ESET NOD32 ANTIVIRUS - FOR KERIO User manual

NOD32 for Windows
Administrator
NOD32 Remote
Administrator
User’s guide
w e p r o t e c t d i g i t a l w o r l d s

2
content
chapter 1.
Basic network features of NOD32 for Windows................5
chapter 2.
Centralized management –
NOD32 Remote Administrator.......................................13
chapter 3.
Remote installation.......................................................25
chapter 4.
Tasks, typical examples.................................................31
chapter 5.
Large hierarchical networks – replications....................35
chapter 6.
Summary of information...............................................39
Copyright © Eset, spol. s r. o.
All rights reserved.
No part of this document may be reproduced or
transmitted in any form or by any means electronic
or mechanical, for any purpose without the express
written permission of Eset, spol. s r. o. Information
in this document is subject to change without prior
notice.
Certain names of program products and company
names used in this
document might be registered trademarks or
trademarks owned by other entities.
Eset, NOD32 and AMON are trademarks of Eset, spol.
s r. o.
Microsoft and Windows are registered trademarks of
Microsoft Corporation.
Eset, spol. s r. o.
Svoradova 1, 811 03 Bratislava, Slovak Republic
http://www.eset.sk/en
Technical Support Worldwide:
http://www.eset.com/support
Technical Support for Europe:
http://www.eset.sk/en/support

3
INTRODUCTION
The NOD32 Antivirus system oers a wide range of
tools, which make running and managing both smaller
and larger company networks easier.
Even the multi-license NOD32 for Windows oers
the basic network services. Especially a feature called Mi-
rror, which serves to decrease trac across your Internet
LAN connection. Client workstations, with NOD32 instal-
led, will not download updates directly from the manu-
facturer (Eset company), but from a local update server,
which is located in the same LAN. Using a Mirror, you can
congure all NOD32 system settings. Thus you can recon-
gure NOD32 settings on all workstations“en bloc“.
In addition, NOD32 for Windows itself, or the control
module NOD32 Control Center, can inform the ad-
ministrator about virus or other problems on workstati-
ons via electronic mail or Windows Messenger.
NOD32 Enterprise Edition oers much more. It in-
cludes NOD32 for Windows and NOD32 Remote Adminis-
trator.
NOD32 Remote Administrator serves to ma-
nage the NOD32 antivirus system in large computer ne-
tworks.Thanks to NOD32 Remote Administrator,
you can get a global overview of the NOD32 antivirus sys-
tem activity on network workstations together with in-
formation about eventual inltration. The information
retrieved from the workstations (from the NOD32 forWin-
dows, or the NOD32 Control Center module) are
stored centrally on the server (NOD32 Remote Ad-
ministrator – RAS), and the network administrator
can access them at once using the user-friendly graphical
interface of the console (NOD32 Remote Adminis-
trator Console – RAC). The communication takes
place also in the opposite direction and administrator can
thus immediately react to newly-created situations, and
assign tasks to the NOD32 Antivirus System on the client
workstations.
Because a lot of information, which may be dicult
to remember is to follow, at the end of the manual you
can nd a summary of the most important issues.

Chapter 1:
Basic network features of
NOD32 for Windows
1 Basic network features of NOD32 for Windows

6
Mirror server
Workstation
Workstation Workstation
Workstation
Internet
Mirror
Mirror is available in two versions:
• mirror as a shared network folder
• mirror as an HTTP server
and its setup is available from NOD32 Control
Center.
When you create the Mirror as an HTTP server, one PC
serves for downloading updates from Eset`s servers, and
as a NOD32 update server for the other workstations in
the LAN at the same time. This version is easier to con-
gure and is not limited by the number of licenses of the
le server, which is required by the rst version for access
to the shared folder.
HTTP Server is a direct part of NOD32 2.5 administra-
tor version and by default runs on port 8081.
If the Mirror is created as a shared folder, then its prin-
ciple lies in distribution of updates across the network,
using a shared network folder. In contrast to the rst me-
thod (HTTP server), a computer creating a Mirror does not
have to be a server, to which the other workstations con-
nect to download updates at the same time.
Figure 1 Principle of a Mirror: The company server downloads updates from the Internet, and workstati-
ons update from this local server.The Mirror thus decreases trac across your Internet connection, becau-
se the workstations download update les from the local server, and not from the Internet. Update pro-
cess is initialized by Mirror server (Update from the Internet) and workstations (update from Mirror Ser-
ver) in regular intervals.

