GFI EndPointSecurity, Add, 100-249u, 1Y, ENG Manuel Page 1

GFIProduct ManualAdministrator Guide

List of TablesTable 1: Terms and conventions used in this manual 11Table 2: GFI EndPointSecurityfeatures 13Table 3: Deployment and Monitoring protecti

GFI EndPointSecurity 7 Discovering Devices | 1007 Discovering DevicesGFI EndPointSecurity enables you to transparently and rapidly query organizationa

GFI EndPointSecurity 7 Discovering Devices | 1011. Click Scanning tab.2. From Common tasks, click Options.3. From the Options dialog, select Logon Cre

GFI EndPointSecurity 7 Discovering Devices | 102Screenshot 75: Running a device scan - Scan device categories tab5. Click Scan Device Categories tab a

GFI EndPointSecurity 7 Discovering Devices | 103Screenshot 76: Running a device scan - Scan ports tab6. Click Scan Ports tab and select the connection

GFI EndPointSecurity 7 Discovering Devices | 1047.2.1 ComputersScreenshot 77: Computers areaThis section displays device scan summary results for ever

GFI EndPointSecurity 7 Discovering Devices | 105lists the devices currently connected to the target computers for the blacklist and whitelist. Forinfo

GFI EndPointSecurity 8 Monitoring Device Usage Activity | 1068 Monitoring Device Usage ActivityThis chapter provides you with information about monito

GFI EndPointSecurity 8 Monitoring Device Usage Activity | 107Protection StatusDevice Usage by Device TypeDevice Usage by Connectivity Port8.1.1 Protec

GFI EndPointSecurity 8 Monitoring Device Usage Activity | 1088.1.3 Device Usage by Connectivity PortScreenshot 83: Device Usage by Connectivity Port a

GFI EndPointSecurity 8 Monitoring Device Usage Activity | 109Screenshot 84: Activity Log sub-tabTo access the Activity Log sub-tab, from GFI EndPointS

GFI EndPointSecurity 1 Introduction | 111 IntroductionThe proliferation of consumer devices such as iPods, USB devices and smartphones has increased t

GFI EndPointSecurity 8 Monitoring Device Usage Activity | 110Screenshot 85: Activity Log sub-tab - Advanced filteringTo access advanced filtering opti

GFI EndPointSecurity 8 Monitoring Device Usage Activity | 111Screenshot 86: Logs Browser sub-tabTo access the Logs Browser sub-tab, from GFI EndPointS

GFI EndPointSecurity 8 Monitoring Device Usage Activity | 112Screenshot 87: Query Builder options4. In the Query Builder dialog, specify a name and a

GFI EndPointSecurity 9 Status Monitoring | 1139 Status MonitoringThis chapter provides with information related to monitoring the status of GFI EndPoi

GFI EndPointSecurity 9 Status Monitoring | 114Screenshot 88: Risk Assessment sub-tabTo access the Risk Assessment sub-tab, from GFI EndPointSecurity m

GFI EndPointSecurity 9 Status Monitoring | 115Feature DescriptionThis section lists the cumulative values of the number of:Scanned endpointsSuccessful

GFI EndPointSecurity 9 Status Monitoring | 116Screenshot 89: Statistics sub-tabTo access the Statistics sub-tab, from GFI EndPointSecurity management

GFI EndPointSecurity 9 Status Monitoring | 117This section graphically represents daily device usage on computers, differentiating between devicesthat

GFI EndPointSecurity 9 Status Monitoring | 118Screenshot 93: Status sub-tabFeature DescriptionThis section lists:The operational status of GFI EndPoin

GFI EndPointSecurity 9 Status Monitoring | 119Feature DescriptionThis section graphically represents all agents deployed on network computers, differe

GFI EndPointSecurity 1 Introduction | 12Better storage capacityImproved performanceEasier and faster to installPhysically small enough to carry in a p

