SAV8 Student Guide Advanced Topics.pdf

(3010 KB) Pobierz
Fo
rS
ym
an
te
c
Pa
rtn
er
In
te
rn
al
Symantec AntiVirus 8.0
Advanced Topics
Student Guide
Revision September 5, 2002
Part Number: TM-00035
St
af
f
Tr
ai
ni
ng
On
ly
Symantec and the Symantec logo are U.S. registered trademarks of Symantec Corporation.
Other brands and products are trademarks of their respective holder/s. Copyright © 2002
Symantec Corporation. All Rights Reserved. Any technical documentation that is made
available by Symantec Corporation is the copyrighted work of Symantec Corporation and is
owned by Symantec Corporation.
NO WARRANTY. The technical documentation is being delivered to you AS-IS, and
Symantec Corporation makes no warranty as to its accuracy or use. Any use of the technical
documentation or the information contained therein is at the risk of the user. Documentation
may include technical or other inaccuracies or typographical errors. Symantec reserves the
right to make changes without prior notice.
Trademarks
Fo
rS
ym
an
te
c
No part of this publication may be copied without the express written permission of
Symantec Corporation, 20330 Stevens Creek Blvd., Cupertino, CA 95014.
Symantec, the Symantec logo, Intruder Alert, NetProwler, Raptor, VelociRaptor, Symantec
Desktop Firewall, Symantec Enterprise VPN, Symantec Enterprise Firewall, RaptorMobile,
NetRecon, Enterprise Security Manager, NAV, Norton AntiVirus, Symantec AntiVirus,
Symantec Client Security, Symantec System Center, Symantec Web Security, Mail-Gear and
I-Gear are trademarks of Symantec Corporation.
Windows is a registered trademark of Microsoft Corporation. Pentium is a registered
trademark of Intel Corporation. Other product names mentioned in this manual may be
trademarks of their respective companies and are hereby acknowledged.
Printed in the United States of America.
10
9
8
7
6
5
4
3
2
1
Pa
rtn
er
In
te
rn
al
Copyright Notice
St
af
f
Tr
ai
ni
ng
On
ly
Table of Contents
Course Overview..........................................................................................................................ix
Intended Audience ...................................................................................................................ix
Course Prerequisites.................................................................................................................ix
Related Documentation ............................................................................................................ix
Conventions..............................................................................................................................x
Course Description ....................................................................................................................x
Course Objectives .....................................................................................................................x
Course Agenda
..................................................................................................................................xi
Unit 1 Virus definitions and VDTM ................................................................................................... 1-1
Virus definitions and VDTM.......................................................................................................
1-2
Microdefs overview ................................................................................................................ 1-2
How the microdefs work......................................................................................................... 1-4
The update files downloaded by a primary server...................................................................... 1-6
Server folders and files .......................................................................................................... 1-8
Updating secondary servers.................................................................................................. 1-10
Updating clients ................................................................................................................. 1-12
Rtvscan Timer Loop
............................................................................................................... 1-14
What is Rtvscan Timer Loop? ............................................................................................... 1-14
Rtvscan and Defwatch ......................................................................................................... 1-16
Planning your network for update traffic
................................................................................... 1-18
Update considerations under normal conditions ..................................................................... 1-18
Update considerations under virus outbreak conditions ........................................................... 1-18
Lab 1-1:Locating virus definitions folders.................................................................................
1-21
Unit 2 Email scanning integration .................................................................................................... 2-1
Email scanning
........................................................................................................................ 2-2
Email scanning overview ........................................................................................................ 2-2
Email scanning and Microsoft Exchange.....................................................................................
2-4
Integration with Microsoft Exchange - Overview ........................................................................ 2-4
The integration process.......................................................................................................... 2-6
Symantec AntiVirus Exchange scanner registry keys.................................................................. 2-6
Email scanning and Lotus Notes................................................................................................