7
chapter 1 / Basic network features of NOD32 for Windows
Model installation of Mirror
as an HTTP server
1. In the NOD32 Control Center choose Mirror and on the
right, click on the Setup button.
2. Check Create update and also Enable access to les
to perform program component upgrade. In the up-
per part, choose those versions of NOD32, for which
updates will be downloaded from the Internet. All
versions that will be running on the workstati-
ons should be checked. Into the dialog box Upda-
te mirror folder, enter a path to the folder, where the
update les will be downloaded and later presen-
ted by the HTTP server. For example the path can be
C:\OD32LAN.
3. Click OK to save your settings.
4. Inordernot towaitforthenextautomaticupdate(and
thusforthefolderC:\NOD32LANtobelledin),clickon
the Update now button in the Update dialog window.
Now server setup is completed.We will proceed to the
workstations.
5. For NOD32 on workstations, just change the update
server URL. In most cases it means from Choose auto-
matically to http:// IP_address_of_my_server:8081.
This is done in NOD32 Control Center: click on the
Update button, and then choose Setup.
6. When there, click on the Servers button and add
a new server, namely http:/ /IP_address_of_my_ser-
ver:8081. Save the changes by clicking OK and set this
server in the previous dialog window.
Now the conguration of workstations is comple-
ted too.
Now click on the Update now button in the Update tab
to check whether it is set up correctly.
Model installation of Mirror
as a shared folder
The whole process of installation is similar to the pre-
vious case. Some dierences can be found in the steps 2,
5, and 6, the others are identical.
• Step 2:
Check the Create update mirror checkbox. In the up-
per part choose those versions of NOD32, for which upda-
tes will be downloaded from the Internet. All versions
that will be running on the workstations should be

8
checked. Into the Update mirror folder enter a path to
the directory, where updates will be downloaded – i.e.
a path to the shared network folder – Mirror – and en-
ter username and password of user with a right to read,
write and browse.
When entering a path, please use the UNC path. Let’s
assume that the shared folder is named NOD32NET and
is located on the MAIN server. Then enter the path in this
form: \\MAIN\NOD32NET.
WARNING! Please, pay attention when entering
“username” and “password”. See below chapter for
details.
• Step 5:
Just change the URL of update server on NOD32 on
the workstations. Again, please be careful when entering
username with Windows NT / 2000 / XP / 2003. Open the
NOD32 Control Center, then choose Update, click on the
Setup button, and enter the username.
Click on the Servers button to add a new update ser-
ver. According to the previous example, enter \\MAIN\NO-
D32NET. Save the changes and return to the Update setup
window and choose it from the roll down menu.
WARNING! Please, pay attention when entering
“username” and “password”. See below chapter for
details.
Click OK in the bottom section to save the settings.To
make sure that it is set up correctly, click on the Update
Now button in the Update dialog window.
If it is set up correctly, you should not be asked for
username and password, and, naturally, no error messa-
ges should be displayed.
Now click on Update now in the Update tab to check
whether it is set up correctly.
How to transfer conguration via
Mirror.
Usinga local updateserver– Mirror–youcanalsodis-
tribute a conguration for NOD32, by which the worksta-
tions will be congured at the next attempt to update.
In order to automatically distribute a conguration,
• set update server on the workstations to http://IP_
address_of_your_server:8081 (if it is the version wi-
th an HTTP server) or to \\MAIN\NOD32NET (if it is the
version with a shared folder)
• place the conguration XML le on the server.
The conguration itself is created on the same PC
where the mirror is created. Click on the Mirror button
in the Update section in the NOD32 Control Center, and
then click on the Setup button. In the Mirror Setup dia-
log window, click on Setup in Conguration les. After clic-
king on the Setup button, select Add, then New and cre-
ate a new conguration le. Save the new conguration
le anywhere on the local disk, EXCEPT for the folder with
the Mirror. After this is done, the application NOD32 Con-
guration Editor is launched (see below).
After required changes are made, save them by clic-
king on the diskette in the upper part of the window.
Then just close the window and click OK to return to the
NOD32 Control Center. Now, by clicking on the Update
button in the Mirror for local updates section the congu-
ration le will be generated in the folder with the Mirror.
The presence of the conguration le in the upda-
te folder/ mirror will ensure, that the workstations
will, besides downloading updates, apply this con-
rmation also.
Access usernames and passwords
Please pay attention when lling in the username
and password dialog boxes in the Update setup dialog
window before updating from the mirror (or before cre-
ating the mirror).
The NOD32 update process runs at the service level,
and a currently logged in user cannot aect this situation
(even if he/she has access to the folder with the Mirror).
So in case of MSWindows NT / 2000 / XP / 2003 opera-
ting system ll in the“name”dialog box this way:
DOMAIN\USER
or
WORKGROUP\USER
under Novell system, just put USER.
Of course we must not forget the password. LOGIN
NAME is a name of the user with read-only rights to the
folder with the mirror (if the user creates the mirror, then
also to write).

