ESET Remote Administrator

Installation Manual

andUser Guide
we protect your digital worlds

contents

Contents

1. Introduction.. 4

2. ERA client/server architecture. 5

2.1 ERA Server (ERAS)..5

2.1.1 2.1.2 2.1.3 2.1.4 2.1.5 2.1.6 2.1.7 Requirements..5 ERAS hierarchy at large networks..6 Installation... 7 Logs... 7 Configuration.. 7 License keys.. 7 Database & information storage..8
2.2 ERA Console (ERAC)...8
3. Other ESET components in network environment.. 9
3.1 ESET client solutions..9. 3.2 ESET Configuration Editor..9
3.2.1 3.2.2 3.3.1 3.3.2 3.3.3 Configuration layering.. 10 Key configuration entries.. 10 Operation of Mirror server..12 Types of updates..12 How to enable and configure Mirror.13
3.3 LAN Update Server -Mirror. 11
4. ESET Remote Administrator Console indetail. 15
4.1 Connecting toERAS..15 4.2 ERAC main screen..15. 4.3 Information filtering..16
4.3.1 4.3.2 4.3.3 4.3.4 4.4.1 4.4.2 4.4.3 4.4.4 4.4.5 4.4.6 4.4.7 4.4.8 4.4.9 4.4.10 4.5.1 4.5.2 4.5.3 4.5.4 4.5.5 4.5.6 4.6.1 4.6.2 4.6.3 4.6.4 4.6.5 Groups...16 Filter...16 Context menu.. 17 Views...18 General description of tabs and clients..18 Replication & information in individual tabs.18 Clients tab...19 Threat Log tab.. 22 Firewall Log tab.. 22 Event Log tab.. 22. The Scan Log tab... 23 Tasks tab.. 23 Reports tab... 23 Remote Install tab.. 25 Connection tab... 25 Columns Show / Hide tab.. 25. Colors tab... 25 Paths tab.. 25 Date / Time tab... 25 Other Settings tab.. 25 General tab.. 26. Security tab... 26 Server Maintenance tab.. 27 Logging tab... 27 Replication tab... 27

4.4 Tabs in ERAC..18

Copyright 2008 by ESET, spol. sr.o. ESET Remote Administrator was developed by ESET, spol. sr.o. For more information visit www.eset.com. All rights reserved. No part of this documentation may be reproduced, stored in aretrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise without permission in writing from the author. ESET, spol. sr.o., reserves the right to change any of the described application software without prior notice. Customer Care Worldwide: www.eset.eu/support Customer Care North America: www.eset.com/support REV.20080310-005
4.5 ERA Console setup... 25
4.6 Configuring ERA Server using the Console. 26

4.6.6 4.6.7

Updates... 29 Other Settings tab.. 29

5. Tasks...30

5.1 Configuration Task... 30 5.2 On-Demand Scan task..31 5.3 Update Now task..31
6. Installation of ESETs client solutions. 32
6.1 Command line parameters for direct installation of client solutions... 32 6.2 Installation methods.. 32
6.2.1 Direct installation with predefined XML configuration... 32 6.2.2 Remote installation in general.. 33 6.2.3 Remote push install.. 34 6.2.4 Logon / email remote install.. 37 6.2.5 Custom remote install.. 39
6.3 The einstaller.exe agent in detail. 39 6.4 Avoiding repeated installations..40 6.5 Installation process error messages..40
6.5.1 Remote Install Diagnostics..41
Deployment scenarios for ESET Remote Administrator, Mirror server and ESET client solutions.. 42
7.1.1 Installation of HTTP Mirror server. 42 7.1.2 Installation of ERA Server.. 43 7.1.3 Installation of ERA Console.. 43 7.1.4 Remote install on workstations present in the network... 43 7.1.5 Remote install on notebooks currently not present in the network.. 44
7.1 Small network 1x ERAS, 1x Mirror server. 42
7.2 Company with aremote subsidiary 2x ERAS, 2x Mirror server.. 46
7.2.1 Installations at headquarters..46 7.2.2 Subsidiary: installation of ERA Server. 47 7.2.3 Subsidiary: Installation of HTTP Mirror server.. 47 7.2.4 Subsidiary: Remote installation to clients. 47

