FARONICS DEEP FREEZE ENTERPRISE - TREND MICRO OFFICESCAN... User manual
















2
Introduction
e process of updating virus pattern files on workstations protected by Deep Freeze Enterprise
involves three fundamental steps:
1. Rebooting the workstations into a awed state so the updates are kept upon restart
2. Updating the virus pattern file
3. Shutting down or restarting the workstation into a Frozen state
is white paper provides technical information on how to approach these steps with Trend Micro
OfficeScan.
Deep Freeze is not marketed as an antivirus product. However, Deep Freeze will
protect workstations from any virus. Just restart the Frozen workstation and the virus
is gone. Many viruses require a fundamental change to be made to the core files and
only become active on restart. With Deep Freeze installed and activated, these viruses
will be deleted upon restart and therefore never become active.
Ensure the BIOS is set to boot directly to the C: drive and that the BIOS is protected
with a password; failure to do so can result in boot sector viruses being transferred to
the hard disk drives via infected floppy disks.
Setting the Workstations to a Thawed state
In order to make any permanent changes, the workstations protected by Deep Freeze have to be set
into a awed state. ose permanent changes include antivirus updates; therefore, the workstations
must be rebooted into a awed state before applying these updates.
ere are basically three ways to remotely set workstations into a awed state:
• By manually using the Deep Freeze Enterprise Console
• By setting up an Scheduled Maintenance Period
• By using the Command Line Control


3
Manually Using the Deep Freeze Enterprise Console
e Enterprise Console contains a toolbar at the top of the screen that allows quick access to the
functions of the Console.
To boot a workstation into the awed state, select the workstation and click the aw Workstation
icon on the toolbar.
Alternatively you can right-click and select the Set Computer(s) to aw option in the context menu.
Click OK in the confirmation window.
e selected workstations restart in the awed state.


4
Setting up a Scheduled Maintenance Period
ere are two ways to set up a Scheduled Maintenance Period. One is to set it up when configuring
the Deep Freeze Enterprise installation files with the Configuration Administrator (best method for
new deployments). e other way is to create or update the Maintenance Period using the Enterprise
Console. Assuming Deep Freeze is already deployed throughout your network, the following
instructions elaborate on how to create/update the Maintenance Period with the Enterprise Console.
1. Open the Enterprise Console, select any workstation, and right-click on it.
2. Select Update Maintenance. A red bar appears at the bottom of the screen.
3. Click New. e Configuration Screen appears. It only contains the Restart/Shutdown,
Maintenance, and Advanced Maintenance options.


5
4. Click the Maintenance tab and place a check in the Enable awed Maintenance Schedule
check box. Also, place a check beside each day you want the Maintenance Schedule to run.
5. Once the days are checked, set the Maintenance start time for each day in the Start Time
column, and the end time in the Stop Time column.
6. It is recommended that the Disable keys option is checked so the keyboard and mouse are
disabled while the workstations are in the awed state.
Also, it is important to check the Shutdown box so Deep Freeze shuts the workstations down
at the end of the Maintenance Period. Otherwise, the workstations are restarted aer the
maintenance Period is complete.
7. Close the Configuration Screen. A pop-up message appears requesting the administrator to
select the workstations to send the new configuration to.
8. Select the workstations to be updated and click Send.
is action updates all the selected workstations’ configuration on the fly. is means that the
workstations don’t have to be in the awed state for the configuration updates to take place.
Controlling Deep Freeze through the Command Line Control - DFC
e Deep Freeze Command Line Control (DFC) offers network administrators increased flexibility
in managing Deep Freeze workstations. DFC works in combination with third party enterprise
management tools and/or central management solutions. is combination allows administrators to
update workstations on the fly and on demand.
It is important to note that DFC is not a stand-alone application. DFC integrates seamlessly with any
solution that can run script files, including standard run-once login scripts.
e DFC executable is installed in the same directory as the Configuration Administrator:
C:\Program Files\Faronics\Deep Freeze Enterprise\Dfc.exe
DFC commands require a password with command line rights. One Time Passwords (OTPs) cannot
be used.
DFC Boot Control
Syntax Description
DFC password /BOOTTHAWED Restarts workstation into a awed state. Only works on Frozen
workstations.
DFC password /THAWNEXTBOOT
Sets up workstation to restart awed the next time it restarts.
Only works on Frozen workstations. Does not force workstation
to restart.
DFC password /BOOTFROZEN Restarts workstation into a Frozen state. Only works on awed
workstations.
DFC password /FREEZENEXTBOOT
Sets up workstation to restart Frozen the next time it restarts.
Only works on awed workstations. Does not force workstation
to restart.


