ESET REMOTE ADMINISTRATOR - ANNEXE 636 User manual
we protect your digital worlds
ESET
Remote
Administrator
Installation Manual
and User Guide
contents
Copyright © 2009 by ESET, spol. s r. o.
ESET Smart Security was developed by ESET, spol. s r.o.
For more information visit www.eset.com.
All rights reserved. No part of this documentation may be
reproduced, stored in a retrieval system or transmitted in any
form or by any means, electronic, mechanical, photocopying,
recording, scanning, or otherwise without permission in
writing from the author.
ESET, spol. s r.o. reserves the right to change any of the
described application software without prior notice.
Customer Care Worldwide: www.eset.eu/support
Customer Care North America: www.eset.com/support
REV.
1. Introduction ..........................................4
1.1 Program architecture .................................................... 4
.. ERA Server ERAS..................................................
.. ERA Console ERAC...............................................
2. Installation of ERA Server and ERA Console5
2.1 Requirements............................................................... 5
.. Hardware requirements .........................................
.. Ports used .............................................................
2.2 Basic Installation guide.................................................. 6
.. Environment overview network structure.............
.. Before installation .................................................
.. Installation............................................................
... Installation of ERA Server .......................................
... Installation of ERA Console ....................................
... How to enable and configure the Mirror..................
... Database types supported by ERA Server ................
.... Basic requirements ................................................
.... Database connection setup....................................
.... Installing over an existing database ........................
... Remote install to client workstations in the network
... Remote install on notebooks currently not present in
the network ........................................................
2.3 Scenario – Installation in an Enterprise environment .......10
.. Environment overview network structure...........
.. Installation..........................................................
... Installation at headquarters.................................
... Branch oce: Installation of ERA Server.................
... Branch oce: Installation of HTTP Mirror server .....
.. Other requirements for Enterprise environments....
3. Working with ERAC ............................ 13
3.1 Connecting to ERAS ................................................. 13
3.2 ERAC – main window.................................................... 13
3.3 Information filtering..................................................... 14
.. Groups .................................................................
.. Filter ....................................................................
.. Context menu.......................................................
3.4 Tabs in ERAC................................................................16
.. General description of tabs and clients ...................
.. Replication & information in individual tabs ...........
.. Clients tab............................................................
.. Threat Log tab .....................................................
.. Firewall Log Tab ....................................................
.. Event Log tab........................................................
.. Scan Log tab.........................................................
.. Tasks tab.............................................................
.. Reports tab .........................................................
.. Remote install tab ...............................................
3.5 ERA Console setup .......................................................22
.. Connection tab....................................................
.. Columns Show / Hide tab...................................
.. Colors tab............................................................
.. Paths tab.............................................................
.. Date / Time tab....................................................
.. Other settings tab................................................
3.6 Display modes .............................................................24
3.7 ESET Configuration Editor .............................................24
.. Configuration layering .........................................
.. Key configuration entries .....................................
4. Installation of ESET client solutions ....... 27
4.1 Direct installation ........................................................27
4.2 Remote installation ..................................................... 27
.. Requirements......................................................
.. Configuring the environment for remote installation
.. Remote Push Install .............................................
.. Logon /email remote install..................................
.. Custom remote install..........................................
ESET Remote Administrator
.. Avoiding repeated installations.............................
4.3 Installation in an Enterprise environment.......................36
5. Administering client computers............. 38
5.1 Tasks ..........................................................................38
.. Configuration Task...............................................
.. Ondemand Scan task..........................................
.. Update Now task.................................................
.. SysInspector Script Task .......................................
5.2 Groups ........................................................................39
5.3 Policies ...................................................................... 40
.. Basic principles and operation ..............................
.. How to create policies..........................................
.. Virtual policies......................................................
.. Policies and structure of ESET Configuration Editor
.. Viewing policies...................................................
.. Assigning policies to clients ..................................
... Default Primary Clients Policy...............................
... Manual assigning.................................................
... Policy Rules .........................................................
.. Deleting policies ..................................................
.. Special settings....................................................
.. Policy deployment scenarios.................................
... Each server is a standalone unit and policies are
defined locally .....................................................
... Each server is administered individually policies
are managed locally but the Default Parent Policy is
inherited from the upper server ............................
... Inheriting policies from an upper server.................
... Assigning policies only from the upper server.........
... Using policy rules.................................................
... Using local groups................................................
5.4 Notifications .............................................................. 49
.. Notification Manager...........................................
... Notifications via SNMP TRAP................................
.. Rule creation .......................................................
5.5 Detailed information from clients ................................. 55
6. Reports............................................... 56
7. ESET Remote Administrator Server (ERAS)
setup .................................................. 58
7.1 Security tab................................................................ 58
7.2 Server Maintenance tab............................................... 58
7.3 Mirror server .............................................................. 59
.. Operation of the Mirror server ..............................
.. Types of updates..................................................
.. How to enable and configure the Mirror................
.. Mirror for clients with NOD version .x...............
