Before we begin installing Forefront Client Security (FCS), we need to know exactly what we will be installing. We must understand the roles that are required in a successful FCS deployment and what the hardware and software requirements are. FCS isn’t just client software; as we mentioned earlier it provides simple administration through central management. Hence a server or servers, depending on your environment, is required.

An FCS server consists of four roles, each which can reside on a single physical box or on separate systems depending on your environment and requirements. Those roles are management server, collection server, reporting server, and distribution server. An explanation of each role is shown later in this chapter. During installation FCS installs its own Microsoft Operations Manager (MOM) server, which it leverages for client alerts and event management.

FCS can be implemented in numerous topologies. It can hold all roles on a single system or expand out to six servers depending on the environment. Most small- to medium-sized companies will implement one to three servers, with three servers supporting up to 5000 users. Figures 2.1, 2.2, and 2.3 shows what a one-, two-, and three-server implementation looks like. Larger installations can include four, five, or six servers and can manage well over 10,000 managed systems. Table 2.2 lists the hardware and software requirements for an FCS implementation as provided by Microsoft.

Figure 2.1. Single-Server Topology

Figure 2.2. Two-Server Topology

Figure 2.3. Three-Server Topology

As we mentioned earlier, most companies will implement one to three servers. Figure 2.1 shows all roles and databases residing on a single physical computer.

An administrator may require a two-server implementation if they already have a WSUS server in their environment, but the current server cannot support all FCS roles. Figure 2.2 shows a typical two-server implementation.

A three-server topology usually appears when the reporting database is used heavily and the load from it significantly slows down the primary FCS system running the Management, Collection, and Reporting roles. Although we are not moving the Reporting role from the primary server we are moving the database to a dedicated or existing SQL Server 2005 system in an effort to improve performance. Figure 2.3 shows a three-server implementation.

As we mentioned earlier, there are other topologies that expand to six servers in an attempt to improve performance. This includes having the individual server roles running on their own separate servers. Once again this would benefit mostly large enterprises managing 10,000 computers and beyond. Table 2.2 lists FCS hardware and software requirements for various server roles.

Installing FCS Server Software

Now that we are familiar with the server roles, software and hardware requirements, clients that are supported, and the different topologies available we can focus on installing Forefront Client Security. For our example we will be using a single-server topology, meaning that all roles and databases will reside on one box. At this point we have following installed on our server:

• Windows Server 2003 Standard R2 with SP2

• SQL Server 2005 Standard with SP2 and Reporting Services (also Integration Services and Workstation components)

• .NET Framework 2.0

• Internet Information Services 6.0

• ASP.NET

• FrontPage Server Extensions

• GPMC SP1

• WSUS 3.0

MMC 3.0 already comes with the R2 release of Windows Server 2003, so we don’t have to download it. FCS requires the use of four service accounts, and you can use a single domain user account to fill all four roles. Table 2.3 lists the service accounts used in FCS.

Table 2.3. Service Accounts Used in FCS

Account	Type	Description
Data Access Server (DAS)	Domain user, but if also used on the collection server it needs to have local administrator rights	The Collection Server uses the DAS account to access the colletion database.
Reporting Account	Domain user	Used on the Reporting Server to access both the reporting and collection databases.
Action Account	Domain user and local administrator on the Collection Server	This account must be a local administrator on the Collection Server. The Collection Server uses this account to run server side scripts and security state assessment scans. The action account MUST be a domain user account.
Domain Transformation Services (DTS)	Domain user	Used by the reporting server to run a DTS job that transfers data from the collection database to the reporting database.

As you see, it really makes things a lot simpler if we just use one domain-based account that meets the security requirements of each role. Once we’ve verified that our prerequisites are met we can now install Forefront Client Security on the server. Follow these steps to install FCS:

1. With an account that has local administrator privileges, logon to the server that will run FCS.

2. Insert the Microsoft Forefront Client Security DVD in the DVD-ROM drive.

3. On the FCS Startup screen, choose Run the Setup wizard as shown in Figure 2.4.

   

   Figure 2.4. FCS Startup Screen

4. At the Before You Begin screen, verify that your name and organization are correct, and then click Next.

5. At the License Agreement screen, you’ll be asked to select I accept the terms in the license agreement. If you agree to them, just put a check mark in the appropriate box and click Next.

6. Now you’ll come to the Component Installation screen. For our scenario, a single-server, Select each component as shown in Figure 2.5, then click Next.

