Avast WEBforum
Business Products => Archive (Legacy) => Avast Business => Avast Endpoint Protection => Topic started by: wpn on April 20, 2011, 03:24:10 PM
-
20-4-11 ADDED WISHES
21-4-11 ADDED Question
Ill open a new thread to post found problems and all for this Beta2 release
compliments
- Installation of IIS doesn't show the dosbox anymore, thank you, i love it!
- kudos for the improved mirror progress, still freakishly slow tho, but not really important for now
- Thank you for the context menu (right mouse-click) in the NETWORK > GROUP VIEW
- Wonderful solution for computers that you don't want to install to (unmanaged group)
Quirks
- The SQL server SEARCH button does not find any sql servers.
I used a tool from Quest software named Quest Discovery Wizard for SQL server and this tool does find the servers with the instances (but i had to point the tool towards the ip address of the server, so the not finding could be a thing on my side in my test environment).
I put the servername\instancename in the box manually and the installer accepted it, so it did connect. If the server\instance didn't exist the installer wouldn't continue either (i tested this)
Since the DB on another server is installed in either mixed mode or windows authentication, i would expect i could give in a user which to use for database access.
In the SQL authentication i cant change the SSPI and i cant give in a username so eventually the database couldnt be created (according to the log) and the installation aborted prematurely.
For this i have chosen (for this BETA) to download the express SQL again
- The silverlight page give the notification in IE 8 and IE 9 about compatibility view. This for example is not shown for Google.com, but also shows for Avast.com. Its really minor
- The log file still knows xx seconds (up to 1 minute) if the remote deployment failed or not
- TO EDIT
Problems
- Run as service logon setting: This setting is a kind of hidden and per computer setting.
In the Early beta release thread i got this answer on why there is no hierarchical tree menu like AD uses
b) AD groups won't be reflected into our product. AD groups are hierarchical, our groups are not. The product is meant to be easy to understand and handle. Tree structure is difficult to comprehend and manage for not-so-advanced user, so we decided not to support hierarchies, thus we can't mimic this behavior of AD or other LDAP store.
This mandatory setting (which SHOULD only be solved by using group policies in offices which use AD), which makes everything HARDER to configure for the "not-so-advanced".
So far i have not been successful deploying the client to a wide open computer.
I have given the account used for deployment (the domain/enterprise/schema administrator) the LOGON AS SERVICE rights on the client machine (manually). In the logs this is the error now:
Logonuser administrator testbzw error 1385 (Logon failure: the user has not been granted the requested logon type at this computer)
- After manual installation the client computer STILL does not communicate with the SBC. Nothing in the logs accept for the vague notification SERVER DIDNT RESPOND IN TIME! (log-file: avastnet)
During installation i had to tell the installer the DNS name from my SBC machine, i did but it doesn't communicate!
(anywhere where i can look for more details or for turning on debugging?)
Questions
- In which mode should the SQL Server 2008 R2 instance be installed when its on a separate server? Mixed authentication or Windows authentication?
- will there be even more improvements on the creating mirror installation part? like a download speed indicator?
- why is there a DOMAIN option in the settings from deployment tasks? If this setting is detected automatically why do i still need to fill in the domain name in the username for deployment?
- Where are the controls of installing Webrep or Gadget in the SBC console? i dont want my users to have those installed. I can choose them to be installed or not with the manual installation, not with the deployment
- How/where can i control Safezone via SBC
- How/where can i control the firewall via SBC?
- How will updates be done for the SBC server itself?
Suggestions
- Give the unmanaged group box a different color for the titelbar and the contentcell, something light shade of red would be nice so you know those computers are unmanaged (and a possible risk)
OR!
Make the default group the unmanaged group. Found computers have no avast installed. This could be a chained task (which i know i wont use) find computer > install avast. BUt the default group is unmanaged by default since there is no automatic installation chained on it from installation of SBC..... (does that still sound clear?)
- Deploying is something WAY different then updating. Could you please seperate those in the JOBS > SCHEDULER screen?