8. Hints & tips..48

8.1 Export and other features of client XML configuration... 48 8.2 Combined update for notebooks and mobile devices.. 48 8.3 Removing existing profiles.. 49 8.4 Scheduler setup.. 50 8.5 Custom install packages..51

1. Introduction

ESET Remote Administrator is an application which allows you to manage ESETs products in a networked environment. ESET Remote Administrator (ERA) is a solution which allows you to administer ESET products, including workstations and servers from one central location. Thanks to ESET Remote Administrators built-in task management system, you can quickly respond to new problems threats, and - last but not least install ESET solutions on remote computers. ESET Remote Administrator itself does not provide any other form of protection against malicious code, such as viruses and worms. ERA depends on the presence of an ESET solution on workstations or servers, such as ESET NOD32 Antivirus or ESET Smart Security. To perform acomplete deployment of ESET security solutions portfolio, the following steps must be taken: Installation of ERA Server (ERAS), Installation of ERA Console (ERAC), Installation of Mirror server, Installation of client computers (ESET NOD32 Antivirus, ESET Smart Security, ESET Server Edition, etc.). NOTE: Some parts of this document will use system variables, which refer to an exact location of folders and files: %ProgramFiles% = typically C:\Program Files %ALLUSERSPROFILE% = typically C:\Documents and Settings\All Users

Figure 1

Simplified model of deployment: ESET for Windows clients, ESET Remote Administrator. ERAS and MIRROR SERVER can, but do not have to be installed on the same system.
2. ERA client/server architecture
Technically, ESET Remote Administrator consists of two separate components: ERA Server (ERAS) and ERA Console (ERAC). You can run an unlimited number of ERA Servers on your network as there are no limitations in the license agreement for their use. The only limitation is the total number of clients your installation of ERA can administer (see section 2.1.6 , License keys). 2.1 ERA Server (ERAS) The server component of ERA runs as aservice under the following Microsoft Windows NT-based operating systems: NT4, 2000, XP, 2003 and Vista. The main task of this service is to collect information from clients and to send various requests to them. These requests, including configuration tasks, remote installation requests, etc., are created through the ERA Console (ERAC). ERAS is a meeting point between ERAC and client computers a place where all information is processed, maintained or modified before being transferred to clients or to ERAC. 2.1.1 Requirements

ERAS requires aMicrosoft Windows NT-based operating system (NT4, 2000, XP, 2003, Vista). The Microsoft Windows Server Edition is not necessary for ERAS to work. Acomputer with ERAS should be always online and accessible via computer network by: Clients (usually workstations) PC with ERA Console Other instances of ERAS (if replicated) The chart below lists the possible network communications used when ERAS is installed. The process era.exe listens on TCP ports 2222, 2223, 2224 and 2846. Other communications occur using native operating system processes (for example NetBIOS over TCP/IP). Protocol TCP TCP Port 2222 (ERAS listening) 2223 (ERAS listening) Description Communication between clients and ERAS Communication between ERAC and ERAS By default, this port offers update packages using the Mirror feature integrated in ERAS (HTTP communication)

2221 (ERAS listening)

If using all features of the program, the following network ports need to be open: Protocol TCP TCP TCP UDP UDP TCP Port 2224 (ERAS listening) 2846 (ERAS listening) 139 (target port from the point of view of ERAS) 137 (target port from the point of view of ERAS) 138 (target port from the point of view of ERAS) 445 (target port from the point of view of ERAS) Description Communication between the agent einstaller.exe and ERAS during remote install ERAS replication Copying of the agent einstaller. exe fromERAS to aclient using the share admin$ during push install Name resolving during remote install Browsing during remote install Direct access to shared resources using TCP/IP during remote install (an alternative toTCP 139)
The minimum hardware configuration for the deployment of ERAS is also the minimum recommended configuration for the Microsoft Windows operating system used on the machine.
ERAS hierarchy at large networks
In larger networks multiple ERA Servers can be installed to perform future remote installs of client computers from servers which are more accessible. For this purpose, ERA Server offers replication, which allows stored information to be forwarded to a superior ERA Server (upper server). Replication can be configured using ERAC. The replication feature is very useful for companies with multiple branches or remote offices. The model deployment scenario would be as follows: Install ERAS in each office and have each replicate to a central ERA Server. The advantage of this configuration is especially apparent in private networks which are connected via VPN, which is usually slower the administrator will only need to connect to a central ERAS (the communication marked by the letter A in the figure below). He will not need to use the VPN tunnel to access individual departments (the communications B, C, D and E) allowing him to bypass a slower communication channel through the use of ERA Server replication. The replication setup allows an administrator to define which information will be transferred to upper servers automatically at a preset interval, and which will be sent upon request from the upper server administrator. Replication makes ERA more user-friendly and also minimizes network traffic. Another advantage to replication is that multiple users can log in with various permission levels. The administrator accessing the ERAS london1.company.com with the console (communication E) will be able to administer only clients connecting to london1.company.com, london.company.com, paris.company.com. If you connect to the central company.com (A), you will be able to control all clients located at company headquarters and departments/ branches.