   

   Figure 2.5. Component Installation Screen

7. At the Collection Server screen shown in Figure 2.6, enter the server’s computer name in the Collection server box (done by default). In the Management group name box, enter the name of the group name or accept the default, ForefrontClientSecurity. Make sure you record the Management group name because you will need it when configuring Client Security. In the DAS account box, enter the username and password for the DAS account created during the prerequisites. In our example, we actually created a username DAS. We recommend that you use a name less conspicuous, but for our example, we chose something easy to remember. Remember that the account is a domain user, and then click Next.

   

   Figure 2.6. Collection Server Screen

8. In the Collection Database screen as shown in Figure 2.7, verify that the Collection database will be stored on the current server and then accept the default size of the database or modify it. Note: If you select a size for the database that exceeds the amount of drive space available, the setup will fail. In the Report account portion you can use either the DAS account you created earlier or another domain user account at your discretion. In our example, you see that we are continuing to use the DAS account. Now click Next.

   

   Figure 2.7. Collection Database Screen

9. At the Reporting database screen shown in Figure 2.8, verify that the Reporting database is the current server and that the database size is appropriate for your expected amount of reporting. In the DTS account section either reuse the DAS account for the DTS account or use a different domain user account. Click Next.

   

   Figure 2.8. Reporting Database Screen

10. On the Reporting Server screen shown in Figure 2.9, verify that the Reporting server is correct. In the URLs for reports section, verify that the URL for Report Server and the URL for Report Manager boxes are correct. They should be the ones you specified when setting up SQL Server Reporting Services. If you used the default values (http://<servername>/ReportServer and http://<servername>/Reports), click Next. If they are not the default values, enter the correct URLs, then click Next.

    

    Figure 2.9. Reporting Server Screen

11. In the Action Account screen shown in Figure 2.10, either use the DAS account you’ve used earlier or enter a new domain user account, then click Next.

    

    Figure 2.10. Action Account Screen

12. Now you need to specify the location where you want to install the Client Security files. If you choose the default (C:Program Files), click Next. Otherwise, enter a location where you would like these files (see Figure 2.11).

    

    Figure 2.11. Client Security Files Location

13. Next is the Verifying Settings and Requirements screen as shown in Figure 2.12. Forefront Client Security setup will verify that you meet the system requirements. If you receive an error, you will not be able to install FCS until the error(s) is resolved. If you receive a warning, you have the option of taking the suggestion from FCS or not, but you can continue the installation. In our example, we are given a warning that having two or more processors is recommended. For now, we will continue. After the verification is complete, click Next.

    

    Figure 2.12. Verifying Settings and Requirements

14. The Completing Setup screen is shown in Figure 2.13. FCS will complete the setup and provide you a status of each item being installed. Once it’s finished, click Close.

    

    Figure 2.13. Completing Setup

Once the installation is complete, you’ll notice two new programs: Forefront Client Security, which is the actual client piece that can be seen on the system tray in the bottom-right corner and the Forefront Client Security Console, which is used as the primary interface for managing FCS.

Forefront Client Security Console

To get to the FCS Console, click Start | All Programs | Microsoft Forefront | Client Security | Microsoft Forefront Client Security Console. When you run the FCS Console for the first time, you will run through a wizard that will take you through the rest of the configuration.

1. At the Before You Begin screen shown in Figure 2.14, click Next.

   

   Figure 2.14. Before You Begin Screen

2. At the Collection Server and Database screen, shown in Figure 2.15, verify that the correct Collection server, Collection database, and Management group name are shown. Click Next.

   

   Figure 2.15. Collection Server and Database

3. On the Reporting Database screen seen in Figure 2.16, verify the computer name is correct in the Reporting database box, and then enter the username and password used for reporting. This should be the domain user account you created earlier.

   

   Figure 2.16. Reporting Database

4. In the Reporting Server screen, verify the correct computer name is entered for the Reporting server and that the URLs for both the Report Server and the Report Manager are correct. Once you’ve confirmed this, click Next. Figure 2.17 has the information entered for our scenario.

   

   Figure 2.17. Reporting Server

5. Next you’ll come to the Verifying Settings and Requirements, which setup will do. If everything is successful as you see in Figure 2.18, click Next. Otherwise, examine the details of any failures and troubleshoot from there.

