Microsoft Forefront Endpoint Protection 2010 - PowerPoint Presentation

480 views
Uploaded On 2016-04-22

Microsoft Forefront Endpoint Protection 2010 - PPT Presentation

and Microsoft System Center Deep Dive into Management and Reporting Chris Norman Sr Escalation Engineer Microsoft SIM311 Adwait Joshi Sr Product Manager Microsoft Session Objectives and Takeaways ID: 287885

microsoft policy protection fep policy microsoft fep protection configmgr forefront management endpoint reports policies distribution exe client security configuration

Link:

Copy

Embed:

<iframe width="560" height="315" src="https://www.docslides.com/embed/287885" frameborder="0" allowfullscreen></iframe>

Download Presentation from below link

Download Presentation The PPT/PDF document "Microsoft Forefront Endpoint Protection ..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentation Transcript

Slide1

Microsoft Forefront Endpoint Protection 2010 and Microsoft System Center Deep Dive into Management and Reporting

Chris NormanSr. Escalation EngineerMicrosoft

SIM311

Adwait Joshi

Sr. Product Manager

MicrosoftSlide2

Session Objectives and TakeawaysSession Objectives(s):Demonstrate simplified management and operations for Forefront Endpoint Protection using System Center Configuration ManagerUnderstand how to effectively manage FEP PolicyFEP Monitoring: Dashboard, Alerts & Reporting

FEP Remediation Tasks: Virus scans and signature updates TakeawaysConvergence of FEP and ConfigMgr makes endpoint protection and management easy and more effectiveSlide3

Forefront Endpoint Protection 2010

One infrastructure for desktop management and protection

Built

top of Microsoft

System Center Configuration Manager

Supports

all System Center Configuration Manager topologies and scaleFacilitates easy migrationDeploy across various operating systems Windows® client and Server

Protection against all type of malwareProactive security against zero day threatsProductivity-oriented default configurationIntegrated management of host firewallBacked by Microsoft Malware Protection Center

Unified management interface for desktop administratorsEffective alertsSimple, operation-oriented policy administration Historical reporting for security administrators

Ease of Deployment

Enhanced Protection

Simplified Desktop ManagementSlide4

Policy LifecycleSlide5

Policy Lifecycle at a GlancePolicy Creation:ConfigMgr ConsoleGroup Policy Management Console

Export / Import of XML (fep2010gptool.exe)Policy Deployment:ConfigMgr

Software Distribution of Policies packageGroup Policy

Command-line

During install (FEPInstall.exe /policy <policy>)

After Install (ConfigSecurityPolicy.exe <policy>)

Policy Monitoring:

Dashboard and ReportsSlide6

FEP Policy: CfgMgr or Group Policy?

You should consider managing policy with CfgMgr if

…

You should consider managing

policy

with Group Policy if…

You

want unified management (Recommended)

You have CfgMgr deployed on all the computers you will manageYou have non domain-joined machinesYou do not want to have to understand and manage many low level settingsYou don’t need more than one policy per computer, even on serversSome of the computers you want to manage don’t have CfgMgrYou prefer to manage policy with group policyYou want extremely granular control over settingsYou prefer to “layer” policies, that is to apply more than one policy per computerSlide7

Policy Creation: ConfigMgr ConsoleNew Policy wizardCreate new policy based on templateCopy existing policy

Use source policy as templateImport policy from XMLSlide8

Policy Templates - Client

Standard

High Security

Perf. Optimized

Enable NIS





Scheduled ScansWeekly QuickDaily QuickWeekly FullWeekly QuickScan only when idle

Force if 2 scans missed(on reboot)Throttle CPU50%-30%Force definitionupdate after1 day1 day-

FirewallBlock incoming in all profilesBlock incoming in all profilesNot ConfiguredSlide9

Available Server Workloads Policies

Server Role or Server Application

SQL 2005

Ent

/Std (with clustering)

SQL 2008 Ent/Std (with clustering)3SCOM 2007 R2 (with clustering) in FEP-S Configuration4SCCM 2007 (with clustering) in FEP Configuration5Exchange2007 (HubTransport, ClientAccess, Mailbox)6Exchange2010 (HubTransport, ClientAccess, Mailbox)7SharePoint8File Services9Internet Information Services 610Internet Information Services 711DNS Server12Active Directory Domain Services (including SYSVOL/FRS/DFS/DFS-R)

13DHCP Server14Terminal Services15Hyper-V16Forefront Protection for ExchangeSlide10

Default PoliciesFEP provides 2 default policies:Default Desktop PolicyWeekly quick scan, RTP on, default exclusions, Firewall enabledAssigned to Deployment Succeeded\Deployed Desktops CollectionDefault Server Policy

No scheduled scan, RTP on, default exclusions, Firewall not enabledAssigned to Deployment Succeeded\Deployed Servers CollectionCan be modified but not deletedSlide11

Policy PrecedenceComputers can belong to multiple Collections, so may be candidates for multiple policiesOnly one policy can be applied via ConfigMgr at a time

ConfigMgr-delivered policy does not support “layering”Precedence is used to determine the effective policySlide12

demo FEP 2010 Policy ManagementSlide13

Under the Hood: Policy CreationAdmin creates/updates a FEP policy in consoleAn ConfigMgr Program is created inside the

“FEP Policies 1.0” Package and set to disabledStatus Filter launches PlcUpdtr.exe

Ensures default policies are present and up to dateCreates actual program and updates the program’s ISV DataUpdates Client installation Package with default policies if needed

