McAfee使用手册

合集下载

McAfee ePO配置手册

未经 Networks Associates T echnology, Inc. 或其供应商或子公司的书面许可，不得以任何形式或手段将本出版物的任何部分复制、传播、转录、存储于检索系统或翻译成任何语言。

要获得该许可，请写信给 McAfee 法律部门，通信地址为：5000 Headquarters Drive, Plano, T exas 75024, 或致电：+1-972-963-8000。

商标归属Active Firewall、Active Security、ActiveSecurity （及片假名）、ActiveShield、AntiVirus Anyware 及设计、Clean-Up、Design（特殊样式的 E）、Design（特殊样式的 N）、Entercept、Enterprise SecureCast、Enterprise SecureCast（及片假名）、ePolicy Orchestrator、First Aid、ForceField、GMT、GroupShield、GroupShield（及片假名）、Guard Dog、HomeGuard、Hunter、IntruShield、Intrusion Prevention Through Innovation、M 及设计、McAfee、McAfee（及片假名）、McAfee 及设计、、McAfee VirusScan、NA Network Associates、Net Tools、Net Tools（及片假名）、NetCrypto、NetOctopus、NetScan、NetShield、Network Associates、Network Associates Colliseum、NetXray、NotesGuard、Nuts & Bolts、Oil Change、PC Medic、PCNotary、PrimeSupport、RingFence、Router PM、SecureCast、SecureSelect、SpamKiller、Stalker、ThreatScan、TIS、TMEG、Total Virus Defense、Trusted Mail、Uninstaller、Virex、Virus Forum、Viruscan、Virusscan、Virusscan（及片假名）、Webscan、Webshield、Webshield（及片假名）、Webstalker、WebWall、What's The State Of Your IDS? Who's Watching Your Network、Your E-Business Defender 和 Your Network. Our Business. 是 McAfee, Inc. 和/或其子公司在美国和/或其他国家或地区的注册商标或商标。

