# Post-Installation Tasks

* Verify services are installed/started.
* bullet

  Make sure Startup type for SQL Server Agent (EPOSERVER) service is Automatic.
* bullet

  Make sure pop-up blocker is off.
* bullet

  Log in to ePO for first time.
* bullet

  Import root certificate.
* bullet

  Install required updates for Trellix security products (if appropriate).
* bullet

  View port assignments.
* bullet

  Configure ePO for multiple NICs (if appropriate).

### **Verify Services are Installed and Started**

1. Select **Start** > **Programs** > **Administrative Tools** > **Services**.
2. Identify the services installed on the server and started. Pay special attention to these services:
   1. **Trellix ePolicy Orchestrator Application Server Service (Tomcat)**: Responsible for displaying the ePO console and running extensions, as well as other background functions.
   2. **Trellix ePolicy Orchestrator Event Parser Service**: Takes events uploaded from clients in your environment and parses them into the SQL database.
   3. **Trellix ePolicy Orchestrator Server Service (Apache)**: Processes and receives all agent-server communication.

**Log Files for Application Server**, **Event Parser**, and **Server Services**\
The following are the primary log locations for these services:

* **Application Server service (Tomcat)**: orion.log or orion\_servername.log located in:\
  ...\\\<epoinstallationdirectory>\server\logs\\
* **Event Parser service**: eventparser.log or eventparser\_servername.log located in:\
  ..\\\<epoinstallationdirectory>\db\logs\\
* **Server service (Apache)**: server.log or server\_servername.log located in:\
  ...\\\<epoinstallationdirectory>\db\logs\\

**List of Services**

* Trellix ePO Application Server Service (Tomcat)
* Trellix ePO Event Parser Service
* Trellix ePO Server Service (Apache)
* Product Improvement Program Service (optional)
* SQL Server
* SQL Server Agent
* SQL Server Browser

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FdLLMdoECwRwwqwJsajxL%2Fimage.png?alt=media&#x26;token=bb6c18e7-1efa-4ba2-9868-eafc3f009bfb" alt=""><figcaption></figcaption></figure>

Rely on constant, high-speed connection to ePO SQL Server database/ Cluster installs only

### **Logging in to ePO for the First Time**

After the installation is complete, connect to the ePO server and verify the ePO console is accessible. Because the console is web-based, you can also access the console remotely using a supported browser at one of these addresses:

* https\://\<servername>:\<console-to-server port (default 8443)
* https\://\<ipaddress\_of\_server>:\<console-to-server port (default 8443)

After connecting to the server, log in with default admin account credentials. These credentials are case-sensitive. (Later, you will add accounts for other ePO users.)

* Preferred language (**Note**: Choose English UK as the language for European date and time format. )
* User name: admin (default)
* Password: as specified during the install

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FMpNBIax1eRXTKfO7Jn5w%2Fimage.png?alt=media&#x26;token=2965fb58-081f-45c7-9a85-e347506cee11" alt=""><figcaption></figcaption></figure>

#### **Login Guidelines**

* You can log on to multiple ePO servers by opening a new browser session or tab for each ePO server.
* The computer must exist in the same domain, (or a domain that has a trust relationship with that domain) as the ePO server.&#x20;
* If a system name contains an underscore (\_) character, log on using the ePO server’s IP address, rather than the machine name.
* Console communication is secured with industry standard Secure Socket Layer (SSL).
* If desired, you can change the default login banner to meet your own needs.\
  Click **Menu** > **Configuration** > **Server Settings**, select **Login Message** from the Settling Categories, then click **Edit**. Select **Display custom login message**, then enter your message and click **Save**.

### **Logging in to ePO using Identity Provider**

ePO Single Sign-On feature enables the customer to bring their own identity provider for the user authentication purposes. This feature internally uses SAML (Security Assertion Markup Language) that allows identity providers (IdPs) to pass authorization credentials to service providers (SP).&#x20;

Supported Identity Providers:

* OKTA
* ADFS
* Ping Identity
* Azure AD
* Onelogin

The service provider will be ePO.

### Install Trellix ePO Single Sign-On Extension <a href="#card-title-14" id="card-title-14"></a>

Follow this process to install the ePO Single Sign-On extension from the Trellix Download site using your Trellix Grant Number.

