Exchange Server Forums

Groupshield 6.0.x - Should I be afraid?

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Server Security >> Groupshield 6.0.x - Should I be afraid?

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Groupshield 6.0.x - Should I be afraid? - 26.Jul.2006 8:08:18 PM

Manning

Posts: 40
Joined: 26.Jun.2006
Status: offline

Hello all,

Looking for opinions based on actual experience here. Anything anecdotal may not help very much.

I can be long winded, so please bear with me:

Here is the situation. I recently moved everything over to a new Server 2003/Exchange 2003 server and brought down our 2000/2000 server. Now I am beyond the point where I should install some virus protection. Currently all mail passes through a Barracuda and it does block probably 99% of the potential threats, but I feel like I need to go ahead and install our license of Groupshield 6.0 on the new Exchange server. We ran GS 5.0 on the old server and it worked very well, but I have read so may nightmare stories about 6.0 that I am a little nervous. In fact, we tried to run it on our 2000 server for a little while and just couldn't get it configured properly so we switched back to 5.0.

SO, in your actually personal experience do I have anything to be worried about? We just renewed our contract with NAI (Workstations, etc.), so not much chance my boss will be too happy with me buying anything else.

Thanks in advance

_____________________________

Michael

Post #: 1

Featured Links*

RE: Groupshield 6.0.x - Should I be afraid? - 26.Jul.2006 8:34:09 PM

a.grogan

Posts: 1887
Joined: 12.Apr.2005
From: London
Status: offline

Hiya, I use GSE 6SP1 on an Active / Passive clustered Exchange server for the last year or so, and I have had not problems thus far (touch wood).
It can be a little bit "interesting" to configure some of the on access settings, but generally its ok.

If it helps I didn't do anything special in the install just followed the Wizard - although I did not install the Remote Web based admin feature, the only other annoying thing is that when using the GSE6 MMC frontend on the Exchange server - if you are using Windows 2003 sometimes IE blocks the active content that GSE uses (for example progress bars).

Hope this helps..

(in reply to Manning)

Post #: 2

RE: Groupshield 6.0.x - Should I be afraid? - 26.Jul.2006 8:50:00 PM

Manning

Posts: 40
Joined: 26.Jun.2006
Status: offline

yes, it does help, thanks.

That enhanced IE security in 2003 drives me batty sometimes. I'll have to watch for that.

_____________________________

Michael

(in reply to a.grogan)

Post #: 3

RE: Groupshield 6.0.x - Should I be afraid? - 28.Jul.2006 8:23:44 PM

Manning

Posts: 40
Joined: 26.Jun.2006
Status: offline

Anybody else have experiences they would like to share regarding this topic?

_____________________________

Michael

(in reply to Manning)

Post #: 4

RE: Groupshield 6.0.x - Should I be afraid? - 4.Aug.2006 6:16:54 PM

sgjr173

Posts: 3
Joined: 4.Aug.2006
Status: offline

Hi,

I'm a relative newcomer to managing an Exchange Server, and even newer when it comes to Groupshield 6, but the amount of experience I have gained in the last few weeks will last a lifetime!

Our Exchange server went live only last month with no real problems, Groupshield 6 was working well but one day last week the automatic update failed.

McAfee have their Virtual Technician available to assist in such problems, so I ran it, it pointed to the failed update as being a real problem, so I contacted McAfee to use our Gold Support. They seemed great initially, the problem could only be resolved by uninstalling Groupshield and installing the full upgrade.

Fine.

I did exactly that, installed SpamShield afterwards to update the licence for SpamShield, all went well. I did some tests and found everything EXCEPT the outgoing disclaimers was working.

After 2 weeks, I have just got off the phone with one of their support staff who failed to fill me with confidence when his first suggestion was to delete the exchange mailbox!!!

Needless to say I explained that we were not going to do that and that he should try a different approach to fixing this small problem.

He asked about how the installation had taken place. As it had to be done in "quiet time" I had used a VPN connection and then Terminal Services, then add remove to uninstall and then used the file McAfee had provided to install the new version.

This guy then told me this was a mistake! If you install over Terminal Services you must put Terminal Services into "Install Mode" and usee Add Programs to install the App, then go into "Execute" mode and run the application!

I don't know if this is right, but I asked him to gather the supporting information and send it to me, I can't believe that I a remote install could cause this silly little problem and not affect the rest of the system.

Would I install Groupshield 6 again? Yes, functionally it is brilliant, although not everything workd the way the manual says, it is easy to work out what the manual should say.

Would I pay for Gold Cover, not persoanlly, but as a company, yes.

Good luck my friend, walk carefully and carry a big stick if you need McAfee support.