6
DFC Status Query
Syntax Description
DFC get /ISFROZEN Queries workstation if it is Frozen. Returns 0 if awed.
Returns 1 if Frozen.
Configuration Update
Syntax Description
DFC password /CFG=[path] depfrz.rdx
Replaces Deep Freeze configuration information.
Works on awed or Frozen workstations.
Password changes are effective immediately.
Other changes require restart.
Example Batch File
Below is a sample batch file that can be modified for use with any antivirus soware that supports
updating through a command line.
@ECHO OFF
\\SERVER\SHARE\FOLDER\DFC.EXE get /isfrozen
IF ERRORLEVEL 1 GOTO FROZEN
IF ERRORLEVEL 0 GOTO THAWED
ECHO Errors where encountered running the command line control on this
workstation.
:FROZEN
\\SERVER\SHARE\FOLDER\DFC.EXE password /bootthawed
GOTO END
:THAWED
REM **********************************************************************
REM * Insert the command to update the antivirus software here. *
REM **********************************************************************
\\SERVER\SHARE\FOLDER\DFC.EXE password /freezenextboot
REM Send commands to reboot the system.
REM For Windows 95/98/ME
RUNDLL32 SHELL32.DLL,SHExitWindowsEx 2
REM For Windows 2000 (may need to be called 2x)
RUNDLL32 USER32.DLL,ExitWindowsEx 2
RUNDLL32 USER32.DLL,ExitWindowsEx 2
REM For Windows XP
SHUTDOWN -s -t 01
GOTO END
:END


7
Updating the Virus Definitions
is document provides six different ways to approach virus patterns updates for the Trend Micro
OfficeScan.
1) Do Nothing
e virus patterns keeps getting updated every time the workstations are restarted, but the changes are
lost upon reboots. On fast-switched networks, this has negligible impact on the boot-up time.
e workstations have the latest pattern at all times; the only down side of this method is that, with
time, the patterns will keep growing bigger. erefore, it is recommended to schedule a awed
Maintenance Period at least twice a year to make the updates permanent.
2) Manually update the New Virus Patterns
Using the Enterprise Console, set the workstations to reboot into the awed state. Once the computers
are back on, access the OfficeScan Management Console.
On the le menu, click Updates, select Client Deployment > Manual Deployment. Click Notify.
Follow the steps as prompted. e server and the workstations are updated with the latest virus
pattern.


8
3) Scheduling Virus Pattern Files Updates
1. Using the Deep Freeze Enterprise Console, schedule a Maintenance Period as per instructions
on p. 4-5.
2. Open the OfficeScan Management Console. On the le menu click Updates.
3. Select Client Deployment > Automatic Deployment.
Under the Deployment Schedule section check Enable scheduled deployment.
4. In our example, we set Deep Freeze Enterprise to have a maintenance window Monday
through Friday from 18:00 to 20:00. It is important to give the workstations enough time to
reboot into the awed state. Fieen minutes is sufficient.
5. Click the Daily radio button, set the starting time at 18:15, and leave the deployment period
in one hour. Click Save to update the settings.


9
4) Configure Deep Freeze Enterprise to Run a Batch File that Updates the Virus
Pattern File
1. Open the Deep Freeze Enterprise Console and follow the steps on p. 4 to set up a Scheduled
Maintenance Period.
2. Check the Run Bat radio button to allow the workstations to run a batch file automatically
during the Maintenance period.
3. Click the Advanced Maintenance tab and enter the following line in the Batch File window.
\\SERVER\OFCSCAN\AUTOPCC.EXE
is command triggers the update and the virus pattern file downloads from the server.
\\SERVER\OFCSCAN\AUTOPCC.EXE


10
5) Updating Virus Patterns via a Batch File in a Third-Party Desktop Management
Solution
Virus pattern files can be also updated running a batch file from a Desktop Management soware such
as Novell ZenWorks, Altiris, Microso SMS, BigFix, etc. You can add a task that runs the following
batch file.
@ECHO OFF
\\SERVER\SHARE\FOLDER\DFC.EXE get /isfrozen
IF ERRORLEVEL 1 GOTO FROZEN
IF ERRORLEVEL 0 GOTO THAWED
ECHO Errors where encountered running the command line control on this
workstation.
:FROZEN
\\SERVER\SHARE\FOLDER\DFC.EXE password /bootthawed
GOTO END
:THAWED
REM **********************************************************************
\\SERVER\OFCSCAN\AUTOPCC.EXE
REM **********************************************************************
\\SERVER\SHARE\FOLDER\DFC.EXE password /freezenextboot
REM Send commands to reboot the system.
REM For Windows 95/98/ME
RUNDLL32 SHELL32.DLL,SHExitWindowsEx 2
REM For Windows 2000 (may need to be called 2x)
RUNDLL32 USER32.DLL,ExitWindowsEx 2
RUNDLL32 USER32.DLL,ExitWindowsEx 2
REM For Windows XP
SHUTDOWN -s -t 01
GOTO END
:END