9
We recommend creating a new special account for
this purpose (e. g. noduser) and using it for downloading
updates (company\noduser etc.)
NOD32 Program component
upgrades
Besides the virus signatures database update, a licen-
se also includes program updates – program component
upgrades, which require a restart of the operating sys-
tem and bring a lot of new features and improvements
to NOD32 (it is an upgrade to a completely new version, e.
g. from 2.0 to 2.5). Choose “Require permission to perform
program component upgrade” in the Mirror Setup window
to ensure that the program component upgrade will not
be applied to a local update server immediately it is avai-
lable on the servers of the Eset company. NOD32 on the
workstations will remain in the current version, and the
workstations will only accept virus signatures updates
from the mirror.This feature is suitable if the administra-
tor tests new program updates before applying them to
all workstations in the network.
If “Require permission to perform program compo-
nent upgrade” is active and there is a newer program
update available than the one saved in the Mirror direc-
tory, the “Components Update” in NOD32 Control Center
> Mirror will be active. By clicking on this button the ad-
ministrator agrees that the program update will be avai-
lable to the workstations via Mirror.
Installation of NOD32 for Windows
on workstations
The above-mentioned conguration le can serve
also for a new installation of NOD32 according to the re-
quested setup. Place the conguration le into the folder
with the installation of NOD32, i.e. where SETUP.EXE is lo-
cated and name the conguration le NOD32.XML.
It may be useful to remember the parameter /SILENT-
MODE connected with SETUP.EXE (i.e. SETUP.EXE /SILENT-
MODE), which installs NOD32 in silent mode – no dialog
window will be displayed during installation.
chapter 1 / Basic network features of NOD32 for Windows
Now there follows a list of all useful parameters that
can be used during installation of NOD32:
/SILENTMODE – a mode without dialog windows – si-
lent installation.
/UNINSTALL – uninstall of existing installation.
/FORCEOLD – will also install over newer version.
/CFG= – switch with a conguration name (if this para-
meter is not present, NOD32.XML is used by default).
/SETTINGS= – name with obligatory SETUP.XML le (en-
tered only if SETUP.XML is not present in the installation
folder, or has a dierent name).
/TEST – if the installation is launched with this parame-
ter, NSETUP.LOG is created, where the installation progress
is described in details. Here you can exact reasons of even-
tual problem when installing.
/REBOOT – after a silent installation is complete, the
PC is not restarted by default, even though it may be re-
quired. Using this parameter will switch the restart op-
tion on.
/SHOWRESTART – if this parameter is combined with the
previous one, conrmation for restart will be required.
/PWD= – entering password for uninstall. This is impor-
tant in case a current version of NOD32 is protected by
a password, and the administrator intends to reinstall in
silent mode.
/NUP= – if the value of this parameter is set (name of
the le with component), the installation does not re-
quire SETUP.XML for the whole installation, but you can
install only one component.
/INSTMFC – this parameter turns on installation of MFC
libraries – if it is necessary – without asking. The MFC li-
brary must be located in the same directory as SETUP.EXE.
The installation program will check whether there are
newer libraries in the system (or none) and will proceed
according to the verdict (e. g. install).
The switches with “=”require entering of a thread. It
can be put into quote marks, but does not have to. Quote
marks are obligatory only if the thread contains spaces.
Should this version of the installation be applied, for
example using logon scripts, then make sure that the in-
stallation will not be repeated by every start of the logon
script. SETUP.EXE can not decide by itself whether there is
NOD32 already installed on the workstation.