7.4 Replication tab ........................................................... 62
7.5 Logging tab ................................................................ 64
7.6 License management .................................................. 64
7.7 Advanced settings....................................................... 65
7.8 Other settings tab....................................................... 65
.. SMTP settings......................................................
.. Ports...................................................................
.. New clients .........................................................
.. ThreatSense. Net .................................................
8. ERA Maintenance Tool.......................... 67
8.1 ERA Server Information ................................................67
8.2 Task Type ....................................................................67
.. Stop ERA Server...................................................
.. Start ERA Server ..................................................
.. Database Transfer................................................
.. Database Backup.................................................
.. Database Restore ................................................
.. Delete Tables .......................................................
.. Install New License Key ........................................
.. Modify server configuration .................................
9. Troubleshooting...................................69
9.1 FAQ ........................................................................... 69
.. Problems installing ESET Remote Administrator to
Windows server / ..................................
.. What is the meaning of the GLE error code?...........
9.2 Frequently encountered error codes.............................. 69
.. Error messages displayed when using ESET Remote
Administrator to remotely install ESET Smart Security
or ESET NOD Antivirus ......................................
.. Frequently encountered error codes in era.log .......
9.3 How to diagnose problems with ERAS?...........................70
10. Hints & tips...........................................71
10.1 Scheduler .................................................................... 71
10.2 Removing existing profiles ............................................73
10.3 Export and other features of client XML configuration .....73
10.4 Combined update for notebooks.................................... 73
10.5 Installation of third‑party products using ERA.................75
1. Introduction
ESET Remote Administrator ERA is an application which allows you to manage ESET’s products in a networked
environment, including workstations and servers from one central location. With ESET Remote Administrator‘s
builtin task management system, you can install ESET security solutions on remote computers and quickly respond
to new problems and threats.
ESET Remote Administrator itself does not provide any other form of protection against malicious code. ERA
depends on the presence of an ESET security solution on workstations or servers, such as ESET NOD Antivirus or
ESET Smart Security.
To perform a complete deployment of an ESET security solutions portfolio, the following steps must be taken:
• InstallationofERAServer(ERAS),
• InstallationofERAConsole(ERAC),
• Installationofclientcomputers(ESETNOD32Antivirus,ESETSmartSecurity,LinuxESETSecurityclient,etc…).
NOTE: Some parts of this document use system variables which refer to an exact location of folders and files:
%ProgramFiles % = typically C:\Program Files
%ALLUSERSPROFILE % = typically C:\Documents and Settings\All Users
1.1 Program architecture
Technically, ESET Remote Administrator consists of two separate components: ERA Server ERAS and ERA Console
ERAC. You can run an unlimited number of ERA Servers and Consoles on your network as there are no limitations
in the license agreement for their use. The only limitation is the total number of clients your installation of ERA can
administer see section .., ”License keys”.
1.1.1 ERA Server (ERAS)
The server component of ERA runs as a service under the following Microsoft Windows® NTbased operating
systems: NT, , XP, , Vista and . The main task of this service is to collect information from clients and
to send them various requests. These requests, including configuration tasks, remote installation requests, etc., are
created through the ERA Console ERAC. ERAS is a meeting point between ERAC and client computers a place
where all information is processed, maintained or modified before being transferred to clients or to ERAC.
1.1.2 ERA Console (ERAC)
ERAC is the client component of ERA and is usually installed on a workstation. This workstation is used by the
administrator to remotely control ESET solutions on individual clients. Using ERAC, the administrator can connect
to the server component of ERA on TCP port . The communication is controlled by the process console.exe,
which is usually located in the following directory:
%ProgramFiles %\ESET\ESET Remote Administrator\Console
When installing ERAC, you may need to enter the name of an ERAS. Upon startup, the console will automatically
connect to this server. ERAC can also be configured after installation.
ERAC outputs graphical logs in HTML that are saved locally. All other information is sent from ERAS on TCP port
.
2. Installation of ERA Server
and ERA Console
2.1 Requirements
ERAS works as a service, and therefore requires a Microsoft Windows NTbased operating system NT, , XP,
, Vista or . The Microsoft Windows Server Edition is not necessary for ERAS to work. A computer with
ERAS installed on it should always be online and accessible via computer network by:
• Clients(usuallyworkstations)
• PCwithERAConsole
• OtherinstancesofERAS(ifreplicated)
2.1.1 Hardware requirements
The eect on system performance is minimal. However, it depends on the number of clients, the type of database
used by ERAS, on the logging level, etc. The minimum HW configuration for the deployment of ERAS is also the
minimum recommended configuration for the Microsoft Windows operating system used on the machine.
2.1.2 Ports used
The chart below lists the possible network communications used when ERAS is installed. The process EHttpSrv.
exe listens on TCP port and the process era.exe listens on TCP ports , , and . Other
communications occur using native operating system processes e.g., ”NetBIOS over TCP/IP”.
