License Manager, Policy Manager and Notification Manager are also inaccessible.
3.7 ESET Configuration Editor The ESET Configuration Editor is an important component of ERAC and is used for several purposes. Some of the most important are the creation of the following: Predefined configurations for installation packages Configurations sent as tasks or policies to clients A general (.xml) configuration file...
3.7.2 Key configuration entries In this section, we explain several of the key configuration entries for ESET Smart Security and ESET NOD32 Antivirus, available through the ESET Configuration Editor: ESET Smart Security, ESET NOD32 Antivirus > ESET Kernel > Setup > Remote administration...
Page 32
NOTE: On portable devices such as notebooks, two profiles can be configured – one to provide updating from the Mirror server and the other to download updates directly from ESET’s servers. For more information, see chapter Combined update for notebooks...
4.1 Direct installation With a direct installation, the administrator is present at the computer where the ESET security product is to be installed. This method requires no further preparation and is suitable for small computer networks or in scenarios where ERA is not used.
Page 34
– selected parameters are then applied automatically on target clients. Additional parameters for ESET Smart Security and ESET NOD32 Antivirus can be typed after the name of the .msi installation package (e.g., eav_nt64_ENU.msi /qn): Quiet installation mode –...
You need to add this parameter when the ESS/EAV settings are password protected. Parameters for ESET NOD32 Antivirus 2.x should be typed after the setup.exe filename, which can be extracted along with other files from the installation package (e.g., setup.exe /silentmode): /SILENTMODE Quiet installation mode –...
Push Installation from the context menu). ESET Remote Administrator 4.2 4.2.2 Configuring the environment for remote installation Before installing ESET security products to network computers, the administrator should appropriately prepare the environment to avoid installation failures. Network View section in Remote Install tab provides a customizable view for the network.
Supposing that all workstations are turned on, the push installation method is the most effective method. Before starting a push install, you must first download the .msi install files for ESET Smart Security or ESET NOD32 Antivirus from ESET’s website and create an installation package. You can create an .xml configuration file that will automatically be applied when the package runs.
Page 38
8) Agent installs the package under the administrator account defined in step 2; the corresponding .xml configuration and command line parameters are also applied. 9) Immediately after the installation is complete, the agent sends a message back to ERAS. Some ESET security products require a reboot and will prompt you if necessary.
While the logon script runs automatically when the user logs on, the email method requires intervention on the part of the user, who must launch the einstaller.exe agent from the email attachment. If launched repeatedly, einstaller.exe will not trigger another installation of ESET client solutions. For more information, see chapter Avoiding repeated installations The line calling the einstaller.exe agent from the logon script can be inserted using a text editor or other proprietary tool.
Page 40
Attaching the agent (einstaller.exe) to email: 1) Click Email… on the Remote Install tab and select the Type and name of the Package you wish to install. 2) Click To… to select addresses from the address book (or insert individual addresses). 3) Enter a Subject in the corresponding field.
(ERAS) restart. 4.2.5 Custom remote install It is not a requirement to use ERA tools to remotely install ESET client solutions. In the end, the most important aspect is to deliver and execute the einstaller.exe file on client workstations.
The username and password of the account under which the installation of the package is to be performed must be an account with administrator rights or, preferably, a domain administrator account. During the remote installation process, backward connection to ERAS takes place and the agent (einstaller.exe) adopts settings from the Set Default Logon for E-mail and Logon Script Installations option.
MSI installer, which is distributed directly to all clients connecting to the domain via Group Policy. To configure a domain controller to automatically install ESET Smart Security or ESET NOD32 Antivirus on each workstation after logging in, proceed as follows: 1) Create a shared folder on your domain controller.
Page 44
3) Insert an .xml configuration file, which is to be applied to the program, to the same folder. The file should be named cfg. xml. To create a configuration file, the ESET Configuration Editor can be used. For more information see chapter...
5. Administering client computers 5.1 Tasks Client workstations that are correctly connected to ERAS and displayed in ERAC can be configured and administered using various types of tasks. The general workflow below applies for all tasks described in the following sub-chapters except the Interactive Task (see the chapter for an explanation of the workflow).