Steve Richards
http://www.e-readit.co.uk
http://www.e-readit.net
http://www.911resume.com

(in reply to Manning)

Post #: 5

RE: Groupshield 6.0.x - Should I be afraid? - 14.Aug.2006 5:34:50 PM

Manning

Posts: 40
Joined: 26.Jun.2006
Status: offline

Hey Steve

I installed a week or so ago and everything was dandy, but then wouldn't you know it, Automatic Updates quit on our GSE instance all of the sudden. Still scanning just fine, and if I run a superDAT it actually updates the DAT, but autoupdate, nothin'.

One thing I read, and I don't know if this is a line of BS or not, but supposedly SpamShield should not be run on the same server as GroupShield (?). The failed AutoUpdate issue is supposedly one of the symptoms. However, we don't run SpamShield since we have a Barracuda appliance to handle spam and the first line of virus scanning, so that shouldn't be causing the problem on our server.

What I am thinking may be the issue is something in the updates from Microsoft that came out recently. Word is they have been causing some problems, so I wonder if they have hosed GS as well.

Michael

quote:

ORIGINAL: sgjr173

Hi,

I'm a relative newcomer to managing an Exchange Server, and even newer when it comes to Groupshield 6, but the amount of experience I have gained in the last few weeks will last a lifetime!

Our Exchange server went live only last month with no real problems, Groupshield 6 was working well but one day last week the automatic update failed.

McAfee have their Virtual Technician available to assist in such problems, so I ran it, it pointed to the failed update as being a real problem, so I contacted McAfee to use our Gold Support. They seemed great initially, the problem could only be resolved by uninstalling Groupshield and installing the full upgrade.

Fine.

I did exactly that, installed SpamShield afterwards to update the licence for SpamShield, all went well. I did some tests and found everything EXCEPT the outgoing disclaimers was working.

After 2 weeks, I have just got off the phone with one of their support staff who failed to fill me with confidence when his first suggestion was to delete the exchange mailbox!!!

Needless to say I explained that we were not going to do that and that he should try a different approach to fixing this small problem.

He asked about how the installation had taken place. As it had to be done in "quiet time" I had used a VPN connection and then Terminal Services, then add remove to uninstall and then used the file McAfee had provided to install the new version.

This guy then told me this was a mistake! If you install over Terminal Services you must put Terminal Services into "Install Mode" and usee Add Programs to install the App, then go into "Execute" mode and run the application!

I don't know if this is right, but I asked him to gather the supporting information and send it to me, I can't believe that I a remote install could cause this silly little problem and not affect the rest of the system.

Would I install Groupshield 6 again? Yes, functionally it is brilliant, although not everything workd the way the manual says, it is easy to work out what the manual should say.

Would I pay for Gold Cover, not persoanlly, but as a company, yes.

Good luck my friend, walk carefully and carry a big stick if you need McAfee support.

Steve Richards
http://www.e-readit.co.uk
http://www.e-readit.net
http://www.911resume.com

(in reply to sgjr173)

Post #: 6

RE: Groupshield 6.0.x - Should I be afraid? - 14.Aug.2006 5:59:47 PM

sgjr173

Posts: 3
Joined: 4.Aug.2006
Status: offline

Thanks for that.

I've been working with a McAfee Tier 3 engineer/developer for the last week on this issue and we have illiminated laods of thing.... i.e. we haven't found a solution.

The disclaimer not being attached linked in with spam not being routed to the users junk folder, this it seems is a symptom of the EventSync process not working properly.

Exchange doesn't have a facility to provide a disclaimer as standard, see http://support.microsoft.com/default.aspx?scid=kb;en-us;317680 for details of how MS recommend you fix it.

Groupshield (Enterprise) is designed to run with SpamKiller and part of it's interface has a SpamKiller page on the GUI.

The way SpamKiller ties in with Exchange is similar to the VB Script in the MS solution but it uses the event sync to:-

Determine if the email is inbound or outbound.
If Outbound it scans it for viruses and trojans, then adds the disclaimer if selected.
If Inbound, it scans it in the same way but dependent on the rules, it will use the Groupshield routing engine to delete, put in system junk or user junk folder as specified in groupshield depending also on the spam threat level.

Wheeeew.... that took some getting out! :-)

Anyway, watch this space for a solution. Even the McAfee engineer says this is the most stubborn problem he's seen.

The downside for me is that almost every time we try anything we have to restart IIS Admin - Not good, damn thing hangs 1 in 3 times if you're lucky and that means a reboot. Such happy users!!

Oh well. Back to it.

Steve

_____________________________

http://findv.com/x.php?2or
Don't get scammed read this free wealth report.

(in reply to Manning)

Post #: 7

RE: Groupshield 6.0.x - Should I be afraid? - 14.Aug.2006 8:27:27 PM

Manning

Posts: 40
Joined: 26.Jun.2006
Status: offline

Duh, my mistake. It's VirusScan that is supposed to cause a problem when installed on a server with GroupShield, not SpamShield. But there again, I don't have VScan installed, just GroupShield.

quote:

VirusScan Enterprise is installed on the same server as GroupShield. They both use the Common Management Agent (CMA).
The CMA automatically checks for updates for all products installed on the same machine, and therefore only one product needs to have a scheduled update task configured.
A conflict may randomly occur if both schedules are enabled. This will not cause any other problems and the next AutoUpdate usually succeeds.