Protocol Port Description
TCP ERAS listening
Default port used by the
Mirror feature integrated in
ERAS HTTP version
TCP ERAS listening Communication between
clients and ERAS
TCP ERAS listening Communication between
ERAC and ERAS
If using all features of the program, the following network ports need to be open:
Protocol Port Description
TCP ERAS listening
Communication between the
agent einstaller.exe and ERAS
during remote install
TCP ERAS listening ERAS replication.
TCP target port from the
point of view of ERAS
Copying of the agent
einstaller.exe from ERAS
to a client using the share
admin
UDP target port from the
point of view of ERAS
“Name resolving” during
remote install.
UDP target port from the
point of view of ERAS
“Browsing” during remote
install
TCP target port from the
point of view of ERAS
Direct access to shared
resources using TCP/IP during
remote install an alternative
to TCP
The predefined ports , , , , and can be changed in the event that they are already in use by
other applications.
To change the default ports used by ERA, click Tools > Server Options…To change port , select the Updates
tab and change the HTTP server port value. Ports , , , and can be modified in the Ports section
on the Other settings tab.
The predefined ports , , and can also be modified during the advanced install mode ERAS.
2.2 Basic Installation guide
2.2.1 Environment overview (network structure)
A company network usually consists of one local area network LAN, therefore we suggest installing one ERAS and
one Mirror server. The Mirror server can either be created in ERAS or in ESET NOD Antivirus Business Edition /ESET
Smart Security Business Edition.
Suppose all clients are Microsoft Windows /XP/Vista workstations and notebooks, networked within a domain.
The server named GHOST is online / and can be a Windows workstation, Professional, or Server Edition it does
not have to be an Active Directory Server. In addition, suppose that notebooks are not present in the company’s
network during the installation of ESET client solutions. The network structure may resemble the one displayed
below:
Figure 2-1
2.2.2 Before installation
Before installing, the following installation packages should be downloaded from ESET’s website:
ESET Remote Administrator components:
ESET Remote Administrator – Server
ESET Remote Administrator – Console
ESET client solutions:
ESET Smart Security 4.0
ESET Smart Security 3.0
ESET NOD32 Antivirus 4.0
ESET NOD32 Antivirus 3.0
ESET NOD32 Antivirus 2.7
Only download the client solutions you will use on client workstations.
2.2.3 Installation
2.2.3.1 Installation of ERA Server
Install ERAS on the server named GHOST. You can select either Typical or Advanced installation mode.
If you select Typical mode, the program will prompt you to insert a license key a file with the extension .lic that
provides operation of ERAS for the period defined in the license. Next, the program will ask you to set update
parameters username, password and update server. However, you can proceed to the next step, and enter the
update parameters later.
If you select the Advanced installation mode, the installer will oer additional parameters to be set. These
parameters can be modified later via ERAC, but in most cases this is not necessary. The only exception is server
name, which should be equivalent to the DNS name, or %COMPUTERNAME % value of your operating system or
the IP address assigned to the computer. This is the most essential piece of information for performing remote
installation. If a name is not specified during installation, the installer will automatically supply the value of the
system variable %COMPUTERNAME %, which is sucient in most cases.
It is also important to select the correct database to which ERAS information will be stored. For more information,
please see section ...“Databases supported by ERA Server”.
By default, ERAS program components are installed in the following folder:
%ProgramFiles %\ESET\ESET Remote Administrator\Server
Other data components such as logs, install packages, configuration, etc. are stored in:
%ALLUSERSPROFILE %\Application Data \ESET\ESET Remote Administrator\Server
After installation, the ERAS service is launched automatically. The activity of the ERAS service is recorded in the
following location:
%ALLUSERSPROFILE %\Application Data\ESET\ESET Remote Administrator\Server\logs\era.log
2.2.3.2 Installation of ERA Console
Install the ESET Remote Administrator Console to the administrator’s PC/notebook as shown at the bottom left
of Figure −. At the end of the Advanced installation mode enter the name of the ERA Server or its IP address to
which ERAC will automatically connect at startup. It is labeled GHOST in our example.
After installation launch ERAC and check the connection to ERAS. By default, no password is required to connect
to an ERA Server the password text field is blank, but we strongly recommend that one be established. To create
a password to connect to an ERA Server:
Click File > Change Password… and then modify the Password for Console by clicking the Change... button.
The administrator can specify a password for Administrator Access and for ReadOnly Access which only allows
viewing of ERAS configuration.
2.2.3.3 How to enable and configure the Mirror
You can use the ERA Console to activate the LAN Update server the Mirror in the ERA Server. This server can then
be used as a source of update files for workstations located in the LAN. By activating the Mirror you will decrease
the volume of data transferred through your Internet connection.
Proceed as follows:
. Connect the ERA Console to the ERA Server by clicking File > Connect.
. From the ERA Console click Tools > Server Options… and click the Updates tab.
. From the Update server dropdown menu, select Choose Automatically, leave Update interval at minutes.
Insert Update username EAV*** and then click Set Password...and type or paste the password you received
with your username.