10
Such control can be provided for example with this batch
le (.BAT):
@echo o
IF EXIST “c:\program les\eset\nod32.exe” GOTO end
echo Installing NOD32...
\\server\nod32\setup.exe /SILENTMODE /REBOOT /cfg=\\
server\cfg\kong01.xml
GOTO end2
:end
echo NOD32 already installed...
GOTO end3
:end2
echo Completed...
:end3
Conguration editor
Using the Conguration editor, you can create a con-
guration XML le, according to which, NOD32 on worksta-
tions and servers will be set up, or scan the computers
using its conguration. All of the features are arranged in
a tree structure. The small icons in front of each feature
are very important. At the moment when the congurati-
on will be applied on the target PC, the setting marked by
a “grey” symbol will be left unchanged on the target
PC. However, all items marked by blue symbols: will
be changed on the target PC.
Thus you can easily recongure chosen features on
all computers at once and leave the other settings un-
changed.
Some of the key settings of the
NOD32 conguration
Now there follows a list of some key conguration op-
tions (other important information can be found in the
Proles chapter).
Path:
• General / Settings / General / Silent Mode
If the Silent mode is turned on, no messages about
successful updates and so on, will be displayed. This
setting will not aect behavior of NOD32 in case an
inltration was found.
• General/Settings/ General/Lock Settings and Password
to unlock
These settings protect access to the NOD32 congura-
tion options by the workstation user.
• General / Settings / Remote Administration
Very important in case NOD32 Remote Administra-
tor is also installed. Then it is important to enter the
IP address (or DNS name) of the RA server, by which
the client workstations communicate (you can leave
default settings for Server port and Interval between
connecting to RA Server) and allow remote adminis-
tration.
• AMON / Settings / Security / Start AMON automatically
We recommend leaving the default setting. Change
it only if you are not sure, whether there is another
antivirus system installed. It is not recommended to
have two AV’s installed and running in real-time on
one PC (it can lead to conicts). These settings can be
changed also in the NOD32 Control Center > Threat-

11
Protection Modules > AMON > Setup > Security tab
> Enable automatic startup of AMON.
• AMON / Settings / Enabled
AMON – the resident shield will watch over the ma-
nipulation of les (YES), or will be running only in the
background and will not watch over the manipulation
(NO).
• IMON / Settings / Register IMON to the system
We recommend setting this option to YES, if it is
a workstation, and to NO, if NOD32 for Windows will
be installed on a server, or a PC, where some other
services are running.
These settings can be changed also in the menu
NOD32 Control Center > Threat Protection Modules >
IMON > Quit.
• IMON / Settings / Enabled
IMON – the Internet monitor – will control commu-
nication (YES), or will be running only in the backg-
round and will not watch over the communication
(NO).
• Update / Prole / Settings / Update server
This option sets a path to the server, which will be ser-
ving as an update server. By default it is set to AUTO-
SELECT - NOD32 automatically chooses one of the Eset
company update servers.
• Update / Prole / Settings / Username and Password
Username and password are authorization data to the
above mentioned server. In case NOD32 is updated di-
rectly from an Internet update server of the Eset Com-
pany, then enter the username and password you re-
ceived when you purchased the NOD32 license. If you
use your own update server (see chapter about “Mir-
ror”), enter the username and password for this upda-
te server (also described in a separate chapter).
• General /Settings / ThreatSense.Net
This system allows sending of suspicious les (that
were identied by heuristic analysis as probably be-
ing infected by an unknown virus) from client to our
virus lab. We recommend considering this feature,
especially the option that decides whether the suspi-
cious les will be sent automatically, after user’s con-
sent or not at all..
Proles – Scheduler/Planner
NOD32 for Windows allows dening “groups” of set-
tings – proles – in certain parts of the program, espe-
cially in update proles and scanning proles. You may,
for example, want to have one prole p roviding updates
from a local server and another one, providing updates di-
rectly from the Internet.The same applies to the scanning
proles – one prole would test local disks without scan-
ning of archives, and another would scan network drives
including archives.
The proles are interconnected with scheduled tasks
(NOD32 Control Center / NOD32 System Tools / Schedu-
ler/Planner). For example, after standard installation of
NOD32 for Windows, a prole is created called My Pro-
le, which as one of its tasks sets automatic update for
every hour.
Please pay attention when setting compatibility of
the proles and the scheduled tasks, and please also be
careful when dening your own proles – check whether
the proles are really launched automatically.
If there’s no automatic update scheduled, it is shown
in the Setup of Automatic Update tab, as can be seen in
the screenshot.
chapter 1 / Basic network features of NOD32 for Windows

Chapter 2:
Centralized management –
NOD32 Remote Administrator
2 Centralized management – NOD32 Remote Administrator

