# ePServer Configuration

### **Server Settings**

All the necessary settings specific to your ePO server are in Server Settings. The available entries here allow you to fine-tune you ePO server based on the needs of your organization. Customizations made here affect all your ePO users.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FuX1BxRgBvhjwo6N0XGO6%2Fimage.png?alt=media&#x26;token=fc7a39af-6e4c-4cfe-b0a3-6782cdc1b959" alt=""><figcaption><p><em><strong>Menu</strong></em> > <em><strong>Configuration</strong></em> > <em><strong>Server Settings</strong></em></p></figcaption></figure>

#### **Password Policy**

The ePO 5.10 release added the Password Policy feature, which allows you to define the strength of a password. For example, an administrator can restrict the number of previously used passwords and limit the number of days before the password expires.

To use this feature, administrators must manually enable these settings via the Password Policy setting category in Server Settings as this feature is not enabled by default.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FdyXBCSqDUh1ePAropOI8%2Fimage.png?alt=media&#x26;token=06f955d5-3ecd-466e-806f-a9a4ebe3c4c7" alt=""><figcaption><p>Select the <strong>Password Policy</strong> Setting Category, then click <strong>Edit</strong>.</p></figcaption></figure>

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2Fndw5U4vEMt8zEbTUUK7b%2Fimage.png?alt=media&#x26;token=a96612cb-017e-4848-bb5d-ac57daea8a70" alt=""><figcaption></figcaption></figure>

Once enabled, available options for this feature include:

* Password Strength **Criteria**: Passwords can be defined as having 7-30 characters, and must contain at least one of the following characters:
  * Uppercase
  * Lowercase
  * Numeric
  * Special &#x20;
* **Password Expiration Criteria**: Expiration dates from 30-365 days can be configured before a password expires

#### **Logon Protection**

The ePO 5.10 release also added the ability to set user account lockouts based on multiple logon attempts or restrict access via IP address management thru the Logon Protection server setting.&#x20;

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FtKzl6h8NTpD9diOcSeJm%2Fimage.png?alt=media&#x26;token=331efce6-c944-4bca-83b7-23393cd34339" alt=""><figcaption></figcaption></figure>

* Select the **Logon Protection** Setting Category, then click **Edit.**
* Click on the **Automatic Responses** link under **Notifications** to create you own customizable default response to failed logon attempts.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2F7itC6rbR1U92FH2jrMVg%2Fimage.png?alt=media&#x26;token=a4c3d2c5-67cb-4252-a8d2-d93bf1fa2b87" alt=""><figcaption></figcaption></figure>

Enable these features to provide added logon protection:

* **Lock Out User Accounts**: Enable this feature to lock out a user account after the configurable failed attempts is met.
* **Restrict IP Addresses**: Enable this feature to automatically block an IP address if 10 or more failed attempts occur in under 60 seconds.

***

#### **Queries Page**

**Queries** is a new category introduced in the Server settings page. Use the Queries page to set the maximum number of elements that display in the following chart types:

* Single-Line Chart
* Bar Chart
* Stacked Bar Chart
* Single Group Summary Table
* Bubble Chart

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FvjvWCGcz9rMSJCquDmzq%2Fimage.png?alt=media&#x26;token=cbcf4081-24a0-47b7-82ba-7bef1601c247" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**Higher number of elements may affect query and chart performance. You can set the maximum limit up to 2000 for any of the chart types.**&#x20;
{% endhint %}

#### **Email Encryption**

**Email Encryption (TLS support)** is a new setting on the **Email Server** page in the Server Settings.

* Provides the secure channel (SMTP over TLS) for email support in ePO
* Allows you to enable/disable the TLS support
* When you enable this option, the port number in **SMTP server port** updates from an existing port number to 587

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FhTfqZdTGkEbYM6meNW3m%2Fimage.png?alt=media&#x26;token=8fa433df-7bc2-48fa-a7a6-fd1a9f0eb732" alt=""><figcaption></figcaption></figure>

#### **Server Information**

The Server Information Settings page specifies Java, OpenSSL, and Apache server information for the ePO and database server, such as name, IP address, and version information. You can export the Server Information page details to a CSV file.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FlnQc9K2ljNh0Q4r5eQjF%2Fimage.png?alt=media&#x26;token=97a0c120-1696-4778-934e-56e600254e5f" alt=""><figcaption></figcaption></figure>

### **Personal Settings**

**Personal Settings** in the ePO console allows you to customize the ePO server to your environmental needs.&#x20;

To configure Personal Settings, go to **Menu** > **Configuration** > **Personal Settings**.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FA28HmHchxrmGN415vGSD%2Fimage.png?alt=media&#x26;token=54fbc6fa-5fc2-4449-92e0-c2cbcd0893c0" alt=""><figcaption></figcaption></figure>