. Select the Create update mirror option. Leave the default path for mirrored files and HTTP server port .
Leave Authentication at NONE.
. Click the Other Settings tab and click Edit Advanced Settings… In the advanced setup tree, navigate to ERA
Server > Setup > Mirror > Create mirror for the selected program components. Click Edit on the righthand
side and select the program components to be downloaded. Components for all language versions that will be
used in the network should be selected.
. In the Updates tab, click Update now to create the Mirror.
For more detailed Mirror configuration options, please see section . , ”How to enable and configure the Mirror”.
2.2.3.4 Database types supported by ERA Server
By default, the program uses the Microsoft Access Jet Database engine. ERAS . also supports the following
databases:
• MicrosoftSQLServer
• MySQL
• Oracle
The database type can be selected during the Advanced installation mode of ERAS. After the installation it is not
possible to change the database version.
2.2.3.4.1 Basic requirements
First, it is necessary to create the database on a database server. The ERAS installer is capable of creating an empty
MySQLdatabase,whichisautomaticallynamedESETRADB.
By default, the installer automatically creates a new database. To create the database manually, select the option
Export Scripts. Make sure that the Create tables in the new database automatically option is deselected.
Collation Settings
Sorting will be realized employing the default settings of each single database, it is required to activate CASE
INSENSIVITY CI.
Followingly:
-forMSSQLandMySQLaCOLLATEmustbesetup,withtheCIactive
for ORACLE you set up a NLS_SORT, with the CI active
for MS Access this is not required as it is always CI
Character set
It is important to use the UNICODE character set preferred is UTF, especially in cases, where server administers
clients with specific locales and/or the ERA itself is working in a localized version. In case no replication of the
current server onto a server with a dierent locale is planned and all clients are of the same locale, the character set
of the locale of the ERA that the user wants to install can be used.
2.2.3.4.2 Database connection setup
After a new database is created, you must specify connection parameters for the database server using one of two
options:
. Using DSN data source name
To open DSN manually, open the OBCD
Date Source Administrator
Click Start –> Run – and type odbcad32.exe.
Example of a DSN connection:
DSN =ERASqlServer
. Directly, using a complete connection string
All required parameters must be specified driver, server and name of database.
ThisisanexampleofacompleteconnectionstringforMSSQLServer:
Driver ={SQL Server}; Server =hostname; Database =ESETRADB
Figure 2-2
This is an example of a complete connection string for Oracle Server:
Driver ={Oracle in instantclient10_1}; dbq =hostname:
1521/ESETRADB
ThisisanexampleofacompleteconnectionstringforMySQLServer:
Driver ={MySQL ODBC 3.51 Driver}; Server =hostname; Database =ESETRADB
Then set the Username and password for the connection the Set button).OracleandMSSQLServerdatabases
also require a Schema Name(forMSSQLServerthisisusuallythesameasusername).
Click Test Connection to verify the connection to the database server.
2.2.3.4.3 Installing over an existing database
If there are existing tables in the database, the installer will display a notification. To overwrite contents of an
existing table, select Overwrite Warning: this command deletes the contents of tables and also overwrites their
structure!. Select Ignore to leave tables untouched.
NOTE: Selecting Ignore may under certain conditions cause database inconsistency errors; especially when tables are damaged
or incompatible with the current version.
To cancel installation of ERAS and analyze the database manually, click Cancel.
2.2.3.5 Remote install to client workstations in the network
Supposing that all workstations are turned on, the push installation method is the most eective method. Before
starting a push install, you must first download the .msi install files for ESET Smart Security or ESET NOD
Antivirus from ESET’s website and create an installation package. You can create an XML configuration file that will
automatically be applied when the package runs.
More information about remote installation can be found in chapter .“Installation of ESET client solutions”.
2.2.3.6 Remote install on notebooks currently not present
in the network
Notebooks which are outside the local network require a dierent type of remote installation, since installation
must be performed after they logon to the domain. For these devices, the logon script method is suggested.
More information about logon script remote install can be found in chapter .“Installation of ESET client solutions”.
2.3 Scenario – Installation in an Enterprise environment
2.3.1 Environment overview (network structure)
Below is a copy of the previous network structure with one additional branch oce, several clients and one server
named LITTLE. Let’s suppose there is a slow VPN channel between the headquarters and the branch oce. In this
scenario, the Mirror server should be installed on the server LITTLE. We will also install a second ERA Server on
LITTLE in order to create a more userfriendly environment, and minimize the volume of transferred data.
Figure 2-3
2.3.3 Installation
2.3.3.1 Installation at headquarters
Installations of ERAS, ERAC and client workstations are very similar to the previous scenario. The only dierence is
in the configuration of the master ERAS GHOST. In Tools > Server Options… > Replication select the Enable
“from” replication check box and enter the name of the secondary server in Allowed servers. In our case, the
lower server is named LITTLE.
If there is a password for replication set on the upper server Tools > Server Options… > Security > Password for
replication, then that password must be used for authentication from the lower server.