Enables all disabled programs

Creates Applypolicy.vbs if missing

All activity is logged to

C:\Program Files\Microsoft Configuration Manager\

AdminConsole

\AdminUILog\FepPolicySourceUpdater.logSlide14

Policy Creation: GPMC.ADMX / .ADML files on install mediaManage via Vista / Windows 2008 (or later) GPMCSlide15

Policy Creation: Import / ExportConfigMgr GPOSlide16

Policy Creation: Import / ExportGPO ConfigMgrSlide17

Policy LifecycleSlide18

Policy Lifecycle at a GlancePolicy Creation:ConfigMgr Console

Group Policy Management ConsoleExport / Import of XML (fep2010gptool.exe)Policy Deployment:

ConfigMgr Software Distribution of Policies packageGroup Policy

Command-line

During install (FEPInstall.exe /policy <policy>)

After Install (ConfigSecurityPolicy.exe <policy>)

Policy Monitoring:

Dashboard and ReportsSlide19

Assign to ConfigMgr Collection(s)Slide20

Verify Program AdvertisementsSlide21

Under the Hood: Client Applies PolicyConfigMgr client receives new policy from advertised program (the FEP policy)Advertised program (ApplyPolicy.vbs) runsCheck to see if

CCM_ISV_SoftwarePolicy Class existsRequests Machine policy and evaluates itApplyPolicy.vbs finds the policy with highest precedence

Builds index of policies and precedenceIdentifies Policy with highest precedence and creates .xml fileCalls C:\Program Files\Microsoft Security Client\

ConfigSecurityPolicy.exe “<Policy>.xml”

All of this logged in %temp%\FEP-Applypolicy-%computername%.logSlide22

Policy LifecycleSlide23

Policy Lifecycle at a GlancePolicy Creation:ConfigMgr Console

Group Policy Management ConsoleExport / Import of XML (fep2010gptool.exe)Policy Deployment:

ConfigMgr Software Distribution of Policies package

Group Policy

Command-line

During install (FEPInstall.exe /policy <policy>)

After Install (ConfigSecurityPolicy.exe <policy>)

Policy Monitoring:

Dashboard and ReportsSlide24

Under the Hood: Display in DashboardClient reports status of program installationSlide25

Under the Hood: Display in ConsoleClient reports status of program installationUpdates Collection membershipCollections updatedevery minuteSlide26

Troubleshooting Policy - FEP Client Gui Policy InformationSlide27

Troubleshooting Policies – Policy Distribution ReportThere are new reports that can help with troubleshooting of policies. You can reach these reports by going to Computer Manager

 Reporting  Reports.

“Policy Distribution Overview” - This report displays the breakdown of policy distribution states per collection. This report will only enumerate computers with Microsoft Forefront Endpoint Protection 2010 installed.

“

Policy Distribution for a specific collection

” - This report displays the policy distribution states for a specific collection. This report is divided into three sections. The Applied Policy section lists the number of computers and the applied policy. The Pending State section lists the number of computers that in a pending state. The Failure section lists the number of computers that have reported failures in applying their policy.

“Policy Distribution for a specific collection in a specific state” - This report displays a list of computers in a specific collection and specific policy state (applied, pending, and failure).NOTE: Since policy distribution is similar to client roll out (both use the Configuration Manager software distribution capabilities), troubleshooting follows the same concepts and uses similar reports.Slide28

Dashboard & RemediationI want to monitor my computers health and act on policy driftsSlide29

FEP Dashboard & Remediation – Key ConceptsOperationalized security monitoringDeployment issuesProtection status

Antimalware activity issuesDefinitions updates issuesPolicy distribution issuesVisibility to FEP DCM baselines

Launchpad to ConfigMgr collections

Drill down to

ConfigMgr

collections

Refresh operation statistics on demand

Manual remediation actions :

Full/Quick scanSignature updateSlide30

demo Dashboard and RemediationSlide31

ReportsI want to have an historical view of my org protection stateSlide32

FEP ReportsSecurity mindedOperational

investigation capabilities

Operational compliance

capabilities

SQL Reporting services

Export to other formats

Accessed from browser

ExtensibilityCreate you own reports Shared schemaSlide33

Reports in ConfigMgrdemo Slide34

demo Custom FEP Reporting on FEP DB OLAPSlide35

FEP AlertsI want to be notify on critical security incidents anywhere, anytimeSlide36

FEP Security Alerts - ConceptsSecurity alerts – Guidelines:Actionable – Actions associated with an alertTimely – Expected and accepted delay for an alert to reach its destination

Manageable – Number & Types of expected alertsSensitivity-based – Different instances per alert type and/or collectionsSecurity alerts in FEP:Rely on CM and FEP data up flows

Expected response is ~30 – 120 minutesE-mail notifications

Viewed in FEP report (Antimalware activity)

Event log

Configurable threshold basedSlide37

FEP Security AlertsSlide38

Forefront Endpoint Protection 2012 Beta

Convergence of Management and Security

Built on System Center Configuration Manager 2012

Advanced protection with lower impact on productivity

New Enhancements

Simplified hierarchy model

Role Based Access Control

Definition Updates and automatic approval rules through

ConfigMgr

Improved alert timings

Evaluation OptionsFEP 2012 Beta available now: http://www.microsoft.com/fepJoin Community Evaluation Program (included in ConfigMgr CEP) https://connect.microsoft.com/site1211Slide39

SummaryConvergence of Forefront Endpoint Protection with System Center Configuration Manager:Lowers ownership costs Delivers simplified management and ease of deploymentEnables improved visibility for identifying and safeguarding potentially vulnerable endpoints

Forefront Endpoint Protection 2012 Beta Available now!Evaluate with a community of peers: https://connect.microsoft.com/site1211Slide40