In **Personal Settings**, you can modify items such as:&#x20;

* **Appearance**: Provides the ability to change the display color of a selected entry in the console
* **Password**: This option is no longer available from within Personal Settings; see the “Change Password” entry under the Help icon on the banner bar
* **Queries and Reports Warning**: Determines whether a warning message appears when you try to drag a query from one query group to another
* **System Tree Settings**: Determines whether a warning message appears when you try to drag systems or groups from one System Tree group to another. Enable auto-expand (default) of System Tree nodes when moving one system to another.
* **Tables**: Identifies how often auto-refreshed tables are refreshed during your session
* **Time Zone Preference**: Provides the ability to set the desired time zone for your ePO server
* **User Session**: Controls the length of time that your user session remains open after you stop interacting with the user interface

***

### **Registered Servers**

Various types of additional servers in a customer environment can be registered in the ePO server, allowing you to integrate ePO with other external servers. To configure these external servers, go to **Menu** > **Configuration** > **Registered Servers**.

{% hint style="info" %}
**Registered servers are servers that work with your ePO server to support or add functionality. When you install ePO for the first time, no other servers are registered with your ePO server.**&#x20;
{% endhint %}

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FHZKZYG87XsdDK23QHDcO%2Fimage.png?alt=media&#x26;token=f3e56da7-7238-4872-96a8-22b8f1d91958" alt=""><figcaption></figcaption></figure>

Click **New Server** to create a new registered server, or click **Action** to delete or edit an existing registered server. You can register several types of servers with your main ePO server, including:

* **LDAP servers**: Registering this type of server allows you to use Policy Assignment rules to dynamically enable assigned permission sets and to enable Active Directory (AD) User Login; Active Directory servers are an example of LDAP servers that can be used to synchronize and import systems from an AD server to the ePO System Tree.
* **Other ePO servers**: Registering this type of server allows you to collect or aggregate data or transfer managed systems between the registered servers.
* **SNMP servers**: Registering this type of server allows ePO to know where to send the trap to so it can receive the trap info.
* **Syslog servers**: Registering this type of server allows ePO to forward events received from clients to the syslog server.
* **Additional, remote, database servers**: Registering this type of server allows you to retrieve data from the database in queries, reports, dashboard monitors, and server tasks.

***

{% hint style="info" %}
**See the** [***Registered Servers***(opens in a new tab)](https://docs.trellix.com/bundle/epolicy-orchestrator-5.10.0-product-guide/page/GUID-946575D1-FA11-4B1A-B872-5DC6FDE8AA2C.html) **section in the ePO 5.10 Product Guide for additional details on registering servers in ePO.**&#x20;
{% endhint %}

***

### **Agent Handlers**

#### **What are Agent Handlers?**

Agent Handlers are an ePO server component that handle communication between Agent and an ePO server. Each installation of ePO includes an Agent Handler. Agent Handlers can be deployed independently on systems throughout your network. These servers should be on the same network as the ePO server and not on a remote network across a WAN link.

* By default, the ePO server acts as an Agent Handler.
* Agent Handlers helps offload the demand on the ePO server.
* They can help scale the ePO infrastructure and reduce the load on the ePO server.
* They can take care of all the ASCI communication.

#### **How Agent Handlers Work**

<details>

<summary>Managed system is assigned to Agent Handler</summary>

Agent Handlers distribute network traffic, which is generated by an agent-to-server communication interval (ASCI), by assigning managed systems or groups of systems to report to a specific Agent Handler. You can assign single system or groups of systems, as well as have distinct groups assigned to different Agent Handlers.&#x20;

</details>

<details>

<summary>System performs regular ASCI</summary>

After assignment, a managed system performs regular agent-server communication to its Agent Handler instead of to the main ePO server. Like the ePO server, communications between agents and Agent Handlers are over an Industry‑standard Transport Layer Security (TLS) network protocol for secure network transmissions.&#x20;

</details>

<details>

<summary>Agent pulls necessary files and information from its Agent Handler</summary>

The Agent Handler provides updated sitelists, policies, and policy assignment rules to clients. The handler also supplies repository content to clients configured to update from the master repository. The agent handler on the ePO server provides the content directly; additional agent handlers cache files from the main repository as clients request them. When an agent requests content from its handler, if the handler does not have the files needed, the handler retrieves them from the Main Repository and passes them to the agent. The files are cached on the additional agent handler so that subsequent requests for the same file do not require additional traffic from the Main Repository.&#x20;

</details>

<details>

<summary>Repositories</summary>

* By default, requested repository files are cached in C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\RepoCache directory on the ePO server or remote Agent Handler.
* The primary ePO server (i.e., the system that has the ePO Application Server service installed) hosts the Main Repository.
* Agent Handlers transparently handle requests for software and cache the required files after downloading from the main repository.
* No configuration is necessary.