14
Workstation
Workstation Workstation
Workstation
RAC2
RAC1
RAS
TCP 2222
TCP 2222 TCP 2222
TCP 2222
TCP 2223
TCP 2223
Remote Administrator
NOD32 Remote Administrator serves to manage the
NOD32 antivirus system in large computer networks.
Thanks to NOD32 Remote Administrator, you can get
a global overview of the NOD32 antivirus system activity
onnetworkworkstationstogetherwithinformationabout
any eventual inltration. The information retrieved from
workstations (from NOD32 for Windows, or the NOD32
Control Center module) are stored centrally on the server
(NOD32 Remote Administrator – RAS), and the network
administrator can access them at once using the user-
friendly graphical interface of the console (NOD32 Remote
Administrator Console – RAC). The communication takes
place also in the opposite direction and the administrator
can thus immediately react to newly-created situations,
and assign tasks to the NOD32 Antivirus System on the
client workstations.
Figure 2: Simple RA connection diagram. The real situation can be much more complex. There can be also
a separate mirror server – though usually RA server and Mirror would be located on one computer/server.
The connection to RAS is initiated by the workstations in preset intervals.
Installation of RAS and RAC, basic
conguration
NOD32 Remote Administrator Server (from now
on only referred to as RAS) – is an application which
communicates with NOD32 on workstations (or with
NOD32 Control Center), gathers information about them
and sends them to the other application – NOD32 Remote
Administrator Console (RAC).It is advised to install RAS on
a PC that is running all the time and that is“visible”for the
workstations with NOD32 on the TCP/IP level, but also for
the PCs, from which the administrator will connect using
theconsole(RAC).TheproductmustbeinstalledontheMS
WindowsNTbasedoperatingsystem(NT4,2000,XP,2003).
RAS is installed by running the le rasrvnten.exe. RAS
is installed as a service.

15
You can control the service manually using these
commands:
NOD32RA.EXE –INSTALLSERVICE
NOD32RA.EXE –REMOVESERVICE
During installation, the program will ask for the
location of the license key, i.e. of the le called nod32.
lic, which contains information about its owner, its expiry
date as well as about the number of users, for which the
RAS was purchased. You can copy the key later into the
directory C:\Program Files\Eset\RA\Server (it is activated
after restarting the NOD32 Remote Administration Server
service). Information included in the key can be seen
in Help / About / Server Options after connecting to the
server with the console.
Duringtheexpertinstallation,thenameoftheserver,
under which workstations in the network recognize it, is
required. If not stated otherwise, the server is presented
under the name of the PC where it is located.
Please pay attention when entering the name of the
server. This name is used for example by nod32installer
providing remote installation of NOD32 on workstations.
If RAS would not have been visible under this name, the
remote installation could fail.
We recommend entering the DNS name of the server.
chapter 2 / Centralized management – NOD32 Remote Administrator
Also NOD32 for Windows Antivirus System is
supposed to be running on the same PC – connected
to the Internet. Its virus signature database serves as
a detector of the most recent for the databases present
on the workstation.
NOD32 Remote Administrator Console (from now
on only referred to as RAC)serves for accessing the
information retrieved by RAS from the workstations with
the NOD32 installation. It is advised to install RAC on
workstations,fromwhichtheadministratorwillaccessRAS.
The installation begins after running the le
raconsnten.exe (console for Windows NT/2000/XP/2003)
or racons98en.exe (console for Windows 95/98/ME).
To complete the setup procedure, congure also
the workstations with NOD32 for Windows, which will
communicate with RAS. Remote administration therefore
must be enabled on the workstations with NOD32 for
Windows in the menu NOD32 Control Center / NOD32
System Tools / NOD32 System Setup / Setup – Remote
Administration. Enter the name or IP address of the RA
server, or change the interval between connections (5
minutes by default). Communication between NOD32 (or
NOD 32 Control Center) on the workstation and RAS takes
place by default onTCP port 2222.
Connecting to server using console
interface
The console connects to RAS after entering the
RAS IP address in menu Tools / Console Options (the
Connection tab) and clicking on the Connect button.
Select the option Connect to selected server on the console
startup provides automatic connection to selected RAS
after starting the console.
Enter your access data to chosen RAS during
connection. By default the password dialog box is blank
– it is advised to dene your password in the menu
File / Change Password…
The console can remember passwords – check the
Remember password checkbox during entering – but it
is recommended to leave this option disabled for security
reasons. If it is already enabled and you do not want the
passwords to be lled in automatically by the console,
then check File / Clear Cached Passwords.

