Installation Guide to AEA + Endpoint Protection Suite

[Che Johnson]

Installation Guide for Enterpise Administration Console (AEA) and Endpoint Protection Client

Hello and thank you for your participating in our avast! Free for EDU program.  We have made most of our avast! antivirus products and solutions free for use by schools and libraries in the US. This is just the first step and if it is successful, we will extend it worldwide. We are doing this for a couple of reasons. First, even though schools need security products, in these tough budget times, they need the ability to focus their spending on teaching. We know that schools spend a lot on security—money that could be better spent on teaching.  Please feel free to discuss your opinions and/or possible issues with other users in this forum/thread.

The AEA console is required when managing 200+ systems.  This Enterprise console is the most powerful anti-virus management tool we have. The avast! AEA console can support tens of thousands of clients.  This is achieved through support of multiple avast! Enterprise Administration Servers (AEAS).  The AEAS is a mirror of an avast! update server, and each AEAS can manage up to 1000 systems. The AEA console then can manage many AEAS.  However, full SQL is required for the “Replication Service” to support multiple AEAS (to support 1000+ clients) There is no migration path currently that will use the existing database from ADNM.


For user guides and FAQs please refer to:


Enterprise Administration Console Installation Guide - http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=1289 

Endpoint Protection User Guides - http://www.avast.com/download-documentation#business-products

Enterprise Administration Required Ports -  http://www.avast.com/FAQ/AVKB79#idt_18

Enterprise Administration Console User Manual - http://files.avast.com/files/documentation/enterprise-administration-user-guide.pdf

Enterprise Administration Console + Client Download - http://files.avast.com/iavs5x/setup_enterprise_eps.exe

Endpoint Protection Suite Stand Alone Client - http://files.avast.com/iavs5x/setup_av_eps.exe

Endpoint Protection FAQ - http://www.avast.com/FAQ/AVKB79

Installing and configuring Microsoft SQL Server 2008 R2 Express - http://www.avast.com/FAQ/AVKB74



Helpful Information

NOTE: You may push a deployment from the console for a domain. Workgroups will not deploy, so installs either occur from users or administrators.

Service Port Numbers

Mirror 16135
Client communication port 16136
Client communication port, push requests 16139
SSL communication port console 16138
UDP information port 16133
Standard RPC, NETBIOS and SMB TCP ports for remote deployment 135, 139, 445
Standard NETBIOS UDP ports for remote deployment 137, 138

2.  When installing the Enterprise Administration Console please make sure to install a MS SQL 2008 R2 as standalone, not from the installation process, so later you can connect the EA to it (best practice)

3. Do a discovery task to find all the machines

4. Create a deployment package for each type of system deployment: Desktop, Server, Sharepoint, Exchange, etc.

Create a deployment package for each type of OS (Desktop, server)

File Servers

For servers, I will recommend to modify the components of the deployment package (create a light installation package for servers OS’s) which consists of the File System Shield only. This is usually the only real protection required for file servers and this is an industry standard best practice. This assumes that the File Server not being used as a workstation. NOTE: DO NOT use the Network Shield on servers.   SharePoint servers should add the SharePoint shield in addition to the File System Shield.  If servers are to be managed (see below), then each server type will require its own group, separate from the managed client group. If servers are NOT to be managed, then use the custom install feature to select the correct shield/shields for that server type.

Workstations

For desktop installation, I recommend to remove all the server protection modules from the deployment components, so they are not installed on the client. Note: When creating an installation package please be sure to select the server name / address in the installation package for the clients to communicate with the console after deployment.

Workstations

For desktop installation, I recommend to remove all the server protection modules from the deployment components, so they are not installed on the client. Note: When creating an installation package please be sure to select the server name / address in the installation package for the clients to communicate with the console after deployment. It is best to have the system hosting the SOA console to use a fixed IP vs. DNS name.  This will eliminate DNS issues during deployment.