The license key is a file with the.lic extension, similar in structure to the.xml format, but protected by an electronic signature. This file is required to successfully configure ERAS. The file contains the following information: License owner Number of client machines (number of licenses) License expiry date Here are four common problem scenarios related to license key files: .lic file is not present ERAS will run in atrial mode it will be possible to administer only two clients (workstations) for an unlimited time period. .lic file is corrupt The ERA Server service will not launch at all. The event will be logged to the era.log file. .lic file has expired If the expiry date defined in a.lic file is older than acurrent date, it is not possible to establish connection between ERAC and ERAS. ERAS will continue to accept information from clients, but will not be able to administer them. The number of clients defined in a.lic file is exceeded This status will be displayed by an error message in ERAC. It will be not possible to administer the extra clients communicating with the ERA Server.
License keys should be stored in the folder: %ALLUSERSPROFILE%\Application Data\Eset\Eset Remote Administrator\Server\license During the installation of ERAS, the license key is automatically copied to the above-mentioned folder. If the license is updated or upgraded, the license key must be manually updated. The folder may contain several license files, but ERAS will always choose and work with the most suitable file with the.lic extension. Every time anew license is installed, the ERAS service must be stopped and restarted. There are several ways to upload a license key to ERAS: Copy it to the above-mentioned directory where ERA Server is installed; then restart the ERAS service. Use the ESET Configuration Editor in ERAC and import license keys to ERA Server remotely Use the Licenses feature in ESET Smart Security/ESET NOD32 Antivirus to import license keys 2.1.7 Database & information storage
ERAS uses the MDAC (Microsoft Data Access Components) database component, while larger entries are saved to individual files in the Storage folder. ERAS has tools built in to allow administrators to automatically perform database and stored information maintenance. This can be configured during the installation (expert level) or later through ERAC. Database maintenance leads to faster responses on database queries from ERAS and also saves hard disk space. We recommend using the default configuration, which automatically deletes all entries older than six months. Decrease this value only in the event that the system is overwhelmed by entries from a large amount of clients. The database is stored in the following directory: %ALLUSERSPROFILE%\Application Data\Eset\Eset Remote Administrator\Server\database Files related to records in the database are stored in: %ALLUSERSPROFILE%\Application Data\Eset\Eset Remote Administrator\Server\storage Information about client communication with ERAS is stored in individual files. These files reside in the Storage folder, and contain the following information: Client details (.xml configuration, Protection Status, Protection Features, and System Information), Log details (from Threat Log and Scan Log), Task details, Scheduled reports details (not directly related to the communication between aclient and ERAS).