</details>

<details>

<summary>Data Channel</summary>

* API extension for Trellix products integration
* Mechanism for Trellix products to exchange messages between their endpoint plugins and their management extensions
* Agent properties, tagging, and policy computation performed directly against database

</details>

#### **Logical ePO Infrastructure**

An Agent Handler is installed as a part of the primary ePO server. This is sufficient for many small ePO installations. For larger and more complex networks, you can distribute services across the network by installing additional Agent Handlers.&#x20;

* These additional Agent Handlers co-exist within a single logical ePO infrastructure.&#x20;
* You can deploy Agent Handlers on separate hardware or virtual machines that coexist within a single logical ePO infrastructure.&#x20;
* An Agent Handler installation includes only the Trellix ePO Server service (Apache Server) and Trellix ePO Event Parser service.&#x20;
  * The Trellix ePO Server service communicates with the Trellix Agent, receives updated events and properties from the agents, and sends updated policies and tasks as assigned by administrators in the  ePO console.
  * The Trellix ePO Event Parser service receives events from the Trellix ePO Server service, which in turn receives them from the clients.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FYjOi6vfFkhIY1TAjQJyq%2Fimage.png?alt=media&#x26;token=d0c71c3f-776f-45d7-a6eb-cc26612fbb43" alt=""><figcaption></figcaption></figure>

**Agent Handler Requirements**

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FmIGepr7svvdldyAze9uI%2Fimage.png?alt=media&#x26;token=f958fa59-f01c-4c64-a748-c8be2e4a4219" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Agent Handlers can be installed on virtual infrastructure systems, such as VMware ESX.

Their hardware and software requirements and CPU load are approximately the same as an ePO server.&#x20;
{% endhint %}

#### **Important Notes**

* Agent Handlers (AH) are NOT a solution to low bandwidth.
* An additional Agent Handler with low bandwidth to the SQL server has WORSE performance than just having agents connect to the ePO server.
* A single Agent Handler with a poor connection to SQL will have a massive performance impact on the whole ePO infrastructure, not just the clients it is handling.
  * When one AH is interacting with the database, the other AHs are locked out. The AH with the poor connection locks the database for large amounts of time, preventing the other AHs from working.
* Agent Handlers MUST have a high-speed connection to the SQL server and a stable connection to the SQL server database.
* If the database serving the ePO server is under heavy load, adding Agent Handlers will not help.
* You may need to upgrade your SQL server hardware to take advantage of multiple Agent Handlers.
* Agent Handlers should be co-located with the SQL server and never installed in “remote” locations.

#### **Required Ports**

Installing the Agent Handler server hardware, software, and configuring the firewall ports are the first steps before using ePO to manage systems behind a DMZ.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FECt5APEzN4dPyFbsVGsy%2Fimage.png?alt=media&#x26;token=2490654e-c4f9-4ddc-ab77-31458cd797fb" alt=""><figcaption></figcaption></figure>

1. Build the Agent Handler server hardware with the Microsoft Windows server Operating System.
2. In the DMZ of your firewall protected network, install the Agent Handler server hardware and Microsoft Windows server operating system.
3. &#x20;Configure your Domain Name System (DNS) server to host the Agent Handler server to the internal ePO network.
4. &#x20;Configure these ports on the *internal-facing* firewall to communicate between the ePO server and the Agent Handler in DMZ:
   1. **Port 80** — Bidirectional&#x20;
   2. **Port 8443** — Bidirectional&#x20;
   3. **Port 8444** — Bidirectional&#x20;
   4. **Port 443** — Bidirectional
5. **Optional**: If your SQL database is installed on a different server than your ePO server, configure these two ports on the *internal-facing* firewall to connect to the Agent Handler:
   1. **Port 1433 TCP** — Bidirectional&#x20;
   2. **Port 1434 UDP** — Bidirectional
6. Configure these ports on the *public-facing* firewall to communicate between the ePO server and the Agent Handler in the DMZ:
   1. &#x20;**Port 80 TCP** — Inbound
   2. **Port 443 TCP** — Inbound
   3. **Port 8081 TCP** — Inbound
   4. **Port 8082 UDP** — Inbound

Now you have installed your Agent Handler hardware and server operating system in the DMZ. Plus, you configured all ports to connect through the firewall, between the ePO server and database to the Agent Handler server.

{% hint style="info" %}
**See** [**KB66797**(opens in a new tab)](https://kcm.trellix.com/corporate/index?page=content\&id=KB66797) **for additional information regarding ePO port requirements for firewall traffic.**
{% endhint %}

#### **Agent Handler Deployment**

The figure below shows the workflow for an Agent Handler deployment.