McAfee指南：实施10个步骤的网络安全指南说明书

White PaperTable of Contents1. Develop an Information Security and Risk-Management Regime 32. Secure System Configuration Management Strategy 33. Establish an Anti-Malware Strategy 44. Network Security Strategy 65. Security Monitoring Strategy 7 Summary 8Government is undergoing a transformation. The global economic condition, coupled with explosion of IT capability, and an evolving, persistent threat landscape, has forced a reinvention of the service delivery and business model of the government. This change in business requirements is also forcing a change in how security is perceived and implemented throughout the enterprise.In order for the government to realise the value it can achieve through digital services, the resilience of systems must be assured and enterprises must improve their capability to defend against continuous cyber assaults. The 10 Steps to Cyber Security guidance, produced by Communications-Electronics Security Group (CESG), the information security arm of the UK Government Communications Headquarters (GCHQ), represents a template for threat prevention capabilities that will help enterprises tangibly improve their cyber defence capacity and the resilience of their digital systems. This white paper describes the five measures McAfee believes will help an organisation successfully implement the CESG guidance to improve their cyber resilience and security posture.1. Develop an Information Security and Risk-Management RegimeA successful information risk management programme starts at the top of the organisation. Establishing a culture of risk management and accountability ensures that security becomes part of the business and not an afterthought. Secondly, articulating the information assurance policy framework formally anchors the security programme. This framework will include the policies and processes that form a secure, high-assurance foundation for the organisation. The 10 Steps to Cyber Security policy framework, recommended by CESG, should include some of the following key components:• Home and mobile worker.• Acceptable use of government systems.• Malware prevention.• Privileged account management.• Removable media.An associated 10 Steps process framework will include some of the following key components:• Training, certification, and awareness programme for users, operators, and security specialists.• Secure configuration development and patch management.• Incident management programme that includes monitoring and incident response processes.• Penetration testing to assess security processes and control readiness.Finally, incorporating cyber risk factors into business decisions regarding service assurance or new service deployment ensures that security becomes operational in the business.McAfee® Foundstone Strategic Consulting Services, as part of strategic security engagement, can assess the current security programme and guide an organisation through the essential elements of developing an effective Information Security and Risk Management Regime.2. Secure System Configuration Management StrategyEmploying baseline secure configurations of system architecture is an essential component of cyber risk management. However, secure configurations are not static elements. They must be continually reviewed to keep up with threat condi-tions, new business functionality, or policy requirements. A process of Design, Test, Monitor, and Control will enable a secure configuration management process. Typically, the process starts with a system assessment to Design the baseline configuration, added security functionality, and change management process. Baseline configurations are usually available for commercial off-the-shelf operating systems and applications. However, custom web applications and databases may need further testing to develop a secure configuration.McAfee Foundstone Services , as part of a strategic security engagement, can assess the current security configurations, conduct additional penetration testing, and conduct code review for the custom applications.Once deployed, the system should be continually tested for new vulnerabilities and monitored for unauthorised changes to the baseline and any potential intrusions. The 10 Steps to Cyber Security recommends conducting regular scans to assess vulnerabilities using automated tools that support open standards like the Security Content Automation Protocol (SCAP). McAfee Vulnerability Manager and McAfee Policy Auditor solutions support these open standards and facilitate configuration monitoring through the McAfee ePolicy Orchestrator ® (McAfee ePO ™) security management platform. In addition to operating system vulnerabilities, it is important to test web applications and databases. These applications form a critical backbone of most digital government systems but are usually not tested nor monitored regularly as part of this process. Through the same management platform, organisations can also use McAfee Web Application Assessment Module and McAfee Vulnerability Manager for Databases to scan and test these critical applications and systems.Figure 1: Basic secure configuration management reference architecture.One of the most important functions in this process is selecting the additional security controls that will harden the system against a variety of threat vectors. According to the 10 Steps to Cyber Security, the baseline security controls must include the capabilities to restrict removable media devices, conduct regular antivirus scans, and implement data-at-rest encryption. The McAfee ePO security management platform, first employed to conduct vulnerability and configuration assessments, can be now be used to easily deploy those additional baseline security controls.3. Establish an Anti-Malware StrategyMalware is the tool of choice for any cyberattacker and has many potential vectors into an organisation. However, most organisations mistakenly equate anti-malware with antivirus. As malware has become increasingly sophisticated and the attack surface increasingly diverse, a successful anti-malware strategy must include a dynamic capability to Prevent, Detect, and Respond in order to limit the impact of malware as an attack vector.Although not mentioned directly in the 10Steps guide, it is a good practice to identifyand label these critical assets within thesecurity information and event managementsystem. This information on the criticality ofsystems provides essential context duringincident response.Although the 10 Step s guide requiresmanaging and monitoring privilegedusers’ accounts, it is very challenging fororganisations to get granular control andvisibility over the use of administrativeaccounts. Through the McAfee ePO securitymanagement platform and McAfee