To access the Configuration Editor, start the ERA Console and click Tools > ESET Configuration Editor. 3.2.1 Configuration layering
If a value is changed in the Configuration Editor, the change is marked by a blue symbol. Any entry with the grey icon has not been changed and will not be written to the.xml output configuration. When applying a configuration to clients, only those modifications which have been saved to the.xml output configuration file will be applied. An example is shown below. In this configuration the user name and password are inserted and using aproxy server is prohibited.
The second configuration (shown below) sent to clients will ensure that previous modifications are preserved, including the user name EAV-12345678 and password, but will also allow the use of a proxy server, and defines its address and port.
Key configuration entries
In this section, we will explain several of the key configuration entries for ESET Smart Security available through the ESET Configuration Editor (Tools > ESET Configuration Editor ). To change specific settings, select the option in the tree structure on the left and change the corresponding Value on the right. Kernel > Setup > Remote administrator Here you can enable communication between client computers and the ERA Server (Connect to Remote Administrator server). Enter the name or IP address of the ERA Server (Server address). The Interval between connections to server option should be left at the default value of five minutes. For testing purposes, this value can be decreased to 0, which will establish a connection every ten seconds. If aPassword is set, use the one which was
specified in the ERA Server. For more information, see the chapter about the configuration of ERAS the Password for Clients option). If a password is used, the communication between clients and the ERAS will be encrypted. Kernel > Setup > License keys Client computers require no license keys to be added or managed. License keys are used only for server products. Kernel > Setup > ThreatSense.Net This branch defines the behavior of the ThreatSense.Net Early Warning System, which allows submission of suspicious files for analysis to ESETs labs. When deploying ESET solutions to alarge network, the Submit suspicious files and Enable submission of anonymous statistical information options are particularly important: If these are set to Do not submit or No, respectively, the ThreatSense.Net System is completely disabled. To submit files automatically with no need for user interaction, select Submit without asking and Yes, respectively. If aproxy server is used with the Internet connection, specify the connection parameters under Kernel > Setup > Proxy server. Kernel > Setup > Protect setup parameters Allows the administrator to password protect the setup parameters. If a password is established, it will be required in order to access the setup parameters on client workstations. However, the password will not affect any changes to the configuration made from ERAC. Kernel > Setup > Scheduler/Planner This key contains the Scheduler/Planner options, which allow the administrator to schedule regular antivirus scans, virus signature updates, etc. NOTE: By default, all ESET security solutions contain several predefined tasks. In most cases, it should not be necessary to edit or add new ones. Update This branch of the Configuration Editor allows you to define how virus signature and program component updates are handled on client workstations. In most cases it is necessary only to modify the predefined profile My profile and change the Update server, User name and Password settings. If Update server is set to Choose Automatically, all updates will be downloaded from ESETs update servers. In this case, please specify the User name and Password parameters which were provided at the time of purchase. For information on setting client workstations to receive updates from alocal server (Mirror), please see section 3.3, LAN Update Server - Mirror. NOTE: On mobile devices, two profiles can be configured one to provide updating from the Mirror server, and the other to download updates directly from ESETs servers. For more information, see section 8.2 Combined update for notebooks and mobile devices. 3.3 LAN Update Server -Mirror The Mirror feature allows a user to create a local update server. Client computers will not download virus signature updates from ESETs servers on the Internet, but will instead connect to a local Mirror server on your network. The main advantages of this solution are to save Internet bandwidth and to minimize network traffic, since the mirror server connects to the Internet for updates, rather than hundreds of client machines. The only potential drawback is an outage of the Mirror server, which would prevent updates from being sent to client workstations (if it was the only server providing updates). Warning! A Mirror server which performed a program component upgrade and has not been rebooted may cause an outage. In this scenario, the server would be unable to download ANY updates or distribute them to client workstations. DO NOT SET AUTOMATIC PROGRAM COMPONENT UPGRADES FOR ESET SERVER PRODUCTS! (see section 3.3.1 for more information on program component upgrades) The Mirror feature is available in two locations: ESET Remote Administrator (Mirror physically running within ERAS, manageable from ERAC) ESET Smart Security Business Edition or ESET NOD32 Antivirus Business Edition (provided that the Business Edition has been activated by alicense key) It is left to the administrator to select the method for activating the Mirror feature. In large networks it is possible to create multiple Mirror servers (e.g., for various company departments), and establish one of them as central (at company headquarters) in cascade-style similar to an ERAS configuration with multiple clients.