   

   Figure 2.18. Verifying Settings and Requirements

6. Next you’ll come to the Completing the Configuration Wizard shown in Figure 2.19, where setup will complete the tasks listed in the Action column. After all tasks have completed successfully, click Close.

Figure 2.19. Completing the Configuration Wizard

Creating and Deploying Policies

In deploying the Client Security to client systems (XP, Vista, Windows 2000, Windows Server 2003), we need to create and deploy a policy to those systems. Policies are where we decide centrally what the scan schedules and configuration will be. Once the client system has a policy, the computer will download the client software from the distribution server. After deployment, the client systems need to be approved in MOM before they are able to report data. Typically this happens within an hour.

Creating a Policy

Here are the steps required for creating and deploying policies in FCS.

1. Click Start | All Programs | Microsoft Forefront | Client Security | Microsoft Forefront Client Security Console. The Microsoft Forefront Client Security Console appears and the Dashboard is at the forefront as seen in Figure 2.20.

   

   Figure 2.20. FCS Console

2. Now we need to create a policy. In the FCS Console, click the Policy Management tab, then click New. On the General Tab, enter a Name and any Comments you like about the policy. In our example, we are calling this policy Client Settings.

3. Now go to the Protection tab, where you will select what protection you want on. You can turn Virus protection and Spyware protection On or Off. You can choose to Use real-time protection, which scans programs and services when they are accessed. You can schedule to Run a scan at a certain day, everyday, and an exact time. You can choose the type of scan such as a Full scan, or a Quick scan. You can also choose to run a Quick scan at certain hourly intervals. Security state assessment scans can also be set or not. For our scenario, we’ve decided on all the defaults plus to Run a Quick Scan every four hours as you see in Figure 2.21.

   

   Figure 2.21. New Policy Protection Settings

4. Once finished, click the Advanced tab; the options seen in Figure 2.22 appear. Here we have kept the defaults for Check for updates before starting a scan, Check for updates at set interval (hours) 6, Scan archive files, and Use heuristics to detect suspicious files. We have modified the Client options to Users can view all Client Security agents settings and messages and Only administrators can change Client Security agent settings. The Overrides tab allows you to change responses to specific malware threats that may be default.

   

   Figure 2.22. New Policy Advanced Settings

5. Although we are not changing anything in the Reporting tab, Figure 2.23 shows all the options available, including the ability to specify Alert levels, Logging, and SpyNet settings. SpyNet will be covered later in this chapter. Now click OK.

Figure 2.23. Reporting Tab

Once completed you will see the new policy listed in FCS as shown in Figure 2.24.

Figure 2.24. New Policy Listed in FCS

Deploying a Policy

Now that we have created our policy for the Client Security, we need to turn our attention to deploying it. To deploy a policy:

1. Open the Client Security console (Start | All Programs | Microsoft Forefront | Client Security | Microsoft Forefront Client Security Console).

2. Go to the Policy Management and click on the policy you want to deploy. In our case, we are deploying the policy called Client Settings. Click Deploy as shown in Figure 2.25.

   

   Figure 2.25. Deploy Policy

3. At the Deploy dialog box, you have the option of selecting where you want to deploy your target or targets. In our example, we will be deploying to an OU. As you see, not only can you deploy to an OU but you can also deploy to AD security groups, GPOs, and .reg files. Figure 2.26 shows that we are deploying to the Workstations OU in our Active Directory deployment.

Figure 2.26. Selecting Deployment Target(s)

If you return to the Client Security console, you will see that information such as Last Modified, Modified By, Last Deployed, Deployed By, and Deployed To are now populated with the correct information. So now that we have Microsoft Forefront Client Security installed on our server and we have created and deployed our settings policy, we now need to install the client software on the client computers.

Installing Client Software Agent

The Forefront Client security agent runs on Windows Vista, Windows XP SP2, Windows 2000 SP4, Windows Server 2003 R2, and Windows Server 2003 SP1. Before installing the agent software, verify that your client is up to date on all critical updates. If there are any other anti-virus and anti-spyware software currently installed on the client system, uninstall them. In Windows Vista, be sure to disable Defender’s service. For Windows 2000 SP4 clients, be sure to install the Windows Update Agent 2.0 and the Windows Installer 3.1. Installation of the client agent can be done via a logon script, automated installation via SMS, or manually. We will walk through doing it manually. To install the client agent manually:

1. Insert the Forefront Client Security DVD in the DVD-ROM drive of the client system.

2. On the DVD, copy the CLIENT directory somewhere on the client workstation.

3. After the CLIENT directory has been copied, click Start | Run.

4. In the Run dialog box, point to the CLIENT directory you just copied and run the ClientSetup.exe command. For our example, we copied the CLIENT directory from the C root. After that we ran the command ClientSetup.exe /MS FCS-SRV.sigr.local /CG ForefrontClientSecurity. The /MS parameter specifies the name of the FCS Server, and the /CG parameter specifies the name of the configuration group that you created during the FCS install. The switches for ClientSetup.exe are listed in Table 2.4.