Figure 2-4
2.3.3.2 Branch oce: Installation of ERA Server
As in the example directly above, install the second ERAS and ERAC. Again, enable and configure the replication
settings. This time select the Enable “to” replication check box Tools > Server Options… > Replication and
define the name of the master ERAS. We recommend using the IP address of the master server, which is the IP
address of the server GHOST.
Figure 2-5
2.3.3.3 Branch oce: Installation of HTTP Mirror server
The Mirror server installation configuration in the previous scenario can also be used in this case. The only changes
are in the sections defining the username and password.
As seen in Figure −, updates for the branch oce are not downloaded from ESET’s update servers, but from the
server at the headquarters GHOST. The update source is defined by the following URL address:
http://ghost: or http://IP_address_of_ghost:
By default, there is no need to specify a username or password, because the integrated HTTP server requires no
authentication.
For more information on configuring the Mirror in ERAS, see section .,“Mirror Server”.
2.3.3.4. Branch oce: Remote installation to clients
Once more, the previous model can be used, except that it is suitable to perform all operations with ERAC
connected directly to the ERAS of the branch oce LITTLE .
2.3.4 Other requirements for Enterprise environments
In larger networks, multiple ERA Servers can be installed to perform remote installs of client computers from servers
which are more accessible. For this purpose, ERAS oers “replication“ see sections ... and ..., which allows
stored information to be forwarded to a parent ERAS “upper server”. Replication can be configured using ERAC.
In order to avoid potential DNS translation problems when converting names to IP addresses between networks depending on the DNS
configuration.
This is done to prevent install packages from being transferred via the VPN channel, which is slower
The replication feature is very useful for companies with multiple branches or remote oces.The model deployment
scenario would be as follows: Install ERAS in each oce and have each replicate to a central ERAS. The advantage
of this configuration is especially apparent in private networks which are connected via VPN, which is usually
slower the administrator will only need to connect to a central ERAS the communication marked by the letter A in
the Figure .. There is no need to use VPN to access individual departments the communications B, C, D and E.
The slower communication channel is bypassed through the use of ERAS replication.
The replication setup allows an administrator to define which information will be transferred to upper servers
automatically at a preset interval, and which information will be sent upon request from the upper server
administrator. Replication makes ERA more userfriendly and also minimizes network trac.
Another advantage of replication is that multiple users can log in with various permission levels. The administrator
accessing the ERAS london.company.com with the console communication E can only control clients connecting
to london.company.com. The administrator accessing the central company.com A can control all clients located
at company headquarters and departments/branches.
Figure 2-6
3. Working with ERAC
3.1 Connecting to ERAS
Most features in ERAC are only available after connecting to ERAS. Define the server by name or IP address before
connecting:
Open the ERAC, and click File > Edit Connections… or Tools > Console Options… and click the Connection
tab.
Click the Add/Remove… button to add new ERA Servers or to modify currently listed servers. Pick the desired
server in the Select connection dropdown menu. Then, click the Connect button.
Other options in this window:
• Connect to selected server on the console startup
If this option is selected, the console will automatically connect to the selected ERAS on startup.
• Show message when connection fails
If there is a communication error between ERAC and ERAS, an alert is displayed.
Connections can be password protected. By default, no password is required to connect to an ERAS, but we strongly
recommend that one be established. To create a password to connect to an ERAS:
Click File > Change Password… and then click the Change… button to the right of Password for Console.
When entering a password, there is the option to Remember password. Please consider the possible security risk
of using this option. To delete all remembered passwords, click File > Clear Cached Passwords…
When communication is established, the program’s header will change to Connected [server_name].
Alternatively, you can click File > Connect to connect to ERAS.
On program startup, select the Access Type from the Access dropdown menu either Administrator
or Read-Only.
3.2 ERAC – main window
Figure 3-1 ESET Remote Administrator Console main window
The current communication status between ERAC and ERAS is displayed in the status bar . All necessary data
from ERAS is refreshed regularly Default is every minute. See Tools > Console Options…. The refresh progress can
also be seen in the status bar.
NOTE: Press F5 to refresh displayed data.
Information is divided into several tabs in order of importance . In most cases data can be sorted in ascending or
in descending order by clicking on an attribute , while a draganddrop operation can be used for reorganization.
If multiple data rows are to be processed, you can limit them by using the Items to show dropdown menu and
the browse page by page buttons. Select the View mode to display attributes according to your need For further
details, see section .,“Information filtering”.
The Server section is important if you replicate ERA Servers. This section displays summary information about
the Console to which ERAS is connected, as well as information about child or ”lower” ERA Servers. The Servers
dropdown menu in section will influence the scope of information displayed in section .
• Use All Servers
Displays information from all ERA Servers section .
• Use Only Selected Servers
Displays information from selected ERA Servers section .
• Exclude Selected Servers
Excludes information from selected ERA Servers.
Columns in Section :
• Server Name
Displays name of server.
• Clients
Total number of clients connecting to or in the database of the selected ERAS.