GFI EndPointSecurity 9 Status Monitoring | 1209.4.1 About Deployment status viewScreenshot 94: Deployment sub-tabUse the Deployment sub-tab to view:Cu

GFI EndPointSecurity 9 Status Monitoring | 1219.4.2 Current DeploymentsScreenshot 95: Current Deployments areaThis section displays a list of deployme

GFI EndPointSecurity 9 Status Monitoring | 1229.4.5 Deployment HistoryScreenshot 98: Deployment History areaThis section displays an audit trail for a

GFI EndPointSecurity 10 Reporting | 12310 ReportingThe GFI EndPointSecurity GFI ReportPack is a fully-fledged reporting add-on to GFI EndPointSecurity

GFI EndPointSecurity 10 Reporting | 124Screenshot 99: Digest Report options - General tab3. From the General tab of the Digest Report dialog, select/u

GFI EndPointSecurity 10 Reporting | 125Screenshot 100: Digest Report options - Details tab5. Click Details tab to select/unselect report content items

GFI EndPointSecurity 11 Managing the Database Backend | 12611 Managing the Database BackendThis chapter provides you information related to managing a

GFI EndPointSecurity 11 Managing the Database Backend | 127Screenshot 101: Maintenance options4. From the Maintenance dialog, configure how often even

GFI EndPointSecurity 11 Managing the Database Backend | 12811.2 Using an existing SQL Server instanceTo connect to an existing SQLServer instance:1.

GFI EndPointSecurity 12 Alerting Options | 12912 Alerting OptionsThis chapter provides you with information about configuring the GFI EndPointSecurity

GFI EndPointSecurity 1 Introduction | 13GFI EndPointSecurity Management Console Management ConsoleGFI EndPointSecurity Agent.1.3.1 GFI EndPointSecurit

GFI EndPointSecurity 12 Alerting Options | 1303. From Email tab , click Add..., to specify your mail server settings. Click OK to close the Mail-serve

GFI EndPointSecurity 12 Alerting Options | 131Screenshot 105: Alerting Options - SMS tab6. Click SMS tab and from the Select SMS drop-down menu, selec

GFI EndPointSecurity 12 Alerting Options | 1321. Click Configuration tab > Options sub-tab.2. From Configure, click Alerting Options > Users sub

GFI EndPointSecurity 12 Alerting Options | 133Screenshot 107: EndPointSecurityAdministrator Properties options - Working Hours tab5. Click Working Hou

GFI EndPointSecurity 12 Alerting Options | 134Screenshot 108: EndPointSecurityAdministrator Properties options - Alerts tab6. Click Alerts tab and sel

GFI EndPointSecurity 12 Alerting Options | 1357. Click Member Of tab and click Add to add the user to notification group(s).8. Click Apply and OK.12.3

GFI EndPointSecurity 12 Alerting Options | 136Deleting groups of alert recipients12.4.1 Creating groups of alert recipientsTo create a new group of al

GFI EndPointSecurity 12 Alerting Options | 1371. Click Configuration tab > Options sub-tab.2. Click Alerting Options > Groups sub-node.3. From t

GFI EndPointSecurity 13 Configuring GFI EndPointSecurity | 13813 Configuring GFI EndPointSecurityGFI EndPointSecurity enables you to configure the com

GFI EndPointSecurity 13 Configuring GFI EndPointSecurity | 1393. From the Communication tab, key in the required TCP/IP port number to be used for com

GFI EndPointSecurity 1 Introduction | 14GFI EndPointSecurity featuresPower users The administrator can specify users or groups who would always have f

GFI EndPointSecurity 13 Configuring GFI EndPointSecurity | 140Screenshot 113: Advanced Options - Agent Security tab5. Click Agent Security tab and sel

GFI EndPointSecurity 13 Configuring GFI EndPointSecurity | 141Screenshot 114: Custom Messages dialog options3. Select/unselect the message types you w

GFI EndPointSecurity 13 Configuring GFI EndPointSecurity | 142Screenshot 115: General tab - Updates3. From the right pane, configure the options descr

GFI EndPointSecurity 14 Miscellaneous | 14314 MiscellaneousThe miscellaneous chapter gathers all the other information that falls outside the initial

GFI EndPointSecurity 14 Miscellaneous | 144Screenshot 117: Computers sub-tab - delete computer(s)3. From the right pane, right-click target computer t

GFI EndPointSecurity 14 Miscellaneous | 145Screenshot 118: Deployment sub-tab6. From the Deployment History area, confirm the successful completion of

GFI EndPointSecurity 14 Miscellaneous | 146Screenshot 119: Uninstallation information messageNoteIf any agents are still installed, an information dia

GFI EndPointSecurity 15 Troubleshooting and Support | 14715 Troubleshooting and SupportThis chapter explains how to resolve any issues encountered dur

GFI EndPointSecurity 15 Troubleshooting and Support | 148Issue Possible Cause Possible SolutionInstallationfailed.Installation of the GFI End-PointSec

GFI EndPointSecurity 15 Troubleshooting and Support | 149Web ForumUser to user technical support is available via the GFI web forum. Access the web fo

GFI EndPointSecurity 1 Introduction | 15Figure 1: Protection policy - Deployment and MonitoringThe table below describes the stages depicted above:Sta

GFI EndPointSecurity 16 Glossary | 15016 GlossaryAAccess permissionsA set of permissions (access, read and write) that are assigned to users and group

GFI EndPointSecurity 16 Glossary | 151DDatabase backendA database used by GFI EndPointSecurity to keep an audit trail of all events generated by GFIEn

GFI EndPointSecurity 16 Glossary | 152GFI EndPointSecurity applicationA server-side security application that aids in maintaining data integrity by pr

GFI EndPointSecurity 16 Glossary | 153Protection policyA set of device access and connectivity port permissions that can be configured to suit yourcom

17 IndexAaccess permissions 30, 33, 35, 49, 60, 63, 65, 68Active Directory 12, 14, 34, 36, 50, 54, 59-60, 63, 65,68, 70, 81, 96, 123, 131, 135alert re

Troubleshooter wizard 148Troubleshooting 147Uuser messages 35, 138, 140Vversions 11WWeb Forum 149wizardCreate Protection Policy wizardQuick Start wiza

USA, CANADA AND CENTRAL AND SOUTH AMERICA15300 Weston Parkway, Suite 104 Cary, NC 27513, USATelephone: +1 (888) 243-4329Fax: +1 (919) 379-3402ussales@

GFI EndPointSecurity 1 Introduction | 16Stage DescriptionStage 3 -Deploy pro-tection pol-icyThe administrator deploys the protection policy. Upon the

GFI EndPointSecurity 1 Introduction | 17Stage DescriptionStage 1 - Deviceattached to com-puterThe user attaches a device to a target computer protecte

GFI EndPointSecurity 1 Introduction | 181.8 Supported device categoriesIn GFI EndPointSecurity devices are organized into the following categories:Flo

GFI EndPointSecurity 1 Introduction | 19Zip drivesTape drivesMO (magneto optical) drives (internal and external).1.9 Supported connectivity portsGFI E

The information and content in this document is provided for informational purposes only and isprovided "as is" with no warranty of any kind

GFI EndPointSecurity 1 Introduction | 20Screenshot 1: Navigating GFI EndPointSecurity user interfaceGFI EndPointSecurity Management Console consists o

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 212 Installing GFI EndPointSecurityThis chapter provides you with information about preparing

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 22Agent - Hardware requirementsProcessor: 1GHz processor clock speed or betterRAM: 256 MB (mi

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 23Security settingsOptions:Logging optionsDatabase options.Upgrading from GFI LanGuard Portab

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 24Screenshot 2: GFI EndPointSecurity installation: domain administrator account setup5. Key i

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 25NoteThe license key can be keyed in after installation or expiration of the evaluation peri