Table 2.4. ClientSetup.exe Switches

/CG <ManagementGroupName>	Specify the MOM management group name. Default is ForefrontClientSecurity.
/MS <ManagementServerName>	The fully qualified domain name of the Management server. Ex: srv1.test.com.
/I	Specify a folder to install the client in besides the default.
/NOMOM	Tell ClientSetup.exe not to install the MOM agent. Used on a separate Collection Server.

A command window will come up with a flashing cursor in the upper left corner. After the install, the command window disappears and the Forefront agent can be seen in the lower right corner of the system tray as seen in Figure 2.27. Now that the Forefront Client Security agent is installed let’s get acquainted with it.

Figure 2.27. Forefront Client Security Agent in System Tray

Note

After the installation you may receive Error found: Code 0x80240016. This typically happens if the system was ready for a reboot before you installed the agent. Just reboot the system and the Forefront Client Security agent should function normally and change its color from yellow to green.

By opening the FCS agent, which can be done by clicking the green icon with the check mark in it on the system tray or by clicking Start | All Programs | Microsoft Forefront | Forefront Client Security, we see an interface very similar to that of Defender. We have in the upper portion of the utility options for Home, Scan, History, Tools, and Help (which is displayed as a question mark inside a blue circle) FCS client on machine. Show this tab.

The Home screen provides us with information about any malware that was detected and the status of the agent in the bottom half of the screen. The Status area informs us of our Last scan, Scan schedule, Real-time protection, and current Antivirus and Antispyware definitions, as seen in Figure 2.28.

Figure 2.28. Home Screen in FCS Agent

Scan

The Scan button kicks off a scan of the computer. By default it will kick off a Full Scan of the system, but if you click the down-arrow button on the right side of the Scan option you can choose from a Quick Scan, Full Scan, and a Custom Scan, as shown in Figure 2.29.

Figure 2.29. Scanning Options

Full Scan

A full scan checks all files on the hard disk, and currently running programs. Conducting a full scan will effect performance, hence it might best to schedule it when you are not using the system (e.g., during the night; we will cover this under the Tools option of the FCS agent). Figure 2.30 shows a full scan running on a system.

Figure 2.30. Full Scan with FCS Agent

History in the FCS agent displays any actions that have been applied to malware and any other potentially unwanted software that has been detected. Here you can review and monitor items you’ve permitted by going to the Allow items section. You can also remove or restore items that have been placed in the Quarantined items area. The History screen also informs you if you have joined Microsoft’s SpyNet, the level of your membership, and allows you to change any settings you like.

Possibly the busiest screen in the FCS client agent, the Tools option is made up of two sections. The Settings section and the Tools section. The Settings section consists of Options and Microsoft SpyNet, the Tools section consists of Quarantined items, Software Explorer, Allowed items, and Microsoft Forefront Client Security website. Figure 2.31 shows the Tools option screen within the FCS agent.

Figure 2.31. Tools Section of FCS Agent

Options

Options allows you to choose how you want the FCS agent to run. Figure 2.32 shows the options available within the Options category. Under Options within Tools, you are able to schedule scanning on the system. You can choose how often you want to scan, the time for it to take place, and the type. You can set an interval (in hours) if you like for running a quick scan. The option of checking for updated definitions before scanning is available. Within the Options area, you can set what’s referred to as Default actions. Here you can decide what to do when a certain level of alert item happens. Alert items come in Severe, High, Medium, and Low.

Figure 2.32. Options Screen

As you’ve probably noticed, all of our settings are grayed out. The reason is because we created a centrally managed policy that configured these settings earlier.

Also in the settings section of Tools and Settings under the Tools tab in FCS client are the Microsoft SpyNet settings. Microsoft SpyNet is the online community network of Windows Defender and Forefront Client Security users and administrators that helps determine what software should be investigated as potential spyware. This community can help administrators see how others are responding to software that has not yet been classified for risk. Ratings from the SpyNet community are one of the factors used by Microsoft in determining which software to investigate as potential risks.