• Virus Signature DB Range
Version of virus signature databases among the clients of the selected ERAS.
• Least Recent Connection
The oldest version of virus signature database among the clients of the selected ERAS.
• Last Threat Alerts
Total number of virus alerts see the attribute Last Threat Alert in section .
• Last Firewall Alerts
The total number of firewall alerts.
• Last Event Warnings
Total number of current events see the attribute Last Event in section .
If you are not currently connected, you can rightclick in the Server section and select Connect to This Server to
connect to the chosen ERAS.
More information will be displayed in the Server section if replication is enabled.
The most important features of ERAC are accessible from the main menu or from the ERAC toolbar .
The last section is Computer filter criteria see section .,“Information filtering”.
3.3 Information filtering
ERAC oers several tools and features which provide userfriendly administration of clients and events.
3.3.1 Groups
Individual clients can be divided into groups by clicking Tools > Groups Editor… in the ERAC. Groups can later
be used when applying filters or creating tasks. Groups are independent for each ERAS and are not replicated.
The Synchronize with Active Directory feature in the Groups Editor allows the administrator to sort clients to
groups, as long as the client name equals the object type“computer“ at the side of Active Directory AD and belongs
to groups in the AD.
NOTE: In order for ERAS to synchronize with Active Directory, it is not required that ERAS be installed on your Domain
Controller. The Domain Controller must only be accessible from the computer where your ERAS is located. To configure
authentication to your Domain Controller, go to Tools > Server Options > Other Settings > Edit Advanced Options > ESET
Remote Administrator > ERA Server > Settings > Active directory. The format of the server name is LDAP://servername or
GC://servername. When empty, global catalog (GC) is used.
For more information on group management and synching with AD at the organizational unit level i.e., Support
Dept., Marketing Dept., etc., see section .,“Groups”.
3.3.2 Filter
Filter allows the administrator to display only information related to specific servers or client workstations. To show
the filter options, click View > Show/Hide Filter Pane from the ERAC menu.
To activate filtering, select the Use filter option in the upper left side of the ERAC and click the Apply Changes
button. Any future modifications to the filter criteria will automatically update displayed data, unless configured
otherwise in the Tools > Console Options… > Other Settings tab. In the Computer filter criteria section define
the filtering criteria Primary server, Client name, Computer name, MAC address.
In the Computer filter criteria section you can filter ERA Servers/clients, using the following criteria:
• Only clients (using whole words)
Output only includes clients with names identical to the string entered.
• Only clients beginning like (?,*)
Output will only list clients with names beginning with the specified string.
• Only clients like (?,*)
Output will list only clients with names containing the specified string.
• Exclude clients (using whole words), Exclude clients beginning like (?,*), Exclude clients like (?,*)
These options will yield opposite results to the previous three.
The Primary server, Client name, Computer name and MAC Address fields accept whole strings. If any of these are
populated, a database query will be run and results will be filtered based on the populated field; the logical operator
AND is used.
The next section allows filtering of clients by groups:
• Clients in Groups
Only displays clients belonging to the specified groups.
• Clients in other Groups or N/A
Output will only include clients belonging to other groups, or clients which are not a member of any group. If
a client belongs to both specified and nonspecified groups, it will be displayed.
• Clients in no Groups
Only displays clients which are not a part of any group.
The last option is problem based filtering outputs will only include clients with the specified type of problem.
To display the list of problems, select the Only show problems option and click Edit…Select the problems to be
displayed and click OK to show clients with the selected problems.
All changes made in the filtering setup will be applied after clicking the Apply Changes button.To restore defaults,
click Reset.To automatically generate new outputs at each modification of filter settings, select the Tools >
Console Options... > Other Settings... > Auto apply changes option.
3.3.3 Context menu
Use the right mouse button to invoke the context menu and adjust output in columns. Context menu options
include:
• Select All
Selects all entries.
• Select by ‘...’
This option allows you to rightclick on any attribute, and automatically select highlight all other workstations or
servers with the same attribute. The string ... is automatically replaced by the value of the current tab.
• Inverse Selection
Performs inverted selection of entries.
• Hide Selected
Hides selected entries.
• Hide Unselected
Hides all unselected entries in the list.
The last two options are eective if further organization is needed after using previous filtering methods. To disable
all filters set by the context menu, click View > Cropped View, or click the icon on the ERAC toolbar. You can
also press F5 to refresh displayed information and disable filters.
Example:
• Toonlydisplayclientswiththreatalerts:
In the Clients tab, rightclick on any empty pane with Last Virus Alert and choose Select by ‘…‘ from the context
menu. Then again from the context menu, click Hide Selected.
• Todisplaythreatalertsforclients”Joseph”and”Charles”:
Click the Threat Log tab and rightclick any attribute in the Client Name column with the value Joseph. From
the context menu click Select by ‘Joseph’. Then, press and hold the CTRL key, rightclick and click Select by
‘Charles’. Finally, rightclick and select Hide Unselected from the context menu and release the CTRL key.