Figure 4

The main screen of ESET Remote Administrator Console
Acurrent status of communication between ERAC and ERAS is displayed in the status bar (1). All necessary data from ERAS is refreshed regularly (Default is every minute. See Tools > Console Options.). The refresh progress can also be seen in the status bar. NOTE: Press F5 to refresh displayed data.
Information is divided into several tabs (2) in order of importance. In most cases data can be (5) sorted in ascending or in descending order by clicking on an attribute, while a drag-and-drop operation can be used for reorganization. If multiple data rows are to be processed, you can limit them by using the Items to show drop-down menu and the browse page by page buttons. Select a View mode to display attributes according to your need. For more information see section 4.3, Information filtering. The Server section (4) is important if you replicate ERA Servers. Here you can find summary information about the Console to which your ERAS is connected, as well as information about child or lower ERA Servers. The Servers drop-down menu in section 4 will influence the scope of information displayed in section 5. Server menu options: Use All Servers Displays information from all ERA Servers Use Only Checked Servers Displays information from selected ERA Servers Exclude Checked Servers Excludes selected ERA Servers
Columns in Section 4: Server Name Displays name of server Clients Total number of clients connecting to the selected ERAS Oldest Version The oldest version of virus signature database among the clients of the selected ERAS Least Recent Connection States the longest inactivity period (interval from the last connection) among the clients of the given ERAS Last Threat Alerts Total number of virus alerts (see the attribute Last Threat Alert in section 5 of Figure 4) Last Firewall Alerts Total number of firewall alerts (see the attribute Last Firewall Alert in section 5 of Figure 4) Last Event Warnings Total number of system events (see the attribute Last Event Warning in section 5 of Figure 4)
If you are not currently connected, you can right-click in the Server section (4) and select Connect to This Server to connect to the chosen ERAS. If replication is enabled, lower servers will automatically be displayed in the Server section (4). The most important features of ERAC are accessible from the menu or from the ERAC toolbar (3). The last section is Computer filter criteria(6) see Information filtering in the next section. 4.3 Information filtering ERAC offers several tools and features which provide user-friendly administration of clients and events. 4.3.1 Groups
Individual clients can be divided into groups by clicking Edit > Groups. in the ERA Console. Groups can later be used when applying filters or creating tasks, because those activities can be applied on whole groups of clients at the same time. Groups are independent for each ERAS and they are not replicated. The Synchronize with Active Directory feature allows the administrator to sort clients to groups, if the client name equals the object type computer at the side of Active Directory (AD) and belongs to groups in the AD. 4.3.2 Filter

NOTE: Some values are for informational purposes only and may not be current when the administrator views them at the Console. For example, at 7:00 A.M. there may have been an update error, but at 8:00 A.M. it was performed successfully. If the administrator knows this information is obsolete, he can right-click the value and select Clear Last Threat Alert Info, or Clear Last Event Info. Information about the last virus incident or last system event will be deleted. This applies to values in the columns Last Threat Alert and Last Event.
Figure 6 Obsolete events from the columns Last Threat Alert and Last Event Warning can be easily removed.

Figure 7

Detailed information about a client workstation.
The Clients tab offers several options after double-clicking on aclient: General tab Contains similar information to that displayed in the Clients tab. Here you can specify the Client Name - the name under which this client is visible in ERA, plus an optional comment. Member Of Groups tab This tab lists all groups to which the client belongs. For more information please see Information filtering in section 4.3. Tasks tab Tasks related to the given client. For more information see Tasks in Chapter 5. Configuration tab This tab allows you to view or export the current client configuration to an.xml file. Later in this manual, we will explain how.xml files can be used to create a configuration template for new/modified.xml configuration files. For more information see Tasks in Chapter 5. the Protection Status tab General status statement regarding all ESET programs. Some of the statements are interactive and it is possible to intervene immediately. This functionality is useful in that it prevents the need to manually define new tasks to solve the problem. the Protection Features tab Component status for all ESET security features (Antispam, Personal firewall, etc.) the System Information tab Detailed information about the installed program, its program component version, etc.

4.4.4

Threat Log tab

The meaning of this tab is described in Chapter 5, Tasks. The following attributes are available: Attribute Task Id State Type Name Description Date Received Comment Description ID of the corresponding entry in the database tab Task status (Active = being applied, Finished = task was delivered to clients) Task type Task name Task description Time event was logged by ERAS Optional description

Reports tab

The Reports tab is used to create statistical information reports in the form of graphs or charts. These can be saved and processed later in the Comma Separated Value form (or CSV) by using the ERA tools to provide graphs and graphical outputs. By default, ERA saves output in the HTML format (images are in PNG format). ERA provides several predefined templates for reports. To select a report, use the Report Type drop-down menu in the middle of the window, below the Generate Now button.