Configuration tasks are used to modify protection settings on client workstations. These tasks are delivered to client workstations in configuration packages which contain the modification parameters. The .xml files created in the ESET Configuration Editor or exported from clients are also compatible with configuration tasks. The example below demonstrates how to create a configuration task that changes the username and password on target computers.
New Task > Update Now. 2) If you wish to exclude certain types of ESET security products from the task, select them in the Configuration section drop-down menu and select the Exclude this section from Update Task option.
Protection Status Text column monitoring the protection status of all connected ESET clients. A blank field denotes that the protection status of a specific client is on the Maximum protection level. If the protection level of a client is lower than maximum, a protection status warning highlighted in red or orange will appear in Protection Status Text (e.g.,...
System is secure. NOTE: The Interactive task feature is supported by ESET Smart Security/ESET NOD32 version 3 and later. 5.2 Group Manager Group Manager is a powerful tool for managing your clients, separating them into different groups and applying different settings, tasks, restrictions, etc.
AD groups will be completely replaced by those to be synchronized (AD groups synchronize). Synchronize option allows you to schedule the AD synchronization to a certain time interval. Detailed configuration of Active Directory synchronization can be done using the Configuration Editor (ESET Remote...
ESET security product (or client). All parameters are organized into a comprehensive structure and all items in the Editor are assigned an icon. Clients will only adopt active parameters (marked by a blue icon). All inactive (greyed out) parameters will remain unchanged on target computers.
5.3.3 Virtual policies In addition to created policies, as well as those replicated from other servers (see chapter Replication tab ), the Policy Tree also contains a Default Parent Policy and Default Primary Clients Policy, which are referred to as virtual policies. The default Parent Policy is located on an upper server in the Global Policy Settings and selected as Default policy for lower...
selected (for more information, see chapter How to create policies Icons with downward arrows – these policies are replicated – the option Down replicable policy is enabled. You can apply these policies on the given server and on its child servers. 2) Policies with grey icons originate from other servers.
5.3.7 Assigning policies to clients There are two main rules for assigning policies to clients: 1. Local (primary) clients can be assigned any local policy or any policy replicated from upper servers. 2. Clients replicated from lower servers can be assigned any local policy with the Down replicable attribute or any policy replicated from upper servers.
HAS IP Range (specify) – if client belongs to the group defined by the IP range… HAS (NOT) Defined Policy (specify) – if client does (or does not) adopt the policy… Product Name (NOT) IN - if product name is... Product Version IS (NOT) - if product version is...
5.3.9 Special settings Two additional policies are not located in the Policy Manager but in Tools > Server Options > Advanced > Edit Advanced Settings > ESET Remote Administrator > ERA Server > Setup > Policies. Interval for policy enforcement (minutes): This feature applies to policies in the specified interval.
5.3.10.2 Each server is administered individually - policies are managed locally but the Default Parent Policy is inherited from the upper server The configuration from the previous scenario also applies to this scenario. However, Server A has the Default Policy for Lower Servers enabled and policies on the lower servers inherit the configuration of the Default Parent Policy from the master server.
5.3.10.3 Inheriting policies from an upper server The network model for this scenario is the same as the previous two scenarios. In addition, the master server, along with the Default Parent Policy, contains other policies, that are down replicable and serve as parent policies on the lower servers.
5.3.10.4 Assigning policies only from the upper server This scenario represents a centralized system of policy management. Policies for clients are created, modified and assigned only on the main server - the local administrator has no rights to modify them. All lower servers have only one basic policy, which is empty (by default titled Server Policy).
5.3.10.6 Using groups In some situations, assigning policies to groups of clients can complement previous scenarios. Groups can be created manually or by using the Active Directory Synchronization option. Clients can be added to groups either manually (Static Groups) or automatically — by the group properties (Parametric Groups).
5.4.1 Notification Manager To open the Notification Manager main window, click Tools > Notification Manager. The main window is divided in two sections. The Notification rules section in the top part of the window contains a list of existing (either predefined or user defined) rules. A rule in this section must be checked to generate notification messages. By default, no notifications are enabled.