- In the quickstart document it tells that when the computer icon is RED there is no communication OR a possible infection (found a virus).
Seperate these 2 please with different icons.
1) Show a network disconnected icon if there is no communication
2) Show a virus/bug icon if a virus has been found
Wishes
- Choice for mirror file placement! Either at installation or in the GUI. THis to be able to comply to company rules for data placement! Why would you put frequently accessed USER data on an expensive RAID setting and on the OS disk!? My extensive argumentation and idea's can be found here (http://forum.avast.com/index.php?topic=76288.0) and here (http://forum.avast.com/index.php?topic=73456.0)
-
compliments and Quirks, I agree with WPN.
I also like the Advanced Mode on Admin Setting. I know where is the logs file and the others things regarding the avast SBC installed.
PC Test
I install the SBC beta 2 on XP SP3 with netframework 2, 3.5sp1, 4 | MSSQL2008 Express | IIS | Memory 1024Mb | HDD 10Gb | Workgroup name is Workgroup and running on VM
Problem
- Creating Computer discovery for Workgroup can not found any computer with others workgroup name, what i can find is only computer with workgroup name with Workgroup.
- Deployment on PC with in workgroup shown successfully but on the logs file shown that error 3 event if i do the push install on the SBC PC installed.
I have turn on the file and printer share, also turn off the firewall
Error Logs
C:\Documents and Settings\All Users\Application Data\AVAST Software\Administration Console\Packages\setup.exe error 3 (The system cannot find the path specified.
Question
- Why the logs files and everythings about avast SBC is put on hidden folder (C:\Documents and Settings\All Users\Application Data\AVAST Software\Administration Console\Logs) as my experience Application Data is a hidden Folder on XP
Wish
- On the admin menu please put the link for check the logs files so we not need to open the logs files directly.
I will update more i found on this second beta when i found some problem or have question.
BTW, thanks to wpn to give me an idea for writing more structural
-
@SPI
can you check your mirror directories? seems like it cant find the files in the mirror directory, if there is nothing, try running the mirror.exe file manually
Why the hidden: the directory you mention is a hidden folder, as the name states, the application should put its data in that directory
Avast fulfills to compliance rules according to the microsoft rules for application data (hence we are not allowed to adjust the current beta's to comply with the companies (avast customer!) mandatory rules for data placement)
Next to that, in XP a normal user has admin rights, you dont want a normal user to screw up this folder by accident :)
---- but only avast can clarify this for sure of course :D
my pleasure....
ive always seen the buttons above the textarea, never cared to use it... but sometimes i go crazy (no video from this, you perverts) and start hitting buttons :D
and this was the result.... i have to say i like it a lot better too... hopefully JX can appreciate it too :)
-
OK.... i did another clean install from Win7 (reverted to a clean installed snapshot) now the deployment runs good....
cant figure out why since for the rest there hasnt been anything changed in settings on either side....
however in the remote install log from SBC the deployment (I monitor it by reopening the logfile every so many seconds) it shows that the setup was running at 70% for 5minutes and 50 seconds (noticed this in previous beta too)....
i looked in the client settings and found an option where you can set the ip or dnsname for the console.
THis is filled in already AND filled with the correct information, it shows the DNS name from my SBC server...
I changed the DNS to the IP, without luck... the server can be accessed without problems....
I checked with wireshark if there is any communication....
there seems to be a lot of communications between the server and the client, but only in the form of ack/sync pakkets...
cant find any data packets
would it help if i dump a communication file for the more experienced network pakket inspection people?
-
I checked with wireshark if there is any communication....
there seems to be a lot of communications between the server and the client, but only in the form of ack/sync pakkets...
cant find any data packets
would it help if i dump a communication file for the more experienced network pakket inspection people?
share with me i have cacepilot tools, maybe can help.
-
@SPI
can you check your mirror directories? seems like it cant find the files in the mirror directory, if there is nothing, try running the mirror.exe file manually
yes i have check the folder there is full with updated files.