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 26Tab DescriptionScanArea Select the target area on which GFI EndPointSecurity scans the com

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 2712. From Users Groups, select/unselect Configure Users Groups to create domain/workgroup us

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 28Screenshot 4: Navigating GFI EndPointSecurity user interfaceGFI EndPointSecurity Management

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 292.6 Testing your installationOnce GFI EndPointSecurity is installed and the Quick Start wiz

Contents1 Introduction 111.0.1 Terms and conventions used in this guide 111.1 Portable media device threats 111.2 About GFI EndPointSecurity 121.3 Com

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 30NoteIf the deployment of the agent on to the local computer is not up-to-date, thenmanually

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 31Screenshot 5: Selecting control entities8. In the Add permissions… dialog select the Device

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 32Screenshot 7: Adding users or groups10. Click Add… and specify the user with no administrat

GFI EndPointSecurity 2 Installing GFI EndPointSecurity | 33To deploy the protection policy updates on to the local computer:1. From the right pane, cl

GFI EndPointSecurity 3 Achieving Results | 343 Achieving ResultsThis chapter provides you with step by step instructions about how to block unauthoriz

GFI EndPointSecurity 3 Achieving Results | 353. Configure protection policy settingsConfigure the protection policy to block removable storage devices

GFI EndPointSecurity 3 Achieving Results | 361. Automatically discover devices on the networkGFI EndPointSecurity enables you to automatically add new

GFI EndPointSecurity 3 Achieving Results | 373.3 Monitoring network activity from a central locationAgents generate activity logs that are stored in a

GFI EndPointSecurity 4 Adding Target Computers | 384 Adding Target ComputersGFI EndPointSecurity enables you to specify the computers you intend to de

GFI EndPointSecurity 4 Adding Target Computers | 39Option DescriptionClick From Domain…. Specify the required computer(s) from within the domain/workg

6 Customizing Protection Policies 576.1 Configuring controlled device categories 576.2 Configuring controlled connectivity ports 586.3 Configuring pow

GFI EndPointSecurity 4 Adding Target Computers | 40Screenshot 10: Auto Discovery options - Auto Discovery tab3. Click Start discovery now to run auto

GFI EndPointSecurity 4 Adding Target Computers | 41Screenshot 11: Auto Discovery options - Discovery Area tab6. Click Discovery Area tab and select th

GFI EndPointSecurity 4 Adding Target Computers | 42Screenshot 12: Auto Discovery options - Actions tab7. Click Actions tab and from the Use as default

GFI EndPointSecurity 4 Adding Target Computers | 431. Click Configuration tab > Computers.2. Right-click on a computer from the list and click Set

GFI EndPointSecurity 4 Adding Target Computers | 44NoteBy default, GFI EndPointSecurity is configured to use the logon credentials of thecurrently log

GFI EndPointSecurity 5 Managing Protection Policies | 455 Managing Protection PoliciesThis chapter describes how to deploy newly created protection po

GFI EndPointSecurity 5 Managing Protection Policies | 463. Key in a unique name for the new protection policy.4. Select whether you want to create a b

GFI EndPointSecurity 5 Managing Protection Policies | 47Screenshot 16: Controlled Device Categories options6. From the Controlled Device Categories di

GFI EndPointSecurity 5 Managing Protection Policies | 48Screenshot 17: Controlled connectivity ports options8. From the Controlled connectivity ports

GFI EndPointSecurity 5 Managing Protection Policies | 49Screenshot 18: Creating a new policy - Global Permissions settings10. From the Global Permissi

9.2.1 Protection Status 1169.2.2 Device Usage by Device Type 1179.2.3 Device Usage by Connectivity Port 1179.3 Status view 1179.4 Deployment status vi

GFI EndPointSecurity 5 Managing Protection Policies | 50NoteIn addition, GFI EndPointSecurity can also allow or block Active Directory (AD) usersand/o

GFI EndPointSecurity 5 Managing Protection Policies | 51Tab DescriptionContentAwarenessGFI EndPointSecurity enables you to specify the file content re

GFI EndPointSecurity 5 Managing Protection Policies | 524. From the left pane, click the Assign Protection Policyhyperlink in the Actions section.Scre

GFI EndPointSecurity 5 Managing Protection Policies | 53Screenshot 20: Deploying a policy immediately - Deployment sub-tab5.2.2 Scheduled policy deplo

GFI EndPointSecurity 5 Managing Protection Policies | 54Screenshot 21: Schedule deployment options4. From Schedule deployment dialog select the deploy

GFI EndPointSecurity 5 Managing Protection Policies | 55Deployment history areaAgents' status area5.3.1 Deployment HistoryUse the information dis

GFI EndPointSecurity 5 Managing Protection Policies | 56NoteIf a target computer is offline, the deployment of the relevant policy is rescheduled fora

GFI EndPointSecurity 6 Customizing Protection Policies | 576 Customizing Protection PoliciesThis chapter provides you with information related to modi

GFI EndPointSecurity 6 Customizing Protection Policies | 581. Click Configuration tab > Protection Policies.2. From Protection Policies > Securi

GFI EndPointSecurity 6 Customizing Protection Policies | 59NoteUnspecified ports will be fully accessible from the target computers covered by theprot

List of FiguresScreenshot 1: Navigating GFI EndPointSecurity user interface 20Screenshot 2: GFI EndPointSecurity installation: domain administrator ac

GFI EndPointSecurity 6 Customizing Protection Policies | 60covered by a protection policy. You can define sets of power users on a policy-by-policy ba

GFI EndPointSecurity 6 Customizing Protection Policies | 61When a device category is not set to be controlled by the particular security policy, the r

GFI EndPointSecurity 6 Customizing Protection Policies | 62Screenshot 28: Add permissions options - Device categories5. Enable or disable the required

GFI EndPointSecurity 6 Customizing Protection Policies | 636. Click Add… to specify the user(s)/group(s) that will have access to the device categorie

GFI EndPointSecurity 6 Customizing Protection Policies | 64Screenshot 31: Add permissions options - Control entities5. In the Add permissions dialog s

GFI EndPointSecurity 6 Customizing Protection Policies | 657. Click Add… to specify the user(s)/group(s) that will have access to the connectivity por

GFI EndPointSecurity 6 Customizing Protection Policies | 661. Click Configuration tab > Protection Policies.2. From Protection Policies > Securi

GFI EndPointSecurity 6 Customizing Protection Policies | 67Screenshot 35: Add permissions options - Specific devices6. Enable or disable the required

GFI EndPointSecurity 6 Customizing Protection Policies | 687. Click Add… to specify the user(s)/group(s) that will have access to the specific devices

GFI EndPointSecurity 6 Customizing Protection Policies | 69Screenshot 38: Protection Policies sub-tab - devices viewScreenshot 39: Protection Policies

Screenshot 39: Protection Policies sub-tab - users view 69Screenshot 40: Protection Policies sub-tab - Security area 70Screenshot 41: Black list optio

GFI EndPointSecurity 6 Customizing Protection Policies | 704. From the left pane, click Switch to devices view or Switch to users view in the Common t

GFI EndPointSecurity 6 Customizing Protection Policies | 71For an updated list of devices currently connected to the target computers, run a device sc

GFI EndPointSecurity 6 Customizing Protection Policies | 72Screenshot 42: Select Devices options5. In the Select Devices dialog enable or disable the

GFI EndPointSecurity 6 Customizing Protection Policies | 73Screenshot 43: Select Devices options - Select device serials6. Select the required serials

GFI EndPointSecurity 6 Customizing Protection Policies | 74Screenshot 44: Select Devices options - Edit Device serialsTo deploy protection policy upda

GFI EndPointSecurity 6 Customizing Protection Policies | 75Screenshot 45: White list options4. In the Whitelist dialog, click Add… to select devices t