SecurityInnovation Alliance (SIA) partner Avecto,McAfee makes it easy for governmentorganisations to meet this requirement.Check the McAfee SIA website for moreinformation on the McAfee-AVECTOintegration.A layered defence to malware starts with the user. Although layered defences most often addresses technology, users must be trained to recognise attack methods, such as phishing, and understand where to report suspicious activity. Since many successful attacks often target a specific user, training is an essential anti-malware control. McAfee Foundstone services, as part of a strategic engagement, will design a recurring and accountable user security awareness programme. This programme ensures that both users and specialists become the first and last line of defence against malware. In addition, McAfee Foundstone can provide specialist security training, such as Forensic and Malware Analysis, for the Security Operations and Intelligence Centre (SOIC) analysts.Protecting the user device is the next stage in the strategy. The end-user device baseline security config-uration recommended by CESG already includes antivirus as a first layer of defence. Hardening the end-user devices or servers with additional security capability beyond antivirus, such as application whitelisting and reputation intelligence, will provide an effective defence at the host layer, even against malware that uses zero-day exploits. Security and change events generated at the host should be centrally collected, monitored, and analysed by the SOIC to detect potential incidents. Through the McAfee ePO security management platform, McAfee makes it simple to deploy application controls and enable extended behavioural-based security functions, such as reputation intelligence within McAfee VirusScan ® Enterprise software already deployed at the endpoint. Security events are also collected through the McAfee ePO platform and reported to the McAfee Enterprise Security Manager, the McAfee Security Information and Event Management (SIEM) system, for correlation and incident response services. Although application whitelisting and antivirus are effective prevention tools, malware is a multi-stage attack utilising several vectors into and out of the protected network. A comprehensive anti-malware strategy must include a network capability to recognise malware behaviours on the network and to protect end-user devices that may not support host-based security controls, such as smartphones or tablets. Since the most common delivery and command vector for malware is via the web, it is recommended to deploy web content anti-malware inspection at the Internet perimeter to betterprotect end-user devices or detect behavioural evidence of malware already inside the network. Byemploying the McAfee Web Gateway with its strong anti-malware capability—including sophisticatedcontent emulation, a gateway anti-malware engine, botnet identification, and reputation intelligence—organisations not only increase their resilience against malware but also their agility to adopt newenabling technologies. As with host-security events, events from McAfee Web Gateway should becentrally collected, monitored, and analysed by the SOIC to detect potential incidents.As mentioned, a comprehensive anti-malware strategy involves a people, process, and technology approach.One of the key processes is a breach response strategy that will Identify, Validate, Contain, and Respond tosecurity incidents. When a suspicious event is identified, security analysts in the SOIC must rapidly validate themalware, uncover its characteristics, and find affected hosts in order to contain the impact, such as data lossor further compromise. Having direct access to automated malware analysis tools and real-time data sourceswill greatly increase the speed of analysis and reduce the impact of malicious cyber activity. The McAfeeadvanced sensor grid, including the McAfee Network Security Platform and McAfee Web Gateway, willidentify malware in motion.Today, McAfee uses the McAfee Global Threat Intelligence ™ (McAfee GTI ™) network to quickly sharedetections of emerging malware threats. The McAfee host and network products detect a suspicious fileand contact the McAfee Global Threat Intelligence network to see if it has a reputation. Based on thatreputation, as well as network connection reputation, and other factors, the McAfee products can make a decision to block the file.McAfee ApplicationContro l also enablesthe organisation tomeet other controlsrecommended by the 10Steps to Cyber Security,such as locking downoperating systemsand software. McAfeeApplication Controlcan also be extendedto include real-time fileintegrity checking formonitoring changesto critical systems. Theadditional data providedby Application Controlcan be monitored withinthe McAfee EnterpriseSecurity Manager. Thiswill improve the incidentmanagement programmeby enabling more effectivedetection of breach attempts.McAfee Application Control can also be deployed on embedded operating systems.McAfee Web Gateway also meets the require-ment in the 10 Steps to Cyber Security guide for a proxy at the network perimeter. By extending the web security to include identity controls, an organisation coulddevelop a fuller pictureof user behaviour andmore effective policyenforcement.McAfee is also developing a new integrated, advanced malware detection appliance, called McAfee Advanced Threat Defense. If the content cannot be validated immediately, it will be automatically sent to the Advanced Threat Defense system for behaviour deconstruction and analysis. Advanced Threat Defense will assign a fingerprint to the malicious file and distribute this threat intelligence locally—to McAfee-protected endpoints and network gateways—and, if you permit, that DAT will also be sent to the McAfee Global Threat Intelligence network. Through this intelligence exchange, McAfee products on your site and at other customer sites will be able to protect against this newly identified malware.• The new DAT will allow any infected system to be identified and cleaned by McAfee VirusScan (the scanning engine inside McAfee endpoint protections).• The network security products will block transmission of that content over the network to prevent reinfection within your infrastructure.• The web and email gateways will block inbound reinfections.• The endpoint protections will block infection directly on the host (through an infected USB stick, for example.)