2-8
Integration with Lotus Notes - Overview................................................................................... 2-8
Integration into the Notes client ........................................................................................... 2-10
The Notes watchdog ............................................................................................................ 2-12
More Symantec AntiVirus Notes scanner registry keys ............................................................. 2-14
Email scanning limitations
...................................................................................................... 2-16
Scanning limitations in Exchange and Notes.......................................................................... 2-16
Unit 3 The Symantec AntiVirus registry ............................................................................................ 3-1
How Symantec AntiVirus uses the registry
.................................................................................. 3-2
The purpose of the registry in Symantec AntiVirus .................................................................... 3-2
The root of the Symantec AntiVirus registry.............................................................................. 3-2
Local scans .......................................................................................................................... 3-2
iii
Fo
rS
ym
an
te
c
Pa
rtn
er
In
te
rn
al
St
af
f
Tr
ai
ni
ng
On
ly
Unit 4 Understanding Grc.dat ..........................................................................................................4-1
Defining the Grc files
...............................................................................................................4-2
Grc.dat.................................................................................................................................4-2
Grcsrv.dat.............................................................................................................................4-4
Grcgrpl.dat ...........................................................................................................................4-4
Grcgrp.dat ............................................................................................................................4-6
When Grc.dat files are written
...................................................................................................4-8
More than one change at a time............................................................................................4-10
When a client does not receive a Grc.dat ...............................................................................4-12
Debugging the Grc.dat flow process
.........................................................................................4-14
ProductControl\Debug..........................................................................................................4-14
Lab 4-1:Using the debug window.............................................................................................4-17
Editing Grc.dat manually
........................................................................................................4-20
Common reasons for editing Grc.dat manually........................................................................4-20
Editing Grc.dat manually .....................................................................................................4-20
Implementing the new Grc.dat..............................................................................................4-22
Lab 4-2:Modifying Grc.dat manually
........................................................................................4-25
Unit 5 Discovery.............................................................................................................................5-1
Introduction to Discovery
..........................................................................................................5-2
What is Discovery? ................................................................................................................5-2
Understanding the discovery processes.......................................................................................5-4
Load from cache only ............................................................................................................5-4
Local discovery .....................................................................................................................5-6
Intense discovery ................................................................................................................5-10
Alternate method for finding computers....................................................................................5-12
Find Computer dialog box ....................................................................................................5-12
Support for non-WINS environments
........................................................................................5-16
Importer .............................................................................................................................5-16
Advanced discovery .............................................................................................................5-26
Using cached information
.......................................................................................................5-28
Updating the console's cached information ............................................................................5-28
Clear Cache feature .............................................................................................................5-30
Lab 5-1:Understanding the discovery process
...........................................................................5-33
Fo
rS
ym
iv
an
te
c
Pa
rtn
er
In
te
rn
al
Symantec AntiVirus™ 8.0 Advanced Topics
St
af
f
Extra entry on a primary server ...............................................................................................3-2
Key components of the Symantec AntiVirus registry.....................................................................3-4
AddressCache registry key ......................................................................................................3-4
Relevance to support personnel ..............................................................................................3-4
ClientConfig registry key ........................................................................................................3-6
Relevance to support personnel ..............................................................................................3-6
DomainData key ....................................................................................................................3-8
Relevance to support personnel ..............................................................................................3-8
Clients registry key ..............................................................................................................3-10
Relevance to support personnel ............................................................................................3-10
Children registry key ............................................................................................................3-12
Groups registry key ..............................................................................................................3-14
Scanning registry keys
............................................................................................................3-16
On-Demand scans from the console ......................................................................................3-16
On-Demand scans from the client user interface ....................................................................3-18
Realtime Protection.............................................................................................................3-20
Lab 3-1:Exploring the Symantec AntiVirus portion of the registry
................................................3-23
Tr
ai
ni
ng
On
ly
Fo
rS
ym
Unit 8 Scaling to the enterprise .......................................................................................................8-1
Scalability
...............................................................................................................................8-2
What is scalability?................................................................................................................8-2
Scalability improvements
..........................................................................................................8-4
Push updates........................................................................................................................8-4
Scalability improvements
..........................................................................................................8-6
Multi-threaded updating of servers and clients .........................................................................8-6
Scalability improvements
..........................................................................................................8-8
Updating computers by network or subnet ...............................................................................8-8
Scalability improvements registry keys......................................................................................8-10
Conventions used in showing registry keys .............................................................................8-10
Push updates registry keys ...................................................................................................8-12
Multi-threaded updating registry keys ....................................................................................8-14
Updating computers by subnet registry keys...........................................................................8-14
Lab 8-1:Locating registry keys to control scalability options........................................................8-17
Unit 9 Server and client rollout options.............................................................................................9-1
Understanding server and client remote installation options
.........................................................9-2
Defining server and client remote installation from the console ..................................................9-2
Iforgot.exe ............................................................................................................................9-4
Remote installation rollouts.......................................................................................................9-6
an
te
c
Pa
rtn
er
In
te
rn
al
Unit 7 Management tasks................................................................................................................7-1
Management tasks in Symantec AntiVirus™ for Client & Server
....................................................7-2
Common management tasks ...................................................................................................7-2
Client discovery general information ........................................................................................7-4
Client display improvements in version 8 .................................................................................7-6
When queries are performed to build client lists .......................................................................7-8
How are client lists saved at the console................................................................................7-10
Promoting a secondary server ...............................................................................................7-14
Move servers .......................................................................................................................7-18
Delete ................................................................................................................................7-20
Refresh ..............................................................................................................................7-22
St
af
f
Unit 6 Client/server communication..................................................................................................6-1
Understanding client/server communication................................................................................6-2
Why clients and servers must communicate .............................................................................6-2
When the Symantec AntiVirus Server service loads ...................................................................6-2
Communication components
.....................................................................................................6-4
Rtvscan communicates with Rtvscan .......................................................................................6-4
PDS and static ports..............................................................................................................6-4
Application IDs .....................................................................................................................6-6
Ping and pong packets...........................................................................................................6-6
Understanding client/server communication contact
....................................................................6-8
When any server loads ...........................................................................................................6-8
When secondary servers load ................................................................................................6-12
When clients load................................................................................................................6-14
Finding the parent server .....................................................................................................6-16
Reviewing the full communication process.............................................................................6-18
Symantec System Center console and discovery
........................................................................6-20
How SSC uses the communication components to discover servers ..........................................6-20
How SSC uses the communication components to discover clients...........................................6-20
Tr
ai
ni
ng
On
ly
v

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin