Installing new Policy Manager Server

Hi,

I have an existing PMS/PMC 9.00 with which I support quite a few customers. Some of these customer are running Windows 2000 servers and therefore still use Antivirus for Servers 8.01 as it is the latest version available for this OS.

They have decided to do this despite me telling them that they e.g have only protection against viruses and not spyware anymore, these updates stopped december 31, 2012.

Now, for other customers I have installed/will install Server Security because of obvious reasons.

The problem for me now is that SS 9.20 is not fully supported in PMC 9.00, if I understand correctly it must be upgraded to the latest 10.01/10.10? One example is that I can´t upgrade to SS 9.20 from Antivirus for Servers because SS 9.20 appears to be Antivirus for workstations 9.32 when showing up in the console.

I read the below in the release notes for PM 10.01:

"Policy Manager no longer receives and distributes obsolete virus definition updates"

I assume that this means I can´t upgrade PM to 10.10 because then I loose all support for the old clients? Has anyone tested this, is it possible that the virus updates for 8.01 would still be distributed?

If not, is the only solution for me to install a brand new server and run all hosts that don´t have old versions on that?

This leads me to another question: If I need to install a new server, can I import parts of the old environment, e.g. can I import all the firewal settings/rules to the new environment?

Any help/thoughts on this would be very appreciated.

Thanks and Regards,

Find more posts tagged with

Comments

Vad

Hi JC,

Current plan is last week of May. Still can be postponed for 2-3 weeks, but not more.

Best regards,

Vad

J-C

Hi Vad,

Thanks for your response, I will upgrade asap.

Could you please try to find out a more exact date/week for me so I can give this final message to my customers?

Regards,

Vad

Hello J-C,

Unfortunately, in the nearest future (few weeks) all 8.x versions will stop receiving ANY DB updates, regardless of PM version. The way of signing/verification of updates is changing now, and only 9.x versions or higher are compatible with the new one.

So the recomendation is to upgrade to the latest version of PM. You will still be able to administer and upgrade 8.x versions using it.

Best regards,

Vad

J-C

Hi,

Sorry for the very late response and thanks for your answer Tamas. I am of course aware of what you write below and believe me, I have pointed this out to customers repeatedly without much response.

What I really need to know is, what happens to clients running 8.xx version if I upgrade Policy manager to the latest version?

Will they continue to get the (one?) antivirus update, as they do today or will all updates stop?

I have read the document "Upgrading policy manager and Client security in 4 easy steps" and from what I can tell I don´t loose contact with clients running 8.xx and are still able to administer and upgrade them, after upgrading policy manager?

Any suggestions/advice in this matter is greatly appreciated!

Thanks and regards,

etomcat

Hello,

Running FSAS8.xx on a Windows 2000 makes no sense any more. It does not protect against fresh malware, because the corresponding database updates have been discontinued. Most in-the wild malware is fresh nowadays, with a lifetime of just a few days, before an ever newer variant is pushed by the hackers. FSAS8 protects the customer against 2 million specimens of museum exhibit malware. It doesn't even have DeepGuard to protect against newly emerging threats!

Essentially, FSAS8 today is the equivalent of taking a flu shot, using a syringe filled with a vaccine combination that was designed against last year's flu strains...

On the other hand, the FSAS 8.xx virus protection had a huge system load on the system resources (CPU/RAM) due to its ancient AVP3-based main scanning engine infrastructure. It was so heavy, it's own signature updates sometimes failed and had to retry due to scan timeouts... There is a reason FSAS 9.00 and then FSAV ESS 9.20 were introduced to replace 8.xx, but regrettably F-Secure decided to drop Win2K support with those versions.

Please also consider that M$ no longer updates W2K with security hotfixes and unpatched holes sometimes do allow malware to come into the OS, even if the best antivirus is on guard.

Our little company actually had an Win2000 until 1.5 years ago on a dual-P3 box and we migrated straight to Win2008R2 / Exchange 2010, after we realized Win2K cannot be responsibly kept alive any more.

Sincerely: Tamas Feher, Hungary.