• Real Time for McAfee ePO can be used to ensure all endpoints have pulled down the new DAT and run a scan to seeif the malware is present.This combination of sensor, analysis, and automated response is unique in the industry and will greatly reduce the impact of malware on the environment.Figure 2: Basic anti-malware reference architecture.4. Network Security StrategyThe role of network security is expanding and changing with the expansion of digital services in government. Traditionally, network security devices functioned as traffic cops governing which network addresses can pass or which protocols can traverse the Internet perimeter. While still providing that function, the goal of the network security strategy is to Deny, Delay, and Disrupt the ability of an attacker to get in and move around on the protected network systems.To enable this strategy, network security devices have evolved from controlling addresses to identifying and controlling application access across multiple security zones within the enterprise. This is aligned with the 10 Steps to Cyber Security recommendations to protect both the internal and external network boundaries.Dividing the network into logical security zones requires different checkpoints for an attacker. T ypically, one of the internal security zones is the consolidated or shared-services datacentre. An effective datacentre network security strategy requires an application layer firewall for controlling application access and an intrusion prevention sensor to protect the sensitive applications from vulnerability exploitation. Other potential network security zones include partner and cross-domain network interconnections. Each of those connections requires an application firewall to control access, although the risk of vulnerability or malware exploitation is low across these perimeters. The greater concern is the access to, or loss of, sensitive data to unauthorised business or coalition partners. Best practice recommends a network data loss prevention solution be deployed and monitored at these perimeter locations.The adoption of cloud services presents unique challenges for traditional perimeter security solutions. While an application layer firewall provides granular traffic control at the Internet perimeter, many applications are exposed to external cloud services through application programme interfaces. Today, on-premises deployment of a centralised service gateway is recognised as the best practice deployment pattern for the application-to-application, web-based service interaction models. A service gateway enables the organisation to develop a standards-based policy enforcement point that is integrated with internal identity management and auditing/monitoring infrastructure.5. Security Monitoring StrategyWith the sophistication and persistence of malicious cyber activity combined with the complexity of security information, detecting or anticipating a security breach requires an organisational monitoring and intelligence strategy, trained specialists, and a 24/7 SOIC. Developing a monitoring strategy starts with an understanding of attack methods. Using threat intelligence will determine the data sources that are most effective to identify and validate an incident. The monitoring strategy must also reflect other requirements from regulations such as GPG13. Once requirements are established, the data collection architecture can be built to support the various breach response or other monitoring use cases.The 10 Steps to Cyber Security recommends collecting various data types such as network traffic, security events, server and device events, and user behaviour, as the foundation of the monitoring capability. Centralising this data inside McAfee Enterprise Security Manager will facilitate rapid data mining for both identification and validation. The McAfee Enterprise Security Manager easily scales to handle high-volume data sources while still enabling rapid data retrieval for reporting and analysis. One of the key processes of the SOIC is Incident or Breach Response. This is the process of Identifying, Validating, Containing, and Mitigating a cyber incident. A successful strategy also starts with threat intelligence of attack methods to determine what are the most effective indicators. For example, identifying an insider attack usually requires identity and database activity monitoring since these provide the mostlikely indicators. Identifying an attempted breach from an outside attacker usually requires network andhost sensors and automated malware intelligence as described in the anti-malware section. Designingthe sensor grid that will expose the right indicators is one of the key foundations to this strategy. ExistingMcAfee ePO infrastructure can easily be extended to include McAfee Database Activity Monitoring andPrivileged Identity data that supports insider monitoring use cases. McAfee Advanced Threat Defenseand McAfee Web Gateway will reveal indications of remote attackers using malware as the entry vector.Centralising this data and incident workflow within the McAfee Enterprise Security Manager allows forrapid identification and validation of malicious activity.Once a breach is identified, speed of response is critical. McAfee Enterprise Security Manager is a centralcommand and control platform that can adjust policy on the McAfee Network Security Platformto rapidly block malicious files or update security policy through McAfee ePO software to contain anincident at the host level. McAfee FoundstoneServices can design anincident-managementprogramme from policydevelopment, to processemployment throughspecialised training inmalware analysis and attacker techniques. The SIA partner, TITUS, can monitor user behaviour related to data and data policy. TITUS is fully integrated with the McAfee ePO security management platform for deployment and management. TITUSevents can also be sentto McAfee EnterpriseSecurity Manager foruser behaviour trendingand further user-relatedcorrelation scenarios2821 Mission College Boulevard Santa Clara, CA 95054888 847 8766 McAfee, the McAfee logo, McAfee ePolicy Orchestrator, McAfee ePO, McAfee Global Threat Intelligence, McAfee GTI, and McAfee VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other marks and brands may be claimed as the property of others. The product plans, specifications, and descriptions herein are provided for information only and subject to change without notice, and are provided without warranty of any kind, express or implied. Copyright © 2013 McAfee, Inc.Figure 3: Basic monitoring reference architecture.SummaryThis solution brief represents McAfee ideas for improving cyber resilience and security posture through implementation of the CESG’s 10 Steps to Cyber Security. While this guide does not address all areas of security or cyber defence requirements, it does provide proven cyber risk reduction steps that could allow an organisation to withstand a cyber threat. For further information and consultation, please contact your local McAfee representative or visit .。

