McAfeeePolicyOrchestrator

-->

HereareMcAfeerecommendationsforinstallinganewMcAfeeePolicyOrchestrator(McAfeeePO)serverorupgradinganexistinginstance.ThefirststepistodownloadandrunthelatestPre-InstallationAuditor(PIA).IfthePIAtoolfindsanyissues,itwillguideyoutotherelevanttechnicalarticles.

NOTE:Tomanuallyperformthesechecks,orifyourcompanypolicywillnotallowyoutorunthePIAtool,completetheMcAfeeePOinstallationandpatchupgradechecklist(registrationrequired).

InadditiontorunningthePIAtool,reviewtheseitemspriortoattemptingaMcAfeeePOupgrade:

IfthisisanewMcAfeeePOserverinstallation,confirmallrequiredportsforMcAfeeePOcommunicationareopen.SeeKB66797foracompletelistofportsneededforcommunicationthroughafirewall.

SupplementalDocumentation:

Aftertheupgradecompletes,it’sagoodideatodoaquickhealthcheckontheMcAfeeePOserverbyconfirmingthefollowing:

IfyouhaveupgradedtoMcAfeeePO5.9.Xorlaterfromversion5.3.3orearlier,youneedtomigratecertificatesfromSHA-1toSHA-2.SeeKB87017fordetails.

NOTE:IfyouhaveupgradedtoMcAfeeePO5.9.1only,youneedtoapplyMcAfeeePO5.9.1Hotfix1226775beforemigratingyourcertificates.SeeKB90182fordetails.

Ifyourupgradewasunsuccessful,itshouldrollbackandleaveMcAfeeePOinafunctionalstate.Iftherollbackalsofails,youmayneedtoperformadisasterrecoveryonyourMcAfeeePOserver.

NOTE:Knownissue:DisasterRecoverySnapshottaskfailsonaclusteredMcAfeeePO

IfyourePOUpgradefails,performthefollowingstepspriortologgingaServiceRequestwithMcAfeeSupport:

Afteryouhavecollectedlogsandperformedadisasterrecovery,openaServiceRequestwithSupportusingtheMcAfeeServicePortal.

SystemTree

-->

Areyouanewuser?SeeouravailableMcAfeeePOtrainingcourses.

OutlinedbelowaretheinitialstepstogetstartedmanagingMcAfeesoftwarewithMcAfeeePO.Youcancompletemostofthesetaskswithmultiplemethods.Themethodyouchooseforeachstepdependsonthesizeandmakeupofyourenvironment.AdditionaldetailsforcompletingthesestepscanbefoundinSettingupyourMcAfeeePOenvironment.

FromtheServerSettingssection,defineProxySettings,ifrequired,forMcAfeeePOtoreachexternalresources.Checkinlicensedproductsoftwarepackagesandmanagementextensions.Addsystemstothesystemtree.Configureandassignpointproductpolicies.DeployMcAfeeAgenttoyoursystemssotheyareunderMcAfeeePOmanagement.YoumustinstalltheMcAfeeAgentonasystembeforeyoucandeployothersoftware.Deploysoftwaretoyourmanagedsystems.Configureproductupdatetasksforyourmanagedsystems.

Themasterrepositorystorestheinstallers,updates,hotfixes,andcontentupdatesthatdeploytomanagedsystems.CheckinginsoftwaretothemasterrepositoryisnecessaryifyouplantouseMcAfeeePOtodeployproducts.Themasterrepositoryisdividedintothreeseparatebranches:Current,Evaluation,andPrevious.Theintentionofthebranchesistoaidwithproductlifecyclemanagement.

EachpointproductyouplantomanagewithMcAfeeePOalsoincludesoneormoremanagementextensions.Theextensionsaddcontrolsforthatpointproduct,suchaspoliciesandclienttasks.

NOTE:Ifamanagementextensionisremoved,thecorrespondingpoliciesandtasksyoucreatedforthatproductarealsoremoved.TheoptionalserversettingPolicyandTaskRetentioncanbeenabledtosavepoliciesandclienttaskdataifyouremovetheextension.

BuildingtheSystemTreeinvolvestwomainobjectives:

1.Creatingandorganizinggroupsandsub-groups

2.Addingsystems

Aspartoftheplanningprocess,considerthebestwaytoorganizesystemsintogroupsbeforebuildingtheSystemTree.Groupingsystemswithsimilarpropertiesorrequirementsintotheseunitsallowsyoutomanagepoliciesandtasksforsystemsinoneplace,ratherthansettingpoliciesforeachsystemindividually.ForadditionalguidancereviewConsiderationsforPlanningYourSystemTree.

TherearemanymethodstopopulatetheSystemTree.Foracompleteunderstandingoftheoptions,reviewthePopulatingSystemTreeGroupssectionsoftheMcAfeeePOProductGuide.

TheLostandFoundGroup:

Thisgroupcannotbedeletedorrenamed.Thesortingcriteriacannotbechangedfrombeingacatchallgroup,althoughyoucanprovidesortingcriteriaforanysubgroupscreatedinit.WhenasystemissortedintoLostandFound,itisplacedinasubgroupnamedforthesystem’sdomain.Ifnosuchgroupexists,oneiscreated.

Whenaproductmanagementextensionischeckedin,thepolicycatalogisupdatedwiththepoliciesforthecorrespondingpointproduct.Aread-onlyversionnamed“McAfeeDefault”ofeachpolicyisaddedwithaneditablecopyofthepolicynamed“MyDefault.”

Beforedeployingtheproducttoanysystems,youshouldreviewthesettingsdefinedwiththepolicytoensuretheyareappropriateforyoursystemsandmakechangesorcreatecustompoliciesasneeded.ReviewtheProductGuideforcorrespondingproductinformationaboutthepolicysettingsyouareworkingwith.

Whenapolicyhasbeencreated,itcanbeassignedtoanygroup,subgroup,orindividualnodeintheSystemTree.AllchildsubgroupsintheSystemTreehierarchyinheritpoliciessetattheirparentgroups.Theseinheritancerulessimplifypolicyandtaskadministration.FordetailsreviewtheEnforcingPoliciessectionoftheProductGuide.

SystemswithaMcAfeeAgentinstalledthatreporttoMcAfeeePOarereferredtoas“ManagedSystems.”WhentheMcAfeeAgentisinstalledonaclient,theagentautomaticallyinitiatescommunicationtoMcAfeeePOshortlyaftertheagentservicesstart.Duringtheagent-servercommunicationinterval,systempropertiesandproducteventsarecollectedandsenttoMcAfeeePO.Thelistofassignedclienttasksisthendownloadedandaddedtotheagentscheduler,andassignedpoliciesareenforced.Thisprocessisrepeatedateveryagent-servercommunicationinterval(ASCI).

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-120294-1.html