The CTRL key can be used to select/deselect specific entries, and the SHIFT key can be used to mark/unmark a group
of entries.
NOTE: Filtering can also be used to facilitate the creation of new tasks for specific (highlighted) clients. There are many ways to
use filtering eectively, please experiment with various combinations.
Views
In the Clients tab, the number of columns displayed can be adjusted by using the View mode dropdown menu
on the far right side of the Console. The Full View Mode dispalys all columns, while the Minimal View Mode only
shows the most important columns. These modes are predefined and cannot be modified. To activate the Custom
View, select Custom View Mode. It can be configured in the Tools > Console Options… > Columns > Show/Hide
tab.
3.4 Tabs in ERAC
3.4.1 General description of tabs and clients
Most of the information on tabs is related to the connected clients. Each client connected to ERAS is identified by
the following attributes:
Computer Name client name + MAC Address + Primary Server
The behavior of ERAS related to certain network operations such as renaming a PC can be defined in ERAS
Advanced Setup. It can help prevent duplicate entries in the Clients tab. For example, if one of the computers in the
network has been renamed, but its MAC address remained unchanged, you can avoid creating a new entry in the
Clients tab.
Clients that connect to ERAS for the first time are designated by a Yes value in the New User column. They are
also marked by a small asterisk in the upper right corner of the client’s icon see Figure . This feature allows an
administrator to easily detect a newly connected computer. This attribute can have dierent meanings depending
on the administrator’s operating procedures.
Figure 3-2
If a client has been configured and moved to a certain group, the New status can be disabled by rightclicking on the
client and selecting Set/Reset Flags > Reset ”New“ Flag. The icon of the client will change to the one shown in
Figure , and the attribute New User will change to No.
3In previous versions of ERA, clients were identified by the following attributes: Computer Name + Primary Server
Figure 3-3
NOTE: The Comment attribute is optional in all three tabs.The administrator may insert any description here (e.g., ”Oce No. 129”).
Time values in ERAS can be displayed either in the relative mode “ days ago”, in the absolute mode . . or
in the system mode Regional settings.
In most cases data can be sorted in ascending or in descending order by clicking on an attribute, while
a draganddrop operation can be used for reorganization.
Clicking on certain values activates other tabs in order to display more detailed information. For example, if you click on
a value in the Last Threat Alert column, the program will move to the Threat Log tab and display Threat Log entries
related to the given client. If you click on a value which contains too much information to be displayed in a tabbed view,
a dialog window will open showing detailed information about the corresponding client.
3.4.2 Replication & information in individual tabs
If ERAC is connected to an ERAS which is operating as an upper server, all information from lower servers will be
displayed automatically, unless the lower server is not configured to allow this.
In such a scenario, the following information could be missing:
•Detailedalertlogs(Threat Log tab
•DetailedOn-demandscannerlogs(Scan Log tab
•Detailedcurrentclientcongurationsinthe.xmlformat(theClients tab, the Configuration column, Protection
Status, Protection Features, System Information
Information from the ESET SysInspector program may also be missing. ESET SysInspector is integrated with
generation .x ESET products and later.
In dialog windows where such information should otherwise be present, the Request button is available Actions
> Properties > Configuration. Clicking this button downloads missing information from a lower ERAS. Since
replication is always initiated by a lower ERAS, the missing information should be delivered within the preset
replication interval.
Figure 3-4 Click Request to retrieve missing information from lower ERA Servers.
3.4.3 Clients tab
This tab displays general information about individual clients.
Attribute Description
Computer Name Name of workstation / server hostname
MAC Address MAC address network adapter
Primary Server Name of ERAS with which a client is communicating
Domain Domain / group name, to which a client belongs these are not groups created in ERAS
IP IP address
Product Name Name of ESET security product
Product Version Version of ESET security product
Policy Name Name of policy assigned to a client
Last Connected Time that client last connected to ERAS All other data collected from clients includes this timestamp,
except for some data obtained by replication
Protection Status Text Current status of the ESET security product installed on a client
Virus Signature DB Version of virus signature database
Last Threat Alert Last virus incident
Last Firewall Alert Last event detected by the ESET Smart Security Personal firewall Events from the Warning level and higher
are shown
Last Event Warning Last error message
Last Files Scanned Number of scanned files during the last Ondemand scan
Last Files Infected Number of infected files during the last Ondemand scan
Last Files Cleaned Number of cleaned or deleted files during the last Ondemand scan
Last Scan Date Time of last Ondemand scan
Restart Request Is a restart required e.g., after a program upgrade
Restart Request Date Time of first restart request
Product Last Started Time that client program was last launched
Product Install Date Date that the ESET security product was installed on the client
Mobile User Clients with this attribute will perform the task ”update now” task each time they establish a connection
with the ERAS recommended for notebooks
New Client Newly connected computer see section ..,“General description of tabs and clients”
OS Name Name of client operating system
Attribute Description
OS Platform Operatingsystemplatform(Windows/Linux…)
HW Platform bit / bit
Configuration Client’s current.xml configuration including date/time that the configuration was created
Protection Status General status statement Similar in nature to the Configuration attribute
Protection Features General status statement for program components Similar to Configuration attribute
System Information Client submits system information to ERAS including time that the system information was submitted
SysInspector Clients with versions containing the ESET SysInspector tool can submit logs from this complementary
application.