McAfee企业版快速配置手册(EPO4.5)

Mcafee企业版配置手册（for EPO4.5）目录1.软件部署 (4)1.1安装后任务 (4)2.软件配置 (4)2.1登录控制台 (4)2.2界面定制 (6)2.3配置ePO4.5 (8)2.3.1过程概述 (8)2.3.2用户管理 (9)2.3.3服务器及相关参数配置 (10)2.3.4创建存储库 (14)2.3.5添加系统到系统树 (23)2.3.6部署管理代理 (32)2.3.7策略配置 (36)2.3.8部署产品和软件 (43)承接《Mcafee企业版部署手册》1. 软件部署1.1 安装后任务✓计划ePolicy Orchestrator 系统树和更新方案。

✓创建ePolicy Orchestrator 系统树。

✓将McAfee Agent 分发到要通过ePolicy Orchestrator 管理的系统。

✓创建更新存储库。

✓将那些要由ePolicy Orchestrator 管理的产品签入存储库。

然后配置这些产品的策略设置。

✓将产品部署到托管计算机。

✓配置ePolicy Orchestrator 的高级功能。

2. 软件配置2.1 登录控制台➢可选择在服务端点击桌面的图标登录➢通过远程登录：在浏览器（IE或之上的版本、Firefox3.0以上版本）中输入：https://xxx.xxx.xxx.xxx:8443（IP为可访问IP，端口为安装时配置的端口）输入用户名和密码后：2.2 界面定制➢菜单栏“菜单”是4.5 版ePolicy Orchestrator 软件中的新增功能。