5. Start to deploy by group of 10-20 machines at once, make sure to enable the “Reboot the machine” option in the deployment task settings (this is necessary to finalize the installation process). **Important** – Before sending out an installation please be sure the mirror is up to date which you can check by going to view tab in the console and check mirror status. Once it’s up to date then you can send out the installation. (NOTE: SOA can be installed with or without mirror)

6. After you send out an installation you may received an error code 0×00000005 which usually means access denied. This is also due when you don’t reboot the client after the initial installation so please do so and then refresh the Console. Also be sure to use the network administrative passwords or a password with full administrative rights to push the client through the network (Domain/Administrator) NOTE: All systems MUST be rebooted after deployment, so plan accordingly. 

7. If you find that when you deploy some of your clients license change or remain in the trial mode please check to be sure you’re not over your license count in which case you will have a “KEY” icon over the PC. Please note the total sum of your license count is Computers with Agent + Computers without Agent = License Count. So if you have old clients in the Active Directory that will not receive the installation package, please delete them from your lists and this should resolve your issue.

8. If you find that you will be over your estimated license count or current license please contact us for remedy.

9. If you need to install or update to a 2008 R2 SQL please click on the link below.
http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=1286&nav=0,1,23,727

10. The DEFAULT PASSWORD for the EA Console is ADMIN. This of course can be changed after installing.

NOTE: When you are deploying, Enable the Admin Shares. Windows XP systems should have File/Printer sharing DISABLED. Windows 7/Vista systems should have File/Printer sharing ENABLED

WORKGROUP VS ACTIVE DIRECTORY

You may push a deployment from the console for a domain. Workgroups will not deploy, so installs either occur from users or Administrators.

ACTIVE DIRECTORY

If using Active Directory you can easily create an installation package to push the client remotely through the network with Network Administrator password and in the Deploying Group. The Endpoint client will remove existing installation of avast! 4 only.  Any other avast! version or other anti-virus should be un-installed prior to Endpoint deployment.

WORKGROUP

If using a Workgroup you can only DEPLOY remotely (no push deployments from your console)  We recommend to create the installation package manually and send it via email to each client or install it separately via USB Flash disk to manually install it on each client. Once the client has been installed only then will it be detected in the Console.  The Endpoint client will remove existing installation of avast! 4 only.  Any other avast! version or other anti-virus should be un-installed prior to Endpoint deployment.

NOTE: Windows File and Printer Sharing must be enabled so avast! can create the necessary directories!  ALSO, all systems need to be rebooted after installation, so plan accordingly!

Kind Regards

Note: Please note the EDU program does not include ticketed support and all matters should try to be resolved using the free Forum and Knowledgebase. There will be some NEW EDU support packages available so if interested, please let us know and we will provide you with further details.

You can contact edu support at edu-support@avast.com


Kind Regards
Che' Johnson
avast! EDU Moderator

[avast@@dvantage77.com]

Dear Che, this link:

Enterprise Administration Console Installation Guide - http://files.avast.com/iavs5x/setup_enterprise_eps.exe

is really the installer!


Here is the real one!

Enterprise Administration Console Installation Guide:

http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=1289 

Happy 4th, buddy!

[Che Johnson]

Thanks buddy...made the change..

Happy 4th to you too..

[karmana]

"10. The DEFAULT PASSWORD for the EA Console is ADMIN. This of course can be changed after installing."

What is the default username?  I've tried administrator, ADMIN, neither works with ADMIN as the password.  I just installed the EA, and can't get logged in!

Thanks,
Karmana

[Infratech Solutions]

User: Administrator
Password (lowercase): admin

[karmana]

Thank you.  The guide above should be updated, since it's both incomplete and incorrect, just a heads up!

[avast@@dvantage77.com]

Dear Karmana,

This is an older version of the document.  here is the URL to the newest most up to date version:

http://advantage77.com/blog/2013/05/15/managing-avast-endpoint-protection-suite-using-the-avast-enterprise-administration-console-aea/

(all 4 versions of current documents are here)

I will make sure Che gets this updated.  Sorry for the inconvenience.


Sincerely,
 
J.R. "AutoSandbox Guy" Guthrie

"At this point in time, the Internet should be regarded as an Enemy Weapons System!"