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FjLt3E10yw9VAh9OKNS7l%2Fimage.png?alt=media&#x26;token=359f7bf1-3418-45e0-8cb5-4b4bc9d6d64e" alt=""><figcaption></figcaption></figure>

**Updating the ePO Server and the Agent Handlers**

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2F2QAeGqQyMQT6K5PJwnNl%2Fimage.png?alt=media&#x26;token=d87b9a93-eb0f-4630-89e4-68187d8a10e1" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**The ePO server and the Agent Handler must be at the same patch level. The Agent Handler checks the database version every 30 seconds and disables itself if a different schema is found.**
{% endhint %}

#### **Configuring Agent Handlers**

After the installation is complete, your next step is to set up Agent Handlers in your network and assign Trellix Agents to them. Agent handler management is performed from the Agent Handlers page.&#x20;

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FHwOQz4NgJjo20l0WvTon%2Fimage.png?alt=media&#x26;token=3a42c6fb-dc88-4b3a-84bb-dcdf54faac0b" alt=""><figcaption></figcaption></figure>

**Tasks**

* Create Agent Handler groups
* Manage Agent Handler groups
* Assign Trellix Agents to Agent Handlers
* Manage Agent Handler assignments
* Move agents between handlers

**Agent Handlers Page**

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FFi2LXcxUyWKas8S7RCXt%2Fimage.png?alt=media&#x26;token=3a13cd97-27f9-464e-bca7-f7632c414066" alt=""><figcaption><p><em><strong>Menu</strong></em> > <em><strong>Configuration</strong></em> > <em><strong>Agent Handlers</strong></em></p></figcaption></figure>

***

The Agent Handlers page consists of four monitors:&#x20;

1. **Handler Status**: Specifies the number of active and out-of-date handlers
2. **Systems per Agent Handler**: Specifies the number of agents assigned to each Agent Handler
3. **Handler Groups**: Specifies the number of Agent Handler groups that the ePO server manages
4. **Handler Assignment Rules**: Displays the list of Agent Handler assignments in your environment, their priority, and details about rule settings

Click the active areas in each monitor to drill down and view more details about the systems informing each monitor.

Actions within the Agent Handler Confirmation page are:\
**At the top of the page:**

* **New Assignment**: Opens the Agent Handler Assignment page. Use this to create a new Agent Handler Assignment
* **Edit Priority**: Opens the Edit Priority page. Use this page to change priority of the Agent Handler Assignments

**By using the Actions Button in the Handler Assignment Rules window:**

* **Import**: Imports a previously exported Agent Handler Assignment list
* **Export**: Opens the Download Agent Handler Assignment page. Use this to download an xml file containing the Agent Handler Assignment list

**Handler Assignment Rules: Row Actions**: Specifies the actions you can perform on selected Agent Handler assignments, including:

* **To Edit**: Click the blue hyperlink Assignment name to open the Edit Assignment page. Use this to edit the settings of the selected Agent Handler Assignment
* **Delete**: Deletes the selected agent

### **Certificate Manager**

As discussed in the previous lesson, the Certificate Manager is another part of the basic server configuration. The latest certificates are loaded by default with a fresh installation of ePO, but if you have upgraded from an older version of ePO, ensure you migrate the ePO certificates to the latest hash algorithm.&#x20;

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FuRqTzb7Qw61slIeIjmur%2Fimage.png?alt=media&#x26;token=369e1b45-3562-482e-889c-ce85a1e750d1" alt=""><figcaption><p><em><strong>Menu</strong></em> > <em><strong>Configuration</strong></em> > <em><strong>Certificate Manager</strong></em></p></figcaption></figure>

***

The Certificate Manager allows you to:

* Migrate certificates that are signed by older signing algorithm to the new algorithm such as SHA-1 to SHA-256
* Regenerate your certificates when your existing certificates are compromised due to vulnerabilities in your environment
* Migrate or regenerate certificates for managed products that are derived from ePO root CA

### **Registered Executables**

The registered executables you configure are run when the conditions of a rule are met. Automatic Responses trigger the registered executable command to run.<br>

<figure><img src="https://3241386954-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FjmsGhOHPrgQSX87jFLLt%2Fuploads%2FgQvjwFIsMJiwi5pgaK1Z%2Fimage.png?alt=media&#x26;token=92311ecb-ddf1-45ff-a8d5-4596c295e41a" alt=""><figcaption><p><em><strong>Menu</strong></em> > <em><strong>Configuration</strong></em> > <em><strong>Registered Executables</strong></em></p></figcaption></figure>

***

{% hint style="info" %}

* **You can only run registered executable commands on console applications.**&#x20;
* **You must be on the local server system when adding or editing a registered executable in the ePO console.**&#x20;
  {% endhint %}