“菜单”使用类别来对各种ePO 特性和功能进行比较。

每个类别都包含与一个唯一图标相关联的主要功能页列表。

可通过菜单选项选择自己需要的功能区域进行配置。

➢导航栏在ePolicy Orchestrator 4.5 中，可以自定义导航栏。

可以通过将任何菜单项拖入或拖出导航栏来确定导航栏上显示的图标。

在导航到菜单中的某个页面或者单击导航栏中的某个图标时，该页的名称将显示在“菜单”旁的蓝框中。

mcafee企业版快速部署手册（epo4.5）

Mcafee企业版安装部署手册（for EPO4.5）1. 安装所需1.1 硬件可用磁盘空间—最低 1 GB（首次安装）；最低 1.5 GB（升级）；建议 2 GB（现在空间肯定不缺）；内存— 1 GB 可用内存；建议 2-4 GB（最少保证1G内存，否则安装过程中会报错）；处理器— Intel Pentium III 或更高配置；1 GHz 或更高频率；1.2 软件服务器类操作系统— 32 位或64 位（Windows Server 2003 R2 Enterprise Service Pack 2 或更高版本）；数据库（SQL Server 2005、SQL Server 2005 Express、SQL Server 2008、SQL Server 2008 Express），不支持SQL Server 2000；浏览器（Firefox 3.0、Microsoft Internet Explorer 7.0 或8.0）；Internet 信息服务（IIS）；Mcafee ePolicy Orchestrator 4.5及相关的升级补丁（EPO450L.Zip、ePO450P3.Zip、ePO450P补丁升级.Zip、EPOAGENTMETA.zip、MA450P1Win.zip）；McAfee VirusScan 8.7及升级补丁（VSE870EMLRP2.Zip、VSE870LMLRP3.Zip、VSE870P3.Zip）2. 软件部署2.1 服务器系统*本文不做说明（将主机名改为Mcafee，主机名即后来的数据库名）2.2 安装Internet 信息服务（IIS）；*本文不做说明2.3 安装SQL Server 2005 Express请参考《SQL Server 2005 Express安装说明》【安装过程请点击下面图标】SQL Server 2005Express安装说明【注意事项】2.4 插件安装确认系统是否装有下列插件msxml 6.0 parser.msi（此插件必需先安装，否则无法安装ePO，具体可去微软官方下载） Windows .Net Framework 2.0或更高（此插件必需先安装，否则无法安装ePO，具体可去微软官方下载）；Microsoft Visual C++ 2005 SP1 Redistributable Package (x86).exe（此插件可在安装过程中由Mcafee自动安装，也可自行先下载安装）；Microsoft Visual C++ 2008 Redistributable Package (x86).exe（此插件可在安装过程中由Mcafee自动安装，也可自行先下载安装）；2.5 安装Mcafee ePolicy Orchestrator 4.5请参考《Mcafee ePO 4.5安装说明》【安装过程请点击下面图标】Mcafee ePO4.5安装说明2.6 更新安装补丁包在server端运行安装ePO450P3.Zip、ePO450P补丁升级.Zip升级补丁包2.7 安装后任务✓计划 ePolicy Orchestrator 系统树和更新方案。

McAfee 麦咖啡 8.5企业版使用规则全攻略说明教程

McAfee 麦咖啡8.5企业版使用规则全攻略说明教程麦咖啡全球最畅销的杀毒软件之一，McAfee防毒软件,除了操作介面更新外,也将该公司的WebScanX 功能合在一起,增加了许多新功能!除了帮你侦测和清除病毒，它还有VShield自动监视系统，会常驻在SystemTray，当你从磁盘、网络上、E-mail夹文件中开启文件时便会自动侦测文件的安全性，若文件内含病毒，便会立即警告，并作适当的处理，而且支持鼠标右键的快速选单功能，并可使用密码将个人的设定锁住让别人无法乱改你的设定。

首先,下载McAfee VirusScan v8.5i 企业版多国语言正式版。

安装如图:安装方法.现在我们来看安装好后。

开始升级。

一般选手工比较好.在右下角如图位置更新后主要的来了。

另外不仅是Mcafee，如SAFESYSTEM和SENSIVEGUARD这样的FD也一样可以用！当然规则编写见仁见智，如果你有更好的规则，请予以补正！更欢迎你对我们的工作作出评论.如上图中。

