Make sure you have the latest version ePO 4.5 installed

• View our Installation and Deployment services for ePolicy products

• View our McAfee ePO 4.5 Training Courses

• Contact us for advice about migrating from ePO 4.0 to ePO 4.5

Customers who are still running ePO 4.0 as of 9/30/2011 will be required to migrate to a currently supported version of the product (ePO 4.5 or the following release) immediately.

The server task log provides information about your pull and replication tasks, in addition to all server tasks. This provides the status of the task and any errors that may have occurred.

Replication task information in the server task log
The following information is available for replication tasks on the Reporting | Server Task Log tab:
• Start date and task duration.
• Status of task at each site (when expanded).
• Any errors or warnings, their codes, and the site to which they apply.

Pull task information in the server task log
The following information is available for pull tasks on the Reporting | Server Task Log tab:
• Start date and task duration.
• Any errors or warnings and their codes.
• Status of each package that is checked into the master repository.
• Information regarding any new packages that are being checked into the master repository.

New distributed repositories are added to the repository list file containing all available distributed repositories. The agent of a managed system updates this file each time it communicates with the ePO server. The agent performs repository selection each time the agent (McAfee Framework Service) service starts and when the repository list changes.

Selective replication provides more control over the updating of individual repositories. When scheduling replication tasks, you can choose:
• Specific distributed repositories to which the task applies. Replicating to different distributed repositories at different times lessens the impact on bandwidth resources. These repositories can be specified when you create or edit the replication task.
• Specific files and signatures that are replicated to the distributed repositories. Selecting only those types of files that are necessary to each system that checks into the distributed repository lessens the impact on bandwidth resources. When you define or edit your distributed repositories, you can choose which packages you want to replicate to the distributed repository.
NOTE: This functionality is intended for updating products that are installed only on several systems in your environment, like GroupShield and WebShield. The functionality allows you to distribute these updates only to the distributed repositories these systems use.

How agents select repositories
By default, agents can attempt to update from any repository in the repository list file. The agent can use a network ICMP ping or subnet address compare algorithm to find the distributed repository with the quickest response time. Usually, this is the distributed repository closest to the system on the network.

You can also tightly control which distributed repositories agents use for updating by enabling or disabling distributed repositories in the agent policy settings. McAfee does not recommend disabling repositories in the policy settings. Allowing agents to update from any distributed repository ensures they receive the updates.

Scheduling regular Repository Replication server tasks is the best way to ensure that your distributed repositories are up-to-date. Scheduling daily replication tasks ensures that managed systems stay up-to-date. Using Repository Replication tasks automates replication to your distributed repositories.

Occasionally, you may check in files to your master repository that you want to replicate to distributed repositories immediately, rather than wait for the next scheduled replication. Run a Replicate Now task to update your distributed repositories manually.

Full vs. incremental replication
When creating a replication task, select Incremental replication or Full replication.
Incremental replication uses less bandwidth and copies only the new updates in the master repository that are not yet in the distributed repository. Full replication copies the entire contents of the master repository.
TIP: McAfee recommends scheduling a daily incremental replication task. Schedule a weekly full replication task if it is possible for files to be deleted from the distributed repository outside of ePolicy Orchestrator’s own replication functionality.

Use pull tasks to update your master repository with DAT and engine update packages from the source site. DAT and engine files must be updated often. McAfee releases new DAT files daily and engine files less frequently. Deploy these packages to managed systems as soon as possible to protect them against the latest threats.

With this release, you can specify which packages are copied from the source site to the master repository.

NOTE: EXTRA.DAT files must be checked in to the master repository manually. They are available from the McAfee website.
A scheduled Repository Pull server task runs automatically and regularly at times and days you specify. For example, you can schedule a weekly Repository Pull task at 5:00 a.m. every Thursday.
You can also use the Pull Now task to check updates in to the master repository immediately.

For example, when McAfee alerts you to a fast-spreading virus and releases a new DAT file to protect against it.
If a pull task fails you must check the packages in to the master repository manually.
Once you have updated your master repository, you can distribute these updates to your systems automatically with global updating or with replication tasks.