Page 62
meeting the client filter criteria are taken into consideration. The filtering criteria are: FROM Primary Server – Only clients from primary server; (the negative NOT FROM can also be applied) Primary Server IN – Includes primary server in the output HAS New Flag –...
Page 63
corresponding level. Otherwise such notification rules would never find a trigger in the server log. The following log entries are available: – ADSI_SYNCHRONIZE – Active Directory group synchronization – CLEANUP – Server cleanup tasks – CREATEREPORT – On-demand report generating –...
Page 64
However, the condition to activate the rule must still be met. In Server > Advanced > Edit Advanced Settings > ESET Remote Administrator > Server > Setup > Notifications > Interval for notification processing (minutes) you can specify the time interval in which the server will check and execute active rules.
10% of all clients. Possible network attack – If the frequency of ESET Personal firewall log entries on a client has exceeded 1000 critical warnings in one hour on at least 10% of all clients. Server updated –...
Tools > ESET SysInspector from the ERAC main menu. If there are problems with a specific client, you can request an ESET SysInspector log from that client. To do this, right-click the client in the Clients pane and select Request data – Request SysInspector Information.
– Opens the log listed in the top section directly in ESET SysInspector Save As… – Saves the current log to a file. The Then Run ESET SysInspector Viewer to view this file option automatically opens the log after it is saved (as it would after clicking View).
6. Firewall Rules Merge Wizard Firewall Rules Merge Wizard allows you to merge the firewall rules for selected clients. This is especially useful when you need to create a single configuration containing all firewall rules that were gathered by clients in learning mode. The resulting configuration can then be sent to clients via a configuration task or can be applied as a policy.
7. Reports The Reports tab is used to turn statistical information into graphs or charts. These can be saved and processed later in the Comma Separated Value format (.csv) by using ERA tools to provide graphs and graphical outputs. By default, ERA saves output in HTML format.
Page 70
Summary of Combined Top Clients with most Threats/ Top Threats; Combined Top Threats / Threats Comparative Progress; Threats Progress Comprehensive Network Attacks Report Summary of Combined Top Clients with most Network Attacks / Top Network Attacks; Top Network Attacks; Top Network Attacks Sources;...
Templates placed in the Favorites list can be used later to immediately generate new reports. To move a template to Favorites, right-click the report and click Add to Favorites from the context menu. 7.1 Example report scenario To maintain your clients’ network security at the top level, you will need to have a good overview of the network’s security status.
8. ESET Remote Administrator Server (ERAS) setup 8.1 Security Version 3.x and later ESET security solutions (ESET Smart Security, etc.) offer password protection for decrypted communication between the client and ERAS (communication at the TCP protocol, port 2222). Earlier versions (2.x) do not have this functionality. To provide backward compatibility for earlier versions, the...
The Mirror feature allows a user to create a local update server. Client computers will not download virus signature updates from ESET’s servers on the Internet, but will connect to a local Mirror server on your network instead. The main advantages of this solution are to save Internet bandwidth and to minimize network traffic, since only the mirror server connects to the Internet for updates, rather than hundreds of client machines.
ESET‘s update servers use the HTTP protocol with authentication. A central Mirror server should access the update servers with a username (usually in the following form: EAV-XXXXXXX) and password. The Mirror server which is a part of ESET Smart Security/ESET NOD32 Antivirus has an integrated HTTP server (variant 1). NOTE: If you decide to use the integrated HTTP server (with no authentication), please ensure that it will not be accessible from outside your network (i.e., to clients not included in your license).
To set up PCU mirroring go to Advanced > Edit Advanced Settings and configure settings in ESET Remote Administrator > ERA Server > Setup > Mirror Mirror for NOD32 version Select the language components to be downloaded in Advanced >...
The Mirror feature is also available directly from the program interface in ESET Smart Security Business Edition and ESET NOD32 Antivirus Business Edition. It is left to the administrator’s discretion as to which is used to implement the Mirror server.