点第一个。

VIRUSSCAN控制台.再在菜单中点属性。

如图:如上图中，这个要勾上的哦。

图上有详细说明.保护IE不受侵害. 再看下一个.这个选项还是要勾上。

装软件时（指正规软件可暂停。

装好了再勾上。

)不过软件装好后还是要勾上的哦。

防止某些恶意网站来更改你的注册表。

加进东西。

第七个选项是用于邮件的。

这时为了FOXMAIL好用。

我们要自己加进一条。

点编辑。

最后添加foxmail.exe 如图.下面这个选项建议不选。

因为傲游(Maxthon)等大部分程序会严重变慢，如果你确实要选，请添加maxthon.exe才可以。

按图上就行，不要多选图上加箭头的一定要选上,安全第一.哈.禁止HTTP可能导致IE7等软件上网错误.建议取消.McAfee麦咖啡8.5企业版高级教程首先,先下载McAfee VirusScan v8.5i 企业版多国语言正式版，接着看.这儿如果你怕MCAFEE一个不够用。

mcafee epo操作手册

文章标题：深度解析：McAfee ePO操作手册在当今互联网时代，网络安全问题愈发凸显，各种网络攻击与病毒泛滥成灾。

而企业级的网络安全管理更是面临着更为复杂和严峻的挑战。

为了更好地管理和维护企业网络安全，McAfee ePO成为了许多企业的首选工具之一。

本文将深度探讨McAfee ePO操作手册，在全面了解其功能和操作方法的基础上，帮助读者更好地应对网络安全挑战。

1. 了解McAfee ePOMcAfee ePO是McAfee公司开发的一个企业级的安全管理评台，主要用于集中管理企业网络中的安全防护设备和安全软件。

它为企业提供了统一的安全管理界面，帮助企业更好地监控和保护其网络安全。

在当今信息安全威胁不断增加的环境下，McAfee ePO成为了各大企业保护其网络安全的重要利器。

2. 操作手册详解为了更好地使用McAfee ePO，首先需要全面了解其操作手册。

在操作手册中，包括了软件的安装、配置、管理和维护等方面的内容。

通过仔细研读操作手册，用户可以更好地理解McAfee ePO的各项功能，并灵活运用于实际的网络安全管理工作中。

3. 软件安装与配置在使用McAfee ePO之前，首要任务是进行软件的安装与配置。

在操作手册中，用户可以学习到如何进行服务器端和客户端的安装步骤，以及如何对软件进行必要的配置。

这一部分内容十分重要，它直接关系到软件的正常运行和使用。

4. 安全策略管理McAfee ePO可以帮助用户制定和管理安全策略，以应对网络安全威胁。

在操作手册中，用户可以学习如何根据企业的实际情况，制定合适的安全策略，并进行灵活的管理和调整。

这对于提高企业的网络安全水平至关重要。

5. 定期维护与更新软件的定期维护与更新是保证其正常运行和安全性的重要手段。

在操作手册中，用户可以学习到如何进行软件的定期维护和更新，以确保软件始终保持在最佳状态。

6. 个人观点作为一名网络安全专家，我对McAfee ePO的重要性有着非常深刻的认识。

MCAFEE配置说明

目录一、服务器要求 (2)二、EPO安装步骤 (3)三、EPO配置 (8)3．1登陆EPO (8)3．2添加客户端软件包及策略包 (11)3．2．1添加软件包 (11)3．2．2添加策略包 (13)3．3配置二及更新FTP服务器 (14)3．3．1添加二级服务器 (14)3．3．2管理二级服务器 (16)3．4服务器更新测试及更新任务 (19)3．4．1EPO服务器更新测试 (19)3．4．2二级更新服务器更新测试 (20)3．4．3服务器更新任务建立 (21)3．5 EPO Agent配置 (25)3．6 TASK任务设置 (27)3．6．1客户端安装TASK任务 (27)3．6．2新建TASK任务 (29)3．7 EPO Agent程序的生成 (32)3．8 客户端安装 (34)3．9客户端软件版本的升级配置 (34)3．10 VirusScan8.0新增特性说明 (38)一、服务器要求ePolicy Orchestrator 服务器和控制台可以安装和运行在具有如下配置的任何CPU ：PIII 1.0G以上内存：256M以上可用磁盘空间：至少250MB （首次安装）；至少650MB （升级）；建议为1GB。

浏览器： Microsoft Internet Explorer 6.0。

注：如果管理的客户机超过250 台，建议使用专用服务器。

文件系统：建议使用NTFS （NT 文件系统）分区。

IP 地址：我们建议对ePolicy Orchestrator 服务器采用静态IP 地址。

操作系统：以下任何Microsoft Windows 操作系统：Windows 2000 Advanced Server+SP4。

Windows 2000 Server+SP4。

Windows Server 2003 Enterprise。

Windows Server 2003 Standard。

Windows Server 2003 Web。

McAfeeApplicationControl0-Windows产品手册

McAfee Application Control 8.1.0 -Windows 产品手册目录5. 在epo服务器设置上输入ACS及CHS的许可密钥 ------------------ 错误!未定义书签。