Considerations when scheduling a pull task
Consider these when scheduling pull tasks:
• Bandwidth and network usage. If you are using global updating, as recommended, schedule a pull task to run when bandwidth usage by other resources is low. With global updating, the update files are distributed automatically after the pull task finishes.
• Frequency of the task. DAT files are released daily, but you may not want to use your resources daily for updating.
• Replication and update tasks. Schedule replication tasks and client update tasks to ensure the update files are distributed throughout your environment.

NOTE: When using global updating, McAfee recommends scheduling a regular pull task (to update the master repository) at a time when network traffic is minimal. Although global updating is much faster than other methods, it increases network traffic during the update.

Global updating process
Global updating updates most environments within an hour using this process:
1 Contents are checked in to the master repository.
2 The server performs an incremental replication to all distributed repositories.
3 The server issues a superagent wakeup call to all superagents in the environment.
4 The superagent broadcasts a global update message to all agents within the superagent subnet.
5 Upon receipt of the broadcast, the agent is supplied with a minimum catalog version needed for updating.
6 The agent searches the distributed repositories for a site that has this minimum catalog version.
7 Once a suitable repository is found, the agent runs the update task.

If the agent does not receive the broadcast for any reason, such as the client computer is turned off, or there are no superagents, then at the next ASCI, the minimum catalog version is supplied which kicks off the process.

NOTE:
If the agent received notification from a superagent, the agent is supplied with the list of updated packages. If agent finds the new catalog version at the next ASCI, it is not supplied with the list of packages to update and therefore updates all packages available.

Requirements
These requirements must be met to implement global updating:
• A SuperAgent must use the same agent-server secure communication key as the agents that receive its wake-up call.
• A SuperAgent is installed on each broadcast segment. Managed systems cannot receive a SuperAgent wake-up call if there is no SuperAgent on the same broadcast segment. Global updating utilizes the SuperAgent wake-up call to alert agents that new updates are available.
• Distributed repositories are set up and configured throughout your environment. McAfee recommends SuperAgent repositories, but they are not required — global updating functions with all types of distributed repositories.
• If using SuperAgent repositories, managed systems must be able to “see” the repository from which it updates. Although, a SuperAgent is required on each broadcast segment for systems to receive the wake-up call, SuperAgent repositories are not required on each broadcast segment, but the managed systems must “see” the SuperAgent repository from which to update.

If you are using global updating, this task is unnecessary, although you can create a daily task for redundancy.

Considerations when creating update client tasks
Consider the following when scheduling client update tasks:
• Create an Update client task to update DAT and engine files daily at the highest level of the System Tree that is inherited by all systems. If your organization is large, you can use randomization intervals to mitigate the bandwidth impact. Also, for large networks with offices in different time zones, run the task at the local system time on the managed system, rather than at the same time for all systems, to help balance network load.
• Schedule the task at least an hour after the scheduled replication task, if you are using scheduled replication tasks.
• Run update tasks for DAT and engine files at least once a day. Managed systems might be logged off from the network and miss the scheduled task; running the task frequently ensures these systems receive the update.
• Maximize bandwidth efficiency and create several scheduled client update tasks that update separate components and run at different times. For example, you can create one task to update only DAT files, then create another to update both DAT and engine files weekly or monthly — engine packages are released less frequently.
• Create and schedule additional tasks to update products that do not use the agent for Windows.
• Create a task to update your main workstation applications, such as VirusScan Enterprise, to ensure they all receive the update files. Schedule it to run daily or several times a day.

Consider a phased rollout to install products to groups of systems at a time. If your network links are fast, try deploying to several hundred clients at a time. If you have slower or less reliable network connections, try smaller groups. As you deploy to each group, monitor the deployment, run reports to confirm successful installations, and troubleshoot any problems with individual systems.

If you are deploying McAfee products or components that are installed on a subset of your managed systems:

1 Use a tag to identify these systems.
2 Move the tagged systems to a group.
3 Configure a Product Deployment client task for the group.

Product deployment and updating process

Follow this high-level process for distributing DAT and engine update packages:

1. Check in the update package to the master repository with a pull task or manually.
2. Do one of the following:

• If using global updating, nothing else is required for systems on the network. You should, however, create and schedule an update task for laptop systems that leave the network.
• If not using global updating, use a replication task to copy the contents of the master repository to the distributed repositories, then create and schedule an update task for agents to retrieve and install the update on managed systems.