Why the hidden: the directory you mention is a hidden folder, as the name states, the application should put its data in that directory
Avast fulfills to compliance rules according to the microsoft rules for application data (hence we are not allowed to adjust the current beta's to comply with the companies (avast customer!) mandatory rules for data placement)
Next to that, in XP a normal user has admin rights, you dont want a normal user to screw up this folder by accident :)
---- but only avast can clarify this for sure of course :D
Ok, i agree. Like what i wish it must have link for shown the logs.
I have captured the mirror setup from the admin setup. WPN would you share to me the mirror setup configuration?
-
Here is my configuration for the mirror....
I am running SBC on a Win2k8 R2 machine (where the RTM will be installed some day)
I will post the wireshark dump later on.... lastnight around 2am i had another idea what could be a possible cause of the problem....
i am running the SBC server dualhomed. I have 1 internal network card (static; which i have chosen to use for services at setup) and 1 network card (dhcp) for the connection to internet.
i will do another fresh install from SBC but ill remove the second networkcard and i will use the proxy that i installed for the connection now....
if this fails then i will post the logs from wireshark (which i have to dump again then)
since ill be in meeting in the afternoon (all afternoon) it might be later tonight i will post the dump...
edit:
i did the setup several times this morning cuz of problems with files on the downloadserver side according to the (deleted)log.
i noticed that there have been different mirror sizes:
i have seen 154MB and 160MB.
Right now im downloading a mirror size 154MB.
Assuming those sizes and file errors are from updates done by Avast.
-
In which mode should the SQL Server 2008 R2 instance be installed when its on a separate server? Mixed authentication or Windows authentication?
Should work with both, BP uses SSPI (windows authentication).
will there be even more improvements on the creating mirror installation part? like a download speed indicator?
Not at this time, but probably in future yes. At the moment we're busy adding other tweaks that you'll see daily, compared to the progress you'll really only see once during the install...
why is there a DOMAIN option in the settings from deployment tasks? If this setting is detected automatically why do i still need to fill in the domain name in the username for deployment?
Some customers may want to manage computers across domains on a single server. So, supposing you have MyNewDomain and MyOldDomain, you install the server into MyNewDomain but you want to manage computers in MyOldDomain as well, there is a way to achieve this.
Where are the controls of installing Webrep or Gadget in the SBC console? i dont want my users to have those installed. I can choose them to be installed or not with the manual installation, not with the deployment
Currently we are aiming at providing the maximum possible protection for the user. To make management simpler for the target user, we chose to hide these features and go with default installation of the client. You may remove these features by doing manual install or uninstall on the client computer if you wish.
How/where can i control Safezone via SBC
See the above...
How/where can i control the firewall via SBC?
Not with BP, firewall will be part of BPP.
How will updates be done for the SBC server itself?
Re-install new packages over existing installation at least for the first release. The update itself will be quite fast. Technically, it's really only stopping the services, changing the binaries and starting the services again, nothing more to it (mirror is already downloaded, network is discovered, ...)
-
Quote from: wpn on Yesterday at 15:24:10
Where are the controls of installing Webrep or Gadget in the SBC console? i dont want my users to have those installed. I can choose them to be installed or not with the manual installation, not with the deployment
Currently we are aiming at providing the maximum possible protection for the user. To make management simpler for the target user, we chose to hide these features and go with default installation of the client. You may remove these features by doing manual install or uninstall on the client computer if you wish.
I mean no offense but: You (Avast) do realize that Webrep and the gadget are not actually real protection and that you force installing this into a business environment where browser add-ons and desktop add-ons are not wanted often, specially with internally used websites?
Both items are extra pieces of software which can potentially invade business (security) compliancy. That it works good for home users doesnt mean it works good in business environments, i dont mean the technical working....
Walking down to up to 200 desktops (the limit of SBC) to uninstall those items manually is killing the whole point of remote deployment, if you seriously consider to keep this out of control in the RTM version i seriously doubt this will be a serious business product.