Custom Info Custom Information to be displayed specified by the administrator.
Comment A short comment describing the client entered by the administrator
NOTE: Some values are for informational purposes only and may not be current when the administrator views them at the
Console. For example, at 7:00 A. M. there may have been an update error, but at 8:00 A. M. it was performed successfully. These
values may include Last Threat Alert and Last Event Warning. If the administrator knows this information is obsolete,
it can be cleared by right-clicking and selecting Clear Info > Clear “Last Threat Alert” Info or Clear “Last Event
Warning” Info. Information about the last virus incident or last system event will be deleted.
Figure 3-5 Obsolete events from the Last Threat Alert and Last Event Warning columns can easily be removed.
Figure 3-6 Detailed information about a client workstation.
The Clients tab oers several options after doubleclicking on a client:
• General
Contains similar information to that displayed in the Clients tab. Here you can specify the Client Name the
name under which this client is visible in ERA, plus an optional comment.
• Member Of Groups
This tab lists all groups to which the client belongs. For more information, see section . ”Information filtering”.
• Tasks
Tasks related to the given client. For more information see section ., ”Tasks“.
• Configuration
This tab allows you to view or export the current client configuration to an.xml file. Later in this manual, we will
explain how.xml files can be used to create a configuration template for new/modified.xml configuration files.
For more information see section ., ”Tasks“.
• Protection Status
General status statement regarding all ESET programs. Some of the statements are interactive and it is possible
to intervene immediately. This functionality is useful in that it prevents the need to manually define a new task to
solve a given protection problem.
• Protection Features
Component status for all ESET security features Antispam, Personal firewall, etc.
• System Information
Detailed information about the installed program, its program component version, etc.
• SysInspector tab
Detailed information about startup processes and processes running in the background.
3.4.4 Threat Log tab
This tab contains detailed information about individual virus or threat incidents.
Attribute Description
Client Name Name of client reporting the threat alert
Computer Name Workstation/server name hostname
MAC Address MAC address network adapter
Primary Server Name of ERAS with which a client is communicating
Date Received Time at which the event was logged by ERAS
Date Occurred Time at which the event occurred
Level Alert level
Scanner Name of security feature which detected the threat
Object Object type
Name Usually a folder where the infiltration is located
Threat Name of the detected malicious code
Action Action taken by the given security feature
User Name of the user that was identified when the incident occurred
Information Information about the detected threat
Details Client log submission status
This manual suits for next models
1
Table of contents
Other ESET Software manuals
ESET
ESET NOD32 ANTIVIRUS - FOR KERIO User manual
ESET
ESET NOD32 ANTIVIRUS - FOR MICROSOFT WINDOWS... User manual
ESET
ESET NOD32 ANTIVIRUS - FOR NOVELL NETWARE SERVER User manual
ESET
ESET MAIL SECURITY 4 - V4.2 FOR MICROSOFT EXCHANGE... User manual
ESET
ESET NOD32 ANTIVIRUS 4 - FOR MICROSOFT WINDOWS... User manual
ESET
ESET NOD32 ANTIVIRUS - FOR KERIO User manual
ESET
ESET MOBILE SECURITY User manual
ESET
ESET NOD32 ANTIVIRUS - FOR KERIO User manual
ESET
ESET NOD32 ANTIVIRUS - FOR KERIO User manual
ESET
ESET REMOTE ADMINISTRATOR 3 User manual
ESET
ESET SMART SECURITY User manual
ESET
ESET GATEWAY SECURITY User manual
ESET
ESET MOBILE SECURITY - FOR SYMBIAN User manual
ESET
ESET NOD32 V 2.7 - User manual
ESET
ESET REMOTE ADMINISTRATOR User manual
ESET
ESET NOD32 ANTIVIRUS - FOR KERIO User manual
ESET
ESET GATEWAY SECURITY - FOR LINUX BSD AND SOLARIS User manual
ESET
ESET MAIL SECURITY - FOR LINUX BSD AND SOLARIS User manual
ESET
ESET NOD32 ANTIVIRUS - FOR MICROSOFT WINDOWS... User manual
ESET
ESET MOBILE SECURITY - FOR SYMBIAN User manual
Popular Software manuals by other brands
ScanSoft
ScanSoft SCANSOFT PAPERPORT 3.6 manual
Texas Instruments
Texas Instruments TI-83 Plus Silver Edition Guide book
Canon
Canon CanoScan D646U user guide
Novell
Novell IDENTITY MANAGER 3.6.1 - UNDERSTANDING POLICIES... reference guide
Novell
Novell IMANAGER 2.7.3 Administration guide
Imaginova
Imaginova Starry Night Pro 5.0 User's Guide manual