Using Microsoft ForeFront Server Security Management Console

[patris1]

http://www.msexchange.org/articles_tutorials/exchange-server-2007/security-message-hygiene/using-microsoft-forefront-server-security-management-console-part1.html

Anderson Patricio

PART-1


Taking a look at the installation process for ForeFront Security for Exchange and How to manage it from a central location using ForeFront Sever Security Management Console (FSSMC).
Introduction

If you have a couple of ForeFront Security for Exchange Servers and want to keep the same configuration on all servers, then this article is for you. We are going to cover the process involved in the installation of the FSSMC (ForeFront Server Security Management Console) and how to manage updates, general configuration and reports using FSSMC.
The FSSMC is a web-console interface that allows an Administrator to manage, from a single location, both the ForeFront Security for Exchange and the ForeFront Security for Sharepoint products. Instead of going on each server to define settings, the administrator is able to create a simple job on the console and apply it to all servers or at a specific group of servers. The administrator can deploy packages, see a single summary page containing all viruses, spam and filter statistics, the product has built-in reports such as: SMTP Traffic, Engine and Signature versions and detection reports.
Another feature is the ability to download the latest engines from the internet and then distribute them to the internal computers.
The FSSMC does not require a lot of pre-requisites. If you have a Hyper-V in your environment the FSSMC can be a good candidate to be a virtual machine. The requirements are Windows Server 2003, IIS installed, and it must be a 32bits machine.
Deploying ForeFront Server Security Management Console (FSSMC)

FSSMC can be installed in a standalone server for a small company, but it also supports hierarchy using Primary and Backup topology. If you have a medium to large environment, you should consider using Primary/Backup scenario where you can have redundancy of updates in case of a failure of the primary server.
The installation requirements are really simple, basically you just need to install IIS on a Windows Server 2003 32bits and deploy the software. The IIS portion requirements are described in these following steps:

1. Logged with an account with local administrator privileges on the server that we are going to install FSSMC
2. Click on Start, Settings, Control Panel
3. Double click on Add/Remove Programs
4. Click on Add/Remove Windows Components
5. Select Application Server and click Next (Figure 1)

Figure 1
It is now time to download the FSSMC package, found here. As soon as you download the package, double click on Setup.exe.

1. Double click on the installation file, all files will be extracted and the figure shown in the Figure 2 will be displayed. In our environment we are going to use a single server, so let us select Standalone and click on Next.

Figure 2

1. The second page will ask about the SQL Deployment, we can use a SQL Enterprise where we can specify a different server that will host the SQL database used by FSSMC, in this tutorial we will use Express option where a SQL 2005 Express will be installed locally only for the FSSMC purpose. Click Check Prerequisites, as shown in Figure 3.

Figure 3

1. The installation process will validate the current system and all prerequisites that must be installed before the FSSMC installation wizard will be listed. Just click on Yes to start installing all prerequisites.
   
   Note:
   Depending of your server configuration it may take some minutes.

Figure 4

1. After finishing the prerequisite installation process, the initial page of the FSSMC Wizard installation will show up, just click on Next. (Figure 5)

Figure 5

1. On the End-User License Agreement page. Select on I accept the terms in the License Agreement option and click on Next.
2. On the Select Installation folder page. Accept the default values and click on Next.
3. On the Ready to install page, click on Install to start the installation process.
4. That’s it! Click Finish and you will be able to see a new Program group on the Start Menu. Basically the ForeFront Security Management Console icon is a link to the web management console of the product. By default is http://localhost/FSSMConsole/default.aspx

FSSM Console Overview

The initial page of the product is At a Glance… as shown in Figure 6. The administrator has a centralized view and is able to manage the product through all available options in the menu on the left; on the central page the administrator will have a traffic summary of all processed messages of all clients that have the client installed, and statistics about Viruses, Filters, Top 5 Viruses and most active Servers will be displayed as well.

Figure 6
Now that we have installed the FSSMC and we know how to access the initial page. Our next steps are to configure Global settings, add servers to the console and start managing the ForeFront Server Security for Exchange from a central location.
FSSMC Discovery Process

In this part of our tutorial we will be covering the user, server and global configuration sections of the Console and also the first two items from the left menu that are: At a Glance and New Servers.
First things first, by default FSSMC searches for new servers running Exchange Server every night at 1:00AM, and if it finds new servers the information will be displayed on the page At a Glance which is the start page of the Console, an example when a new server is found can be seen in the Figure 7.