16
The communication between the console and RAS
takes place on TCP port 2223.
As soon as the communication is established, the title
Connected [name_of_the_server] appears in the title.
1. In this section you can nd more detailed information
about the RA server to which the console is connected
and also information about RA servers related to it (in
case of replication).
Attributes:
– Clients – number of clients (workstations)
connected to the server, or clients that were
connected in the past and are registered in RAS
database
– Oldest Version – the oldest version occurring on
the workstations connected to t he RAS
– Least Recent Connection – value that was taken
from a client workstation that has not been
connected to the RAS for the longest time period.
– Last Virus Alert – number of virus alert messages
sent from clients to their RAS.
– Last Events – number of events sent from clients
to their RAS.
3) In the left part of this dialog window, there is
a sensitive, adjustable lter displaying only the
information that is interesting to the user.
3) In the bottom part of the dialog window, there is
information retrieved from client computers. In order
Figure 3. The main screen of the NOD32 Remote Administrator Console.
togetanoverview,theinformationisdisplayedintabs
in the bottom part. The tabs Reports a Remote Install
are exceptions; they serve for remote installation.
Tabs in the bottom part of the
console window
Clients
In this tab, there is a list of clients (workstations with
NOD32) that were connected to the RAS in the past. You
can apply a lter on this tab – as well as on all other tabs
(Use lter in the left part). The client workstations can be
divided into groups using the menu Edit / Groups and by
applying the division into groups using the lter.
Clients – computers with NOD32, that have logged
to the RAS for the rst time, are in a state Yes with the
attribute New, that can be seen in the bottom-right part
of an icon in a shape of a small monitor. This feature serves
only for easier orientation of the administrator, who can
thus quickly nd out that there is a client computer which
has not been “cared for“. The attribute can also serve for
other dierentiations – it is up to the administrator.
At the time when the administrator sets up the client
workstationasnecessarythroughRAC(placesitin agroup,
etc.),theadministratorcanplaceitinto“alreadyregistered“

17
by using the right button of the mouse and by choosing
the feature Reset “New“ Flag. The icon will change to this:
The attribute Comment is selectable in all of the tabs.
It serves for inserting the administrator’s comments (for
example alternative name of client workstation).
The attribute Primary Server denotes the name of the
RAS, to which the remote client is connected via NOD32
Control Center. If it is another server than the one which
the administrator is currently connected to, then it is
a result of replication. Version is the current version
of the NOD32 antivirus system on the client workstation,
and Last Connect is the time of the last connection of
NOD32 on the workstation to the RAS server. According
to the settings of the console, time is either relative (e.g.:
“20 seconds ago“) or absolute (e.g.: 12:56:13). If there
is an older version on the workstation, the data eld is
in a dierent color (again, depending on settings of the
console), but it does not inevitably mean a problem (for
example, in case the workstation has been shut down for
a week – it can be seen in Last Connect).
The attributes Last Virus Alert (inltration detected
by the AMON, IMON, and EMON… modules) and Last
Event (error event) display the last event of that type
on the chosen client workstation. The events checked by
the administrator can be removed from the list. Click right
mouse button and select the Clear “Last Event” Text, or
Clear “Last Virus Alert” Text option.
To switch the tab with automatic lter to display
only records belonging to a chosen client computer, click
the left mouse button on the corresponding cell in the
column Last Virus Alert or Last.
Other attributes:
AMON – status of the AMON module on client
workstation.
Conguration–usingtheconsole(bytheConguration
option in context menu) you can retrieve a conguration
of a remote client workstation. In case the client is not
present directly on the server, to which the administrator
is connected with the console, conguration can be
retrieved by clicking on the Request button. The
conguration can be viewed by selecting the View option
or saved by clicking on the Save As button. Click on the
New Task button to create a new task. The attribute
Conguration also informs about the state of import of
the conguration. You can view status (Ready- import
nished or Requested•request to import), last request
for conguration – from the view of the administrator
using console, but also from the view of a user on a client
workstation.
IP – last known IP address of client workstation.
OS – operating system on client workstation.
Mobile User – if the Mobile User option is turned on
(Yes), then the workstation will be updated (the Update
Now task) as soon as the client workstation connects to
the console (see interval dened by the NOD32 Control
Center settings).This attribute can be enabled by the Set
“Mobile User” ag option using the right mouse button
context menu. It is recommended to use the Mobile Server
if you connect to the network with a notebook computer.
The NOD32 Antivirus System update is performed
immediately afterwards.
Alert Log
Alert log contains information about inltrations
detected by the AMON, EMON, IMON, and other modules.
Click left mouse button to gain more information about
the alert.The displayed information can be ltered too.
Attributes:
Event Id – log identication number.
Client Name – name of client workstation.
Primary Server – name of RAS to which client is connected
via NOD32 Control Center (related to replication).
Date – date and time of the event (when it happened –
according to time on client workstation).
Received – date and time of receipt by the server.
Module – name of the module that created the event.
Object – type of infected object.
Virus – name of virus.
Name – name of infected object, sector, or information
about e-mail.
Action – action performed.
Info – contains supplementary information.
Log Details – information about the log accessibility in
relation to replication.
chapter 2 / Centralized management – NOD32 Remote Administrator