Top Threats List of the most frequently detected threats Top Clients with most Threats Lists the most active client workstations (in number of detected threats) Threats Progress Progress of malware events (number) Threats Comparative Progress Progress of malware events by selected threats (using filter) compared with the total number of malware Threats By Scanner Number of threat alerts from the individual program modules Threats By Object Number of threat alerts according to the way they attempted to infiltrate (emails, files, boot sectors) Combined Top Clients / Top Threats Combination of the above mentioned types Combined Top Threats / Threats Progress Combination of the above mentioned types Combined Top Threats / Threats Comparative Progress Combination of the above mentioned types Clients Report, Threats Report, Events Report, Scans Report, Tasks Report Typical reports that can be viewed in the Clients, Threat Log, Event Log, Scan Log or Tasks tab Comprehensive Report Summary of: Combined Top Clients / Top Threats Combined Top Threats / Threats Comparative Progress Threats Progress
In the Filter section you can use the Target clients or Threat drop-down menus to select which clients or viruses will be included in the report. Other details can be configured by clicking the Additional Settings. button. These settings apply mostly to data in the heading and in the types of graphical diagrams used. However, you can also filter data according to the status of chosen attributes (show only clients with a Protection State problem), as well as choose which report format will be used (HTML, CSV). Interval tab - This tab allows you to define an interval for which the report will be generated: Current Only events which occurred in a chosen time period will be included in the report e.g., if a report is created on Wednesday and the interval is set to Current Week, then the events from Sunday, Monday, Tuesday, and Wednesday will be included. Completed Only events which occurred in a chosen, closed period will be included in the report (for example, the entire month of August, or a whole week from Sunday to next Saturday). If the option Add also the current period is selected, the report will include events from the last completed period up till the moment of creation. Example: We want to create a report including events from the last calendar week, i.e. from Sunday to next Saturday. We want this report to be generated on the next Wednesday (after Saturday). In the Interval tab, select Completed and 1 Weeks. In the Scheduler tab set Frequency to Weekly and select Wednesday. The other settings can be configured according to the administrators discretion. From/To Use this setting to define aperiod for which the report will be generated. Scheduler tab - This tab allows you to define and configure an automatic report in chosen time or intervals (Using the Frequency section). Using the Run at spin box and the Start drop-down menu, enter the time and date when the report is to be generated. Click the Select Target. button to specify where the report is to be saved. Reports can be saved to the ERA Server (default), sent via email to a chosen address, or exported to a folder. The latter option is useful if the report is sent to a shared folder on your organizations intranet where it can be can be viewed by other employees. To send generated reports via email, you need to enter SMTP server and sender address information as described in the Chapter 4.6 , Configuring ERA Server using the Console. To define a fixed date range for the report-generation process, use the options in the Range section. You can define

SMTP settings (Server, Sender address,User name, Password) Some features in ESET Remote Administrator require SMTP server settings to be defined. These features include remote installation via email or generating reports to be sent to designated email addresses. Allow new clients If disabled, no new clients will be added in the Clients tab even if new clients communicate with ERA Servers, they will not be visible in the Clients tab. Automatically reset New flag by new clients If enabled, the New flag is removed from clients connecting to ERAS for the first time. For more information please see section 4.4.3 The Clients tab. Ports (Console, Client, Replication port of this server, ESET Remote Installer) Defines ports on which ERAS will listen and wait for communication established by: Console (by default TCP 2223) Client (by default TCP 2222) replication process (Replication port, by default TCP 2846) remote install agent (ESET Remote Installer, by default TCP 2224) Enable ThreatSense.Net data forwarding to ESET servers If enabled, ERAS will forward suspicious files and statistical information from clients to ESETs servers. In some cases it is not possible for client workstations to submit this information directly. Edit Advanced Settings. This buttons opens the ESET Configuration Editor, where ERAS can be configured in detail.

5. Tasks

ESET Remote Administrator allows you to remotely perform tasks on client workstations. These tasks are performed at the moment the client establishes a connection to the ERA Server (on the TCP 2222), which is every five minutes. Three types of tasks are available: Configuration Modifies configuration of clients On-Demand Scan Performs an On-demand scan Update Now Forces update task To open the task wizard from the ERA Console, press CTRL+N, click File > New Task. or click the icon on the ERAC toolbar. The task wizard can also be opened by right-clicking a selected client (this option skips some dialog windows for acomplete configuration, please use either of the first two methods to open the wizard).