Figure 7
As an FSSMC administrator you can manage the discover process changing values of some registry keys in the FSSMC Server. All settings related to the discovery process can be found at; HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ForeFront Server Security\Server Management\Services. Most of the settings are self-explanatory and we are not going over each one in detail, but I am going to play around with a couple of them, for example: we can easily change the discover process time changing the value of AutoDiscoveryTime; we can also disable Exchange Server Discover changing the ExchAutoDiscoveryEnable to 0 (The possible values are: 0 disable and 1 enable), as shown in Figure 8.

Figure 8
Managing Users

Okay, let’s move forward. The first item under Administration topic is Users on that section we can add users to be administrators of the FSSMC. By default, only the user that installed the software is listed on that section. You can add users clicking on Add Users link (Figure 9), use the format DOMAIN\Username to add users and if you have more than add one per line, you can also search your active directory clicking on Browse button after clicking on the Add Users link, then a list of all current users will be displayed and you can pick the new administrators up. As soon as you add the new users you can send them the link to access the FSSMC and they will be able to manage your environment as well.

Figure 9
Managing Servers and New Servers

In this section, we can add servers manually entering their names, or searching for them on Active Directory. We can also associate them to a Server Group. The only group created during the product installation is Default. We will be looking at the Server Group creation process in a bit.
If you noticed that on the main page you have had new servers discovered they would not show up on the Servers list. In order to add those discovered servers you need to click on New Servers link, as depicted in Figure 10, select the servers that you want to add, define their groups in the column Add to Group and then click on Add Servers.

Figure 10
If you don’t have time to wait for the discover services, you can always add them manually, it’s up to you.
No matter which way you added the server, the servers will be always listed on Servers item, on this location we will be able to see all servers their respective agent version and current status.
Managing Server Groups

Under Server Groups item we can manage groups, assign existent servers to different groups, and delete servers from a specific group as well. The usage of groups makes easier to deploy configurations based on the server role, we can create a group just for Hub Transport servers where we can define Transport Scan and also use different sort of protection settings based on the group, on other hand we can have a group for Mailbox Server where we can configure Scan jobs and etc.
We can also create groups based on the ForeFront Server Security, for example: a group for SharePoint and if you still use Exchange Server 2003 and SMTP you may have to create a group for that as well.
Managing Global Configuration

Last but not the least, the final part of the Administration section setup is the Global Configuration. In this section we can configure the SMTP Server that console will be using to send messages out (Figure 11). The recommendation here is to create a mailbox to the FSSMC service, in our scenario we created a mailbox named svc.ForeFront, after filling out all the information we can use the Test E-mail button to validate the configuration.
In this section we still have the Statistics Polling setting where we can define how often the FSSMC will retrieve historical data from the remote servers; the last setting on this page is Download Configuration where we can define the addresses that FSSMC will retrieve updates from Microsoft. If you have a proxy in place to access internet, you can configure such settings on this location. After setting up the global settings just hit Save button.

Figure 11
Conclusion

In this first article we went through the process to install the FSSMC and its prerequisites. We also started to manage Users, Servers and Global Settings. Next article we will be deploying FSSMC agents and pushing ForeFront Security Server for Exchange Server installations to the clients from a central location

---

موضوعات مشابه:

• A Few Notes Regarding Remote SQL Logging with Microsoft ISA Server 2006&Forefront Threat Management
• Microsoft ISA Server 2006 Web-based Management Console
• Using the Security Configuration Wizard with Microsoft Forefront Threat Management Gateway 2010
• Overview of the Forefront Threat Management Gateway 2010 Management Console

---

[patris1]

http://www.msexchange.org/articles_tutorials/exchange-server-2007/security-message-hygiene/using-microsoft-forefront-server-security-management-console-part2.html

PART-2


Introduction

In the previous article from this series, we saw how to add servers to the console, create groups and this kind of stuff. That was just one portion of the configuration, in this article we will be deploying FSSMC agents on our Exchange Servers and after that we will be able to push configuration to them.
Using FSSMC we can also install ForeFront Server Security for Exchange without any manual intervention on Exchange Server. If you do not have FSSMC but you have ForeFront Server Security, the installation process has an option to install remotely, as shown in Figure 1. However, by using FSSMC we can deploy and configure ForeFront for Exchange on all your computers at the same time without having to log on all servers. Cool, isn’t it?

Figure 1
Okay, let us say that we already have installed ForeFront for Exchange on all your Exchange Servers, are there any problems? Definitely not, you just need to deploy FSSMC agent on your servers that already have the software installed and from that point on you can manage all settings through FSSMC.
Deploying the FSSMC agent

The FSSMC agent installation is a simple process, basically we must make sure that we already have the server object listed in the Servers section, as show in Figure 02. Then, we need to select one or more servers that we want to deploy the agent and click on Deploy Agent.