18
Event Log
Event log contains information about an event other
than the virus. The report can be ltered to display only
information you need – for example with the tick boxes in
Type of Event Log. To get more detailed information about
an event, click left mouse button on the event.
Attributes:
Alert Id – log identication number.
Client Name – name of client workstation.
Primary Server – name of RAS, to which is client
connected via NOD32 Control Center to RAS (related
to replication).
Date – and time of the event (when it happened).
Received – date and time of receipt by the server.
Module – name of the module that created the event
Type – type of log.
Event – description of event.
Scan Log
Scan Log contains reports that were performed by the
NOD32 on-demand scanner (antivirus test), which was
planned in the Tasks tab, or started directly on the client
computer. Click left mouse button to gain more detailed
information about the performed test, or request for
the details if servers in your network are replicated. (See
chapter on RAS conguration).
Attributes:
Scan Id – log identication number.
Client Name – name of client workstation.
Primary Server – name of RAS to which client is
connected via NOD32 Control Center to RAS (related
to replication).
Date – date and time of event (when it happened –
according to time on workstation).
Received – date and time of receipt by the server.
Description – contains supplemental information.
Scanned – number of scanned les.
Infected – number of infected les.
Cleaned – number of cleaned les.
Status – status of task completion.
Log Details – information about the log accessibility in
relation to replication.
Tasks
The Tasks tab contains information about tasks
planned in the past (more details in the chapter onTasks).
Attributes:
Task Id – task identication number
Type – type of task
Name – name of task
Date To Deploy – date and time of assigning to target
client computers
Date Received – date and time of the client computer
response
Description – note added by administrator to describe
the task.
Conguration – information about accessibility to current
conguration
Click left mouse button on the task to get more
detailed information, especially in the Details tab. In
the Details tab you can nd a list of client computers
(the attribute Client), which were assigned the task,
and current state (the attribute State) of the task. This
attribute has one of these values:
• Waiting
A task is waiting on RA server to be sent to the client
computer (target workstation). There can be one or two
reasons for this – for example, the client workstation is
shut down, or the NOD32 Control Center has made no
contact to the RA server yet (by default it connects in ve
minutes intervals).
• Done
Task has been assigned to the client computer –
the target workstation. It does not necessarily mean that
the task has been performed by the target workstation
yet.
• Pending
Task is being performed.
Reports
The Reports tab serves for creation of statistical
information – reports. Reports can be planned (for
example once a week) or performed on demand
(generated on administrator’s command).
Individual variants of reports can be selected in the
menu Report / Type. Report / Style determines graphical

19
interface of the resulting report (NOD32 Scheme is more
graphically-demanding).
In the Filter section you can choose what clients
(Target Clients), or viruses (Viruses) will be included in the
report.
Other details can be set by clicking on the Additional
Settings tab. It applies mostly to data in the heading and
in the types of the diagrams used. At the same time,
you can lter the client computers according to states of
chosen attributes, and you can also choose the format of
the output le (HTML, CSV).
In the Interval tab you can dene an interval, for
which the report will be generated:
• Current
Only events that took place in a chosen time period
will be included in the report – meaning the same as now
(e.g.: if a report is created onWednesday and the interval
is set to Current Week, then the events from Sunday,
Monday, Tuesday, andWednesday will be included).
• Completed
Only events that took place in a chosen, closed period
will be included in the report (for example the whole of
August, a whole week – from Sunday to next Saturday).
If the parameter Add also the current period is active, the
period chosen above will also include events from the last
closed period until the moment of creating.
Example:
• We want to create a report including events from
the last calendar week, i.e.: from Sunday to next
Saturday. We want such report to be generated on the
next Monday (after Saturday).
In the Reports / Interval tab, choose Completed and
set 1 Weeks. Remove Add also the current period. In the
Reports / Scheduler tab, set Frequency to Weekly and
choose Monday.The other settings can be set according
to request of the administrator.
• From / To. Use this setting to dene a period for which
the report will be generated.
Click on the Scheduler tab to dene and set up an
automatic report in chosen time or intervals (Frequency
section).
Enter time and date, when the report will be
generated to the Run at tab, and in the Store the Result
to section (the Select Target… button, specify how the
report will be exported.The report can be sent via e-mail
to a chosen address, or exported to a folder. A report can
be exported, for example, to a folder that is accessible via
intranet. Then it can be shared by all employees.
To send generated reports via e-mail, you need to set
the SMTP server and sender address as described in the
chapter“RA Setup“.
To dene the time period when generating will
be active, go to the Range section. You can dene the
number of generated reports (End after), or a date of the
last report (End by).
To save the settings of a dened report to a template,
click on the Save or Save as buttons. When creating
a new template, click on the Save As button and give
the template a name.
In the upper part of the console window, you can see
names of templates that were already created. Beside
the template names, there is information about time/
intervals, when the reports are generated according to
the preset templates. Click on the Generate Now button
(either in upper part, or in context menu – by clicking
right mouse button on chosen template) to generate
a report at any moment regardless of the schedule.
Already generated reports can be viewed in the
Generated Reports tab. With the context menu options
you can perform other operations with reports.
Favorite templates can be placed in the left window
Favorites, and thus you can later immediately generate
reports from favorite templates. To move a template to
Favorites choose Add to Favorites in the context menu in
the list of the scheduled templates.
This is a list of report types:
Top Viruses – list of the most frequently detected viruses
Top Clients with most Alerts – list of the most “active”
client workstations (in number of detected viruses)
Alerts Progress – progress of virus events (number)
Alerts Comparative Progress – progress of virus reports by
chosen viruses (using lter) compared with the total
number of viruses.
Alerts By Module – number of virus alerts from the
individual NOD32 modules.
AlertsByObject–numberofvirusalertsaccordingtotheway
theyattemptedtoinltrate(emails,les,bootsectors).
chapter 2 / Centralized management – NOD32 Remote Administrator