The SBC is a point of CONTROL for the admin. If you aim at inexperienced users then a manual install is wanted without a central point of control because that will give the least problems to solve. Whats the point of a central point of control if you cant control anything...
Quote from: wpn on Yesterday at 15:24:10
How/where can i control the firewall via SBC?
Not with BP, firewall will be part of BPP.
In the current beta2 i can deploy the firewall module.... isnt beta 2 a test with BPP? if not then what is the firewall doing there? :)
-
I clicked on the EDIT button for the details of the standard targetted deployment job and i got several UNKNOWN ERROR notifications
In the code below is the text from all the notifications
[CommunicationObjectAborted1]
Arguments: System.ServiceModel.Channels.ClientPollingDuplexSessionChannel
Debugging resource strings are unavailable. Often the key and arguments provide sufficient information to diagnose the problem. See http://go.microsoft.com/fwlink/?linkid=106663&Version=4.0.60310.0&File=System.ServiceModel.dll&Key=CommunicationObjectAborted1
at System.ServiceModel.Channels.CommunicationObject.ThrowIfDisposedOrNotOpen()
at System.ServiceModel.Channels.DuplexChannel.BeginSend(Message message, TimeSpan timeout, AsyncCallback callback, Object state)
at System.ServiceModel.Dispatcher.DuplexChannelBinder.BeginRequest(Message message, TimeSpan timeout, AsyncCallback callback, Object state)
at System.ServiceModel.Channels.ServiceChannel.SendAsyncResult.StartSend(Boolean completedSynchronously)
at System.ServiceModel.Channels.ServiceChannel.SendAsyncResult.FinishEnsureOpen(IAsyncResult result, Boolean completedSynchronously)
at System.ServiceModel.Channels.ServiceChannel.SendAsyncResult.StartEnsureOpen(Boolean completedSynchronously)
at System.ServiceModel.Channels.ServiceChannel.SendAsyncResult.Begin()
at System.ServiceModel.ClientBase`1.ChannelBase`1.BeginInvoke(String methodName, Object[] args, AsyncCallback callback, Object state)
at Avast.Net.Console.SbcServiceConnectionPoint.SbcConnectionPointServerClient.SbcConnectionPointServerClientChannel.BeginSchedulerGetJobById(Guid id, AsyncCallback callback, Object asyncState)
at Avast.Net.Console.SbcServiceConnectionPoint.SbcConnectionPointServerClient.Avast.Net.Console.SbcServiceConnectionPoint.ISbcConnectionPointServer.BeginSchedulerGetJobById(Guid id, AsyncCallback callback, Object asyncState)
at Avast.Net.Console.SbcServiceConnectionPoint.SbcConnectionPointServerClient.OnBeginSchedulerGetJobById(Object[] inValues, AsyncCallback callback, Object asyncState)
at System.ServiceModel.ClientBase`1.InvokeAsync(BeginOperationDelegate beginOperationDelegate, Object[] inValues, EndOperationDelegate endOperationDelegate, SendOrPostCallback operationCompletedCallback, Object userState)
[Async_ExceptionOccurred]
Arguments:
Debugging resource strings are unavailable. Often the key and arguments provide sufficient information to diagnose the problem. See http://go.microsoft.com/fwlink/?linkid=106663&Version=4.0.60310.0&File=System.dll&Key=Async_ExceptionOccurred
at System.ComponentModel.AsyncCompletedEventArgs.RaiseExceptionIfNecessary()
at Avast.Net.Console.SbcServiceConnectionPoint.SchedulerGetJobTypeFamiliesCompletedEventArgs.get_Result()
at Avast.Net.Console.Jobs.ViewModels.JobDetailViewModel.OnSchedulerGetJobTypeFamiliesCompleted(Object sender, SchedulerGetJobTypeFamiliesCompletedEventArgs e)
at Avast.Net.Console.SbcServiceConnectionPoint.SbcConnectionPointServerClient.OnSchedulerGetJobTypeFamiliesCompleted(Object state)
[Async_ExceptionOccurred]
Arguments:
Debugging resource strings are unavailable. Often the key and arguments provide sufficient information to diagnose the problem. See http://go.microsoft.com/fwlink/?linkid=106663&Version=4.0.60310.0&File=System.dll&Key=Async_ExceptionOccurred
at System.ComponentModel.AsyncCompletedEventArgs.RaiseExceptionIfNecessary()
at Avast.Net.Console.SbcServiceConnectionPoint.CatalogGetNodeGroupsCompletedEventArgs.get_Result()