Figure 8

ERA offers three types of tasks
5.1 Configuration Task To launch this type of task, click the Create. button to create anew task (.xml file). To select a previously existing.xml configuration file to be applied on remote clients, click Select. NOTE: The.xml configuration files are mutually compatible regardless of their origin. This means that you can use an.xml configuration file which is assigned to an install package, downloaded from aclient computer, or exported locally (e.g., from ESET Smart Security). Modifications to configuration files are performed in the ESET Configuration Editor, described previously. Please take note of the icons associated with each setting they will turn blue if changed. To view a selected configuration, click View. To modify a selected configuration, click Edit. Click Create from Template. to open an existing.xml configuration file and use it as astarting point for acompletely new configuration. After modifications, the template file remains unchanged. Click Next and select all clients (individually, by groups, or by servers) which the.xml configuration file is to be applied to, by dragging and dropping them into the Selected items column. To move clients currently displayed in the Clients pane to the Selected items column, click Add Special., select the option Add clients loaded in the Clients pane and then click the Add button. Of those clients which have been added from the Clients pane, you can further specify particular clients by selecting them from the Servers column and checking the Only selected option. Click Next. The final step is to create aName and Description for the new task. In the same dialog window, you can designate that the task be delayed (the Apply task after option), or automatically deleted, after it has been successfully completed on client computers. To automatically delete successfully completed tasks from the Tasks tab, select the Delete tasks automatically by cleanup if successfully completed option.

Figure 9

Dialog window of the installation packages Editor
Each package is automatically assigned an ESET Remote Installer agent, which allows for seamless installation and communication between target workstations and ERAS. The ESET Remote Installer agent is named einstaller.exe and contains the ERA Server name, and the name and type of package to which it belongs. The following chapters provide a detailed description of the agent. 6.2.3 Remote push install
This method of remote install instantly pushes ESET client solutions to remote target computers. Target computers should be online. The following is a list of requirements (for additional requirements, see the Chapter 2 ERAS): Microsoft network client enabled (feature of network adapter) File sharing service enabled (feature of network adapter) File sharing service enabled in firewall Services: Remote Registry Service, Remote Service Manager, Server Administrator user name and password for client workstations (preferably the domain Administrator user name and password).
To initiate a push installation, follow the steps below: 1) Click the Install. button in the ERA Console (Remote Install tab). 2)In the Network places section on the left, browse to find the workstations where you intend to push the install package. Move them to the empty pane on the right (using the drag-and-drop method).
3)From the Package drop-down menu, select the desired install package to be delivered to target workstations.
4)In the panel on the right, select those workstations to which you intend push the package. 5)Click Install (you can also click Get Info to view information on selected clients). 6)In most cases, you will be prompted to insert the user name and password of the account under which the installation will take place (it must be an account with administrator rights).
7) The following operations are indicated by aprogress bar and atext message. The operations are described below: 8)ERAS sends the einstaller.exe agent to the workstation with the help of the administrative share admin$.
9)Agent starts as aservice under the account specified in step 6.
10) Agent establishes communication with its mother ERAS and downloads the corresponding install package on TCP port 2224.
11)Agent installs the package under the administrator account defined in step 6; the corresponding.xml configuration and command line parameters are also applied.

Figure 10

Export Installer to Folder / Logon Script dialog window
Attaching the agent (einstaller.exe) to email: Click Email. on the Remote Install tab and select the Type and the name of the Package you wish to install. Click To. to select addresses from the address book3 (or insert individual addresses). Insert a Subject in the corresponding field. Type amessage into Body. Click Send to send the message.

