Tips for installing Mcafee A/V on Exchange 2010 Servers

Hi,

We're migrating from Exchange 2003 to 2010 shortly and have been using Mcafee as our A/V provider since year dot. I was just after some tips/best practices about how to go around with the installation of the A/V onto this new setup. We're going to be running one server as the mail box roll and one server as the combined cas/hub transport server.

We've previously had groupshield and 8.7 installed on the exchange 2003 server and found this to be effective. However with this change in setup I thought I'd enquire what others have used.

Cheers  
LVL 1
kchallAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

BusbarSolutions ArchitectCommented:
I am note aware with specifics for MCAFEE, only make sure that you exclude Exchange binaries/processes and DBs from the scan.
jmaggio322Commented:
disable email active protection
Simon EarlSenior ConsultantCommented:
Simple....install Groupshield and VSE 8.8i on the boxes as you have done previously.......

Make sure that you create an exception in the policy for Access Protection for "Prevent Mass Mailing Worms" on the server

Also, there is a good knowledge base article provided by McAfee for exceptions for Exchange.


VirusScan Enterprise and Total Protection Service compatibility
To ensure compatibility with Microsoft Exchange 2007/2010 and McAfee GroupShield for Exchange, the following locations must be excluded in the On-Access Scanner for VirusScan Enterprise (VSE) and Total Protection Service.
 
The method of adding exclusions varies between versions of VirusScan. For information on how to add exclusions, see the Related Information section in this article or check your VSE or Total Protection documentation or Help screens.

If your system contains a SAN or NAS device, or if you use Windows Mount Points, also refer to the KnowledgeBase article mentioned in Related Information.
 
IMPORTANT: For all folder exclusions, a trailing backslash must be used to signify that the excluded item is an entire folder. When adding exclusions locally using the VirusScan Console, this backslash is automatically appended to the folder name. Setting exclusions using McAfee ePolicy Orchestrator (ePO) might require you to type the backslash (\) manually, depending on the version of ePO.
 
 
Exchange Application-related extension Exclusions
**\Microsoft\Exchange Server\**\*.config
**\Microsoft\Exchange Server\**\*.dia
**\Microsoft\Exchange Server\**\*.wsb
 
Exchange Database-related extension Exclusions
**\Microsoft\Exchange Server\**\*.edb
**\Microsoft\Exchange Server\**\*.log
**\Microsoft\Exchange Server\**\*.chk
**\Microsoft\Exchange Server\**\*.jrs
**\Microsoft\Exchange Server\**\*.que
 
Exchange Offline Address Book-related extension Exclusions
**\Microsoft\Exchange Server\**\*.lzx

 
Exchange Content Index-related extension Exclusions
**\Microsoft\Exchange Server\**\*.ci
**\Microsoft\Exchange Server\**\*.wid
**\Microsoft\Exchange Server\**\*.dir
**\Microsoft\Exchange Server\**\*.000
**\Microsoft\Exchange Server\**\*.001
**\Microsoft\Exchange Server\**\*.002
 
Exchange Unified Messaging-related extension Exclusions
**\Microsoft\Exchange Server\**\*.cfg
**\Microsoft\Exchange Server\**\*.grxml
 
Exchange Working and Conversion folder Exclusions
NOTE: These exclusions should be applied only to the processes "EdgeTransport.exe" and "MicrosoftTransportLayer.exe".
**\Temp\ (some content conversions are performed in this folder)
**\Microsoft\Exchange Server\MDBTEMP\
**\Microsoft\Exchange Server\Working\OleConvertor\
 
Exchange file Exclusion
NOTE: This exclusions is not recommended since the file, being an executable file, will go unscanned.
**\\Microsoft\Exchange Server\Bin\EdgeTransport.exe
 
IIS Working folder Exclusions
**\System32\Inetsrv\
**\IIS Temporary Compressed Files\
File Share Witness folder Exclusions
 **\MNS_FSW_DIR*\

NOTE: There are multiple/different directories per Hub Transport server to support the various clusters in each data center.
 
GroupShield 7 for Exchange 2007/2010
**\McAfee\McAfee GroupShield\bin\Runscheduled.exe
**\McAfee\McAfee GroupShield\bin\Runscheduledx64.exe
**\McAfee\McAfee GroupShield\bin\SafeService.exe
See also: KB55595 - Configuring VirusScan exclusions on an Exchange 2000/2003 server running McAfee GroupShield for Exchange or WebShield SMTP
 
 
Processes to place in Low Risk and to disable scanning
postgres.exe from C:\Program Files (x86)\McAfee\MSME\PostgresSQL\bin\postgres.exe
MaesRulesUpdater.exe from C:\Program Files (x86)\McAfee\MSME\bin\MaesRulesUpdater.exe
RPCServ.exe from C:\Program Files (x86)\McAfee\MSME\bin\RPCServ.exe
 
Processes to add as exclusions for the Access Protection rule "Anti-Virus Standard Protection: Prevent mass mailing worms from sending mail"
 
SAFeService.exe

 
VirusScan Enterprise 8.5i and later
Click Start, Programs, McAfee, VirusScan Console and double-click Access Protection.
Select Anti-virus Standard Protection and for Prevent mass mailing worms from sending mail, select Block and Report.
Click Apply and OK.
Close the VirusScan console.
Related Information
VirusScan Exclusion Monitor
GroupShield 7.x has a component (VirusScan Exclusion Monitor) that monitors the GroupShield-related exclusions that exist in VirusScan's configuration every few (three to four) minutes. If the necessary exclusions are not present, the monitor adds them to the VirusScan configuration.

This ensures that when GroupShield is running on an Exchange server protected by VirusScan, the relevant GroupShield-related exclusions are always in place. Typically, the exclusions cover things such as the GroupShield Postgres database and quarantine folders, and temporary working folders.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.