Software Explorer

Under the Tools section below the Settings section of the Tools tab is Software Explorer, which allows users to change how a program runs on their PCs. This typically is used when you are sure that you have identified a specific program causing a problem. Software Explorer categorizes programs in the following way: Startup Programs, Currently Running Programs, Network Connected Programs, and Winsock Service Providers. Software Explorer provides a great deal of information about programs on the system. It even groups them by manufacturer. For instance, all Microsoft programs will be listed under their name, even the Google Toolbar Notifier is listed—of course, under Google. Programs also are classified by Software Explorer as shown in Figure 2.33.

Figure 2.33. Software Explorer

The Help function is shown beside the Tools tab at the top of the FCS agent as a blue dot with a white question mark, and provides access to FCS agent help file.

By clicking the down-arrow key beside the Help button, you can select About Microsoft Forefront Client Security and view information about what client and engine version you are running, and you can see the definition versions for the antivirus and antispyware functions. Figure 2.34 shows the system information found in the About Microsoft Forefront Client Security box.

Figure 2.34. About Microsoft Forefront Client Security

So far we have gone through what Forefront provides; how to prepare for the installation, performing the installation, creating and deploying policies, installing the client security agent; and walked through the options available in the FCS agent. Now let’s watch FCS in action. In our test scenario, we have attempted to download a file that will act as a test virus. The file is known as EICAR, a well-known test file that can be downloaded from numerous sites on the Internet such as www.eicar.org/anti_virus_test_file.htm. As soon as we began to download EICAR, the Forefront Client Security agent immediately warned us that a virus had been found, which you see in Figure 2.35.

Figure 2.35. FCS Warning of Virus

If we click Smart Clean, the FCS agent will remove the virus. If you choose to find out more information about the virus, we can select Review and the Home screen from the agent will appear with the Apply actions to detected items screen, while providing information about the virus as shown in Figure 2.36.

Figure 2.36. Applying Actions to Deleted Items

By default, for severe alert levels the action is to remove the virus. If we wanted we could select Quarantine or Always allow instead. Since this is a severe alert level we’re going to take the FCS agent’s default action and remove this virus. Remember we can remove the virus by selecting Smart Clean, or in this case we can remove it by selecting Apply Actions.

Once the virus is removed, the Home screen will inform us that the computer is running normally again. If we went to the History tab, we would see that we successfully removed the EICAR virus as shown in Figure 2.37.

Figure 2.37. FCS Agent’s History

One of the most common issues we mentioned comes in the form of clients not receiving updated definitions. Although this mostly entails WSUS, it helps to know where clients download their updated definitions. Definition updates download to the Definition Updates Folder, which by default is located in the C:Documents and SettingsAll UsersApplication DataMicrosoftMicrosoft ForefrontClient SecurityClientAntimalware directory on systems other than Windows Vista. In Windows Vista the Definition Updates Folder is located in the C:ProgramData MicrosoftMicrosoft ForefrontClient SecurityClientAntimalware. Within the Definition Updates folder are four subdirectories. One folder’s name is an actual GUID, which will differ from machine to machine. The other folders are Backup, Default, and Updates. The updates are downloaded in the Updates directory just until they are installed, then those updated files will no longer appear in this directory. They will appear in the folder that has a GUID as the name.

Since the days of NT, the first place to look for problems is Event Viewer. For FCS, events are logged in the System Log, which regardless of the client OS the path to Event Viewer should be about the same. For Windows Vista for example, you can click the Start button | Control Panel | Administrative Tools and click Event Viewer; the path is the same in Windows XP. Once Event Viewer is open, just click the icon to the left of where it says System. Here you can search any issues that may arise in FCS, plus you can verify that updates are being received, as you see in Figures 2.38 and 2.39 for Windows XP, and in Figures 2.40 and 2.41 for Windows Vista, by looking for Event 19s.

Figure 2.38. System Log in Event Viewer in Windows XP

Figure 2.39. Verifying Definition Updates in Windows XP

Figure 2.40. System Event Log in Windows Vista

Figure 2.41. Verifying Definitions Update in Windows Vista

Depending on your situation and issues you need to troubleshoot, starting in Event Viewer and working your way down is usually the best way to go.