Figure 2
FSSMC will prompt for credentials to install the agent on the remote server (Figure 3). The format of the username has to be DOMAIN\UserName format. If you have different servers with different administrators you can select a username and password for each server (just make clear the option Use these credentials for all servers). Click on Continue.

Figure 3
A pop up page will be displayed and it will be refreshed automatically. This new page will display any information about the installation process and at the end we can validate if the process was successful, as shown in Figure 4. Click Close.

Figure 4
Okay, the agent is now installed, but what are the changes on our Exchange Server? Basically, the agent installs a new service called DeploymentAgent (Figure 5).The default status is manual and this service is responsible to communicate with the FSSMC and also perform tasks that are started through the console.

Figure 5
Another difference that you will notice is a new program group in your Programs menu. The name is Microsoft ForeFront Server Security Management Console and it has 4 applications on this new group which are: Clear ForeFront log, Disable ForeFront log, Enable ForeFront log and ForeFront Remote Diagnostic (as shown in Figure 6). All those applications we will be using during a PSS call with Microsoft or troubleshooting procedure.

Figure 6
Automating the installation process of ForeFront Server Security for Exchange Server

Our goal in this section is to create a package to install ForeFront Server Security for Exchange Server and create a Deployment Job to install it when required.
The first thing is to get the latest ForeFront for Exchange Server from the following website: www.microsoft.com/ForeFront and download it to a temporary folder in FSSMC server. The process to deploy ForeFront Server Security for Exchange from FSSMC can be summarized in Figure 07.

Figure 7
In order to create the package, logged on the FSSMC main page, let’s click on Packages, and then click on Add Package. In the new page, give a name to the package (for the purposes of this article, I am going to call it ForeFront Security For Exchange). Let us now click on Browse and specify the file that we downloaded in the previous step, and then click on Add (Figure 8) .
Note:
This process may take a while so be patient!

Figure 8
The next page will be about the installation details, all values specified on this page will be used to install on the remote servers. The first three sections of this page are shown in the Figure 9. A brief description of each section is listed below:

• Target Folders - Specifies the installation path and the Start menu Folder caption
  
• Product Key - If you have the license you can fill it in this field. If you don’t the software will work for 120 days-trial mode
  
• Engine Selection - This is one of the advantages of ForeFront, you can select up to 5 engines to be configured on the new installation
  
• Enable Anti-spam Updates - The installation process will enable automatic updates of anti-spam. You can check this configuration using Get-AntiSpamUpdates on your Hub Transport or Edge Server
  
• Microsoft Update - This option is related to update of the ForeFront product itself not engines
  
• Proxy Server (optional settings) - The administrator can define Proxy settings. The proxy settings can be enable/disabled, server name configuration and port configuration
  
• Quarantine Security Settings - The possible values are Secure or Compatibility. Basically, if you want to apply file and filter contents on messages that are coming from Quarantine
  
• Hot Upgrade: Critical File - Possible values are Recycle Services or Abort upgrade. If any file in use must be updated the installation process will take the action configured on this section
  
• Hot Upgrade: Mail Flow - This option is related to the Mail flow during the installation. The default value is Recycle Services

Figure 9
Okay the package was created as we can see it in the Figure 10. Now, the next step is to create a Distribution Job, and then link the current package to this new job and afterwards assign which server(s) will be receiving the Deployment Job. The process that we have just been through can be also used to deploy ForeFront Server Security for Exchange/Sharepoint updates.

Figure 10
In order to create a Deployment Job, let Us click on Jobs, and click on Deployment Jobs item and click on Create, as shown in Figure 11.

Figure 11
A deployment job has a few settings that can be defined during the creation of the job. Basically, we can define a name, an existent package (We are going to use the package that we have just created), Schedule (If Do not schedule option is selected the job must be run manually afterwards), and E-mail notification where we can add one or more e-mail address to receive the status of the process, as shown in Figure 12.

Figure 12
The last part of the Job is which servers and/or groups will receive the current Deployment Job. Let’s click on Finish (Figure 13).

Figure 13
Now that our job has been created, the next step is to click on Run Now, as shown in Figure 14.

Figure 14
A brief summary of the job will be displayed, make sure that the required servers are listed on the Server List section, after that just click on Run (Figure 15). After that a pop up window will show all tasks that have been performed on the remote server.

Figure 15
Conclusion

In this second article about ForeFront Server Security Management Console we have just covered the automated installation process of the ForeFront Server Security for Exchange.
In the next article we will finish this series by going over how to manage updates, standardize settings across the servers, reports and how to use the Quarantine Manager feature