6. 对华为云终端下发任务，推送ACS及CHS ------------------------- 错误!未定义书签。

3，启用应用白名单及变更控制软件功能 ------------------------------ 错误!未定义书签。

4，在终端上确认epo下发的策略已执行并检查系统是否完成固化操作---- 错误!未定义书签。

5，在华为云终端验证ACS功能，执行PE文件被阻挡------------------ 错误!未定义书签。

6，在华为云终端验证Change control功能，创建变更保护策略，以TXT为样板错误!未定义书签。

6.1，选中单个主机修改分配策略，分配新建的测试策略 --------- 错误!未定义书签。

6.2，修改文件被阻止 --------------------------------------- 错误!未定义书签。

7，在epo上查可以查看所有来自MAC所产生的事件------------------ 错误!未定义书签。

产品概述概述McAfee® Application Control 是一款安全软件，可以阻止未经授权的应用程序在您的系统上运行。

Application Control 采用动态白名单，以确保只有受信任的应用程序才能在服务器、设备和台式计算机上运行。

有了它，无需IT 管理员手动维护已批准应用程序的列表。

它还提供对端点的IT 控制，以帮助强制实施软件许可合规性。

此软件采用动态信任模型和创新安全功能，可以阻止高级持续威胁(APT)，无需更新特征码。

它可以提供保护保障而不影响生产效率。

使用Application Control，您可以：•防止执行任何恶意的、不可信的或有害软件。

1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。

代码
手册、章节或主题的标题；新术语的介绍；强调。着重强调的文本。用户键入的命令和其他文本；文件夹或程序的路径。代码示例。
“用户界面” 超文本（蓝色）
用户界面（包括选项、菜单、按钮和对话框）中的文字。指向某个主题或网站的活动链接。附注：附加信息，例如访问某个选项的替代方法。提示：意见和建议。重要事项/注意：有关保护计算机系统、软件安装、网络、企业或数据的有用建议。警告：在使用硬件产品时，防止受到人身伤害的重要建议。
未安装产品 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
索引
15
McAfee Virtual Technician 6.0.0 演练手册
3
前言
本节将介绍演练手册和相关的产品文档。
目录关于本手册查找产品文档
演练手册
McAfee Virtual Technician 6.0.0
版权 Copyright © 2010 McAfee, Inc. 保留所有权利。
未经 McAfee, Inc. 或其供应商或子公司的书面许可，不得以任何形式或手段将本出版物的任何内容复制、传播、转录、存储于检索系统或翻译成任何语言。echnician 6.0.0 演练手册
1
McAfee Virtual Technician 简介
本章将介绍 McAfee Virtual Technician，并提供受支持的家用和家庭办公产品以及企业级产品的列表。 McAfee Virtual Technician 可收集数据，该数据有助于诊断和解决与您计算机上安装的 McAfee 产品相关的问题。诊断数据主要包括有关以下内容的信息：已安装的 McAfee 产品、操作系统、浏览器、物理内存、系统体系结构和虚拟内存。
关于本手册
下文介绍本手册的目标读者、使用的印刷约定和图标以及组织结构。
读者
McAfee 文档经过仔细调研并面向目标读者编写。本指南中的信息主要面向以下人员：
• 用户 — 使用运行的软件并且可以访问该软件的部分或全部功能的人。
约定
本手册使用下列印刷约定和图标。
“手册标题”或强调粗体用户输入或路径
1 McAfee Virtual Technician 简介
7
支持的家用和家庭办公产品 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
支持的企业级产品 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
McAfee Virtual Technician 6.0.0 演练手册
5
前言查找产品文档
查找产品文档
McAfee 提供了产品实施各阶段（从安装到日常使用再到故障排除）所需的信息。在发行某个产品后，有关此产品的信息将输入到 McAfee 在线知识库中。
任务 1 转至 McAfee 技术支持 ServicePortal，网址为。
2 在“Self Service（” 自助服务）下面，访问您所需要的信息类型：
要访问... 用户文档
操作方法... 1 单击“Product Documentation（” 产品文档）。 2 选择“Product（” 产品），然后选择“Version（” 版本）。 3 选择产品文档。
知识库
• 单击“Search the KnowledgeBase（” 搜索知识库）以获取产品问题的解答。 • 单击“Browse the KnowledgeBase（” 浏览知识库）以查看按产品和版本列出的文章。
2 McAfee Virtual Technician 入门
9
安装针对家用和家庭办公产品的 McAfee Virtual Technician . . . . . . . . . . . . . . . . . . . . 9
安装针对企业级产品的 McAfee Virtual Technician . . . . . . . . . . . . . . . . . . . . . . . 10
McAfee Virtual Technician 6.0.0 演练手册
7
1
McAfee Virtual Technician 简介支持的企业级产品
• Host Intrusion Prevention Server • Host Intrusion Prevention Client • McAfee Quarantine Manager • McAfee Policy Auditor Agent • McAfee Risk Advisor • McAfee Security for Lotus Domino • McAfee Security Service for Exchange • McAfee Solidifier • Endpoint Encryption for PC v6 • Endpoint Encryption Agent • Asset Baseline Monitor • McAfee Network Access Control Client • McAfee Network Access Control Guest Client • McAfee Network Access Control Server • System Information Reporter • SiteAdvisor Enterprise • McAfee Security for Microsoft SharePoint • McAfee Host Data Loss Prevention
8
McAfee Virtual Technician 6.0.0 演练手册
2
McAfee Virtual Technician 入门
本章将提供有关安装和使用针对家用和家庭办公产品以及企业级产品的 McAfee Virtual Technician 的详细说明。
目录安装针对家用和家庭办公产品的 McAfee Virtual Technician 安装针对企业级产品的 McAfee Virtual Technician 运行 McAfee Virtual Technician 安装和运行针对所有受支持产品的独立 McAfee Virtual Technician 技术支持选项未安装产品
2
McAfee Virtual Technician 6.0.0 演练手册
目录
前言
5
关于本手册 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
读者 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
任务 1 使用受支持的 Web 浏览器访问。将显示“针对家用和家庭办公的 McAfee 服务与支持”网
页。
如果此页未以您需要的语言显示，可以从右上方的“选择语言”下拉列表中选择语言。
2 单击“转至技术支持”。将显示“针对家用和家庭办公的技术支持”网页。 3 单击“开始”。 4 单击“下一步”。此时会出现“文件下载 ‑ 安全警告”对话框。 5 单击“运行”，然后按照屏幕上的说明，通过安装 McAfee Virtual Technician。若要稍后安装
许可信息
许可协议致全体用户：请仔细阅读与您所购买的许可相关的法律协议，以了解使用许可软件的一般条款和条件。如果您不清楚所购买的许可属于哪一类，请查看软件包装盒中或购买产品时单独提供的销售文档以及其他相关的许可授权或订单文档，这些文档既可以是小册子、产品光盘上的文件，也可以是软件包下载网站提供的文件。如果您不接受该协议规定的所有条款和条件，请勿安装本软件。根据情况，您可以将产品退回 McAfee, Inc. 或原购买处以获得全额退款。
商标特性 AVERT、EPO、EPOLICY ORCHESTRATOR、FOUNDSTONE、GROUPSHIELD、INTRUSHIELD、LINUXSHIELD、MAX (MCAFEE SECURITYALLIANCE EXCHANGE)、 MCAFEE、NETSHIELD、PORTALSHIELD、PREVENTSYS、SECURITYALLIANCE、SITEADVISOR、TOTAL PROTECTION、VIRUSSCAN 和 WEBSHIELD 是 McAfee, Inc. 和/或其子公司在美国和/或其他国家或地区的注册商标或商标。与安全相关的 McAfee 红色是 McAfee 品牌产品的特有代表色。本声明中的所有其他注册和未注册的商标均为其各自所有者专有。
安装针对家用和家庭办公产品的 McAfee Virtual Technician
本任务将提供针对家用和家庭办公产品的 McAfee Virtual Technician 的分步安装说明。开始之前 McAfee Virtual Technician 的最低系统要求如下：操作系统 • Microsoft Windows 2000 操作系统或更高版本。 Web 浏览器 • Internet Explorer 6.0 或更高版本。 • Mozilla Firefox 2.0 或更高版本。
• 快速清理器和文件粉碎机
• 个人防火墙
• 安全中心
• 家长监控
• Wireless Network Security
• 反垃圾邮件
• Easy Network
• 迈克菲防身份信息窃取
• Data Backup
支持的企业级产品
McAfee Virtual Technician 支持的企业级产品包括： • VirusScan Enterprise • Common Management Agent • ePolicy Orchestrator • Total Protection Service ‑ Agent • Total Protection Service ‑ Virus and Spyware Protection • Total Protection Service ‑ Firewall Protection • Total Protection Service ‑ Browser Protection