Figure 11

Send Eset Installer Via E-mail dialog window
During the process of remote installation, backward connection to ERAS takes place and the agent (einstaller.exe) The ERA Console opens the Microsoft Outlook address book (provided it is installed on the same computer as ERAC).
adopts settings from the Set Default Logon for E-mail and Logon Script settings in the Remote Install tab.
Click Logon. to specify the user name and password of the account under which the installation of the package is to be performed. It must be an account with administrator rights or, preferably, a domain administrator account. NOTE: Values inserted in the Logon.dialog window are forgotten after each service (ERAS) restart. 6.2.5 Custom remote install
It is not a requirement to use the tools incorporated in ESET Remote Administrator. In the end, the most important aspect is to deliver and execute the einstaller.exe file on client workstations. NOTE: For einstaller.exe to launch, the currently logged in user does not necessarily have to be an administrator. The agent adopts the required administrator user name / password / domain from the ERAS. For more information, see the end of this chapter. The einstaller.exe file can be obtained as follows: From the Remote Install tab, click Export. and select the Type and name of the Package to be installed. Click the. button next to Folder and select the directory where einstaller.exe will be exported. Click the Export to Folder button. Use the extracted einstaller.exe file.
NOTE: The Direct installation with predefined XML configuration method can be used in situations where it is possible to provide administrator rights for the installation. The.msi package is launched using the parameter /qn (for the version 3) or the parameter /silentmode (for the version 2). These parameters will run the installation without displaying a user interface. During the process of remote installation, backward connection to ERAS takes place and the agent (einstaller.exe) adopts settings from the Set Default Logon for E-mail and Logon Script settings in the Remote Install tab.
Click Logon. to specify the user name and password of the account under which the installation of the package is to be performed. It must be an account with administrator rights or, preferably, the domain administrator account. If the einstaller.exe agent is started manually on atarget workstation, the remote installation is handled in the following way: The einstaller.exe agent sends a request to ERAS (TCP port 2224) ERAS starts a push installation of the corresponding package (sent via the share admin$) The installation of the package is launched, applying the associated.xml configuration and command line parameters under the account defined in ERAS (the Logon.button) 6.3 The einstaller.exe agent in detail Each package is automatically assigned an ESET Remote Installer agent, which allows for seamless installation and communication between target workstations and ERAS. The ESET Remote Installer agent is named einstaller.exe and contains the following information: Name of ERA Server (+IP address of ERAS) Name and type of install package The remote installation process using the einstaller.exe agent has two phases. First, the smaller installer (about 200 KB) einstaller.exe is delivered to aworkstation. If all requirements are met, the agent initiates downloading of the entire install package (several MB) from ERAS. The activity of the einstaller.exe agent is logged to the file %TEMP%\einstaller.log and if technically feasible, back to the ERA Server (target TCP port is 2224).

7.2.3 Subsidiary: Installation of HTTP Mirror server The Mirror server installation example of the previous model can also be used in this case. The only changes are in the sections defining: Source of update files User name and Password As seen in Figure 14, updates for the subsidiary are not downloaded from ESETs update servers, but from the server at the headquarters (GHOST). The update source is defined by the URL address: http://ghost:2221 (or http:// IP_address_of_ghost:2221). By default, there is no need to specify a user name or password, because the integrated HTTP server requires no authentication. 7.2.4 Subsidiary: Remote installation to clients
Once more, the previous model can be used, except that it is suitable to perform all operations with ERAC connected directly to the ERA Server of the subsidiary (LITTLE)5.
4 In order to avoid potential DNS translation problems when converting names to IP addresses between networks (depending on the DNS configuration). 5 This is done to prevent install packages from being transferred via the VPN channel, which is slower

8. Hints & tips

8.1 Export and other features of client XML configuration From the ERA Console, select any clients in the Clients tab in ERA Console. Right-click and select Configuration. from the context menu. Click Save As. to export the assigned configuration of the given client to an.xml file6. The.xml file can be used afterwards for various operations: For remote installations, the.xml file can be used as atemplate for apredefined configuration. This means that no new.xml file is created, and the existing.xml file is assigned (Select.) to anew install package. For configuring multiple clients; selected clients receive apreviously downloaded.xml file and adopt the settings which are defined in the file (again, no new configuration is created, only assigned by the Select. button ). Example: An ESET solution is installed on only one workstation. Adjust the settings directly through the programs user interface. When finished, export the settings to an.xml file. This.xml file can then be used for remote installations to other workstations. This method can be very useful for tasks such as fine-tuning firewall rules, if the Policy-based mode is to be applied. 8.2 Combined update for notebooks and mobile devices If there are any mobile devices in your local network (i.e., notebooks), we recommend that you configure a combined update from two sources, ESETs update servers and the local Update Server - Mirror. First, notebooks contact the local Mirror server, and if the connection fails (they are outside of the office), they download updates directly from ESETs servers. To allow for this functionality: Create two update profiles, one directed to the Mirror server (referred to as LAN in the following example) and the second one to ESETs update servers (INET) Create anew update task, or modify an existing update task through the Scheduler (Tools > Scheduler from the main program window of ESET Smart Security or ESET NOD32 Antivirus). The configuration can be made directly on notebooks, or remotely using the ESET Configuration Editor. It can be applied either during installation, or anytime later as aconfiguration task. To create new profiles in ESET Configuration Editor, right-click on the Update branch and select New profile from the context menu. The result of modifications should resemble the one displayed below:

This type of package is also useful for uninstalling security software from other vendors.