at Avast.Net.Console.Jobs.ViewModels.JobDetailViewModel.OnCatalogNodesGroupsUpdateReceived(Object sender, CatalogGetNodeGroupsCompletedEventArgs e)
at Avast.Net.Console.SbcServiceConnectionPoint.SbcConnectionPointServerClient.OnCatalogGetNodeGroupsCompleted(Object state)
[Async_ExceptionOccurred]
Arguments:
Debugging resource strings are unavailable. Often the key and arguments provide sufficient information to diagnose the problem. See http://go.microsoft.com/fwlink/?linkid=106663&Version=4.0.60310.0&File=System.dll&Key=Async_ExceptionOccurred
at System.ComponentModel.AsyncCompletedEventArgs.RaiseExceptionIfNecessary()
at Avast.Net.Console.SbcServiceConnectionPoint.CatalogGetNodesCompletedEventArgs.get_Result()
at Avast.Net.Console.Jobs.ViewModels.JobDetailViewModel.OnCatalogGetNodesCompleted(Object sender, CatalogGetNodesCompletedEventArgs e)
at Avast.Net.Console.SbcServiceConnectionPoint.SbcConnectionPointServerClient.OnCatalogGetNodesCompleted(Object state)
and
-
I have to agree with WPN. What is the point of the SBC if you need to go to each machine to change settings? It defeats the purpose of the management console.
Also, what is the point of having settings (mirror location, etc) that cannot be changed? This product should be geared towards IT/System admins, who should have enough knowledge to be able to change those type of settings without getting in too much trouble. Most non-tech people installing AV in their small business (5 to 10 pc's) are not going to install a management console anyway, because they won't know what to do with it, and probably don't care. The IT guy who supports multiple client networks or the system admin who supports 10-200 or more computers needs a management console that will control everything, including Macs, without having to visit individual PC's. Most, if not all settings should be able to be changed by an admin in the console. Throw up all kinds of warnings about the dangers of changing a particular setting or make us jump through hoops to discourage the change if it will make you feel better, but allow us to make the changes we need to make.
Quote from: wpn on Yesterday at 15:24:10
Where are the controls of installing Webrep or Gadget in the SBC console? i dont want my users to have those installed. I can choose them to be installed or not with the manual installation, not with the deployment
Currently we are aiming at providing the maximum possible protection for the user. To make management simpler for the target user, we chose to hide these features and go with default installation of the client. You may remove these features by doing manual install or uninstall on the client computer if you wish.
I mean no offense but: You (Avast) do realize that Webrep and the gadget are not actually real protection and that you force installing this into a business environment where browser add-ons and desktop add-ons are not wanted often, specially with internally used websites?
Both items are extra pieces of software which can potentially invade business (security) compliancy. That it works good for home users doesnt mean it works good in business environments, i dont mean the technical working....
Walking down to up to 200 desktops (the limit of SBC) to uninstall those items manually is killing the whole point of remote deployment, if you seriously consider to keep this out of control in the RTM version i seriously doubt this will be a serious business product.
The SBC is a point of CONTROL for the admin. If you aim at inexperienced users then a manual install is wanted without a central point of control because that will give the least problems to solve. Whats the point of a central point of control if you cant control anything...
Quote from: wpn on Yesterday at 15:24:10
How/where can i control the firewall via SBC?
Not with BP, firewall will be part of BPP.
In the current beta2 i can deploy the firewall module.... isnt beta 2 a test with BPP? if not then what is the firewall doing there? :)