8.4 Replication Replication is used in large networks where multiple ERA Servers are installed (e.g., a company with several branches). For more information, see chapter Installation The options in the Replication tab (Tools > Server Options...) are divided into two sections: Replication “to“...
%ALLUSERSPROFILE%\Application data\Eset\Eset Remote Administrator\Server\logs\era.log We recommend leaving the Log verbosity set to Level 2 – Above + Session Errors. Change the log level only if you are experiencing problems, or if you are advised to do so by ESET Customer Care. Click Tools >...
Enable MAC address renaming (from unknown to valid) After reinstalling from an ESET client solution that does not support sending a MAC address (e.g., ESET NOD32 Antivirus 2.x) to a client solution that does (e.g., a 3.x client), the old client record will be converted to the new one. We recommend the default setting (Yes).
2224). ThreatSense.Net If enabled, ERAS will forward suspicious files and statistical information from clients to ESET’s servers in specified interval. Note that it is not always possible for client workstations to submit this information directly, due to the network configuration.
The purpose of the ERA Maintenance tool is to execute specific tasks for server operation and maintenance. It can be accessed by clicking Start > Program Files > ESET Remote Administrator > Server. When you launch the ERA Maintenance tool, an interactive wizard will display to help you in performing the required tasks.
(Allow import from a different type of database) as well as to stop ESET Remote Administrator Server during database restore (Stop server during processing task).
10.1.2 What is the meaning of the GLE error code? Installing ESET Smart Security or ESET NOD32 Antivirus via the Remote Administrator Console can occasionally generate a GLE error. To find the meaning of any GLE error number, follow the steps below: 1) Open a command prompt by clicking Start >...
This update module error can be encountered if a proxy server is used to mediate Internet connection – namely Webwasher proxy. 0x2104 – UPD_RETVAL_SERVER_ERROR Update module error indicating an HTTP error code higher than 500. If the ESET HTTP server is being used, error 500 indicates a problem with memory allocation. 0x2105 – UPD_RETVAL_INTERRUPTED This update module error can be encountered if a proxy server is used to mediate the Internet connection –...
If no changes have been made after installation, ESET NOD32 and ESET Smart Security contain two predefined tasks of this type. The first task checks system files at each user logon, the second task does the same after a successful virus signature database update.
Page 86
60 minutes by default. Usually there is no reason to modify its parameters. The only exception is for notebooks, since their owners also connect to the Internet from outside of company networks. The last dialog allows you to specify two different update profiles, covering updates either from a local server or from ESET’s update servers.
.xml file (.xml configuration files can also be extracted directly from the ESET Smart Security program interface). The .xml file can be used afterwards for various operations: For remote installations, the .xml file can be used as a template for a predefined configuration. This means that no new .
ESET’s update servers and the local Mirror server. First, notebooks contact the local Mirror server, and if the connection fails (they are outside of the office), they download updates directly from ESET’s servers. To allow for this functionality:...
11.5 Installation of third party products using ERA In addition to remote installation of ESET products, ESET Remote Administrator is capable of installing other programs. The only requirement is that the custom install package must be in the .msi format. The remote installation of custom...
In the next step select the target media where ESET SysRescue will be located. In addition to CD/DVD/USB you can choose to save ESET SysRescue in an ISO file. Later on, you can burn the ISO image on CD/DVD, or use it some other way (e.g. in the virtual environment such as VmWare or Virtualbox).
WinPE is based on Windows Vista SP1 which supports a wide array of hardware, sometimes hardware is not recognized and you need to add the driver manually. There are two ways to introduce the driver into ESET SysRescue compilation -...
ESS/EAV are not needed; the modules are minimized to Computer scan, Update, and some sections in Setup. Ability to update the virus signature database is the most important feature of ESET SysRescue. We recommend that you update the program prior starting a Computer scan. 12.3.1 Using ESET SysRescue Suppose that computers in the network have been infected by a virus modifying executable (EXE) files.
Need help?
Do you have a question about the REMOTE ADMINISTRATOR 4 and is the answer not in the manual?
Questions and answers