Prerequisites:

* Trellix ePO version must be 5.10.0 Update 11 or later
* Configure your Identity Provider application

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2F2KP1WpgwZd1YKeIqUbUH%2Fimage.png?alt=media&#x26;token=0c1f6e34-a197-4b79-aadc-160654ef60e6" alt=""><figcaption><p>After entering your grant number, search for ePolicy Orchestrator and select version 5.10</p></figcaption></figure>

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FqQNVGrVCihQDwTzLMMwu%2Fimage.png?alt=media&#x26;token=60142036-1336-48b8-a8c9-04a8368ab2c2" alt=""><figcaption><p>In <strong>Available Downloads</strong>, select <strong>Filters type</strong> as <strong>EXTENSION</strong>, select ePO Single Sign-On version 1.0.0.xxx, and download it to your local ePO server.</p></figcaption></figure>

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2F9QcEasX9lhtE58uZcssU%2Fimage.png?alt=media&#x26;token=474c516a-8d48-4df9-9907-d2c4254d0423" alt="" width="344"><figcaption><p>In ePO, go to <strong>Menu</strong> > <strong>Software</strong> > <strong>Extensions</strong>.</p></figcaption></figure>

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2F91Dt0Y9bkV6goOZODqH9%2Fimage.png?alt=media&#x26;token=8f78efe4-d3ff-4332-b9d2-94f697f572cd" alt="" width="267"><figcaption><p>Click <strong>Install Extension</strong>.</p></figcaption></figure>

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FwWuZiMABkluIth1pIrGD%2Fimage.png?alt=media&#x26;token=416cb157-9d1b-4001-b399-51921848e5be" alt=""><figcaption></figcaption></figure>

Browse to and select the **ePOSingleSignOn\_release\_\<version\_number>.\<build\_number>.zip** extension file, click **Open**, then click **OK** twice.

{% hint style="info" %}

### Note <a href="#card-title-20" id="card-title-20"></a>

You can also download the extension from the Software Catalog of your ePO server.
{% endhint %}

**Configuring SSO to Log on to ePO**

<details>

<summary>Configuring the IdP Application</summary>

* Configure a new IdP application in your SSO solution to get the IdP Entity Id (Issuer URL), IdP SSO URL, and X 509 certificate to input in your SAML configuration information
* For instructions on how to configure your IdP application, see your identity provider’s documentation

**Note**: You might need to use placeholder information for the ACS URL and the Audience URI (Service Provider Entity ID) when you configure your third-party IdP. Enter the details when you Update your IdP application SAML settings with the information from the ePO server.

</details>

<details>

<summary>Input SAML Configuration Information</summary>

Configure the settings in the **IDP SAML Settings** page under **Server Settings** to enable SSO using your IdP application:

* **Import IDP Metadata xml file** — Download the metadata from your IdP, and then click **Import** to upload the metadata to ePO
* After entering the details, click **Save**
* Once you log off from the ePO application, you will see the **Log On with IDP** option on the main screen

**Note**: Some IdPs do not support the download of the metadata extension. You will need to input data manually after collecting the necessary details from your IdP application.

</details>

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FZFZBIwnGYe5ni9lWQR10%2Fimage.png?alt=media&#x26;token=29f339c0-3996-4d4c-91c9-de3591777f0f" alt=""><figcaption></figcaption></figure>

<details>

<summary>Update IdP Configuration with Information from ePO Server</summary>

Edit SAML settings in your IdP application with information from ePO

1. **Audience URL (Service Provider Entity ID)**: Enter the Service Provider (ePO) Entity ID from ePO
2. **Single Sign On URL**: Enter the Service Provider Assertion Consumer Service URL from ePO

</details>

<details>

<summary>Assign the User Local for the IdP Application</summary>

When logging in using an identity provider, the user locale is assigned in the following manner:

* **From the user\_locale attribute**: It is configured in the IdP application to inform the Service Provider application about the locale of a particular user; for example: Fr-fr or, FR\_fr
* **Using the drop-down option**: It is present on the logon screen of the ePO application
* Available as the default locale of the tenant

</details>

**Using the Logon with IdP Feature**

1. After configuration, click the Log On with IDP option on the ePO logon page (Service Provider initiated SSO), or click the configured application in the IdP console (Identity Provider initiated SSO), to test the logon option.\
   \
   On successful authentication, a page displays with the following message: *SAML authentication is successful*.
2. Close your browser to end your session and contact your administrator for ePO permissions grant.
3. Request the ePO administrator to grant the required permissions.\
   \
   A new user is created in ePO with a user name which is like the email address used in your IdP application, the authentication type is set to SAML authentication, and no permission sets are assigned.\
   \
   An administrator must log on to the ePO console and assign the required permissions to the newly created (IdP) user.