GFI EndPointSecurity 6 Customizing Protection Policies | 765. In the Select Devices dialog enable or disable the devices to add to the whitelist from

GFI EndPointSecurity 6 Customizing Protection Policies | 77Screenshot 48: Select Devices options - Edit Device serialsTo deploy protection policy upda

GFI EndPointSecurity 6 Customizing Protection Policies | 78Screenshot 49: Devices Temporary Access icon1. From the Control Panel click Devices Tempora

GFI EndPointSecurity 6 Customizing Protection Policies | 796.11.2 Granting temporary access to a protected computerTo grant temporary access:1. From G

Screenshot 79: Devices list area - Add device to devices database 105Screenshot 80: Statistics sub-tab 106Screenshot 81: Protection Status area 107Scr

GFI EndPointSecurity 6 Customizing Protection Policies | 80Screenshot 52: Grant temporary access options - Device categories and connection ports5. En

GFI EndPointSecurity 6 Customizing Protection Policies | 817. Take note of the Unlock code generated. Communicate the code to the user requesting tem-

GFI EndPointSecurity 6 Customizing Protection Policies | 82Screenshot 54: File-type Filter options4. In the File-type Filter dialog select the restric

GFI EndPointSecurity 6 Customizing Protection Policies | 83Screenshot 55: File-type Filter and user options5. Click Add… and select or key in the file

GFI EndPointSecurity 6 Customizing Protection Policies | 841. From GFI EndPointSecurity management console, click Configuration tab > Protection Po

GFI EndPointSecurity 6 Customizing Protection Policies | 85Screenshot 57: Add a new template5. Click Add… and select or key in the template from the T

GFI EndPointSecurity 6 Customizing Protection Policies | 86Screenshot 59: Managing templates6.14 Configuring file optionsGFI EndPointSecurity enables

GFI EndPointSecurity 6 Customizing Protection Policies | 87Screenshot 60: File options4. In the File options dialog select from the following options:

GFI EndPointSecurity 6 Customizing Protection Policies | 88..Screenshot 61: File-type Filter and user options5. From the Archive Options tab, enable /

GFI EndPointSecurity 6 Customizing Protection Policies | 89Screenshot 62: Encryption options - General tab4. Select Enable detection of encrypted devi

Screenshot 119: Uninstallation information message 146Screenshot 120: Specifying contact and purchase details 148Screenshot 121: Specifying issue deta

GFI EndPointSecurity 6 Customizing Protection Policies | 905. Click Add… to specify the users and groups with access to encrypted devices.Screenshot 6

GFI EndPointSecurity 6 Customizing Protection Policies | 911. From GFI EndPointSecurity management console, click Configuration tab > Protection Po

GFI EndPointSecurity 6 Customizing Protection Policies | 92Screenshot 66: Encryption options -Security tab5. From the Security tab, configure the feat

GFI EndPointSecurity 6 Customizing Protection Policies | 93Screenshot 67: Encryption options - Users tab6. Select Users tab and configure the followin

GFI EndPointSecurity 6 Customizing Protection Policies | 94Screenshot 68: Encryption options - Traveler tabNoteTraveler is an application that can be

GFI EndPointSecurity 6 Customizing Protection Policies | 951. Click Configuration tab > Protection Policies.2. From Protection Policies > Securi

GFI EndPointSecurity 6 Customizing Protection Policies | 96Screenshot 70: Logging Options - Filter tab6. Select Filter tab, and select any of the foll

GFI EndPointSecurity 6 Customizing Protection Policies | 97Screenshot 71: Alerting Options - General tab4. In the Alerting Options dialog, click Gener

GFI EndPointSecurity 6 Customizing Protection Policies | 98Screenshot 72: Alerting Options - Configuring users and groups5. For each alert type enable

GFI EndPointSecurity 6 Customizing Protection Policies | 99Screenshot 73: Alerting Options - Filter tab6. Select Filter tab, select any of the followi