20
Combined Top Clients / Top Viruses – combination of the
above mentioned types.
Combined Top Viruses/ Alerts Progress – combination of
the above mentioned types.
Combined Top Viruses/ Alerts Comparative Progress –
combination of the above mentioned types.
Clients Report, Alerts Report, Events Report, Scans Report,
Tasks Report – typical reports that can be viewed in
the Clients, Alert Log, Event Log, Scan Log or Tasks
tab.
Comprehensive Report – summary of these types:
Combined Top Clients /Top Viruses
Combined Top Viruses / Alerts Comparative Progress
Specied Alerts Progress
Remote Install
This tab oers several variants of remote installation
of the NOD32 Antivirus System on workstations and
related features. More detailed information can be found
below.
RA Conguration
License keys (.LIC les)
NOD32 Remote Administration (or NOD32 Enterprise
Edition package) is delivered with a license key – a le
with .lic extension. In this case the key must be copied into
the folder C:\Program Files\Eset\RA\Server,which is done
automatically during installation of the server part. Later
manipulation of the license key has to be done manually.
The license key le must always have .lic extension.
Thelicense le containsinformationaboutexpiry date
andextensionoftheNOD32RemoteAdministratorproduct
license. The license le in fact determines functioning of
NOD32 Remote Administrator as a product.
RAS reads information from .lic les when starting
the nod32.exe service, and then every 60 minutes. If
there are more license keys in the folder C:\Program
Files\Eset\RA\Server, then RAS will choose the most
appropriate (more detailed information can be found
in the le nod32ra.log). If the license key has expired,
NOD32 Remote Administrator will run in demo mode, i.e.:
number of clients will be limited to two. If there are more
clients than is dened in the license key (purchased),
only a limited number of clients, corresponding with the
dened number, will be displayed.
From the version 1.0.11 license key can be changed
remotely on RA server via RA console. It is possible in the
menu Tools/ Server options – Renew License… button.
Note: Should you have any problems with application
of license keys, please look in the le C:\Program Files\
Eset\RA\Server\nod32ra.log where you can nd the
exact reason for the failure.
RA server conguration
To congure RA server, connect RA console to it (for
example in the menu File / Edit Connections…) and then
select Tools/Server Options…
General Tab
Information on server part of RA Curent NOD32
ver. attribute is taken from NOD32 for Windows that
physically runs on the same machine as RA server. This
version is considered to be up-to-date and determines
the currentness of the stations (meaning that the older
versions dier from these ones in colors).
With Change password button it is possible to change
or set the password for RA server. From the version 1.0.11
the button Renew License is available. It gives the option
to change license key on RA server.
Database Maintenance Tab
Here you can set RA server behavior in connection
with database maintenance.
Following options will inuence how many (X) events
for each station should be saved in event log and scan log
tabs.The oldest ones will be deleted.
Only keep the latest X events for each client
Only keep the latest X scan logs for each client
Delete clients not connected for the last X months – the
workstations that has not been connected to RA server
for more than X months will be deleted from clients tab
(usually the ones that do not exist in LAN)
Following choices will inuence how the old events
should be deleted from the alert log, event log and scan