_____________________________

Michael

(in reply to sgjr173)

Post #: 8

RE: Groupshield 6.0.x - Should I be afraid? - 15.Aug.2006 12:05:16 AM

sgjr173

Posts: 3
Joined: 4.Aug.2006
Status: offline

Ahhhh right Manning, I see where you are coming from.

McAfee recommend using the latest McAfee Antivirus software on the Exchange server to update Groupshield and Spamkiller.....

But....

You have to make sure that the disk scanning is deactivated. If McAfee AntiVirus scanner scans the mailboxes on an Exchange server it will probably fail to recognise the mailboxes for what they are and as a result damage can result. So you are right in that respect.

Steve

_____________________________

http://findv.com/x.php?2or
Don't get scammed read this free wealth report.

(in reply to Manning)

Post #: 9

RE: Groupshield 6.0.x - Should I be afraid? - 15.Aug.2006 3:42:49 AM

Manning

Posts: 40
Joined: 26.Jun.2006
Status: offline

Actually the quote I posted from McAfee's Knowledge Base has to do with the Common Management Agent, which schedules update. Since VScan and GroupShield both are trying to use it they can conflict and cause one or the other to not update. There is an update that is supposed to address a volnerability that could allow "allow an attacker to place arbitrary files on the machine running the indicated software". However, in other information I've read it is supposed to fix the non updating issue. Log onto the McAfee download page with your grant number and download and install the Common Management Agent 3.5.5 and see if that fixes it. I installed it this evening and will see if it did anything later.

(in reply to sgjr173)

Post #: 10

RE: Groupshield 6.0.x - Should I be afraid? - 15.Aug.2006 12:21:41 PM

pjhutch

Posts: 3040
Joined: 21.Jul.2001
From: W Yorks, England
Status: offline

I use VirusScan Enterprise 8 and groupshield 6 on our Exchange servers. Just make sure you exclude any exchange folders from VirusScan (see Console, Properties of On-Access Scanner, All Processes, Detection, Exclusions) and add them and subfolders here to prevent any problems with email.
Groupshield 6 seems better than v5 and has a good frontend which you can install on your own PC to monitor things. Make sure you have Java 1.4 or later installed.

(in reply to sgjr173)

Post #: 11

RE: Groupshield 6.0.x - Should I be afraid? - 15.Aug.2006 4:18:32 PM

a.grogan

Posts: 1887
Joined: 12.Apr.2005
From: London
Status: offline

I gave up with the automatic update feature (I couldn't find it) the only options that I seemed to have were 1) Use EPO (which we have installed in our organisation but I am reluctant to install the agent on the Cluster Nodes) or 2) Install Virus Scan 8 or above and let that update (which I am also reluctant to do).

In the end I download the updates from NAI using an FTP program to a shared location and then use a VBSCRIPT to install the update silently.

A

_____________________________

Andy Grogan
MSExchange.org Forums Moderator
For my general ramblings about Exchange please visit my blog:
W: http://telnetport25.wordpress.com/
M: manifoldmaster@gmail.com

(in reply to Manning)

Post #: 12

RE: Groupshield 6.0.x - Should I be afraid? - 15.Aug.2006 5:41:13 PM

Manning

Posts: 40
Joined: 26.Jun.2006
Status: offline

quote:

ORIGINAL: pjhutch

I use VirusScan Enterprise 8 and groupshield 6 on our Exchange servers. Just make sure you exclude any exchange folders from VirusScan (see Console, Properties of On-Access Scanner, All Processes, Detection, Exclusions) and add them and subfolders here to prevent any problems with email.
Groupshield 6 seems better than v5 and has a good frontend which you can install on your own PC to monitor things. Make sure you have Java 1.4 or later installed.

Yep, we had our Exchange 2K server configured with GS5 and VScan 7, excluding the exchange folders. Right now I don't have VScan installed at all on that server. For some reason when I tried to run v8.0 on our Exchange 2K server it prevented mail from being sent/received even though it wasn't scanning the Exchange folders, nor did I have port or overflow protection enabled. Any thoughts about that?

(in reply to pjhutch)

Post #: 13

RE: Groupshield 6.0.x - Should I be afraid? - 15.Aug.2006 5:47:05 PM

pjhutch

Posts: 3040
Joined: 21.Jul.2001
From: W Yorks, England
Status: offline

Open VirusScan console, click on Access Protection properties and disable the 'Prevent mass mailing worms from sending mail' on Port 25. Then it should be fine.

(in reply to Manning)

Post #: 14

RE: Groupshield 6.0.x - Should I be afraid? - 15.Aug.2006 5:49:23 PM