**Importing the Root Certificate**

ePO uses SSL for communication between the console and the Tomcat web server, so a certificate is required. When you log on, you are prompted to accept a security certificate.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FKbwPLxj2KmLKF7IbCMYS%2Fimage.png?alt=media&#x26;token=878e6cb8-14b3-4d65-9eaa-002fa687d907" alt="" width="375"><figcaption></figcaption></figure>

1. Log on to the ePO server. The Certificate Error page appears.&#x20;
2. Click **Continue to this website**.&#x20;
3. Click **Certificate Error**.
4. Click **View Certificates**.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2Fa1z5VbvgvyxJIWb2oz9J%2Fimage.png?alt=media&#x26;token=08a4d597-ff02-4ff6-8385-afb1bf1e648b" alt="" width="375"><figcaption></figcaption></figure>

1. Click **Certification Path** tab.
2. Select the **Orion\_CA\_Name\_of\_Server** certificate and then click **View Certificate**.
3. Click **Install Certificate**.
4. Browse and select **Local Computer** as the physical **store**.

### **Viewing/Editing Port Assignments**

Use this page (**Menu** > **Configuration** > **Settings**) to review and change selected port assignments for communication between the server, the agent, and other components. Click on the information (i) icons for more detailed information regarding each port.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FzIHpd1aw8vVVfpGlVvqX%2Fimage.png?alt=media&#x26;token=9f2d31db-0078-43d1-a08b-4077a205dc8b" alt=""><figcaption></figcaption></figure>

![](https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FI0RV6AERnB3D4ds8tHxx%2Fimage.png?alt=media\&token=3d6ccdbc-f545-4d82-a533-c08dbc7e2a8f)

![](https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FuU98c1AUbyrFUVNBbZR6%2Fimage.png?alt=media\&token=cd8c5b5d-36d4-4ca4-8c31-f26e8317bd83)

![](https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2F3mRxqaTonC476TqDtRfu%2Fimage.png?alt=media\&token=d056300d-55f7-4744-91b6-c990238474c1)

![](https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FrD7DKMDgDh5DmXDtKgVU%2Fimage.png?alt=media\&token=dca72e51-858a-424c-b259-9023dd944255)

![](https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FypvhOxZBta5k0jscZvvx%2Fimage.png?alt=media\&token=8ec73b51-d56f-4422-8448-8c4cfd3b0dd8)

![](https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FsVMTtFGhdpvsbkq3cpaX%2Fimage.png?alt=media\&token=4d2c4afb-4981-4826-8085-e99a9ef5debb)

{% hint style="info" %}
**The Pre-Installation Auditor tool is embedded into the ePO installer by default and identifies port conflicts prior to the installation.**
{% endhint %}

The figure below shows which ports you can change from this screen. Changes take up to one minute to take effect.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FHvogJzRFecyZoXPmlO3U%2Fimage.png?alt=media&#x26;token=98151fe7-dbcf-4ff4-89bb-e12542c657ed" alt="" width="563"><figcaption></figcaption></figure>

**IMPORTANT**: Disabling the Agent-server communication secure port is **NOT** recommended as this breaks the agent-to-server communication until the agents are re-installed. Additionally, upon reinstallation, agents are forced to use a less secure, non-TLS communication path to ePO.\
&#x20;For information about changing ports, see these Technical Articles:

* [**KB72936**(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content\&id=KB72936): How to change ePO Agent-to-Server Communication secure port
* [**KB52141**(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content\&id=KB52141): How to change the ePolicy Orchestrator Console-to-Application Server communication port

### **Configuring ePO for Multiple NICs**

If the ePO server is multihomed (has multiple IP addresses), it is recommended to force the server to be bound to the correct interface. The server IP address is used by the master repository and for agent-server communication. If this address is not provided, the IP address of the first NIC in the binding order is used.&#x20;

1. Open **C:\Program Files (X86)\McAfee\ePolicy Orchestrator\DB\server.ini**.
2. Modify the \[server] section of the file by adding this line:
   1. &#x20;**ServerIPaddress=\<IP address of server you want ePO to use>**
   2. Example: **ServerIPaddress=192.168.1.203**
3. Save and close the server.ini file.
4. Restart all ePO services.

### **Basic Installation Troubleshooting**

Should you have problems with your install, use this methodology to help identify the cause.

* Ensure minimum installation requirements are met.
* Review Release Notes.
* Review relevant Technical Articles.
* Verify account and permissions.
* Collect exact text of all messages.
* Write down any message codes.
* Review any installer log files (%temp%\McafeeLogs\\).
